From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:29:47 +0000 (+0200) Subject: 6.18-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6c5472eba6d14c9e4a4f472d8648f6fa04e52d4d;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch pci-fix-bar-resize-rollback-path-overwriting-ret.patch pci-fix-resizable-bar-restore-order.patch perf-callchain-handle-multiple-address-spaces.patch perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch perf-symbol-fix-enoent-case-for-filename__read_build_id.patch pinctrl-airoha-fix-pinctrl-function-mismatch-issue.patch rdma-bnxt_re-avoid-repeated-requests-to-allocate-wc-pages.patch rdma-bnxt_re-initialize-dpi-variable-to-zero.patch seqlock-fix-scoped_seqlock_read-kernel-doc.patch --- diff --git a/queue-6.18/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch b/queue-6.18/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch new file mode 100644 index 0000000000..41123fc7b0 --- /dev/null +++ b/queue-6.18/ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch @@ -0,0 +1,86 @@ +From 7ce4fc40018de07f05f3035241122d992610dbfb Mon Sep 17 00:00:00 2001 +From: Gil Portnoy +Date: Thu, 28 May 2026 00:00:00 +0000 +Subject: ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd + +From: Gil Portnoy + +commit 7ce4fc40018de07f05f3035241122d992610dbfb upstream. + +Two concurrent same-user DHnC reconnects can both observe fp->conn == NULL +before either sets it. ksmbd_reopen_durable_fd() checks fp->conn to guard +against a handle already being reconnected, but the check and the binding +assignment are not atomic: both threads pass the guard, both call +ksmbd_conn_get() on the same fp, and both eventually reach +kfree(fp->owner.name) -- a double-free of the owner.name slab object. +The double-bound ksmbd_file also causes a write-UAF on the 344-byte +ksmbd_file_cache object when a concurrent smb2_close() spins on fp->f_lock +after the object has been freed by the losing reconnect path. + +KASAN on 7.1-rc5 (48-thread concurrent reconnect, 3000 cycles): + BUG: KASAN: double-free in ksmbd_reopen_durable_fd+0x268/0x308 + BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xac/0x150 + Write of size 4 at offset 24 into freed ksmbd_file_cache object +Five double-bind windows observed; 63 total KASAN reports triggered. + +Fix: validate and claim fp->conn under write_lock(&global_ft.lock) so the +check-and-claim is atomic. ksmbd_lookup_durable_fd() already treats +fp->conn != NULL as "in use" and skips such an fp; setting fp->conn before +dropping the lock closes the race. ksmbd_conn_get() is a non-sleeping +refcount increment, safe under the rwlock. The rollback path on __open_id() +failure also clears fp->conn/tcon under the lock so concurrent readers see +a consistent state. + +Fixes: b1f1e80620de ("ksmbd: centralize ksmbd_conn final release to plug transport leak") +Assisted-by: Henry (Claude):claude-opus-4 +Signed-off-by: Gil Portnoy +Acked-by: Namjae Jeon +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/server/vfs_cache.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/fs/smb/server/vfs_cache.c ++++ b/fs/smb/server/vfs_cache.c +@@ -1185,19 +1185,19 @@ int ksmbd_reopen_durable_fd(struct ksmbd + struct ksmbd_lock *smb_lock; + unsigned int old_f_state; + ++ write_lock(&global_ft.lock); + if (!fp->is_durable || fp->conn || fp->tcon) { ++ write_unlock(&global_ft.lock); + pr_err("Invalid durable fd [%p:%p]\n", fp->conn, fp->tcon); + return -EBADF; + } + + if (has_file_id(fp->volatile_id)) { ++ write_unlock(&global_ft.lock); + pr_err("Still in use durable fd: %llu\n", fp->volatile_id); + return -EBADF; + } + +- old_f_state = fp->f_state; +- fp->f_state = FP_NEW; +- + /* + * Initialize fp's connection binding before publishing fp into the + * session's file table. If __open_id() is ordered first, a +@@ -1208,11 +1208,17 @@ int ksmbd_reopen_durable_fd(struct ksmbd + */ + fp->conn = ksmbd_conn_get(conn); + fp->tcon = work->tcon; ++ write_unlock(&global_ft.lock); ++ ++ old_f_state = fp->f_state; ++ fp->f_state = FP_NEW; + + __open_id(&work->sess->file_table, fp, OPEN_ID_TYPE_VOLATILE_ID); + if (!has_file_id(fp->volatile_id)) { ++ write_lock(&global_ft.lock); + fp->conn = NULL; + fp->tcon = NULL; ++ write_unlock(&global_ft.lock); + ksmbd_conn_put(conn); + fp->f_state = old_f_state; + return -EBADF; diff --git a/queue-6.18/pci-fix-bar-resize-rollback-path-overwriting-ret.patch b/queue-6.18/pci-fix-bar-resize-rollback-path-overwriting-ret.patch new file mode 100644 index 0000000000..9388db7915 --- /dev/null +++ b/queue-6.18/pci-fix-bar-resize-rollback-path-overwriting-ret.patch @@ -0,0 +1,50 @@ +From 08d9eae76b85263173f8c833800e3cc409ee1be4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Wed, 21 Jan 2026 15:14:16 +0200 +Subject: PCI: Fix BAR resize rollback path overwriting ret +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 08d9eae76b85263173f8c833800e3cc409ee1be4 upstream. + +The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback +path") added BAR rollback to pci_do_resource_release_and_resize() in case +of resize failure. + +On the rollback, pci_claim_resource() is called, which can fail and the +code is prepared for that possibility. pci_claim_resource()'s return value, +however, overwrites the original value of ret so +pci_do_resource_release_and_resize() will return an incorrect value in the +end (as pci_claim_resource() normally succeeds, in practice ret will be 0). + +Fix the issue by directly calling pci_claim_resource() inside the if (). + +Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") +Reported-by: Ville Syrjälä +Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/ +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Tested-by: Ville Syrjälä +Reviewed-by: Ville Syrjälä +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260121131417.9582-2-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/setup-bus.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -2504,8 +2504,7 @@ restore: + + restore_dev_resource(dev_res); + +- ret = pci_claim_resource(dev, i); +- if (ret) ++ if (pci_claim_resource(dev, i)) + continue; + + if (i < PCI_BRIDGE_RESOURCES) { diff --git a/queue-6.18/pci-fix-resizable-bar-restore-order.patch b/queue-6.18/pci-fix-resizable-bar-restore-order.patch new file mode 100644 index 0000000000..7ee5e888fa --- /dev/null +++ b/queue-6.18/pci-fix-resizable-bar-restore-order.patch @@ -0,0 +1,118 @@ +From 5528fd38f230c906fcebb202cc94fbb8ed8f122a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= +Date: Wed, 21 Jan 2026 15:14:17 +0200 +Subject: PCI: Fix Resizable BAR restore order +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +commit 5528fd38f230c906fcebb202cc94fbb8ed8f122a upstream. + +The commit 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback +path") changed BAR resize to layer rebar code and resource setup/restore +code cleanly. Unfortunately, it did not consider how the value of the BAR +Size field impacts the read-only bits in the Base Address Register (PCIe7 +spec, sec. 7.8.6.3). That is, it very much matters in which order the BAR +Size and Base Address Register are restored. + +Post-337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") +during BAR resize rollback, pci_do_resource_release_and_resize() attempts +to restore the old address to the BAR that was resized, but it can fail to +setup the address correctly if the address has low bits set that collide +with the bits that are still read-only. As a result, kernel's resource and +BAR will be out-of-sync. + +Fix this by restoring BAR Size before rolling back the resource changes and +restoring the BAR. + +Fixes: 337b1b566db0 ("PCI: Fix restoring BARs on BAR resize rollback path") +Reported-by: Ville Syrjälä +Link: https://lore.kernel.org/linux-pci/aW_w1oFQCzUxGYtu@intel.com/ +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Tested-by: Ville Syrjälä +Reviewed-by: Ville Syrjälä +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260121131417.9582-3-ilpo.jarvinen@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/rebar.c | 18 +----------------- + drivers/pci/setup-bus.c | 20 ++++++++++++++++++-- + 2 files changed, 19 insertions(+), 19 deletions(-) + +--- a/drivers/pci/rebar.c ++++ b/drivers/pci/rebar.c +@@ -215,7 +215,6 @@ int pci_resize_resource(struct pci_dev * + int exclude_bars) + { + struct pci_host_bridge *host; +- int old, ret; + u32 sizes; + + /* Check if we must preserve the firmware's resource assignment */ +@@ -233,21 +232,6 @@ int pci_resize_resource(struct pci_dev * + if (!(sizes & BIT(size))) + return -EINVAL; + +- old = pci_rebar_get_current_size(dev, resno); +- if (old < 0) +- return old; +- +- ret = pci_rebar_set_size(dev, resno, size); +- if (ret) +- return ret; +- +- ret = pci_do_resource_release_and_resize(dev, resno, size, exclude_bars); +- if (ret) +- goto error_resize; +- return 0; +- +-error_resize: +- pci_rebar_set_size(dev, resno, old); +- return ret; ++ return pci_do_resource_release_and_resize(dev, resno, size, exclude_bars); + } + EXPORT_SYMBOL(pci_resize_resource); +--- a/drivers/pci/setup-bus.c ++++ b/drivers/pci/setup-bus.c +@@ -2452,12 +2452,20 @@ int pci_do_resource_release_and_resize(s + struct resource *b_win, *r; + LIST_HEAD(saved); + unsigned int i; +- int ret = 0; ++ int old, ret; + + b_win = pbus_select_window(bus, res); + if (!b_win) + return -EINVAL; + ++ old = pci_rebar_get_current_size(pdev, resno); ++ if (old < 0) ++ return old; ++ ++ ret = pci_rebar_set_size(pdev, resno, size); ++ if (ret) ++ return ret; ++ + pci_dev_for_each_resource(pdev, r, i) { + if (i >= PCI_BRIDGE_RESOURCES) + break; +@@ -2490,7 +2498,15 @@ out: + return ret; + + restore: +- /* Revert to the old configuration */ ++ /* ++ * Revert to the old configuration. ++ * ++ * BAR Size must be restored first because it affects the read-only ++ * bits in BAR (the old address might not be restorable otherwise ++ * due to low address bits). ++ */ ++ pci_rebar_set_size(pdev, resno, old); ++ + list_for_each_entry(dev_res, &saved, list) { + struct resource *res = dev_res->res; + struct pci_dev *dev = dev_res->dev; diff --git a/queue-6.18/perf-callchain-handle-multiple-address-spaces.patch b/queue-6.18/perf-callchain-handle-multiple-address-spaces.patch new file mode 100644 index 0000000000..9f117166f3 --- /dev/null +++ b/queue-6.18/perf-callchain-handle-multiple-address-spaces.patch @@ -0,0 +1,150 @@ +From ae15db3e9b639491007cc1e9e99638e4b6091781 Mon Sep 17 00:00:00 2001 +From: Thomas Richter +Date: Tue, 14 Apr 2026 14:42:41 +0200 +Subject: perf callchain: Handle multiple address spaces + +From: Thomas Richter + +commit ae15db3e9b639491007cc1e9e99638e4b6091781 upstream. + +perf test 'perf inject to convert DWARF callchains to regular ones' +fails on s390. It was introduced with commit 92ea788d2af4e65a ("perf +inject: Add --convert-callchain option") + +The failure comes the difference in output. Without the inject script to +convert DWARF the callchains is: + + # perf record -F 999 --call-graph dwarf -- perf test -w noploop + # perf report -i perf.data --stdio --no-children -q \ + --percent-limit=1 > /tmp/111 + # cat /tmp/111 + 99.30% perf-noploop perf [.] noploop + | + ---noploop + run_workload (inlined) + cmd_test + run_builtin (inlined) + handle_internal_command + run_argv (inlined) + main + __libc_start_call_main + __libc_start_main_impl (inlined) + _start + # + +With the inject script step the output is: + + # perf inject -i perf.data --convert-callchain -o /tmp/perf-inject-1.out + # perf report -i /tmp/perf-inject-1.out --stdio --no-children -q \ + --percent-limit=1 > /tmp/222 + # cat /tmp/222 + 99.40% perf-noploop perf [.] noploop + | + ---noploop + run_workload (inlined) + cmd_test + run_builtin (inlined) + handle_internal_command + run_argv (inlined) + main + _start + # diff /tmp/111 /tmp/222 + 1c1 + < 99.30% perf-noploop perf [.] noploop + --- + > 99.40% perf-noploop perf [.] noploop + 10,11d9 + < __libc_start_call_main + < __libc_start_main_impl (inlined) + # + +The difference are the symbols __libc_start_call_main and +__libc_start_main_impl. + +On x86_64, kernel and user space share a single virtual address space, +with the kernel mapped to the upper end of memory. The instruction +pointer value alone is sufficient to distinguish between user space and +kernel space addresses. + +This is not true for s390, which uses separate address spaces for user +and kernel. + +The same virtual address can be valid in both address spaces, so the +instruction pointer value alone cannot determine whether an address +belongs to the kernel or user space. + +Instead, perf must rely on the cpumode metadata derived from the +processor status word (PSW) at sample time. + +In function perf_event__convert_sample_callchain() the first part +copies a kernel callchain and context entries, if any. + +It then appends additional entries ignoring the address space +architecture. Taking that into account, the symbols at addresses + + 0x3ff970348cb __libc_start_call_main + 0x3ff970349c5 __libc_start_main_impl + +(located after the kernel address space on s390) are now included. + +Output before: + + # perf test 83 + 83: perf inject to convert DWARF callchains to regular ones : FAILED! + +Output after: + # perf test 83 + 83: perf inject to convert DWARF callchains to regular ones : Ok + +Question to Namhyung: + +In function perf_event__convert_sample_callchain() just before the +for() loop this patch modifies, the kernel callchain is copied, +see this comment and the next 5 lines: + + /* copy kernel callchain and context entries */ + +Then why is machine__kernel_ip() needed in the for() loop, when +the kernel entries have been copied just before the loop? + +Note: This patch was tested on x86_64 virtual machine and succeeded. + +Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option") +Signed-off-by: Thomas Richter +Acked-by: Namhyung Kim +Cc: Alexander Gordeev +Cc: Heiko Carstens +Cc: Jan Polensky +Cc: linux-s390@vger.kernel.org +Cc: Sumanth Korikkar +Cc: Vasily Gorbik +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/arch/common.c | 4 +++- + tools/perf/builtin-inject.c | 3 ++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/tools/perf/arch/common.c ++++ b/tools/perf/arch/common.c +@@ -237,5 +237,7 @@ int perf_env__lookup_objdump(struct perf + */ + bool perf_env__single_address_space(struct perf_env *env) + { +- return strcmp(perf_env__arch(env), "sparc"); ++ const char *arch = perf_env__arch(env); ++ ++ return strcmp(arch, "s390") && strcmp(arch, "sparc"); + } +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -555,7 +555,8 @@ static int perf_event__convert_sample_ca + + node = cursor->first; + for (k = 0; k < cursor->nr && i < PERF_MAX_STACK_DEPTH; k++) { +- if (machine__kernel_ip(machine, node->ip)) ++ if (machine->single_address_space && ++ machine__kernel_ip(machine, node->ip)) + /* kernel IPs were added already */; + else if (node->ms.sym && node->ms.sym->inlined) + /* we can't handle inlined callchains */; diff --git a/queue-6.18/perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch b/queue-6.18/perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch new file mode 100644 index 0000000000..80d643479c --- /dev/null +++ b/queue-6.18/perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch @@ -0,0 +1,47 @@ +From e786a04b4a5461dd7e2829422314a5a6d5a664d9 Mon Sep 17 00:00:00 2001 +From: Ian Rogers +Date: Thu, 22 Jan 2026 09:58:46 -0800 +Subject: perf inject: With --convert-callchain ignore the dummy event for dwarf stacks + +From: Ian Rogers + +commit e786a04b4a5461dd7e2829422314a5a6d5a664d9 upstream. + +On hybrid systems there is generally >1 event and a dummy event. + +The perf inject --convert-callchain option is failing to convert +perf.data files on such systems reporting "--convert-callchain requires +DWARF call graph." + +The failing event is the dummy event that doesn't need to be set up for +samples. + +As such ignore this event when checking the evsels. + +Fixes: 92ea788d2af4e65a ("perf inject: Add --convert-callchain option") +Signed-off-by: Ian Rogers +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Ingo Molnar +Cc: James Clark +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-inject.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -2862,7 +2862,7 @@ int cmd_inject(int argc, const char **ar + } + + evlist__for_each_entry(inject.session->evlist, evsel) { +- if (!evsel__has_dwarf_callchain(evsel)) { ++ if (!evsel__has_dwarf_callchain(evsel) && !evsel__is_dummy_event(evsel)) { + pr_err("--convert-callchain requires DWARF call graph.\n"); + goto out_delete; + } diff --git a/queue-6.18/perf-symbol-fix-enoent-case-for-filename__read_build_id.patch b/queue-6.18/perf-symbol-fix-enoent-case-for-filename__read_build_id.patch new file mode 100644 index 0000000000..69ab2e89e0 --- /dev/null +++ b/queue-6.18/perf-symbol-fix-enoent-case-for-filename__read_build_id.patch @@ -0,0 +1,90 @@ +From 5c5f6fe32df2edb4f72bdca62ec2b9f20b7c5ba4 Mon Sep 17 00:00:00 2001 +From: Ian Rogers +Date: Sat, 6 Dec 2025 18:23:45 -0800 +Subject: perf symbol: Fix ENOENT case for filename__read_build_id + +From: Ian Rogers + +commit 5c5f6fe32df2edb4f72bdca62ec2b9f20b7c5ba4 upstream. + +Some callers of filename__read_build_id assume the error value must be +-1, fix by making them handle all < 0 values. + +If is_regular_file fails in filename__read_build_id then it could be +the file is missing (ENOENT) and it would be wrong to return +-EWOULDBLOCK in that case. Fix the logic so -EWOULDBLOCK is only +reported if other errors with stat haven't occurred. + +Fixes: 834ebb5678d7 ("perf tools: Don't read build-ids from non-regular files") +Signed-off-by: Ian Rogers +Reviewed-by: James Clark +Signed-off-by: Namhyung Kim +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-buildid-cache.c | 6 ++++-- + tools/perf/util/libbfd.c | 4 +++- + tools/perf/util/symbol-elf.c | 4 +++- + tools/perf/util/symbol-minimal.c | 4 +++- + 4 files changed, 13 insertions(+), 5 deletions(-) + +--- a/tools/perf/builtin-buildid-cache.c ++++ b/tools/perf/builtin-buildid-cache.c +@@ -276,12 +276,14 @@ static bool dso__missing_buildid_cache(s + { + char filename[PATH_MAX]; + struct build_id bid = { .size = 0, }; ++ int err; + + if (!dso__build_id_filename(dso, filename, sizeof(filename), false)) + return true; + +- if (filename__read_build_id(filename, &bid) == -1) { +- if (errno == ENOENT) ++ err = filename__read_build_id(filename, &bid); ++ if (err < 0) { ++ if (err == -ENOENT) + return false; + + pr_warning("Problems with %s file, consider removing it from the cache\n", +--- a/tools/perf/util/libbfd.c ++++ b/tools/perf/util/libbfd.c +@@ -426,8 +426,10 @@ int libbfd__read_build_id(const char *fi + + if (!filename) + return -EFAULT; ++ ++ errno = 0; + if (!is_regular_file(filename)) +- return -EWOULDBLOCK; ++ return errno == 0 ? -EWOULDBLOCK : -errno; + + fd = open(filename, O_RDONLY); + if (fd < 0) +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -916,8 +916,10 @@ int filename__read_build_id(const char * + + if (!filename) + return -EFAULT; ++ ++ errno = 0; + if (!is_regular_file(filename)) +- return -EWOULDBLOCK; ++ return errno == 0 ? -EWOULDBLOCK : -errno; + + err = kmod_path__parse(&m, filename); + if (err) +--- a/tools/perf/util/symbol-minimal.c ++++ b/tools/perf/util/symbol-minimal.c +@@ -113,8 +113,10 @@ int filename__read_build_id(const char * + + if (!filename) + return -EFAULT; ++ ++ errno = 0; + if (!is_regular_file(filename)) +- return -EWOULDBLOCK; ++ return errno == 0 ? -EWOULDBLOCK : -errno; + + fd = open(filename, O_RDONLY); + if (fd < 0) diff --git a/queue-6.18/pinctrl-airoha-fix-pinctrl-function-mismatch-issue.patch b/queue-6.18/pinctrl-airoha-fix-pinctrl-function-mismatch-issue.patch new file mode 100644 index 0000000000..d739d8e05e --- /dev/null +++ b/queue-6.18/pinctrl-airoha-fix-pinctrl-function-mismatch-issue.patch @@ -0,0 +1,43 @@ +From f2bd5a0f59d052d16749bccf637690e51947a5d6 Mon Sep 17 00:00:00 2001 +From: Chukun Pan +Date: Sat, 15 Nov 2025 18:00:00 +0800 +Subject: pinctrl: airoha: fix pinctrl function mismatch issue + +From: Chukun Pan + +commit f2bd5a0f59d052d16749bccf637690e51947a5d6 upstream. + +The blamed commit made the following changes: + +-#define PINCTRL_FUNC_DESC(id)... +- .desc = PINCTRL_PINFUNCTION(#id, ... ++#define PINCTRL_FUNC_DESC(id, table)... ++ .desc = PINCTRL_PINFUNCTION(#id, ... + +- PINCTRL_FUNC_DESC(pon)... ++ PINCTRL_FUNC_DESC("pon", pon)... + +It's clear that the id of funcs doesn't match the definition. +Remove redundant #string from the definition to fix this issue: +pinctrl-airoha ...: invalid function mdio in map table + +Fixes: 4043b0c45f85 ("pinctrl: airoha: generalize pins/group/function/confs handling") +Signed-off-by: Chukun Pan +Acked-by: Christian Marangi +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/mediatek/pinctrl-airoha.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c ++++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c +@@ -35,7 +35,7 @@ + + #define PINCTRL_FUNC_DESC(id, table) \ + { \ +- .desc = PINCTRL_PINFUNCTION(#id, table##_groups, \ ++ .desc = PINCTRL_PINFUNCTION(id, table##_groups, \ + ARRAY_SIZE(table##_groups)),\ + .groups = table##_func_group, \ + .group_size = ARRAY_SIZE(table##_func_group), \ diff --git a/queue-6.18/rdma-bnxt_re-avoid-repeated-requests-to-allocate-wc-pages.patch b/queue-6.18/rdma-bnxt_re-avoid-repeated-requests-to-allocate-wc-pages.patch new file mode 100644 index 0000000000..2e89b9c18b --- /dev/null +++ b/queue-6.18/rdma-bnxt_re-avoid-repeated-requests-to-allocate-wc-pages.patch @@ -0,0 +1,113 @@ +From 441baa79043431807115fd030d7d0bb14ed441a0 Mon Sep 17 00:00:00 2001 +From: Selvin Xavier +Date: Mon, 15 Jun 2026 15:47:47 -0700 +Subject: RDMA/bnxt_re: Avoid repeated requests to allocate WC pages + +From: Selvin Xavier + +commit 441baa79043431807115fd030d7d0bb14ed441a0 upstream. + +Applications can request multiple WC pages for the same ucontext. +As of now, only 1 WC page per ucontext is supported. Add a lock to +avoid concurrent access and a check to fail repeated requests. +Also, if the mmap entry insert fails for the WC, free the Doorbell +page index mapped for the WC page. + +Fixes: eee6268421a2 ("RDMA/bnxt_re: Move the UAPI methods to a dedicated file") +Fixes: 360da60d6c6e ("RDMA/bnxt_re: Enable low latency push") +Link: https://patch.msgid.link/r/20260615224751.232802-12-selvin.xavier@broadcom.com +Reviewed-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1 + drivers/infiniband/hw/bnxt_re/uapi.c | 33 +++++++++++++++++++++++++------ + 3 files changed, 29 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -4356,6 +4356,7 @@ int bnxt_re_alloc_ucontext(struct ib_uco + goto fail; + } + spin_lock_init(&uctx->sh_lock); ++ mutex_init(&uctx->wcdpi_lock); + + resp.comp_mask = BNXT_RE_UCNTX_CMASK_HAVE_CCTX; + chip_met_rev_num = rdev->chip_ctx->chip_num; +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h +@@ -142,6 +142,7 @@ struct bnxt_re_ucontext { + struct bnxt_re_dev *rdev; + struct bnxt_qplib_dpi dpi; + struct bnxt_qplib_dpi wcdpi; ++ struct mutex wcdpi_lock; /* serialises WC DPI alloc/free */ + void *shpg; + spinlock_t sh_lock; /* protect shpg */ + struct rdma_user_mmap_entry *shpage_mmap; +--- a/drivers/infiniband/hw/bnxt_re/uapi.c ++++ b/drivers/infiniband/hw/bnxt_re/uapi.c +@@ -98,14 +98,23 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD + + switch (alloc_type) { + case BNXT_RE_ALLOC_WC_PAGE: +- if (cctx->modes.db_push) { ++ if (cctx->modes.db_push) { ++ mutex_lock(&uctx->wcdpi_lock); ++ /* already allocated — one WC page per context */ ++ if (uctx->wcdpi.dbr) { ++ mutex_unlock(&uctx->wcdpi_lock); ++ return -EEXIST; ++ } + if (bnxt_qplib_alloc_dpi(&rdev->qplib_res, &uctx->wcdpi, +- uctx, BNXT_QPLIB_DPI_TYPE_WC)) ++ uctx, BNXT_QPLIB_DPI_TYPE_WC)) { ++ mutex_unlock(&uctx->wcdpi_lock); + return -ENOMEM; ++ } + length = PAGE_SIZE; + dpi = uctx->wcdpi.dpi; + addr = (u64)uctx->wcdpi.umdbr; + mmap_flag = BNXT_RE_MMAP_WC_DB; ++ mutex_unlock(&uctx->wcdpi_lock); + } else { + return -EINVAL; + } +@@ -132,8 +141,15 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD + } + + entry = bnxt_re_mmap_entry_insert(uctx, addr, mmap_flag, &mmap_offset); +- if (!entry) ++ if (!entry) { ++ if (mmap_flag == BNXT_RE_MMAP_WC_DB) { ++ mutex_lock(&uctx->wcdpi_lock); ++ bnxt_qplib_dealloc_dpi(&rdev->qplib_res, &uctx->wcdpi); ++ uctx->wcdpi.dbr = NULL; ++ mutex_unlock(&uctx->wcdpi_lock); ++ } + return -ENOMEM; ++ } + + uobj->object = entry; + uverbs_finalize_uobj_create(attrs, BNXT_RE_ALLOC_PAGE_HANDLE); +@@ -164,11 +180,16 @@ static int alloc_page_obj_cleanup(struct + + switch (entry->mmap_flag) { + case BNXT_RE_MMAP_WC_DB: +- if (uctx && uctx->wcdpi.dbr) { ++ if (uctx) { + struct bnxt_re_dev *rdev = uctx->rdev; + +- bnxt_qplib_dealloc_dpi(&rdev->qplib_res, &uctx->wcdpi); +- uctx->wcdpi.dbr = NULL; ++ mutex_lock(&uctx->wcdpi_lock); ++ if (uctx->wcdpi.dbr) { ++ bnxt_qplib_dealloc_dpi(&rdev->qplib_res, ++ &uctx->wcdpi); ++ uctx->wcdpi.dbr = NULL; ++ } ++ mutex_unlock(&uctx->wcdpi_lock); + } + break; + case BNXT_RE_MMAP_DBR_BAR: diff --git a/queue-6.18/rdma-bnxt_re-initialize-dpi-variable-to-zero.patch b/queue-6.18/rdma-bnxt_re-initialize-dpi-variable-to-zero.patch new file mode 100644 index 0000000000..de404f8fbe --- /dev/null +++ b/queue-6.18/rdma-bnxt_re-initialize-dpi-variable-to-zero.patch @@ -0,0 +1,36 @@ +From 978b27d6ce538bb832ccd69e45802824e4301c4b Mon Sep 17 00:00:00 2001 +From: Selvin Xavier +Date: Mon, 15 Jun 2026 15:47:37 -0700 +Subject: RDMA/bnxt_re: Initialize dpi variable to zero + +From: Selvin Xavier + +commit 978b27d6ce538bb832ccd69e45802824e4301c4b upstream. + +dpi is initialized only for BNXT_RE_ALLOC_WC_PAGE, but copied +for all the cases. So initialize the dpi to 0. + +Fixes: eee6268421a2 ("RDMA/bnxt_re: Move the UAPI methods to a dedicated file") +Fixes: 360da60d6c6e ("RDMA/bnxt_re: Enable low latency push") +Link: https://patch.msgid.link/r/20260615224751.232802-2-selvin.xavier@broadcom.com +Reviewed-by: Anantha Prabhu +Signed-off-by: Kalesh AP +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/bnxt_re/uapi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/bnxt_re/uapi.c ++++ b/drivers/infiniband/hw/bnxt_re/uapi.c +@@ -76,8 +76,8 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD + struct ib_ucontext *ib_uctx; + struct bnxt_re_dev *rdev; + u64 mmap_offset; ++ u32 dpi = 0; + u32 length; +- u32 dpi; + u64 addr; + int err; + diff --git a/queue-6.18/seqlock-fix-scoped_seqlock_read-kernel-doc.patch b/queue-6.18/seqlock-fix-scoped_seqlock_read-kernel-doc.patch new file mode 100644 index 0000000000..26c73931bd --- /dev/null +++ b/queue-6.18/seqlock-fix-scoped_seqlock_read-kernel-doc.patch @@ -0,0 +1,58 @@ +From f88a31308db6a856229150039b0f56d59696ed31 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Fri, 23 Jan 2026 10:37:49 -0800 +Subject: seqlock: fix scoped_seqlock_read kernel-doc + +From: Randy Dunlap + +commit f88a31308db6a856229150039b0f56d59696ed31 upstream. + +Eliminate all kernel-doc warnings in seqlock.h: + +- correct the macro to have "()" immediately following the macro name +- don't include the macro parameters in the short description (first line) +- make the parameter names in the comments match the actual macro + parameter names. +- use "::" for the Example + +WARNING: include/linux/seqlock.h:1341 This comment starts with '/**', but isn't a kernel-doc comment. + * scoped_seqlock_read (lock, ss_state) - execute the read side critical +Documentation/locking/seqlock:242: include/linux/seqlock.h:1351: WARNING: + Definition list ends without a blank line; unexpected unindent. [docutils] +Warning: include/linux/seqlock.h:1357 function parameter '_seqlock' not described in 'scoped_seqlock_read' +Warning: include/linux/seqlock.h:1357 function parameter '_target' not described in 'scoped_seqlock_read' + +Fixes: cc39f3872c08 ("seqlock: Introduce scoped_seqlock_read()") +Signed-off-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Link: https://patch.msgid.link/20260123183749.3997533-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/seqlock.h | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/include/linux/seqlock.h ++++ b/include/linux/seqlock.h +@@ -1300,15 +1300,14 @@ __scoped_seqlock_next(struct ss_tmp *sst + __scoped_seqlock_next(&_s, _seqlock, _target)) + + /** +- * scoped_seqlock_read (lock, ss_state) - execute the read side critical +- * section without manual sequence +- * counter handling or calls to other +- * helpers +- * @lock: pointer to seqlock_t protecting the data +- * @ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} indicating +- * the type of critical read section ++ * scoped_seqlock_read() - execute the read-side critical section ++ * without manual sequence counter handling ++ * or calls to other helpers ++ * @_seqlock: pointer to seqlock_t protecting the data ++ * @_target: an enum ss_state: one of {ss_lock, ss_lock_irqsave, ss_lockless} ++ * indicating the type of critical read section + * +- * Example: ++ * Example:: + * + * scoped_seqlock_read (&lock, ss_lock) { + * // read-side critical section diff --git a/queue-6.18/series b/queue-6.18/series index 6e6af49c13..427600af49 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -1599,3 +1599,13 @@ kvm-arm64-nv-re-translate-vncr-before-injecting-abort.patch iommufd-propagate-allocation-failure-in-iommufd_veventq_deliver_fetch.patch iommufd-move-vevent-memory-allocation-outside-spinlock.patch bpf-reject-bpf_map_type_inode_storage-creation-if-bpf-lsm-is-uninitialized.patch +pinctrl-airoha-fix-pinctrl-function-mismatch-issue.patch +perf-symbol-fix-enoent-case-for-filename__read_build_id.patch +pci-fix-bar-resize-rollback-path-overwriting-ret.patch +pci-fix-resizable-bar-restore-order.patch +perf-inject-with-convert-callchain-ignore-the-dummy-event-for-dwarf-stacks.patch +seqlock-fix-scoped_seqlock_read-kernel-doc.patch +perf-callchain-handle-multiple-address-spaces.patch +ksmbd-fix-durable-reconnect-double-bind-race-in-ksmbd_reopen_durable_fd.patch +rdma-bnxt_re-initialize-dpi-variable-to-zero.patch +rdma-bnxt_re-avoid-repeated-requests-to-allocate-wc-pages.patch