From: Greg Kroah-Hartman Date: Mon, 20 Jul 2026 16:33:17 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=efe417dee7a9f787eeb1e138fd4bcd804628b8dd;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: acpica-define-acpi_ut_safe_strncpy-as-strscpy_pad-alias.patch drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master.patch platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch --- diff --git a/queue-7.1/acpica-define-acpi_ut_safe_strncpy-as-strscpy_pad-alias.patch b/queue-7.1/acpica-define-acpi_ut_safe_strncpy-as-strscpy_pad-alias.patch new file mode 100644 index 0000000000..239777bc04 --- /dev/null +++ b/queue-7.1/acpica-define-acpi_ut_safe_strncpy-as-strscpy_pad-alias.patch @@ -0,0 +1,76 @@ +From 9825cf2cb59fac7480e7fac9eee13ab9af3f1ea8 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Tue, 30 Jun 2026 18:03:03 +0200 +Subject: ACPICA: Define acpi_ut_safe_strncpy() as strscpy_pad() alias + +From: Rafael J. Wysocki + +commit 9825cf2cb59fac7480e7fac9eee13ab9af3f1ea8 upstream. + +Commit 292db66afd20 ("ACPICA: Unbreak tools build after switching over +to strscpy_pad()") added an #ifdef based on a __KERNEL__ check which is +sort of nasty to the acpi_ut_safe_strncpy() definition to unbreak ACPICA +tools builds broken by commit 97f7d3f9c9ac ("ACPICA: Replace strncpy() +with strscpy_pad() in acpi_ut_safe_strncpy()"). However, that #ifdef +effectively produces dead code when tools are built because they don't +call acpi_ut_safe_strncpy(). + +Accordingly, drop the existing definition of acpi_ut_safe_strncpy() and +define it as a strscpy_pad() alias. + +Fixes: 292db66afd20 ("ACPICA: Unbreak tools build after switching over to strscpy_pad()") +Signed-off-by: Rafael J. Wysocki +[ rjw: Tweak the changelog ] +Link: https://patch.msgid.link/12941764.O9o76ZdvQC@rafael.j.wysocki +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpica/acutils.h | 2 -- + drivers/acpi/acpica/utnonansi.c | 16 ---------------- + include/acpi/platform/aclinuxex.h | 1 + + 3 files changed, 1 insertion(+), 18 deletions(-) + +--- a/drivers/acpi/acpica/acutils.h ++++ b/drivers/acpi/acpica/acutils.h +@@ -626,8 +626,6 @@ void acpi_ut_repair_name(char *name); + #if defined (ACPI_DEBUGGER) || defined (ACPI_APPLICATION) || defined (ACPI_DEBUG_OUTPUT) + u8 acpi_ut_safe_strcpy(char *dest, acpi_size dest_size, char *source); + +-void acpi_ut_safe_strncpy(char *dest, char *source, acpi_size dest_size); +- + u8 acpi_ut_safe_strcat(char *dest, acpi_size dest_size, char *source); + + u8 +--- a/drivers/acpi/acpica/utnonansi.c ++++ b/drivers/acpi/acpica/utnonansi.c +@@ -164,20 +164,4 @@ acpi_ut_safe_strncat(char *dest, + return (FALSE); + } + +-void acpi_ut_safe_strncpy(char *dest, char *source, acpi_size dest_size) +-{ +- /* Always terminate destination string */ +- +-#ifdef __KERNEL__ +- strscpy_pad(dest, source, dest_size); +-#else +- /* +- * strscpy_pad() is not defined in ACPICA tools builds, so use strncpy() +- * and directly NUL-terminate the destination string in that case. +- */ +- strncpy(dest, source, dest_size); +- dest[dest_size - 1] = 0; +-#endif +-} +- + #endif +--- a/include/acpi/platform/aclinuxex.h ++++ b/include/acpi/platform/aclinuxex.h +@@ -134,6 +134,7 @@ static inline void acpi_os_terminate_deb + /* + * OSL interfaces added by Linux + */ ++#define acpi_ut_safe_strncpy strscpy_pad + + #endif /* __KERNEL__ */ + diff --git a/queue-7.1/drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch b/queue-7.1/drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch new file mode 100644 index 0000000000..b7b3797456 --- /dev/null +++ b/queue-7.1/drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch @@ -0,0 +1,62 @@ +From f5ef65adf81da3dbce4e692e48c1754c0bb95da0 Mon Sep 17 00:00:00 2001 +From: Shuicheng Lin +Date: Tue, 30 Jun 2026 19:22:21 +0000 +Subject: drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM=n +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shuicheng Lin + +commit f5ef65adf81da3dbce4e692e48c1754c0bb95da0 upstream. + +When CONFIG_DRM_GPUSVM=n (e.g. um-allyesconfig), the only caller of +xe_pt_svm_userptr_notifier_lock() is compiled out, triggering: + + drivers/gpu/drm/xe/xe_pt.c:1418:13: warning: + 'xe_pt_svm_userptr_notifier_lock' defined but not used + [-Wunused-function] + +The helpers cannot simply be removed in this case: the matching +xe_pt_svm_userptr_notifier_unlock() is also referenced from +xe_pt_update_ops_run(), which lives outside any DRM_GPUSVM ifdef and is +gated only at runtime by pt_update_ops->needs_svm_lock. The symbol must +exist in all builds. + +Provide empty static inline stubs for !DRM_GPUSVM, matching the pattern +used by xe_svm_notifier_lock()/_unlock() in xe_svm.h. + +Fixes: dca6e08c923a ("drm/xe/userptr: Hold notifier_lock for write on inject test path") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202606302210.QqcLbOEN-lkp@intel.com/ +Reviewed-by: Matthew Brost +Link: https://patch.msgid.link/20260630192221.2998168-1-shuicheng.lin@intel.com +Signed-off-by: Shuicheng Lin +(cherry picked from commit 3359422bf0a1140e96d783a19a397686e580a3ca) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pt.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_pt.c ++++ b/drivers/gpu/drm/xe/xe_pt.c +@@ -1407,6 +1407,7 @@ static int xe_pt_pre_commit(struct xe_mi + pt_update_ops, rftree); + } + ++#if IS_ENABLED(CONFIG_DRM_GPUSVM) + /* + * Acquire/release the svm notifier_lock around xe_pt_svm_userptr_pre_commit() + * and the matching late release in xe_pt_update_ops_run(). Read mode by +@@ -1433,6 +1434,10 @@ static void xe_pt_svm_userptr_notifier_u + xe_svm_notifier_unlock(vm); + #endif + } ++#else ++static inline void xe_pt_svm_userptr_notifier_lock(struct xe_vm *vm) { } ++static inline void xe_pt_svm_userptr_notifier_unlock(struct xe_vm *vm) { } ++#endif + + #if IS_ENABLED(CONFIG_DRM_GPUSVM) + #ifdef CONFIG_DRM_XE_USERPTR_INVAL_INJECT diff --git a/queue-7.1/kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch b/queue-7.1/kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch new file mode 100644 index 0000000000..10883a9bdc --- /dev/null +++ b/queue-7.1/kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch @@ -0,0 +1,46 @@ +From 8d187d4b33c262c0f3e44842553521151d8629e8 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Tue, 7 Jul 2026 17:29:35 +0100 +Subject: KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms() + +From: Marc Zyngier + +commit 8d187d4b33c262c0f3e44842553521151d8629e8 upstream. + +Assigning the invalidation level (an s8 value) with TLBI_TTL_UNKNOWN +(a 32bit signed value) is not ideal, to say the least. Instead of +this, only pass TLBI_TTL_UNKNOWN to __kvm_tlb_flush_vmid_ipa_nsh() +when we know for sure that we don't have a provided level. + +Fixes: 100baf0184896 ("KVM: arm64: Ensure level is always initialized when relaxing perms") +Reported-by: Mark Brown +Reviewed-by: Oliver Upton +Link: https://lore.kernel.org/r/akztC7H2IsEKaq4i@sirena.org.uk +Link: https://patch.msgid.link/20260707162935.1900874-1-maz@kernel.org +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kvm/hyp/pgtable.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm64/kvm/hyp/pgtable.c ++++ b/arch/arm64/kvm/hyp/pgtable.c +@@ -1358,7 +1358,7 @@ int kvm_pgtable_stage2_relax_perms(struc + enum kvm_pgtable_prot prot, enum kvm_pgtable_walk_flags flags) + { + kvm_pte_t xn = 0, set = 0, clr = 0; +- s8 level = TLBI_TTL_UNKNOWN; ++ s8 level; + int ret; + + if (prot & KVM_PTE_LEAF_ATTR_HI_SW) +@@ -1379,7 +1379,8 @@ int kvm_pgtable_stage2_relax_perms(struc + + ret = stage2_update_leaf_attrs(pgt, addr, 1, set, clr, NULL, &level, flags); + if (!ret || ret == -EAGAIN) +- kvm_call_hyp(__kvm_tlb_flush_vmid_ipa_nsh, pgt->mmu, addr, level); ++ kvm_call_hyp(__kvm_tlb_flush_vmid_ipa_nsh, pgt->mmu, addr, ++ (ret == -EAGAIN) ? TLBI_TTL_UNKNOWN : level); + return ret; + } + diff --git a/queue-7.1/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch b/queue-7.1/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch new file mode 100644 index 0000000000..ab7448fe53 --- /dev/null +++ b/queue-7.1/net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch @@ -0,0 +1,118 @@ +From 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 Mon Sep 17 00:00:00 2001 +From: Jamal Hadi Salim +Date: Tue, 30 Jun 2026 11:09:22 -0400 +Subject: net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants + +From: Jamal Hadi Salim + +commit 6301f6a34ed86fe6f3b7b3211ea069f3677fc559 upstream. + +This is a followup based on sashiko comments [1] on commit e5b811fe7931 +("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF") + +Use plain rcu_read_lock()/spin_lock() in teql_master_xmit() instead of the +_bh variants, since ndo_start_xmit is already invoked with BH disabled +by the core stack and the _bh primitives can warn in_hardirq() when xmit +is reached through netpoll or a softirq xmit path with hard IRQs disabled. + +Moves rcu_read_lock() after restart: label + adds rcu_read_unlock() before +goto restart (fixes the unbounded RCU hold across retries) + +[1] https://sashiko.dev/#/patchset/20260628111229.669751-1-jhs%40mojatatu.com + +Signed-off-by: Jamal Hadi Salim +Fixes: e5b811fe7931 ("net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF") +Link: https://patch.msgid.link/20260630150922.238714-1-jhs@mojatatu.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/sch_teql.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +--- a/net/sched/sch_teql.c ++++ b/net/sched/sch_teql.c +@@ -311,14 +311,14 @@ static netdev_tx_t teql_master_xmit(stru + int subq = skb_get_queue_mapping(skb); + struct sk_buff *skb_res = NULL; + +- rcu_read_lock_bh(); +- +- start = rcu_dereference_bh(master->slaves); +- + restart: + nores = 0; + busy = 0; + ++ rcu_read_lock(); ++ ++ start = rcu_dereference(master->slaves); ++ + q = start; + if (!q) + goto drop; +@@ -345,17 +345,17 @@ restart: + netdev_start_xmit(skb, slave, slave_txq, false) == + NETDEV_TX_OK) { + __netif_tx_unlock(slave_txq); +- spin_lock_bh(&master->slaves_lock); ++ spin_lock(&master->slaves_lock); + if (rcu_dereference_protected(master->slaves, + lockdep_is_held(&master->slaves_lock)) == q) + rcu_assign_pointer(master->slaves, + rcu_dereference_protected(NEXT_SLAVE(q), + lockdep_is_held(&master->slaves_lock))); +- spin_unlock_bh(&master->slaves_lock); ++ spin_unlock(&master->slaves_lock); + netif_wake_queue(dev); + master->tx_packets++; + master->tx_bytes += length; +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + return NETDEV_TX_OK; + } + __netif_tx_unlock(slave_txq); +@@ -364,37 +364,38 @@ restart: + busy = 1; + break; + case 1: +- spin_lock_bh(&master->slaves_lock); ++ spin_lock(&master->slaves_lock); + if (rcu_dereference_protected(master->slaves, + lockdep_is_held(&master->slaves_lock)) == q) + rcu_assign_pointer(master->slaves, + rcu_dereference_protected(NEXT_SLAVE(q), + lockdep_is_held(&master->slaves_lock))); +- spin_unlock_bh(&master->slaves_lock); +- rcu_read_unlock_bh(); ++ spin_unlock(&master->slaves_lock); ++ rcu_read_unlock(); + return NETDEV_TX_OK; + default: + nores = 1; + break; + } + __skb_pull(skb, skb_network_offset(skb)); +- } while ((q = rcu_dereference_bh(NEXT_SLAVE(q))) != start); ++ } while ((q = rcu_dereference(NEXT_SLAVE(q))) != start); + + if (nores && skb_res == NULL) { + skb_res = skb; ++ rcu_read_unlock(); + goto restart; + } + + if (busy) { + netif_stop_queue(dev); +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + return NETDEV_TX_BUSY; + } + master->tx_errors++; + + drop: + master->tx_dropped++; +- rcu_read_unlock_bh(); ++ rcu_read_unlock(); + dev_kfree_skb(skb); + return NETDEV_TX_OK; + } diff --git a/queue-7.1/netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch b/queue-7.1/netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch new file mode 100644 index 0000000000..18f11a2697 --- /dev/null +++ b/queue-7.1/netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch @@ -0,0 +1,33 @@ +From 278296b69fae5dd951599692cd481bae4995215c Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Wed, 1 Jul 2026 12:46:57 +0200 +Subject: netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master on updates + +From: Pablo Neira Ayuso + +commit 278296b69fae5dd951599692cd481bae4995215c upstream. + +Really cap it to NF_CT_EXPECT_MAX_CNT (255) on updates. + +The commit ("netfilter: nfnetlink_cthelper: cap to maximum number of +expectation per master") only covers creation of helpers, not updates. + +Fixes: 397c8300972f ("netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nfnetlink_cthelper.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -316,6 +316,8 @@ nfnl_cthelper_update_policy_one(const st + + new_policy->max_expected = + ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); ++ if (!new_policy->max_expected) ++ new_policy->max_expected = NF_CT_EXPECT_MAX_CNT; + if (new_policy->max_expected > NF_CT_EXPECT_MAX_CNT) + return -EINVAL; + diff --git a/queue-7.1/netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master.patch b/queue-7.1/netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master.patch new file mode 100644 index 0000000000..e92992ed2f --- /dev/null +++ b/queue-7.1/netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master.patch @@ -0,0 +1,31 @@ +From bf5355cfdede3e30b30e63a5a74f6bdaafb26082 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 26 Jun 2026 13:40:42 +0200 +Subject: netfilter: nfnetlink_cthelper: cap to maximum number of expectation per master + +From: Pablo Neira Ayuso + +commit bf5355cfdede3e30b30e63a5a74f6bdaafb26082 upstream. + +If userspace helper policy updates sets maximum number of expectation to +zero, cap it to NF_CT_EXPECT_MAX_CNT (255) on updates too. + +Fixes: 397c8300972f ("netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nfnetlink_cthelper.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -163,6 +163,8 @@ nfnl_cthelper_expect_policy(struct nf_co + tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN); + expect_policy->max_expected = + ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); ++ if (!expect_policy->max_expected) ++ expect_policy->max_expected = NF_CT_EXPECT_MAX_CNT; + if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT) + return -EINVAL; + diff --git a/queue-7.1/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch b/queue-7.1/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch new file mode 100644 index 0000000000..caf3c33c48 --- /dev/null +++ b/queue-7.1/platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch @@ -0,0 +1,51 @@ +From a0738abd042f7406edd2175a819cf2e66388ed97 Mon Sep 17 00:00:00 2001 +From: Daniel Gibson +Date: Sat, 27 Jun 2026 00:02:10 +0200 +Subject: platform/x86/amd/pmc: Avoid logging "(null)" for DMI values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Gibson + +commit a0738abd042f7406edd2175a819cf2e66388ed97 upstream. + +dmi_get_system_info(...) can return NULL. Using that as %s arguments +of dev_info() would log "(null)" (as part of a message like +'... System Vendor: "(null)", Product Name: "(null)" ...'), which may +be confusing for users. + +Use Elvis operator to print "(Unknown)" instead. + +Fixes: 428b9fd2dce5 ("platform/x86/amd/pmc: Add delay_suspend module parameter") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202606251540.Nr2BtaNu-lkp@intel.com/ +Suggested-by: Ilpo Järvinen +Signed-off-by: Daniel Gibson +Link: https://patch.msgid.link/20260626220210.1761783-2-daniel@gibson.sh +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/amd/pmc/pmc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/platform/x86/amd/pmc/pmc.c ++++ b/drivers/platform/x86/amd/pmc/pmc.c +@@ -660,11 +660,11 @@ static bool amd_pmc_want_suspend_delay(s + } else if (delay_suspend == 1) { + if (!intermediate_wakeup) + dev_info(pdev->dev, "Delaying suspend by 2.5s because delay_suspend=1. If this solves problems on your machine, please report this whole line to: platform-driver-x86@vger.kernel.org so it can be automatically detected as affected in the future. System Vendor: \"%s\" Product Name: \"%s\" Product Family: \"%s\" Board Vendor: \"%s\" Board Name: \"%s\"\n", +- dmi_get_system_info(DMI_SYS_VENDOR), +- dmi_get_system_info(DMI_PRODUCT_NAME), +- dmi_get_system_info(DMI_PRODUCT_FAMILY), +- dmi_get_system_info(DMI_BOARD_VENDOR), +- dmi_get_system_info(DMI_BOARD_NAME)); ++ dmi_get_system_info(DMI_SYS_VENDOR) ?: "(Unknown)", ++ dmi_get_system_info(DMI_PRODUCT_NAME) ?: "(Unknown)", ++ dmi_get_system_info(DMI_PRODUCT_FAMILY) ?: "(Unknown)", ++ dmi_get_system_info(DMI_BOARD_VENDOR) ?: "(Unknown)", ++ dmi_get_system_info(DMI_BOARD_NAME) ?: "(Unknown)"); + return true; + } + return false; diff --git a/queue-7.1/series b/queue-7.1/series index 6ed8d631c5..74ddbef7ce 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -1938,3 +1938,10 @@ ieee802154-ca8210-fix-pointer-truncation-in-kfifo-on-64-bit.patch gve-fix-header-buffer-corruption-with-header-split-and-hw-gro.patch octeontx2-af-cn10k-restrict-vf-lmtline-sharing-to-its-own-pf.patch ksmbd-fix-stack-buffer-overflow-in-multichannel-session-key-copy.patch +netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master.patch +platform-x86-amd-pmc-avoid-logging-null-for-dmi-values.patch +net-sched-sch_teql-move-rcu_read_lock-spin_lock-from-_bh-variants.patch +acpica-define-acpi_ut_safe_strncpy-as-strscpy_pad-alias.patch +drm-xe-userptr-stub-notifier_lock-helpers-when-drm_gpusvm-n.patch +netfilter-nfnetlink_cthelper-cap-to-maximum-number-of-expectation-per-master-on-updates.patch +kvm-arm64-fix-propagation-of-tlbi-level-in-kvm_pgtable_stage2_relax_perms.patch