From 329ff0138d0be35517ac7574302a47343b7fc880 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 24 Jul 2025 10:15:01 -0400 Subject: [PATCH] Fixes for 6.15 Signed-off-by: Sasha Levin --- ...don-t-allow-oled-to-go-down-to-fully.patch | 55 ++++++++++ ...-adc-ad7949-use-spi_is_bpw_supported.patch | 55 ++++++++++ ...iio-fix-potential-out-of-bound-write.patch | 47 ++++++++ ...-clk-destroy-nodes-in-case-of-memory.patch | 52 +++++++++ ...m-sc7280-add-missing-num_links-to-xm.patch | 36 +++++++ ...x-mlxbf-pmc-remove-newline-char-from.patch | 66 ++++++++++++ ...x-mlxbf-pmc-use-kstrtobool-to-check-.patch | 68 ++++++++++++ ...x-mlxbf-pmc-validate-event-enable-in.patch | 55 ++++++++++ ...s-nb-wmi-add-dmi-quirk-for-asus-zenb.patch | 48 +++++++++ ...-initialization-order-for-firmware_a.patch | 51 +++++++++ ...ate-limit-gid-cache-warning-messages.patch | 44 ++++++++ ...-potential-memory-leak-of-regmap_bus.patch | 44 ++++++++ ...ix-null-dereference-on-unbind-due-to.patch | 44 ++++++++ queue-6.15/series | 18 ++++ ...q_arm-make-vchiq_shutdown-never-fail.patch | 40 +++++++ ...y-fix-incorrect-file-path-conversion.patch | 100 ++++++++++++++++++ ...ce-minimum-tx-ring-size-for-reliabil.patch | 58 ++++++++++ ...-error-reporting-in-virtqueue_resize.patch | 66 ++++++++++++ ...sage-of-cpu_online_mask-to-get-valid.patch | 56 ++++++++++ 19 files changed, 1003 insertions(+) create mode 100644 queue-6.15/drm-amd-display-don-t-allow-oled-to-go-down-to-fully.patch create mode 100644 queue-6.15/iio-adc-ad7949-use-spi_is_bpw_supported.patch create mode 100644 queue-6.15/iio-fix-potential-out-of-bound-write.patch create mode 100644 queue-6.15/interconnect-icc-clk-destroy-nodes-in-case-of-memory.patch create mode 100644 queue-6.15/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch create mode 100644 queue-6.15/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch create mode 100644 queue-6.15/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch create mode 100644 queue-6.15/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch create mode 100644 queue-6.15/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch create mode 100644 queue-6.15/platform-x86-fix-initialization-order-for-firmware_a.patch create mode 100644 queue-6.15/rdma-core-rate-limit-gid-cache-warning-messages.patch create mode 100644 queue-6.15/regmap-fix-potential-memory-leak-of-regmap_bus.patch create mode 100644 queue-6.15/regulator-core-fix-null-dereference-on-unbind-due-to.patch create mode 100644 queue-6.15/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch create mode 100644 queue-6.15/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch create mode 100644 queue-6.15/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch create mode 100644 queue-6.15/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch create mode 100644 queue-6.15/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch diff --git a/queue-6.15/drm-amd-display-don-t-allow-oled-to-go-down-to-fully.patch b/queue-6.15/drm-amd-display-don-t-allow-oled-to-go-down-to-fully.patch new file mode 100644 index 0000000000..69bec85e44 --- /dev/null +++ b/queue-6.15/drm-amd-display-don-t-allow-oled-to-go-down-to-fully.patch @@ -0,0 +1,55 @@ +From b5506242581e516915b503894f410e00d34da9ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Jun 2025 09:29:13 -0500 +Subject: drm/amd/display: Don't allow OLED to go down to fully off + +From: Mario Limonciello + +[ Upstream commit 39d81457ad3417a98ac826161f9ca0e642677661 ] + +[Why] +OLED panels can be fully off, but this behavior is unexpected. + +[How] +Ensure that minimum luminance is at least 1. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4338 +Reviewed-by: Alex Hung +Signed-off-by: Mario Limonciello +Signed-off-by: Ray Wu +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +(cherry picked from commit 51496c7737d06a74b599d0aa7974c3d5a4b1162e) +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 87c2bc5f64a6c..f6d71bf7c89c2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3548,13 +3548,15 @@ static void update_connector_ext_caps(struct amdgpu_dm_connector *aconnector) + + luminance_range = &conn_base->display_info.luminance_range; + +- if (luminance_range->max_luminance) { +- caps->aux_min_input_signal = luminance_range->min_luminance; ++ if (luminance_range->max_luminance) + caps->aux_max_input_signal = luminance_range->max_luminance; +- } else { +- caps->aux_min_input_signal = 0; ++ else + caps->aux_max_input_signal = 512; +- } ++ ++ if (luminance_range->min_luminance) ++ caps->aux_min_input_signal = luminance_range->min_luminance; ++ else ++ caps->aux_min_input_signal = 1; + + min_input_signal_override = drm_get_panel_min_brightness_quirk(aconnector->drm_edid); + if (min_input_signal_override >= 0) +-- +2.39.5 + diff --git a/queue-6.15/iio-adc-ad7949-use-spi_is_bpw_supported.patch b/queue-6.15/iio-adc-ad7949-use-spi_is_bpw_supported.patch new file mode 100644 index 0000000000..480956eeaa --- /dev/null +++ b/queue-6.15/iio-adc-ad7949-use-spi_is_bpw_supported.patch @@ -0,0 +1,55 @@ +From 64aa1fd9c3f669c21e74eba683fc4dd87d3a2184 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 10:04:58 -0500 +Subject: iio: adc: ad7949: use spi_is_bpw_supported() + +From: David Lechner + +[ Upstream commit 7b86482632788acd48d7b9ee1867f5ad3a32ccbb ] + +Use spi_is_bpw_supported() instead of directly accessing spi->controller +->bits_per_word_mask. bits_per_word_mask may be 0, which implies that +8-bits-per-word is supported. spi_is_bpw_supported() takes this into +account while spi_ctrl_mask == SPI_BPW_MASK(8) does not. + +Fixes: 0b2a740b424e ("iio: adc: ad7949: enable use with non 14/16-bit controllers") +Closes: https://lore.kernel.org/linux-spi/c8b8a963-6cef-4c9b-bfef-dab2b7bd0b0f@sirena.org.uk/ +Signed-off-by: David Lechner +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20250611-iio-adc-ad7949-use-spi_is_bpw_supported-v1-1-c4e15bfd326e@baylibre.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad7949.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/adc/ad7949.c b/drivers/iio/adc/ad7949.c +index edd0c3a35ab73..202561cad4012 100644 +--- a/drivers/iio/adc/ad7949.c ++++ b/drivers/iio/adc/ad7949.c +@@ -308,7 +308,6 @@ static void ad7949_disable_reg(void *reg) + + static int ad7949_spi_probe(struct spi_device *spi) + { +- u32 spi_ctrl_mask = spi->controller->bits_per_word_mask; + struct device *dev = &spi->dev; + const struct ad7949_adc_spec *spec; + struct ad7949_adc_chip *ad7949_adc; +@@ -337,11 +336,11 @@ static int ad7949_spi_probe(struct spi_device *spi) + ad7949_adc->resolution = spec->resolution; + + /* Set SPI bits per word */ +- if (spi_ctrl_mask & SPI_BPW_MASK(ad7949_adc->resolution)) { ++ if (spi_is_bpw_supported(spi, ad7949_adc->resolution)) { + spi->bits_per_word = ad7949_adc->resolution; +- } else if (spi_ctrl_mask == SPI_BPW_MASK(16)) { ++ } else if (spi_is_bpw_supported(spi, 16)) { + spi->bits_per_word = 16; +- } else if (spi_ctrl_mask == SPI_BPW_MASK(8)) { ++ } else if (spi_is_bpw_supported(spi, 8)) { + spi->bits_per_word = 8; + } else { + dev_err(dev, "unable to find common BPW with spi controller\n"); +-- +2.39.5 + diff --git a/queue-6.15/iio-fix-potential-out-of-bound-write.patch b/queue-6.15/iio-fix-potential-out-of-bound-write.patch new file mode 100644 index 0000000000..e0a26da5ed --- /dev/null +++ b/queue-6.15/iio-fix-potential-out-of-bound-write.patch @@ -0,0 +1,47 @@ +From 1298904cc4d2d212fd4005ec105109e2fa96caab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 May 2025 15:06:09 +0200 +Subject: iio: fix potential out-of-bound write + +From: Markus Burri + +[ Upstream commit 16285a0931869baa618b1f5d304e1e9d090470a8 ] + +The buffer is set to 20 characters. If a caller write more characters, +count is truncated to the max available space in "simple_write_to_buffer". +To protect from OoB access, check that the input size fit into buffer and +add a zero terminator after copy to the end of the copied data. + +Fixes: 6d5dd486c715 iio: core: make use of simple_write_to_buffer() +Signed-off-by: Markus Burri +Link: https://patch.msgid.link/20250508130612.82270-4-markus.burri@mt.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/industrialio-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c +index b9f4113ae5fc3..ebf17ea5a5f93 100644 +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -410,12 +410,15 @@ static ssize_t iio_debugfs_write_reg(struct file *file, + char buf[80]; + int ret; + ++ if (count >= sizeof(buf)) ++ return -EINVAL; ++ + ret = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, userbuf, + count); + if (ret < 0) + return ret; + +- buf[count] = '\0'; ++ buf[ret] = '\0'; + + ret = sscanf(buf, "%i %i", ®, &val); + +-- +2.39.5 + diff --git a/queue-6.15/interconnect-icc-clk-destroy-nodes-in-case-of-memory.patch b/queue-6.15/interconnect-icc-clk-destroy-nodes-in-case-of-memory.patch new file mode 100644 index 0000000000..9712267227 --- /dev/null +++ b/queue-6.15/interconnect-icc-clk-destroy-nodes-in-case-of-memory.patch @@ -0,0 +1,52 @@ +From cbd76710b604395d874b4b3abf5785181c4d6e21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Jun 2025 19:32:35 +0200 +Subject: interconnect: icc-clk: destroy nodes in case of memory allocation + failures + +From: Gabor Juhos + +[ Upstream commit 618c810a7b2163517ab1875bd56b633ca3cb3328 ] + +When memory allocation fails during creating the name of the nodes in +icc_clk_register(), the code continues on the error path and it calls +icc_nodes_remove() to destroy the already created nodes. However that +function only destroys the nodes which were already added to the provider +and the newly created nodes are never destroyed in case of error. + +In order to avoid a memory leaks, change the code to destroy the newly +created nodes explicitly in case of memory allocation failures. + +Fixes: 44c5aa73ccd1 ("interconnect: icc-clk: check return values of devm_kasprintf()") +Signed-off-by: Gabor Juhos +Reviewed-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20250625-icc-clk-memleak-fix-v1-1-4151484cd24f@gmail.com +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/icc-clk.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/interconnect/icc-clk.c b/drivers/interconnect/icc-clk.c +index 88f311c110207..93c030608d3e0 100644 +--- a/drivers/interconnect/icc-clk.c ++++ b/drivers/interconnect/icc-clk.c +@@ -117,6 +117,7 @@ struct icc_provider *icc_clk_register(struct device *dev, + + node->name = devm_kasprintf(dev, GFP_KERNEL, "%s_master", data[i].name); + if (!node->name) { ++ icc_node_destroy(node->id); + ret = -ENOMEM; + goto err; + } +@@ -135,6 +136,7 @@ struct icc_provider *icc_clk_register(struct device *dev, + + node->name = devm_kasprintf(dev, GFP_KERNEL, "%s_slave", data[i].name); + if (!node->name) { ++ icc_node_destroy(node->id); + ret = -ENOMEM; + goto err; + } +-- +2.39.5 + diff --git a/queue-6.15/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch b/queue-6.15/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch new file mode 100644 index 0000000000..c076e8b682 --- /dev/null +++ b/queue-6.15/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch @@ -0,0 +1,36 @@ +From cad1e7b8ce11cecc57eecb87dcbe2dbe326c6a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jun 2025 22:53:38 +0800 +Subject: interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node + +From: Xilin Wu + +[ Upstream commit 886a94f008dd1a1702ee66dd035c266f70fd9e90 ] + +This allows adding interconnect paths for PCIe 1 in device tree later. + +Fixes: 46bdcac533cc ("interconnect: qcom: Add SC7280 interconnect provider driver") +Signed-off-by: Xilin Wu +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250613-sc7280-icc-pcie1-fix-v1-1-0b09813e3b09@radxa.com +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sc7280.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/interconnect/qcom/sc7280.c b/drivers/interconnect/qcom/sc7280.c +index 346f18d70e9e5..905403a3a930a 100644 +--- a/drivers/interconnect/qcom/sc7280.c ++++ b/drivers/interconnect/qcom/sc7280.c +@@ -238,6 +238,7 @@ static struct qcom_icc_node xm_pcie3_1 = { + .id = SC7280_MASTER_PCIE_1, + .channels = 1, + .buswidth = 8, ++ .num_links = 1, + .links = { SC7280_SLAVE_ANOC_PCIE_GEM_NOC }, + }; + +-- +2.39.5 + diff --git a/queue-6.15/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch b/queue-6.15/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch new file mode 100644 index 0000000000..ac824c094d --- /dev/null +++ b/queue-6.15/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch @@ -0,0 +1,66 @@ +From 60dc718640941c94ab7351a319acd92ed6adf574 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 06:09:01 -0400 +Subject: platform/mellanox: mlxbf-pmc: Remove newline char from event name + input +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shravan Kumar Ramani + +[ Upstream commit 44e6ca8faeeed12206f3e7189c5ac618b810bb9c ] + +Since the input string passed via the command line appends a newline char, +it needs to be removed before comparison with the event_list. + +Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") +Signed-off-by: Shravan Kumar Ramani +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/4978c18e33313b48fa2ae7f3aa6dbcfce40877e4.1751380187.git.shravankr@nvidia.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 771a24c397c12..b8fe51e6d4d3f 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + + #define MLXBF_PMC_WRITE_REG_32 0x82000009 +@@ -1666,6 +1667,7 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev, + attr, struct mlxbf_pmc_attribute, dev_attr); + unsigned int blk_num, cnt_num; + bool is_l3 = false; ++ char *evt_name; + int evt_num; + int err; + +@@ -1673,8 +1675,14 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev, + cnt_num = attr_event->index; + + if (isalpha(buf[0])) { ++ /* Remove the trailing newline character if present */ ++ evt_name = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); ++ if (!evt_name) ++ return -ENOMEM; ++ + evt_num = mlxbf_pmc_get_event_num(pmc->block_name[blk_num], +- buf); ++ evt_name); ++ kfree(evt_name); + if (evt_num < 0) + return -EINVAL; + } else { +-- +2.39.5 + diff --git a/queue-6.15/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch b/queue-6.15/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch new file mode 100644 index 0000000000..0ac1d097b8 --- /dev/null +++ b/queue-6.15/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch @@ -0,0 +1,68 @@ +From ea7ae15cd698e0d8fb6beb46296bafe84cce1f78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 06:09:02 -0400 +Subject: platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shravan Kumar Ramani + +[ Upstream commit 0e2cebd72321caeef84b6ba7084e85be0287fb4b ] + +For setting the enable value, the input should be 0 or 1 only. Use +kstrtobool() in place of kstrtoint() in mlxbf_pmc_enable_store() to +accept only valid input. + +Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") +Signed-off-by: Shravan Kumar Ramani +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com +[ij: split kstrbool() change to own commit.] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index 76966b3dc4ff6..1135d2cf335c8 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1772,13 +1772,14 @@ static ssize_t mlxbf_pmc_enable_store(struct device *dev, + { + struct mlxbf_pmc_attribute *attr_enable = container_of( + attr, struct mlxbf_pmc_attribute, dev_attr); +- unsigned int en, blk_num; ++ unsigned int blk_num; + u32 word; + int err; ++ bool en; + + blk_num = attr_enable->nr; + +- err = kstrtouint(buf, 0, &en); ++ err = kstrtobool(buf, &en); + if (err < 0) + return err; + +@@ -1798,14 +1799,11 @@ static ssize_t mlxbf_pmc_enable_store(struct device *dev, + MLXBF_PMC_CRSPACE_PERFMON_CTL(pmc->block[blk_num].counters), + MLXBF_PMC_WRITE_REG_32, word); + } else { +- if (en && en != 1) +- return -EINVAL; +- + err = mlxbf_pmc_config_l3_counters(blk_num, false, !!en); + if (err) + return err; + +- if (en == 1) { ++ if (en) { + err = mlxbf_pmc_config_l3_counters(blk_num, true, false); + if (err) + return err; +-- +2.39.5 + diff --git a/queue-6.15/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch b/queue-6.15/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch new file mode 100644 index 0000000000..4d543f61f4 --- /dev/null +++ b/queue-6.15/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch @@ -0,0 +1,55 @@ +From 9c6ea5f3995d728b43a3d990353d0ae6530cca8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 06:09:02 -0400 +Subject: platform/mellanox: mlxbf-pmc: Validate event/enable input +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shravan Kumar Ramani + +[ Upstream commit f8c1311769d3b2c82688b294b4ae03e94f1c326d ] + +Before programming the event info, validate the event number received as input +by checking if it exists in the event_list. Also fix a typo in the comment for +mlxbf_pmc_get_event_name() to correctly mention that it returns the event name +when taking the event number as input, and not the other way round. + +Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") +Signed-off-by: Shravan Kumar Ramani +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com +[ij: split kstrbool() change to own commit.] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index b8fe51e6d4d3f..76966b3dc4ff6 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1105,7 +1105,7 @@ static int mlxbf_pmc_get_event_num(const char *blk, const char *evt) + return -ENODEV; + } + +-/* Get the event number given the name */ ++/* Get the event name given the number */ + static char *mlxbf_pmc_get_event_name(const char *blk, u32 evt) + { + const struct mlxbf_pmc_events *events; +@@ -1689,6 +1689,9 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev, + err = kstrtouint(buf, 0, &evt_num); + if (err < 0) + return err; ++ ++ if (!mlxbf_pmc_get_event_name(pmc->block_name[blk_num], evt_num)) ++ return -EINVAL; + } + + if (strstr(pmc->block_name[blk_num], "l3cache")) +-- +2.39.5 + diff --git a/queue-6.15/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch b/queue-6.15/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch new file mode 100644 index 0000000000..55c87a110a --- /dev/null +++ b/queue-6.15/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch @@ -0,0 +1,48 @@ +From 498343da11b1fe2b0486a4caebbfc6e52da9203a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 03:33:01 -0400 +Subject: platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo + UX8406CA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rahul Chandra + +[ Upstream commit 7dc6b2d3b5503bcafebbeaf9818112bf367107b4 ] + +Add a DMI quirk entry for the ASUS Zenbook Duo UX8406CA 2025 model to use +the existing zenbook duo keyboard quirk. + +Signed-off-by: Rahul Chandra +Link: https://lore.kernel.org/r/20250624073301.602070-1-rahul@chandra.net +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 3f8b2a324efdf..f84c3d03c1de7 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -530,6 +530,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_zenbook_duo_kbd, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUS Zenbook Duo UX8406CA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "UX8406CA"), ++ }, ++ .driver_data = &quirk_asus_zenbook_duo_kbd, ++ }, + {}, + }; + +-- +2.39.5 + diff --git a/queue-6.15/platform-x86-fix-initialization-order-for-firmware_a.patch b/queue-6.15/platform-x86-fix-initialization-order-for-firmware_a.patch new file mode 100644 index 0000000000..59970a8450 --- /dev/null +++ b/queue-6.15/platform-x86-fix-initialization-order-for-firmware_a.patch @@ -0,0 +1,51 @@ +From e4582f16d3167142b072547d871a0d66a4203c76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jul 2025 12:32:54 +0200 +Subject: platform/x86: Fix initialization order for firmware_attributes_class +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Torsten Hilbrich + +[ Upstream commit 2bfe3ae1aa45f8b61cb0dc462114fd0c9636ad32 ] + +The think-lmi driver uses the firwmare_attributes_class. But this class +is registered after think-lmi, causing the "think-lmi" directory in +"/sys/class/firmware-attributes" to be missing when the driver is +compiled as builtin. + +Fixes: 55922403807a ("platform/x86: think-lmi: Directly use firmware_attributes_class") +Signed-off-by: Torsten Hilbrich +Link: https://lore.kernel.org/r/7dce5f7f-c348-4350-ac53-d14a8e1e8034@secunet.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile +index 650dfbebb6c8c..9a1884b03215a 100644 +--- a/drivers/platform/x86/Makefile ++++ b/drivers/platform/x86/Makefile +@@ -58,6 +58,8 @@ obj-$(CONFIG_X86_PLATFORM_DRIVERS_HP) += hp/ + # Hewlett Packard Enterprise + obj-$(CONFIG_UV_SYSFS) += uv_sysfs.o + ++obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o ++ + # IBM Thinkpad and Lenovo + obj-$(CONFIG_IBM_RTL) += ibm_rtl.o + obj-$(CONFIG_IDEAPAD_LAPTOP) += ideapad-laptop.o +@@ -122,7 +124,6 @@ obj-$(CONFIG_SYSTEM76_ACPI) += system76_acpi.o + obj-$(CONFIG_TOPSTAR_LAPTOP) += topstar-laptop.o + + # Platform drivers +-obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o + obj-$(CONFIG_SERIAL_MULTI_INSTANTIATE) += serial-multi-instantiate.o + obj-$(CONFIG_TOUCHSCREEN_DMI) += touchscreen_dmi.o + obj-$(CONFIG_WIRELESS_HOTKEY) += wireless-hotkey.o +-- +2.39.5 + diff --git a/queue-6.15/rdma-core-rate-limit-gid-cache-warning-messages.patch b/queue-6.15/rdma-core-rate-limit-gid-cache-warning-messages.patch new file mode 100644 index 0000000000..ee6d0dfcba --- /dev/null +++ b/queue-6.15/rdma-core-rate-limit-gid-cache-warning-messages.patch @@ -0,0 +1,44 @@ +From de4b2bf2da0e6e91cc0b38908d8c1869fc552252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:26:21 +0300 +Subject: RDMA/core: Rate limit GID cache warning messages + +From: Maor Gottlieb + +[ Upstream commit 333e4d79316c9ed5877d7aac8b8ed22efc74e96d ] + +The GID cache warning messages can flood the kernel log when there are +multiple failed attempts to add GIDs. This can happen when creating many +virtual interfaces without having enough space for their GIDs in the GID +table. + +Change pr_warn to pr_warn_ratelimited to prevent log flooding while still +maintaining visibility of the issue. + +Link: https://patch.msgid.link/r/fd45ed4a1078e743f498b234c3ae816610ba1b18.1750062357.git.leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c +index 9979a351577f1..81cf3c902e819 100644 +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -582,8 +582,8 @@ static int __ib_cache_gid_add(struct ib_device *ib_dev, u32 port, + out_unlock: + mutex_unlock(&table->lock); + if (ret) +- pr_warn("%s: unable to add gid %pI6 error=%d\n", +- __func__, gid->raw, ret); ++ pr_warn_ratelimited("%s: unable to add gid %pI6 error=%d\n", ++ __func__, gid->raw, ret); + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.15/regmap-fix-potential-memory-leak-of-regmap_bus.patch b/queue-6.15/regmap-fix-potential-memory-leak-of-regmap_bus.patch new file mode 100644 index 0000000000..87985c61c2 --- /dev/null +++ b/queue-6.15/regmap-fix-potential-memory-leak-of-regmap_bus.patch @@ -0,0 +1,44 @@ +From 255af985a012fba3fdbec00cd6c27a82fdec5207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jun 2025 22:58:21 +0530 +Subject: regmap: fix potential memory leak of regmap_bus + +From: Abdun Nihaal + +[ Upstream commit c871c199accb39d0f4cb941ad0dccabfc21e9214 ] + +When __regmap_init() is called from __regmap_init_i2c() and +__regmap_init_spi() (and their devm versions), the bus argument +obtained from regmap_get_i2c_bus() and regmap_get_spi_bus(), may be +allocated using kmemdup() to support quirks. In those cases, the +bus->free_on_exit field is set to true. + +However, inside __regmap_init(), buf is not freed on any error path. +This could lead to a memory leak of regmap_bus when __regmap_init() +fails. Fix that by freeing bus on error path when free_on_exit is set. + +Fixes: ea030ca68819 ("regmap-i2c: Set regmap max raw r/w from quirks") +Signed-off-by: Abdun Nihaal +Link: https://patch.msgid.link/20250626172823.18725-1-abdun.nihaal@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index f2843f8146751..1f3f782a04ba2 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1173,6 +1173,8 @@ struct regmap *__regmap_init(struct device *dev, + err_map: + kfree(map); + err: ++ if (bus && bus->free_on_exit) ++ kfree(bus); + return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(__regmap_init); +-- +2.39.5 + diff --git a/queue-6.15/regulator-core-fix-null-dereference-on-unbind-due-to.patch b/queue-6.15/regulator-core-fix-null-dereference-on-unbind-due-to.patch new file mode 100644 index 0000000000..d5d3a61dec --- /dev/null +++ b/queue-6.15/regulator-core-fix-null-dereference-on-unbind-due-to.patch @@ -0,0 +1,44 @@ +From d27c6898b01ea4e480986dedff6954c89c0e76f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jun 2025 08:38:09 +0000 +Subject: regulator: core: fix NULL dereference on unbind due to stale coupling + data + +From: Alessandro Carminati + +[ Upstream commit ca46946a482238b0cdea459fb82fc837fb36260e ] + +Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can +lead to NULL pointer dereference when regulators are accessed post-unbind. + +This can happen during runtime PM or other regulator operations that rely +on coupling metadata. + +For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers +a panic in regulator_lock_recursive() due to stale coupling state. + +Ensure n_coupled is set to 0 to prevent access to invalid pointers. + +Signed-off-by: Alessandro Carminati +Link: https://patch.msgid.link/20250626083809.314842-1-acarmina@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 90629a7566932..4ecad5c6c8390 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -5639,6 +5639,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev) + ERR_PTR(err)); + } + ++ rdev->coupling_desc.n_coupled = 0; + kfree(rdev->coupling_desc.coupled_rdevs); + rdev->coupling_desc.coupled_rdevs = NULL; + } +-- +2.39.5 + diff --git a/queue-6.15/series b/queue-6.15/series index 85e954ef01..7afeff747d 100644 --- a/queue-6.15/series +++ b/queue-6.15/series @@ -1 +1,19 @@ x86-traps-initialize-dr7-by-writing-its-architectural-reset-value.patch +virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch +virtio_ring-fix-error-reporting-in-virtqueue_resize.patch +drm-amd-display-don-t-allow-oled-to-go-down-to-fully.patch +regulator-core-fix-null-dereference-on-unbind-due-to.patch +platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch +rdma-core-rate-limit-gid-cache-warning-messages.patch +iio-fix-potential-out-of-bound-write.patch +interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch +interconnect-icc-clk-destroy-nodes-in-case-of-memory.patch +iio-adc-ad7949-use-spi_is_bpw_supported.patch +regmap-fix-potential-memory-leak-of-regmap_bus.patch +platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch +platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch +platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch +tools-hv-fcopy-fix-incorrect-file-path-conversion.patch +x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch +platform-x86-fix-initialization-order-for-firmware_a.patch +staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch diff --git a/queue-6.15/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch b/queue-6.15/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch new file mode 100644 index 0000000000..49c69579b7 --- /dev/null +++ b/queue-6.15/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch @@ -0,0 +1,40 @@ +From 6fb8856a79ac55cd2c4ae0c0e76958af89ce1b9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jul 2025 18:11:08 +0200 +Subject: staging: vchiq_arm: Make vchiq_shutdown never fail + +From: Stefan Wahren + +[ Upstream commit f2b8ebfb867011ddbefbdf7b04ad62626cbc2afd ] + +Most of the users of vchiq_shutdown ignore the return value, +which is bad because this could lead to resource leaks. +So instead of changing all calls to vchiq_shutdown, it's easier +to make vchiq_shutdown never fail. + +Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20250715161108.3411-4-wahrenst@gmx.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +index 6434cbdc1a6ef..721b15b7e13b9 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -393,8 +393,7 @@ int vchiq_shutdown(struct vchiq_instance *instance) + struct vchiq_state *state = instance->state; + int ret = 0; + +- if (mutex_lock_killable(&state->mutex)) +- return -EAGAIN; ++ mutex_lock(&state->mutex); + + /* Remove all services */ + vchiq_shutdown_internal(state, instance); +-- +2.39.5 + diff --git a/queue-6.15/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch b/queue-6.15/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch new file mode 100644 index 0000000000..7893d2f94c --- /dev/null +++ b/queue-6.15/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch @@ -0,0 +1,100 @@ +From 2cdf178d30d78c6a6ab886992d6bdf4362348f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Jun 2025 11:22:17 +0900 +Subject: tools/hv: fcopy: Fix incorrect file path conversion + +From: Yasumasa Suenaga + +[ Upstream commit 0d86a8d65c1e69610bfe1a7a774f71ff111ed8c1 ] + +The hv_fcopy_uio_daemon fails to correctly handle file copy requests +from Windows hosts (e.g. via Copy-VMFile) due to wchar_t size +differences between Windows and Linux. On Linux, wchar_t is 32 bit, +whereas Windows uses 16 bit wide characters. + +Fix this by ensuring that file transfers from host to Linux guest +succeed with correctly decoded file names and paths. + +- Treats file name and path as __u16 arrays, not wchar_t*. +- Allocates fixed-size buffers (W_MAX_PATH) for converted strings + instead of using malloc. +- Adds a check for target path length to prevent snprintf() buffer + overflow. + +Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver") +Signed-off-by: Yasumasa Suenaga +Reviewed-by: Naman Jain +Link: https://lore.kernel.org/r/20250628022217.1514-2-yasuenag@gmail.com +Signed-off-by: Wei Liu +Message-ID: <20250628022217.1514-2-yasuenag@gmail.com> +Signed-off-by: Sasha Levin +--- + tools/hv/hv_fcopy_uio_daemon.c | 37 +++++++++++++--------------------- + 1 file changed, 14 insertions(+), 23 deletions(-) + +diff --git a/tools/hv/hv_fcopy_uio_daemon.c b/tools/hv/hv_fcopy_uio_daemon.c +index 7d9bcb066d3fb..92e8307b2a467 100644 +--- a/tools/hv/hv_fcopy_uio_daemon.c ++++ b/tools/hv/hv_fcopy_uio_daemon.c +@@ -118,8 +118,11 @@ static int hv_fcopy_create_file(char *file_name, char *path_name, __u32 flags) + + filesize = 0; + p = path_name; +- snprintf(target_fname, sizeof(target_fname), "%s/%s", +- path_name, file_name); ++ if (snprintf(target_fname, sizeof(target_fname), "%s/%s", ++ path_name, file_name) >= sizeof(target_fname)) { ++ syslog(LOG_ERR, "target file name is too long: %s/%s", path_name, file_name); ++ goto done; ++ } + + /* + * Check to see if the path is already in place; if not, +@@ -326,7 +329,7 @@ static void wcstoutf8(char *dest, const __u16 *src, size_t dest_size) + { + size_t len = 0; + +- while (len < dest_size) { ++ while (len < dest_size && *src) { + if (src[len] < 0x80) + dest[len++] = (char)(*src++); + else +@@ -338,27 +341,15 @@ static void wcstoutf8(char *dest, const __u16 *src, size_t dest_size) + + static int hv_fcopy_start(struct hv_start_fcopy *smsg_in) + { +- setlocale(LC_ALL, "en_US.utf8"); +- size_t file_size, path_size; +- char *file_name, *path_name; +- char *in_file_name = (char *)smsg_in->file_name; +- char *in_path_name = (char *)smsg_in->path_name; +- +- file_size = wcstombs(NULL, (const wchar_t *restrict)in_file_name, 0) + 1; +- path_size = wcstombs(NULL, (const wchar_t *restrict)in_path_name, 0) + 1; +- +- file_name = (char *)malloc(file_size * sizeof(char)); +- path_name = (char *)malloc(path_size * sizeof(char)); +- +- if (!file_name || !path_name) { +- free(file_name); +- free(path_name); +- syslog(LOG_ERR, "Can't allocate memory for file name and/or path name"); +- return HV_E_FAIL; +- } ++ /* ++ * file_name and path_name should have same length with appropriate ++ * member of hv_start_fcopy. ++ */ ++ char file_name[W_MAX_PATH], path_name[W_MAX_PATH]; + +- wcstoutf8(file_name, (__u16 *)in_file_name, file_size); +- wcstoutf8(path_name, (__u16 *)in_path_name, path_size); ++ setlocale(LC_ALL, "en_US.utf8"); ++ wcstoutf8(file_name, smsg_in->file_name, W_MAX_PATH - 1); ++ wcstoutf8(path_name, smsg_in->path_name, W_MAX_PATH - 1); + + return hv_fcopy_create_file(file_name, path_name, smsg_in->copy_flags); + } +-- +2.39.5 + diff --git a/queue-6.15/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch b/queue-6.15/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch new file mode 100644 index 0000000000..3f0abe4d47 --- /dev/null +++ b/queue-6.15/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch @@ -0,0 +1,58 @@ +From 582749befc6cc83357c1ba1fc5c61b88e78d141a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 May 2025 11:22:36 +0200 +Subject: virtio_net: Enforce minimum TX ring size for reliability + +From: Laurent Vivier + +[ Upstream commit 24b2f5df86aaebbe7bac40304eaf5a146c02367c ] + +The `tx_may_stop()` logic stops TX queues if free descriptors +(`sq->vq->num_free`) fall below the threshold of (`MAX_SKB_FRAGS` + 2). +If the total ring size (`ring_num`) is not strictly greater than this +value, queues can become persistently stopped or stop after minimal +use, severely degrading performance. + +A single sk_buff transmission typically requires descriptors for: +- The virtio_net_hdr (1 descriptor) +- The sk_buff's linear data (head) (1 descriptor) +- Paged fragments (up to MAX_SKB_FRAGS descriptors) + +This patch enforces that the TX ring size ('ring_num') must be strictly +greater than (MAX_SKB_FRAGS + 2). This ensures that the ring is +always large enough to hold at least one maximally-fragmented packet +plus at least one additional slot. + +Reported-by: Lei Yang +Signed-off-by: Laurent Vivier +Reviewed-by: Xuan Zhuo +Acked-by: Jason Wang +Link: https://patch.msgid.link/20250521092236.661410-4-lvivier@redhat.com +Tested-by: Lei Yang +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index c69c241948019..0c9bedb679169 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -3525,6 +3525,12 @@ static int virtnet_tx_resize(struct virtnet_info *vi, struct send_queue *sq, + { + int qindex, err; + ++ if (ring_num <= MAX_SKB_FRAGS + 2) { ++ netdev_err(vi->dev, "tx size (%d) cannot be smaller than %d\n", ++ ring_num, MAX_SKB_FRAGS + 2); ++ return -EINVAL; ++ } ++ + qindex = sq - vi->sq; + + virtnet_tx_pause(vi, sq); +-- +2.39.5 + diff --git a/queue-6.15/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch b/queue-6.15/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch new file mode 100644 index 0000000000..e542b9cadb --- /dev/null +++ b/queue-6.15/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch @@ -0,0 +1,66 @@ +From 134df5cae8340f576868edf98c78400e490735fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 May 2025 11:22:34 +0200 +Subject: virtio_ring: Fix error reporting in virtqueue_resize + +From: Laurent Vivier + +[ Upstream commit 45ebc7e6c125ce93d2ddf82cd5bea20121bb0258 ] + +The virtqueue_resize() function was not correctly propagating error codes +from its internal resize helper functions, specifically +virtqueue_resize_packet() and virtqueue_resize_split(). If these helpers +returned an error, but the subsequent call to virtqueue_enable_after_reset() +succeeded, the original error from the resize operation would be masked. +Consequently, virtqueue_resize() could incorrectly report success to its +caller despite an underlying resize failure. + +This change restores the original code behavior: + + if (vdev->config->enable_vq_after_reset(_vq)) + return -EBUSY; + + return err; + +Fix: commit ad48d53b5b3f ("virtio_ring: separate the logic of reset/enable from virtqueue_resize") +Cc: xuanzhuo@linux.alibaba.com +Signed-off-by: Laurent Vivier +Acked-by: Jason Wang +Link: https://patch.msgid.link/20250521092236.661410-2-lvivier@redhat.com +Tested-by: Lei Yang +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index b784aab668670..4397392bfef00 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -2797,7 +2797,7 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num, + void (*recycle_done)(struct virtqueue *vq)) + { + struct vring_virtqueue *vq = to_vvq(_vq); +- int err; ++ int err, err_reset; + + if (num > vq->vq.num_max) + return -E2BIG; +@@ -2819,7 +2819,11 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num, + else + err = virtqueue_resize_split(_vq, num); + +- return virtqueue_enable_after_reset(_vq); ++ err_reset = virtqueue_enable_after_reset(_vq); ++ if (err_reset) ++ return err_reset; ++ ++ return err; + } + EXPORT_SYMBOL_GPL(virtqueue_resize); + +-- +2.39.5 + diff --git a/queue-6.15/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch b/queue-6.15/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch new file mode 100644 index 0000000000..44a7196926 --- /dev/null +++ b/queue-6.15/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch @@ -0,0 +1,56 @@ +From 4f78d1b01ee1f21e865786c2b3b0de5c4b52e3c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jul 2025 15:44:34 -0700 +Subject: x86/hyperv: Fix usage of cpu_online_mask to get valid cpu + +From: Nuno Das Neves + +[ Upstream commit bb169f80ed5a156ec3405e0e49c6b8e9ae264718 ] + +Accessing cpu_online_mask here is problematic because the cpus read lock +is not held in this context. + +However, cpu_online_mask isn't needed here since the effective affinity +mask is guaranteed to be valid in this callback. So, just use +cpumask_first() to get the cpu instead of ANDing it with cpus_online_mask +unnecessarily. + +Fixes: e39397d1fd68 ("x86/hyperv: implement an MSI domain for root partition") +Reported-by: Michael Kelley +Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB4157639630F8AD2D8FD8F52FD475A@SN6PR02MB4157.namprd02.prod.outlook.com/ +Suggested-by: Thomas Gleixner +Signed-off-by: Nuno Das Neves +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com +Signed-off-by: Wei Liu +Message-ID: <1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com> +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/irqdomain.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/x86/hyperv/irqdomain.c b/arch/x86/hyperv/irqdomain.c +index 31f0d29cbc5e3..e28c317ac9e81 100644 +--- a/arch/x86/hyperv/irqdomain.c ++++ b/arch/x86/hyperv/irqdomain.c +@@ -192,7 +192,6 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + struct pci_dev *dev; + struct hv_interrupt_entry out_entry, *stored_entry; + struct irq_cfg *cfg = irqd_cfg(data); +- const cpumask_t *affinity; + int cpu; + u64 status; + +@@ -204,8 +203,7 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + return; + } + +- affinity = irq_data_get_effective_affinity_mask(data); +- cpu = cpumask_first_and(affinity, cpu_online_mask); ++ cpu = cpumask_first(irq_data_get_effective_affinity_mask(data)); + + if (data->chip_data) { + /* +-- +2.39.5 + -- 2.47.2