From 58073e88506399f5d1617cc9d83b7707bc7e4519 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 22 May 2026 08:36:34 -0400 Subject: [PATCH] drop 4 patches based on RC review feedback MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Dropped patches: - "bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator finalize" Queues: 6.12, 6.6 Reason: build break on riscv — removes the inline bpf_flush_icache() definition but the prerequisite (6798668ab195, "riscv, bpf: Remove duplicated bpf_flush_icache()") is missing in 6.12/6.6, leaving an undefined caller in arch/riscv/net/bpf_jit_comp64.c. Report: https://lore.kernel.org/stable/b8ef921f-e2ab-4cfb-b75c-89e4277214cf@oracle.com/ - "fuse: new work queue to periodically invalidate expired dentries" Queues: 6.18 Reason: FUSE maintainer Miklos Szeredi NAK — "This is not stable material, and I don't think the dependency is real." Report: https://lore.kernel.org/stable/CAOssrKcqmVW3kJ131tRF3LCJVQUtdRB31B5HENDfpgrq6r=jEA@mail.gmail.com/ - "dcache: export shrink_dentry_list() and add new helper d_dispose_if_unused()" [dependency] Queues: 6.18 Reason: only present to support the dropped workqueue patch (Stable-dep-of: 5a6baf204610). - "fuse: fix uninit-value in fuse_dentry_revalidate()" [dependency] Queues: 6.18 Reason: Stable-dep-of relationship to dropped workqueue patch; per maintainer the dependency isn't real and a trivial conflict resolution is the correct path — fix will be reposted directly to stable. - "fuse: fix race when disposing stale dentries" [dependency] Queues: 6.18 Reason: Fixes: ab84ad597386 — cannot apply without the dropped workqueue patch (fuse_dentry_tree_work doesn't exist). - "fuse: make sure dentry is evicted if stale" [dependency] Queues: 6.18 Reason: Fixes: ab84ad597386 — modifies fuse_dentry_tree_work() introduced by the dropped workqueue patch. - "i3c: master: Fix error codes at send_ccc_cmd" Queues: 7.0, 6.18, 6.12, 6.6, 6.1, 5.15, 5.10 Reason: prerequisite patches called out in the commit message ("Move rstdaa/entdaa/bus_init error suppression") are not all backported, so the semantics of the change differ from upstream. Report: https://lore.kernel.org/stable/a6d725bd-9ed4-4328-b2ba-078f658fd8b2@oracle.com/ - "fuse: fix premature writetrhough request for large folio" Queues: 7.0, 6.18 Reason: Reviewed-by Joanne Koong (author of the parent commit that introduced large-folio writethrough support) reports the bug is not triggerable as fuse hasn't enabled large folios yet. Report: https://lore.kernel.org/stable/CAJnrk1bWJfT5hswsJ3X5HMZ=XLz5MO3pYXg6WkuYYvZ6ccS0Nw@mail.gmail.com/ Signed-off-by: Sasha Levin --- ...ster-fix-error-codes-at-send_ccc_cmd.patch | 126 ------ queue-5.10/series | 1 - ...ster-fix-error-codes-at-send_ccc_cmd.patch | 126 ------ queue-5.15/series | 1 - ...ster-fix-error-codes-at-send_ccc_cmd.patch | 126 ------ queue-6.1/series | 1 - ...-redundant-bpf_flush_icache-after-pa.patch | 82 ---- ...ster-fix-error-codes-at-send_ccc_cmd.patch | 126 ------ queue-6.12/series | 2 - ...rink_dentry_list-and-add-new-helper-.patch | 85 ---- ...re-writetrhough-request-for-large-fo.patch | 74 ---- ...x-race-when-disposing-stale-dentries.patch | 78 ---- ...init-value-in-fuse_dentry_revalidate.patch | 65 ---- ...make-sure-dentry-is-evicted-if-stale.patch | 44 --- ...eue-to-periodically-invalidate-expir.patch | 367 ------------------ ...ster-fix-error-codes-at-send_ccc_cmd.patch | 126 ------ queue-6.18/series | 7 - ...-redundant-bpf_flush_icache-after-pa.patch | 82 ---- ...ster-fix-error-codes-at-send_ccc_cmd.patch | 126 ------ queue-6.6/series | 2 - ...re-writetrhough-request-for-large-fo.patch | 74 ---- ...ster-fix-error-codes-at-send_ccc_cmd.patch | 126 ------ queue-7.0/series | 2 - 23 files changed, 1849 deletions(-) delete mode 100644 queue-5.10/i3c-master-fix-error-codes-at-send_ccc_cmd.patch delete mode 100644 queue-5.15/i3c-master-fix-error-codes-at-send_ccc_cmd.patch delete mode 100644 queue-6.1/i3c-master-fix-error-codes-at-send_ccc_cmd.patch delete mode 100644 queue-6.12/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch delete mode 100644 queue-6.12/i3c-master-fix-error-codes-at-send_ccc_cmd.patch delete mode 100644 queue-6.18/dcache-export-shrink_dentry_list-and-add-new-helper-.patch delete mode 100644 queue-6.18/fuse-fix-premature-writetrhough-request-for-large-fo.patch delete mode 100644 queue-6.18/fuse-fix-race-when-disposing-stale-dentries.patch delete mode 100644 queue-6.18/fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch delete mode 100644 queue-6.18/fuse-make-sure-dentry-is-evicted-if-stale.patch delete mode 100644 queue-6.18/fuse-new-work-queue-to-periodically-invalidate-expir.patch delete mode 100644 queue-6.18/i3c-master-fix-error-codes-at-send_ccc_cmd.patch delete mode 100644 queue-6.6/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch delete mode 100644 queue-6.6/i3c-master-fix-error-codes-at-send_ccc_cmd.patch delete mode 100644 queue-7.0/fuse-fix-premature-writetrhough-request-for-large-fo.patch delete mode 100644 queue-7.0/i3c-master-fix-error-codes-at-send_ccc_cmd.patch diff --git a/queue-5.10/i3c-master-fix-error-codes-at-send_ccc_cmd.patch b/queue-5.10/i3c-master-fix-error-codes-at-send_ccc_cmd.patch deleted file mode 100644 index 4045e3f043..0000000000 --- a/queue-5.10/i3c-master-fix-error-codes-at-send_ccc_cmd.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 9adcb0df3f767e218a2e03f4b4ebdc1e71d68005 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Mar 2026 17:11:32 +0100 -Subject: i3c: master: Fix error codes at send_ccc_cmd - -From: Jorge Marques - -[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ] - -i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, -Mx codes) to the ret variable, cascading down multiple methods until -reaching methods that explicitly stated they would return 0 on success -or negative error code. For example, the call chain: - - i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- - master->ops.enable_ibi <- i3c_master_enec_locked <- - i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked - -Fix this by returning the ret value, callers can still read the cmd->err -value if ret is negative. - -All corner cases where the Mx codes do need to be handled individually, -are resolved in previous commits. Those corner cases are all scenarios -when I3C_ERROR_M2 is expected and acceptable. -The prerequisite patches for the fix are: - - i3c: master: Move rstdaa error suppression - i3c: master: Move entdaa error suppression - i3c: master: Move bus_init error suppression - -Reported-by: Dan Carpenter -Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ -Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") -Reviewed-by: Adrian Hunter -Signed-off-by: Jorge Marques -Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com -Signed-off-by: Alexandre Belloni -Signed-off-by: Sasha Levin ---- - drivers/i3c/master.c | 32 +++++++++++++------------------- - 1 file changed, 13 insertions(+), 19 deletions(-) - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index f3fc7fe3779fe..7539e7d563032 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -700,11 +700,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, - cmd->err = I3C_ERROR_UNKNOWN; - } - -+/** -+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) -+ * @master: master used to send frames on the bus -+ * @cmd: command to send -+ * -+ * Return: 0 in case of success, or a negative error code otherwise. -+ * I3C Mx error codes are stored in cmd->err. -+ */ - static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - struct i3c_ccc_cmd *cmd) - { -- int ret; -- - if (!cmd || !master) - return -EINVAL; - -@@ -722,15 +728,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - !master->ops->supports_ccc_cmd(master, cmd)) - return -ENOTSUPP; - -- ret = master->ops->send_ccc_cmd(master, cmd); -- if (ret) { -- if (cmd->err != I3C_ERROR_UNKNOWN) -- return cmd->err; -- -- return ret; -- } -- -- return 0; -+ return master->ops->send_ccc_cmd(master, cmd); - } - - static struct i2c_dev_desc * -@@ -834,8 +832,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_entdaa_locked(struct i3c_master_controller *master) - { -@@ -887,8 +884,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -908,8 +904,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -934,8 +929,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_defslvs_locked(struct i3c_master_controller *master) - { --- -2.53.0 - diff --git a/queue-5.10/series b/queue-5.10/series index f1397069dd..f2c2518af1 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -390,7 +390,6 @@ perf-branch-avoid-incrementing-null.patch pinctrl-abx500-fix-type-of-argument-variable.patch perf-expr-return-einval-for-syntax-error-in-expr__fi.patch perf-util-kill-die-prototype-dead-for-a-long-time.patch -i3c-master-fix-error-codes-at-send_ccc_cmd.patch driver-core-device.h-remove-extern-from-function-pro.patch driver-core-move-dev_err_probe-to-where-it-belogs.patch dev_printk-add-new-dev_err_probe-helpers.patch diff --git a/queue-5.15/i3c-master-fix-error-codes-at-send_ccc_cmd.patch b/queue-5.15/i3c-master-fix-error-codes-at-send_ccc_cmd.patch deleted file mode 100644 index 47872eeb3d..0000000000 --- a/queue-5.15/i3c-master-fix-error-codes-at-send_ccc_cmd.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 4d1def74095aaf84519e1f118fb0d96640b731dc Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Mar 2026 17:11:32 +0100 -Subject: i3c: master: Fix error codes at send_ccc_cmd - -From: Jorge Marques - -[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ] - -i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, -Mx codes) to the ret variable, cascading down multiple methods until -reaching methods that explicitly stated they would return 0 on success -or negative error code. For example, the call chain: - - i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- - master->ops.enable_ibi <- i3c_master_enec_locked <- - i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked - -Fix this by returning the ret value, callers can still read the cmd->err -value if ret is negative. - -All corner cases where the Mx codes do need to be handled individually, -are resolved in previous commits. Those corner cases are all scenarios -when I3C_ERROR_M2 is expected and acceptable. -The prerequisite patches for the fix are: - - i3c: master: Move rstdaa error suppression - i3c: master: Move entdaa error suppression - i3c: master: Move bus_init error suppression - -Reported-by: Dan Carpenter -Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ -Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") -Reviewed-by: Adrian Hunter -Signed-off-by: Jorge Marques -Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com -Signed-off-by: Alexandre Belloni -Signed-off-by: Sasha Levin ---- - drivers/i3c/master.c | 32 +++++++++++++------------------- - 1 file changed, 13 insertions(+), 19 deletions(-) - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index 5df943d25cf0a..6153f5af0b13e 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -654,11 +654,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, - cmd->err = I3C_ERROR_UNKNOWN; - } - -+/** -+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) -+ * @master: master used to send frames on the bus -+ * @cmd: command to send -+ * -+ * Return: 0 in case of success, or a negative error code otherwise. -+ * I3C Mx error codes are stored in cmd->err. -+ */ - static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - struct i3c_ccc_cmd *cmd) - { -- int ret; -- - if (!cmd || !master) - return -EINVAL; - -@@ -676,15 +682,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - !master->ops->supports_ccc_cmd(master, cmd)) - return -ENOTSUPP; - -- ret = master->ops->send_ccc_cmd(master, cmd); -- if (ret) { -- if (cmd->err != I3C_ERROR_UNKNOWN) -- return cmd->err; -- -- return ret; -- } -- -- return 0; -+ return master->ops->send_ccc_cmd(master, cmd); - } - - static struct i2c_dev_desc * -@@ -788,8 +786,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_entdaa_locked(struct i3c_master_controller *master) - { -@@ -841,8 +838,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -862,8 +858,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -888,8 +883,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_defslvs_locked(struct i3c_master_controller *master) - { --- -2.53.0 - diff --git a/queue-5.15/series b/queue-5.15/series index 7474c27f84..9a7919ca50 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -522,7 +522,6 @@ perf-tools-cs-etm-fix-print-issue-for-coresight-debu.patch pinctrl-abx500-fix-type-of-argument-variable.patch perf-expr-return-einval-for-syntax-error-in-expr__fi.patch perf-util-kill-die-prototype-dead-for-a-long-time.patch -i3c-master-fix-error-codes-at-send_ccc_cmd.patch i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch driver-core-device.h-remove-extern-from-function-pro.patch driver-core-move-dev_err_probe-to-where-it-belogs.patch diff --git a/queue-6.1/i3c-master-fix-error-codes-at-send_ccc_cmd.patch b/queue-6.1/i3c-master-fix-error-codes-at-send_ccc_cmd.patch deleted file mode 100644 index 9a4e2d0958..0000000000 --- a/queue-6.1/i3c-master-fix-error-codes-at-send_ccc_cmd.patch +++ /dev/null @@ -1,126 +0,0 @@ -From e14277f0eac3588ba398919b6fd16632a855f7b4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Mar 2026 17:11:32 +0100 -Subject: i3c: master: Fix error codes at send_ccc_cmd - -From: Jorge Marques - -[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ] - -i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, -Mx codes) to the ret variable, cascading down multiple methods until -reaching methods that explicitly stated they would return 0 on success -or negative error code. For example, the call chain: - - i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- - master->ops.enable_ibi <- i3c_master_enec_locked <- - i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked - -Fix this by returning the ret value, callers can still read the cmd->err -value if ret is negative. - -All corner cases where the Mx codes do need to be handled individually, -are resolved in previous commits. Those corner cases are all scenarios -when I3C_ERROR_M2 is expected and acceptable. -The prerequisite patches for the fix are: - - i3c: master: Move rstdaa error suppression - i3c: master: Move entdaa error suppression - i3c: master: Move bus_init error suppression - -Reported-by: Dan Carpenter -Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ -Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") -Reviewed-by: Adrian Hunter -Signed-off-by: Jorge Marques -Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com -Signed-off-by: Alexandre Belloni -Signed-off-by: Sasha Levin ---- - drivers/i3c/master.c | 32 +++++++++++++------------------- - 1 file changed, 13 insertions(+), 19 deletions(-) - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index 74138c499642e..74cadaf638936 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -792,11 +792,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, - cmd->err = I3C_ERROR_UNKNOWN; - } - -+/** -+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) -+ * @master: master used to send frames on the bus -+ * @cmd: command to send -+ * -+ * Return: 0 in case of success, or a negative error code otherwise. -+ * I3C Mx error codes are stored in cmd->err. -+ */ - static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - struct i3c_ccc_cmd *cmd) - { -- int ret; -- - if (!cmd || !master) - return -EINVAL; - -@@ -814,15 +820,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - !master->ops->supports_ccc_cmd(master, cmd)) - return -ENOTSUPP; - -- ret = master->ops->send_ccc_cmd(master, cmd); -- if (ret) { -- if (cmd->err != I3C_ERROR_UNKNOWN) -- return cmd->err; -- -- return ret; -- } -- -- return 0; -+ return master->ops->send_ccc_cmd(master, cmd); - } - - static struct i2c_dev_desc * -@@ -926,8 +924,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_entdaa_locked(struct i3c_master_controller *master) - { -@@ -979,8 +976,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1000,8 +996,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1026,8 +1021,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_defslvs_locked(struct i3c_master_controller *master) - { --- -2.53.0 - diff --git a/queue-6.1/series b/queue-6.1/series index 999069e9f6..1dbf800e27 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -632,7 +632,6 @@ perf-tools-cs-etm-fix-print-issue-for-coresight-debu.patch pinctrl-abx500-fix-type-of-argument-variable.patch perf-expr-return-einval-for-syntax-error-in-expr__fi.patch perf-util-kill-die-prototype-dead-for-a-long-time.patch -i3c-master-fix-error-codes-at-send_ccc_cmd.patch i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch driver-core-device.h-remove-extern-from-function-pro.patch driver-core-move-dev_err_probe-to-where-it-belogs.patch diff --git a/queue-6.12/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch b/queue-6.12/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch deleted file mode 100644 index e76764f5e6..0000000000 --- a/queue-6.12/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 5e410791dbced5ee143653e38daf4ac927e23634 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 13 Apr 2026 12:11:09 -0700 -Subject: bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator - finalize - -From: Puranjay Mohan - -[ Upstream commit 46ee1342b887c9387a933397d846ff6c9584322c ] - -bpf_flush_icache() calls flush_icache_range() to clean the data cache -and invalidate the instruction cache for the JITed code region. However, -since commit 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the -BPF JIT"), this flush is redundant. - -bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX -region via bpf_arch_text_copy() -> patch_text_nosync(), and -patch_text_nosync() already calls flush_icache_range() on the written -range. The subsequent bpf_flush_icache() repeats the same cache -maintenance on an overlapping range. - -Remove the redundant bpf_flush_icache() call and its now-unused -definition. - -Fixes: 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT") -Acked-by: Song Liu -Signed-off-by: Puranjay Mohan -Reviewed-by: Pu Lehui -Tested-by: Paul Chaignon -Link: https://lore.kernel.org/r/20260413191111.3426023-3-puranjay@kernel.org -Signed-off-by: Alexei Starovoitov -Signed-off-by: Sasha Levin ---- - arch/riscv/net/bpf_jit.h | 6 ------ - arch/riscv/net/bpf_jit_core.c | 7 ------- - 2 files changed, 13 deletions(-) - -diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h -index 1d1c78d4cff1e..f87bad9a0578c 100644 ---- a/arch/riscv/net/bpf_jit.h -+++ b/arch/riscv/net/bpf_jit.h -@@ -11,7 +11,6 @@ - - #include - #include --#include - - static inline bool rvc_enabled(void) - { -@@ -109,11 +108,6 @@ static inline void bpf_fill_ill_insns(void *area, unsigned int size) - memset(area, 0, size); - } - --static inline void bpf_flush_icache(void *start, void *end) --{ -- flush_icache_range((unsigned long)start, (unsigned long)end); --} -- - /* Emit a 4-byte riscv instruction. */ - static inline void emit(const u32 insn, struct rv_jit_context *ctx) - { -diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c -index 6de753c667f42..fe362030ed2a9 100644 ---- a/arch/riscv/net/bpf_jit_core.c -+++ b/arch/riscv/net/bpf_jit_core.c -@@ -184,13 +184,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) - prog = orig_prog; - goto out_offset; - } -- /* -- * The instructions have now been copied to the ROX region from -- * where they will execute. -- * Write any modified data cache blocks out to memory and -- * invalidate the corresponding blocks in the instruction cache. -- */ -- bpf_flush_icache(jit_data->ro_header, ctx->ro_insns + ctx->ninsns); - for (i = 0; i < prog->len; i++) - ctx->offset[i] = ninsns_rvoff(ctx->offset[i]); - bpf_prog_fill_jited_linfo(prog, ctx->offset); --- -2.53.0 - diff --git a/queue-6.12/i3c-master-fix-error-codes-at-send_ccc_cmd.patch b/queue-6.12/i3c-master-fix-error-codes-at-send_ccc_cmd.patch deleted file mode 100644 index d3cba05613..0000000000 --- a/queue-6.12/i3c-master-fix-error-codes-at-send_ccc_cmd.patch +++ /dev/null @@ -1,126 +0,0 @@ -From e248e53a772d2d27f13bbbb77e4e2307de793485 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Mar 2026 17:11:32 +0100 -Subject: i3c: master: Fix error codes at send_ccc_cmd - -From: Jorge Marques - -[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ] - -i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, -Mx codes) to the ret variable, cascading down multiple methods until -reaching methods that explicitly stated they would return 0 on success -or negative error code. For example, the call chain: - - i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- - master->ops.enable_ibi <- i3c_master_enec_locked <- - i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked - -Fix this by returning the ret value, callers can still read the cmd->err -value if ret is negative. - -All corner cases where the Mx codes do need to be handled individually, -are resolved in previous commits. Those corner cases are all scenarios -when I3C_ERROR_M2 is expected and acceptable. -The prerequisite patches for the fix are: - - i3c: master: Move rstdaa error suppression - i3c: master: Move entdaa error suppression - i3c: master: Move bus_init error suppression - -Reported-by: Dan Carpenter -Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ -Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") -Reviewed-by: Adrian Hunter -Signed-off-by: Jorge Marques -Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com -Signed-off-by: Alexandre Belloni -Signed-off-by: Sasha Levin ---- - drivers/i3c/master.c | 32 +++++++++++++------------------- - 1 file changed, 13 insertions(+), 19 deletions(-) - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index fe6f956cc3111..8e2bff031aac9 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -825,11 +825,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, - cmd->err = I3C_ERROR_UNKNOWN; - } - -+/** -+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) -+ * @master: master used to send frames on the bus -+ * @cmd: command to send -+ * -+ * Return: 0 in case of success, or a negative error code otherwise. -+ * I3C Mx error codes are stored in cmd->err. -+ */ - static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - struct i3c_ccc_cmd *cmd) - { -- int ret; -- - if (!cmd || !master) - return -EINVAL; - -@@ -847,15 +853,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - !master->ops->supports_ccc_cmd(master, cmd)) - return -ENOTSUPP; - -- ret = master->ops->send_ccc_cmd(master, cmd); -- if (ret) { -- if (cmd->err != I3C_ERROR_UNKNOWN) -- return cmd->err; -- -- return ret; -- } -- -- return 0; -+ return master->ops->send_ccc_cmd(master, cmd); - } - - static struct i2c_dev_desc * -@@ -959,8 +957,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_entdaa_locked(struct i3c_master_controller *master) - { -@@ -1012,8 +1009,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1033,8 +1029,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1059,8 +1054,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_defslvs_locked(struct i3c_master_controller *master) - { --- -2.53.0 - diff --git a/queue-6.12/series b/queue-6.12/series index 33eff73b1a..56e5acbd71 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -342,7 +342,6 @@ mtd-rawnand-sunxi-fix-sunxi_nfc_hw_ecc_read_extra_oo.patch hid-usbhid-fix-deadlock-in-hid_post_reset.patch ext4-fix-possible-null-ptr-deref-in-mbt_kunit_exit.patch bpf-arm64-fix-off-by-one-in-check_imm-signed-range-c.patch -bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch bpf-sockmap-fix-af_unix-iter-deadlock.patch bpf-sockmap-fix-af_unix-null-ptr-deref-in-proto-upda.patch bpf-sockmap-take-state-lock-for-af_unix-iter.patch @@ -377,7 +376,6 @@ reset-replace-boolean-parameters-with-flags-paramete.patch reset-add-devres-helpers-to-request-pre-deasserted-r.patch i3c-master-dw-i3c-fix-missing-reset-assertion-in-rem.patch i3c-dw-fix-memory-leak-in-dw_i3c_master_i3c_xfers.patch -i3c-master-fix-error-codes-at-send_ccc_cmd.patch i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch backlight-sky81452-backlight-check-return-value-of-d.patch platform-surface-surfacepro3_button-drop-wakeup-sour.patch diff --git a/queue-6.18/dcache-export-shrink_dentry_list-and-add-new-helper-.patch b/queue-6.18/dcache-export-shrink_dentry_list-and-add-new-helper-.patch deleted file mode 100644 index aa872017f3..0000000000 --- a/queue-6.18/dcache-export-shrink_dentry_list-and-add-new-helper-.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 88644bdd783993d2a9fdb534da073e398205736d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 16 Sep 2025 14:53:07 +0100 -Subject: dcache: export shrink_dentry_list() and add new helper - d_dispose_if_unused() - -From: Luis Henriques - -[ Upstream commit 395b95530343e7f4bdd2870190d985a222997fb6 ] - -Add and export a new helper d_dispose_if_unused() which is simply a wrapper -around to_shrink_list(), to add an entry to a dispose list if it's not used -anymore. - -Also export shrink_dentry_list() to kill all dentries in a dispose list. - -Suggested-by: Miklos Szeredi -Signed-off-by: Luis Henriques -Signed-off-by: Miklos Szeredi -Stable-dep-of: 5a6baf204610 ("fuse: fix uninit-value in fuse_dentry_revalidate()") -Signed-off-by: Sasha Levin ---- - fs/dcache.c | 18 ++++++++++++------ - include/linux/dcache.h | 2 ++ - 2 files changed, 14 insertions(+), 6 deletions(-) - -diff --git a/fs/dcache.c b/fs/dcache.c -index 8bf82b002b4d4..fcc8ddf7d3fa4 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1086,6 +1086,15 @@ struct dentry *d_find_alias_rcu(struct inode *inode) - return de; - } - -+void d_dispose_if_unused(struct dentry *dentry, struct list_head *dispose) -+{ -+ spin_lock(&dentry->d_lock); -+ if (!dentry->d_lockref.count) -+ to_shrink_list(dentry, dispose); -+ spin_unlock(&dentry->d_lock); -+} -+EXPORT_SYMBOL(d_dispose_if_unused); -+ - /* - * Try to kill dentries associated with this inode. - * WARNING: you must own a reference to inode. -@@ -1096,12 +1105,8 @@ void d_prune_aliases(struct inode *inode) - struct dentry *dentry; - - spin_lock(&inode->i_lock); -- hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) { -- spin_lock(&dentry->d_lock); -- if (!dentry->d_lockref.count) -- to_shrink_list(dentry, &dispose); -- spin_unlock(&dentry->d_lock); -- } -+ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) -+ d_dispose_if_unused(dentry, &dispose); - spin_unlock(&inode->i_lock); - shrink_dentry_list(&dispose); - } -@@ -1141,6 +1146,7 @@ void shrink_dentry_list(struct list_head *list) - shrink_kill(dentry); - } - } -+EXPORT_SYMBOL(shrink_dentry_list); - - static enum lru_status dentry_lru_isolate(struct list_head *item, - struct list_lru_one *lru, void *arg) -diff --git a/include/linux/dcache.h b/include/linux/dcache.h -index c83e02b943894..2bc1339bf6d03 100644 ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -268,6 +268,8 @@ extern void d_tmpfile(struct file *, struct inode *); - - extern struct dentry *d_find_alias(struct inode *); - extern void d_prune_aliases(struct inode *); -+extern void d_dispose_if_unused(struct dentry *, struct list_head *); -+extern void shrink_dentry_list(struct list_head *); - - extern struct dentry *d_find_alias_rcu(struct inode *); - --- -2.53.0 - diff --git a/queue-6.18/fuse-fix-premature-writetrhough-request-for-large-fo.patch b/queue-6.18/fuse-fix-premature-writetrhough-request-for-large-fo.patch deleted file mode 100644 index 3c790a45c8..0000000000 --- a/queue-6.18/fuse-fix-premature-writetrhough-request-for-large-fo.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 1c13ac55d34912bf60ed4b2e1e5711c3bd454fda Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 15 Jan 2026 10:36:07 +0800 -Subject: fuse: fix premature writetrhough request for large folio - -From: Jingbo Xu - -[ Upstream commit 5223e0470e7bb7910038fe3d31171490e00fbbb9 ] - -When large folio is enabled and the initial folio offset exceeds -PAGE_SIZE, e.g. the position resides in the second page of a large -folio, after the folio copying the offset (in the page) won't be updated -to 0 even though the expected range is successfully copied until the end -of the folio. In this case fuse_fill_write_pages() exits prematurelly -before the request has reached the max_write/max_pages limit. - -Fix this by eliminating page offset entirely and use folio offset -instead. - -Fixes: d60a6015e1a2 ("fuse: support large folios for writethrough writes") -Reviewed-by: Horst Birthelmer -Reviewed-by: Joanne Koong -Signed-off-by: Jingbo Xu -Signed-off-by: Miklos Szeredi -Signed-off-by: Sasha Levin ---- - fs/fuse/file.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) - -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 6014d588845cd..00ff6374dc76b 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1183,7 +1183,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - { - struct fuse_args_pages *ap = &ia->ap; - struct fuse_conn *fc = get_fuse_conn(mapping->host); -- unsigned offset = pos & (PAGE_SIZE - 1); - size_t count = 0; - unsigned int num; - int err = 0; -@@ -1210,7 +1209,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - if (mapping_writably_mapped(mapping)) - flush_dcache_folio(folio); - -- folio_offset = ((index - folio->index) << PAGE_SHIFT) + offset; -+ folio_offset = offset_in_folio(folio, pos); - bytes = min(folio_size(folio) - folio_offset, num); - - tmp = copy_folio_from_iter_atomic(folio, folio_offset, bytes, ii); -@@ -1240,9 +1239,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - count += tmp; - pos += tmp; - num -= tmp; -- offset += tmp; -- if (offset == folio_size(folio)) -- offset = 0; - - /* If we copied full folio, mark it uptodate */ - if (tmp == folio_size(folio)) -@@ -1254,7 +1250,9 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - ia->write.folio_locked = true; - break; - } -- if (!fc->big_writes || offset != 0) -+ if (!fc->big_writes) -+ break; -+ if (folio_offset + tmp != folio_size(folio)) - break; - } - --- -2.53.0 - diff --git a/queue-6.18/fuse-fix-race-when-disposing-stale-dentries.patch b/queue-6.18/fuse-fix-race-when-disposing-stale-dentries.patch deleted file mode 100644 index 27bf3d3afb..0000000000 --- a/queue-6.18/fuse-fix-race-when-disposing-stale-dentries.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 68854a07f0897fe16e57d0847472cb835719fac8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 14 Jan 2026 15:53:38 +0100 -Subject: fuse: fix race when disposing stale dentries - -From: Miklos Szeredi - -[ Upstream commit cb8d2bdcb8241b66ca4ac4868f20e12cd6881ebc ] - -In fuse_dentry_tree_work() just before d_dispose_if_unused() the dentry -could get evicted, resulting in UAF. - -Move unlocking dentry_hash[i].lock to after the dispose. To do this, -fuse_dentry_tree_del_node() needs to be moved from fuse_dentry_prune() to -fuse_dentry_release() to prevent an ABBA deadlock. - -The lock ordering becomes: - - -> dentry_bucket.lock - -> dentry.d_lock - -Reported-by: Al Viro -Closes: https://lore.kernel.org/all/20251206014242.GO1712166@ZenIV/ -Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries") -Signed-off-by: Miklos Szeredi -Link: https://patch.msgid.link/20260114145344.468856-2-mszeredi@redhat.com -Signed-off-by: Christian Brauner -Stable-dep-of: 1e2c1af1beb3 ("fuse: make sure dentry is evicted if stale") -Signed-off-by: Sasha Levin ---- - fs/fuse/dir.c | 11 ++--------- - 1 file changed, 2 insertions(+), 9 deletions(-) - -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 98b174bd802f0..b7a6a5b6bbc8a 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -172,8 +172,8 @@ static void fuse_dentry_tree_work(struct work_struct *work) - if (time_after64(get_jiffies_64(), fd->time)) { - rb_erase(&fd->node, &dentry_hash[i].tree); - RB_CLEAR_NODE(&fd->node); -- spin_unlock(&dentry_hash[i].lock); - d_dispose_if_unused(fd->dentry, &dispose); -+ spin_unlock(&dentry_hash[i].lock); - cond_resched(); - spin_lock(&dentry_hash[i].lock); - } else -@@ -464,18 +464,12 @@ static int fuse_dentry_init(struct dentry *dentry) - return 0; - } - --static void fuse_dentry_prune(struct dentry *dentry) -+static void fuse_dentry_release(struct dentry *dentry) - { - struct fuse_dentry *fd = dentry->d_fsdata; - - if (!RB_EMPTY_NODE(&fd->node)) - fuse_dentry_tree_del_node(dentry); --} -- --static void fuse_dentry_release(struct dentry *dentry) --{ -- struct fuse_dentry *fd = dentry->d_fsdata; -- - kfree_rcu(fd, rcu); - } - -@@ -512,7 +506,6 @@ const struct dentry_operations fuse_dentry_operations = { - .d_revalidate = fuse_dentry_revalidate, - .d_delete = fuse_dentry_delete, - .d_init = fuse_dentry_init, -- .d_prune = fuse_dentry_prune, - .d_release = fuse_dentry_release, - .d_automount = fuse_dentry_automount, - }; --- -2.53.0 - diff --git a/queue-6.18/fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch b/queue-6.18/fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch deleted file mode 100644 index 5b50dbe9ff..0000000000 --- a/queue-6.18/fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 9d94da18b3c4059def7eeb38cf054cf6ff6fb148 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 16 Feb 2026 14:48:30 +0000 -Subject: fuse: fix uninit-value in fuse_dentry_revalidate() - -From: Luis Henriques - -[ Upstream commit 5a6baf204610589f8a5b5a1cd69d1fe661d9d3cd ] - -fuse_dentry_revalidate() may be called with a dentry that didn't had -->d_time initialised. The issue was found with KMSAN, where lookup_open() -calls __d_alloc(), followed by d_revalidate(), as shown below: - -===================================================== -BUG: KMSAN: uninit-value in fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394 - fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394 - d_revalidate fs/namei.c:1030 [inline] - lookup_open fs/namei.c:4405 [inline] - open_last_lookups fs/namei.c:4583 [inline] - path_openat+0x1614/0x64c0 fs/namei.c:4827 - do_file_open+0x2aa/0x680 fs/namei.c:4859 -[...] - -Uninit was created at: - slab_post_alloc_hook mm/slub.c:4466 [inline] - slab_alloc_node mm/slub.c:4788 [inline] - kmem_cache_alloc_lru_noprof+0x382/0x1280 mm/slub.c:4807 - __d_alloc+0x55/0xa00 fs/dcache.c:1740 - d_alloc_parallel+0x99/0x2740 fs/dcache.c:2604 - lookup_open fs/namei.c:4398 [inline] - open_last_lookups fs/namei.c:4583 [inline] - path_openat+0x135f/0x64c0 fs/namei.c:4827 - do_file_open+0x2aa/0x680 fs/namei.c:4859 -[...] -===================================================== - -Reported-by: syzbot+fdebb2dc960aa56c600a@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/all/69917e0d.050a0220.340abe.02e2.GAE@google.com -Fixes: 2396356a945b ("fuse: add more control over cache invalidation behaviour") -Signed-off-by: Luis Henriques -Signed-off-by: Miklos Szeredi -Signed-off-by: Sasha Levin ---- - fs/fuse/dir.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 77982fdbcf278..98b174bd802f0 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -455,6 +455,11 @@ static int fuse_dentry_init(struct dentry *dentry) - fd->dentry = dentry; - RB_CLEAR_NODE(&fd->node); - dentry->d_fsdata = fd; -+ /* -+ * Initialising d_time (epoch) to '0' ensures the dentry is invalid -+ * if compared to fc->epoch, which is initialized to '1'. -+ */ -+ dentry->d_time = 0; - - return 0; - } --- -2.53.0 - diff --git a/queue-6.18/fuse-make-sure-dentry-is-evicted-if-stale.patch b/queue-6.18/fuse-make-sure-dentry-is-evicted-if-stale.patch deleted file mode 100644 index 9f7757d9fe..0000000000 --- a/queue-6.18/fuse-make-sure-dentry-is-evicted-if-stale.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 40ee0619112f06285afaf85be5ea372030084484 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 14 Jan 2026 15:53:39 +0100 -Subject: fuse: make sure dentry is evicted if stale - -From: Miklos Szeredi - -[ Upstream commit 1e2c1af1beb395841743e240a59ab37edc9a7d33 ] - -d_dispose_if_unused() may find the dentry with a positive refcount, in -which case it won't be put on the dispose list even though it has already -timed out. - -"Reinstall" the d_delete() callback, which was optimized out in -fuse_dentry_settime(). This will result in the dentry being evicted as -soon as the refcount hits zero. - -Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries") -Signed-off-by: Miklos Szeredi -Link: https://patch.msgid.link/20260114145344.468856-3-mszeredi@redhat.com -Signed-off-by: Christian Brauner -Signed-off-by: Sasha Levin ---- - fs/fuse/dir.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index b7a6a5b6bbc8a..ac5d0c305b51f 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -172,6 +172,10 @@ static void fuse_dentry_tree_work(struct work_struct *work) - if (time_after64(get_jiffies_64(), fd->time)) { - rb_erase(&fd->node, &dentry_hash[i].tree); - RB_CLEAR_NODE(&fd->node); -+ spin_lock(&fd->dentry->d_lock); -+ /* If dentry is still referenced, let next dput release it */ -+ fd->dentry->d_flags |= DCACHE_OP_DELETE; -+ spin_unlock(&fd->dentry->d_lock); - d_dispose_if_unused(fd->dentry, &dispose); - spin_unlock(&dentry_hash[i].lock); - cond_resched(); --- -2.53.0 - diff --git a/queue-6.18/fuse-new-work-queue-to-periodically-invalidate-expir.patch b/queue-6.18/fuse-new-work-queue-to-periodically-invalidate-expir.patch deleted file mode 100644 index e75c5f0b21..0000000000 --- a/queue-6.18/fuse-new-work-queue-to-periodically-invalidate-expir.patch +++ /dev/null @@ -1,367 +0,0 @@ -From 7c1baac1eefd9a824efda7b370cdbea5a2960189 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 16 Sep 2025 14:53:08 +0100 -Subject: fuse: new work queue to periodically invalidate expired dentries - -From: Luis Henriques - -[ Upstream commit ab84ad5973869a660ca3ad0c54a2b84d975d47c4 ] - -This patch adds the necessary infrastructure to keep track of all dentries -created for FUSE file systems. A set of rbtrees, protected by hashed -locks, will be used to keep all these dentries sorted by expiry time. - -A new module parameter 'inval_wq' is also added. When set, it will start -a work queue which will periodically invalidate expired dentries. The -value of this new parameter is the period, in seconds, for this work -queue. Once this parameter is set, every new dentry will be added to one -of the rbtrees. - -When the work queue is executed, it will check all the rbtrees and will -invalidate those dentries that have timed-out. - -The work queue period can not be smaller than 5 seconds, but can be -disabled by setting 'inval_wq' to zero (which is the default). - -Signed-off-by: Luis Henriques -Signed-off-by: Miklos Szeredi -Stable-dep-of: 5a6baf204610 ("fuse: fix uninit-value in fuse_dentry_revalidate()") -Signed-off-by: Sasha Levin ---- - fs/fuse/dir.c | 216 ++++++++++++++++++++++++++++++++++++++++++----- - fs/fuse/fuse_i.h | 10 +++ - fs/fuse/inode.c | 3 + - 3 files changed, 208 insertions(+), 21 deletions(-) - -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index ecaec0fea3a13..77982fdbcf278 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -27,6 +27,67 @@ module_param(allow_sys_admin_access, bool, 0644); - MODULE_PARM_DESC(allow_sys_admin_access, - "Allow users with CAP_SYS_ADMIN in initial userns to bypass allow_other access check"); - -+struct dentry_bucket { -+ struct rb_root tree; -+ spinlock_t lock; -+}; -+ -+#define HASH_BITS 5 -+#define HASH_SIZE (1 << HASH_BITS) -+static struct dentry_bucket dentry_hash[HASH_SIZE]; -+struct delayed_work dentry_tree_work; -+ -+/* Minimum invalidation work queue frequency */ -+#define FUSE_DENTRY_INVAL_FREQ_MIN 5 -+ -+unsigned __read_mostly inval_wq; -+static int inval_wq_set(const char *val, const struct kernel_param *kp) -+{ -+ unsigned int num; -+ unsigned int old = inval_wq; -+ int ret; -+ -+ if (!val) -+ return -EINVAL; -+ -+ ret = kstrtouint(val, 0, &num); -+ if (ret) -+ return ret; -+ -+ if ((num < FUSE_DENTRY_INVAL_FREQ_MIN) && (num != 0)) -+ return -EINVAL; -+ -+ /* This should prevent overflow in secs_to_jiffies() */ -+ if (num > USHRT_MAX) -+ return -EINVAL; -+ -+ *((unsigned int *)kp->arg) = num; -+ -+ if (num && !old) -+ schedule_delayed_work(&dentry_tree_work, -+ secs_to_jiffies(num)); -+ else if (!num && old) -+ cancel_delayed_work_sync(&dentry_tree_work); -+ -+ return 0; -+} -+static const struct kernel_param_ops inval_wq_ops = { -+ .set = inval_wq_set, -+ .get = param_get_uint, -+}; -+module_param_cb(inval_wq, &inval_wq_ops, &inval_wq, 0644); -+__MODULE_PARM_TYPE(inval_wq, "uint"); -+MODULE_PARM_DESC(inval_wq, -+ "Dentries invalidation work queue period in secs (>= " -+ __stringify(FUSE_DENTRY_INVAL_FREQ_MIN) ")."); -+ -+static inline struct dentry_bucket *get_dentry_bucket(struct dentry *dentry) -+{ -+ int i = hash_ptr(dentry, HASH_BITS); -+ -+ return &dentry_hash[i]; -+} -+ - static void fuse_advise_use_readdirplus(struct inode *dir) - { - struct fuse_inode *fi = get_fuse_inode(dir); -@@ -34,33 +95,131 @@ static void fuse_advise_use_readdirplus(struct inode *dir) - set_bit(FUSE_I_ADVISE_RDPLUS, &fi->state); - } - --#if BITS_PER_LONG >= 64 --static inline void __fuse_dentry_settime(struct dentry *entry, u64 time) -+struct fuse_dentry { -+ u64 time; -+ union { -+ struct rcu_head rcu; -+ struct rb_node node; -+ }; -+ struct dentry *dentry; -+}; -+ -+static void __fuse_dentry_tree_del_node(struct fuse_dentry *fd, -+ struct dentry_bucket *bucket) - { -- entry->d_fsdata = (void *) time; -+ if (!RB_EMPTY_NODE(&fd->node)) { -+ rb_erase(&fd->node, &bucket->tree); -+ RB_CLEAR_NODE(&fd->node); -+ } - } - --static inline u64 fuse_dentry_time(const struct dentry *entry) -+static void fuse_dentry_tree_del_node(struct dentry *dentry) - { -- return (u64)entry->d_fsdata; -+ struct fuse_dentry *fd = dentry->d_fsdata; -+ struct dentry_bucket *bucket = get_dentry_bucket(dentry); -+ -+ spin_lock(&bucket->lock); -+ __fuse_dentry_tree_del_node(fd, bucket); -+ spin_unlock(&bucket->lock); - } - --#else --union fuse_dentry { -- u64 time; -- struct rcu_head rcu; --}; -+static void fuse_dentry_tree_add_node(struct dentry *dentry) -+{ -+ struct fuse_dentry *fd = dentry->d_fsdata; -+ struct dentry_bucket *bucket; -+ struct fuse_dentry *cur; -+ struct rb_node **p, *parent = NULL; -+ -+ if (!inval_wq) -+ return; -+ -+ bucket = get_dentry_bucket(dentry); -+ -+ spin_lock(&bucket->lock); -+ -+ __fuse_dentry_tree_del_node(fd, bucket); -+ -+ p = &bucket->tree.rb_node; -+ while (*p) { -+ parent = *p; -+ cur = rb_entry(*p, struct fuse_dentry, node); -+ if (fd->time < cur->time) -+ p = &(*p)->rb_left; -+ else -+ p = &(*p)->rb_right; -+ } -+ rb_link_node(&fd->node, parent, p); -+ rb_insert_color(&fd->node, &bucket->tree); -+ spin_unlock(&bucket->lock); -+} -+ -+/* -+ * work queue which, when enabled, will periodically check for expired dentries -+ * in the dentries tree. -+ */ -+static void fuse_dentry_tree_work(struct work_struct *work) -+{ -+ LIST_HEAD(dispose); -+ struct fuse_dentry *fd; -+ struct rb_node *node; -+ int i; -+ -+ for (i = 0; i < HASH_SIZE; i++) { -+ spin_lock(&dentry_hash[i].lock); -+ node = rb_first(&dentry_hash[i].tree); -+ while (node) { -+ fd = rb_entry(node, struct fuse_dentry, node); -+ if (time_after64(get_jiffies_64(), fd->time)) { -+ rb_erase(&fd->node, &dentry_hash[i].tree); -+ RB_CLEAR_NODE(&fd->node); -+ spin_unlock(&dentry_hash[i].lock); -+ d_dispose_if_unused(fd->dentry, &dispose); -+ cond_resched(); -+ spin_lock(&dentry_hash[i].lock); -+ } else -+ break; -+ node = rb_first(&dentry_hash[i].tree); -+ } -+ spin_unlock(&dentry_hash[i].lock); -+ shrink_dentry_list(&dispose); -+ } -+ -+ if (inval_wq) -+ schedule_delayed_work(&dentry_tree_work, -+ secs_to_jiffies(inval_wq)); -+} -+ -+void fuse_dentry_tree_init(void) -+{ -+ int i; -+ -+ for (i = 0; i < HASH_SIZE; i++) { -+ spin_lock_init(&dentry_hash[i].lock); -+ dentry_hash[i].tree = RB_ROOT; -+ } -+ INIT_DELAYED_WORK(&dentry_tree_work, fuse_dentry_tree_work); -+} -+ -+void fuse_dentry_tree_cleanup(void) -+{ -+ int i; -+ -+ inval_wq = 0; -+ cancel_delayed_work_sync(&dentry_tree_work); -+ -+ for (i = 0; i < HASH_SIZE; i++) -+ WARN_ON_ONCE(!RB_EMPTY_ROOT(&dentry_hash[i].tree)); -+} - - static inline void __fuse_dentry_settime(struct dentry *dentry, u64 time) - { -- ((union fuse_dentry *) dentry->d_fsdata)->time = time; -+ ((struct fuse_dentry *) dentry->d_fsdata)->time = time; - } - - static inline u64 fuse_dentry_time(const struct dentry *entry) - { -- return ((union fuse_dentry *) entry->d_fsdata)->time; -+ return ((struct fuse_dentry *) entry->d_fsdata)->time; - } --#endif - - static void fuse_dentry_settime(struct dentry *dentry, u64 time) - { -@@ -81,6 +240,7 @@ static void fuse_dentry_settime(struct dentry *dentry, u64 time) - } - - __fuse_dentry_settime(dentry, time); -+ fuse_dentry_tree_add_node(dentry); - } - - /* -@@ -283,21 +443,36 @@ static int fuse_dentry_revalidate(struct inode *dir, const struct qstr *name, - goto out; - } - --#if BITS_PER_LONG < 64 - static int fuse_dentry_init(struct dentry *dentry) - { -- dentry->d_fsdata = kzalloc(sizeof(union fuse_dentry), -- GFP_KERNEL_ACCOUNT | __GFP_RECLAIMABLE); -+ struct fuse_dentry *fd; - -- return dentry->d_fsdata ? 0 : -ENOMEM; -+ fd = kzalloc(sizeof(struct fuse_dentry), -+ GFP_KERNEL_ACCOUNT | __GFP_RECLAIMABLE); -+ if (!fd) -+ return -ENOMEM; -+ -+ fd->dentry = dentry; -+ RB_CLEAR_NODE(&fd->node); -+ dentry->d_fsdata = fd; -+ -+ return 0; -+} -+ -+static void fuse_dentry_prune(struct dentry *dentry) -+{ -+ struct fuse_dentry *fd = dentry->d_fsdata; -+ -+ if (!RB_EMPTY_NODE(&fd->node)) -+ fuse_dentry_tree_del_node(dentry); - } -+ - static void fuse_dentry_release(struct dentry *dentry) - { -- union fuse_dentry *fd = dentry->d_fsdata; -+ struct fuse_dentry *fd = dentry->d_fsdata; - - kfree_rcu(fd, rcu); - } --#endif - - static int fuse_dentry_delete(const struct dentry *dentry) - { -@@ -331,10 +506,9 @@ static struct vfsmount *fuse_dentry_automount(struct path *path) - const struct dentry_operations fuse_dentry_operations = { - .d_revalidate = fuse_dentry_revalidate, - .d_delete = fuse_dentry_delete, --#if BITS_PER_LONG < 64 - .d_init = fuse_dentry_init, -+ .d_prune = fuse_dentry_prune, - .d_release = fuse_dentry_release, --#endif - .d_automount = fuse_dentry_automount, - }; - -diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h -index c288f28f6c6ea..276dfddce5b53 100644 ---- a/fs/fuse/fuse_i.h -+++ b/fs/fuse/fuse_i.h -@@ -54,6 +54,13 @@ - /** Frequency (in jiffies) of request timeout checks, if opted into */ - extern const unsigned long fuse_timeout_timer_freq; - -+/* -+ * Dentries invalidation workqueue period, in seconds. The value of this -+ * parameter shall be >= FUSE_DENTRY_INVAL_FREQ_MIN seconds, or 0 (zero), in -+ * which case no workqueue will be created. -+ */ -+extern unsigned inval_wq __read_mostly; -+ - /** Maximum of max_pages received in init_out */ - extern unsigned int fuse_max_pages_limit; - /* -@@ -1278,6 +1285,9 @@ void fuse_wait_aborted(struct fuse_conn *fc); - /* Check if any requests timed out */ - void fuse_check_timeout(struct work_struct *work); - -+void fuse_dentry_tree_init(void); -+void fuse_dentry_tree_cleanup(void); -+ - /** - * Invalidate inode attributes - */ -diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c -index e9ed693fc7b37..a090c91abb89d 100644 ---- a/fs/fuse/inode.c -+++ b/fs/fuse/inode.c -@@ -2296,6 +2296,8 @@ static int __init fuse_init(void) - if (res) - goto err_sysfs_cleanup; - -+ fuse_dentry_tree_init(); -+ - sanitize_global_limit(&max_user_bgreq); - sanitize_global_limit(&max_user_congthresh); - -@@ -2315,6 +2317,7 @@ static void __exit fuse_exit(void) - { - pr_debug("exit\n"); - -+ fuse_dentry_tree_cleanup(); - fuse_ctl_cleanup(); - fuse_sysfs_cleanup(); - fuse_fs_cleanup(); --- -2.53.0 - diff --git a/queue-6.18/i3c-master-fix-error-codes-at-send_ccc_cmd.patch b/queue-6.18/i3c-master-fix-error-codes-at-send_ccc_cmd.patch deleted file mode 100644 index d901577ad0..0000000000 --- a/queue-6.18/i3c-master-fix-error-codes-at-send_ccc_cmd.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 39647fb4e58b4bfc240ea22d9ee7ae1bbeb147d7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Mar 2026 17:11:32 +0100 -Subject: i3c: master: Fix error codes at send_ccc_cmd - -From: Jorge Marques - -[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ] - -i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, -Mx codes) to the ret variable, cascading down multiple methods until -reaching methods that explicitly stated they would return 0 on success -or negative error code. For example, the call chain: - - i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- - master->ops.enable_ibi <- i3c_master_enec_locked <- - i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked - -Fix this by returning the ret value, callers can still read the cmd->err -value if ret is negative. - -All corner cases where the Mx codes do need to be handled individually, -are resolved in previous commits. Those corner cases are all scenarios -when I3C_ERROR_M2 is expected and acceptable. -The prerequisite patches for the fix are: - - i3c: master: Move rstdaa error suppression - i3c: master: Move entdaa error suppression - i3c: master: Move bus_init error suppression - -Reported-by: Dan Carpenter -Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ -Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") -Reviewed-by: Adrian Hunter -Signed-off-by: Jorge Marques -Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com -Signed-off-by: Alexandre Belloni -Signed-off-by: Sasha Levin ---- - drivers/i3c/master.c | 32 +++++++++++++------------------- - 1 file changed, 13 insertions(+), 19 deletions(-) - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index 425e36b36009b..4ecbabcec48b4 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -826,11 +826,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, - cmd->err = I3C_ERROR_UNKNOWN; - } - -+/** -+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) -+ * @master: master used to send frames on the bus -+ * @cmd: command to send -+ * -+ * Return: 0 in case of success, or a negative error code otherwise. -+ * I3C Mx error codes are stored in cmd->err. -+ */ - static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - struct i3c_ccc_cmd *cmd) - { -- int ret; -- - if (!cmd || !master) - return -EINVAL; - -@@ -848,15 +854,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - !master->ops->supports_ccc_cmd(master, cmd)) - return -EOPNOTSUPP; - -- ret = master->ops->send_ccc_cmd(master, cmd); -- if (ret) { -- if (cmd->err != I3C_ERROR_UNKNOWN) -- return cmd->err; -- -- return ret; -- } -- -- return 0; -+ return master->ops->send_ccc_cmd(master, cmd); - } - - static struct i2c_dev_desc * -@@ -960,8 +958,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_entdaa_locked(struct i3c_master_controller *master) - { -@@ -1013,8 +1010,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1034,8 +1030,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1060,8 +1055,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_defslvs_locked(struct i3c_master_controller *master) - { --- -2.53.0 - diff --git a/queue-6.18/series b/queue-6.18/series index 31abc73626..dc8f59126d 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -339,10 +339,6 @@ alsa-hda-realtek-fixed-speaker-no-sound-update.patch gfs2-call-unlock_new_inode-before-d_instantiate.patch fanotify-avoid-silence-premature-lsm-capability-chec.patch fanotify-call-fanotify_events_supported-before-path_.patch -fuse-fix-premature-writetrhough-request-for-large-fo.patch -dcache-export-shrink_dentry_list-and-add-new-helper-.patch -fuse-new-work-queue-to-periodically-invalidate-expir.patch -fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch ktest-avoid-undef-warning-when-warnings_file-is-unse.patch ktest-honor-empty-per-test-option-overrides.patch ktest-run-post_ktest-hooks-on-failure-and-cancellati.patch @@ -521,7 +517,6 @@ perf-util-kill-die-prototype-dead-for-a-long-time.patch i3c-master-dw-i3c-fix-missing-reset-assertion-in-rem.patch i3c-master-renesas-fix-memory-leak-in-renesas_i3c_i3.patch i3c-dw-fix-memory-leak-in-dw_i3c_master_i3c_xfers.patch -i3c-master-fix-error-codes-at-send_ccc_cmd.patch i3c-master-adi-fix-error-propagation-for-cccs.patch i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch backlight-sky81452-backlight-check-return-value-of-d.patch @@ -860,8 +855,6 @@ revert-papr-hvpipe-convert-papr_hvpipe_dev_create_ha.patch pci-initialize-temporary-device-in-new_id_store.patch bpf-fix-sync_linked_regs-regarding-bpf_add_const32-z.patch net-airoha-fix-a-copy-and-paste-bug-in-probe.patch -fuse-fix-race-when-disposing-stale-dentries.patch -fuse-make-sure-dentry-is-evicted-if-stale.patch rtla-fix-parse_cpu_set-bug-introduced-by-strtoi.patch net-airoha-move-entries-to-queue-head-in-case-of-dma.patch net-airoha-move-ndesc-initialization-at-end-of-airoh.patch-22905 diff --git a/queue-6.6/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch b/queue-6.6/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch deleted file mode 100644 index 8a9606603c..0000000000 --- a/queue-6.6/bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch +++ /dev/null @@ -1,82 +0,0 @@ -From ddafa9c6f5ea9f016f183d830c0ebc4d990d8a54 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 13 Apr 2026 12:11:09 -0700 -Subject: bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator - finalize - -From: Puranjay Mohan - -[ Upstream commit 46ee1342b887c9387a933397d846ff6c9584322c ] - -bpf_flush_icache() calls flush_icache_range() to clean the data cache -and invalidate the instruction cache for the JITed code region. However, -since commit 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the -BPF JIT"), this flush is redundant. - -bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX -region via bpf_arch_text_copy() -> patch_text_nosync(), and -patch_text_nosync() already calls flush_icache_range() on the written -range. The subsequent bpf_flush_icache() repeats the same cache -maintenance on an overlapping range. - -Remove the redundant bpf_flush_icache() call and its now-unused -definition. - -Fixes: 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT") -Acked-by: Song Liu -Signed-off-by: Puranjay Mohan -Reviewed-by: Pu Lehui -Tested-by: Paul Chaignon -Link: https://lore.kernel.org/r/20260413191111.3426023-3-puranjay@kernel.org -Signed-off-by: Alexei Starovoitov -Signed-off-by: Sasha Levin ---- - arch/riscv/net/bpf_jit.h | 6 ------ - arch/riscv/net/bpf_jit_core.c | 7 ------- - 2 files changed, 13 deletions(-) - -diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h -index a5ce1ab76ecee..c444c79596703 100644 ---- a/arch/riscv/net/bpf_jit.h -+++ b/arch/riscv/net/bpf_jit.h -@@ -11,7 +11,6 @@ - - #include - #include --#include - - static inline bool rvc_enabled(void) - { -@@ -97,11 +96,6 @@ static inline void bpf_fill_ill_insns(void *area, unsigned int size) - memset(area, 0, size); - } - --static inline void bpf_flush_icache(void *start, void *end) --{ -- flush_icache_range((unsigned long)start, (unsigned long)end); --} -- - /* Emit a 4-byte riscv instruction. */ - static inline void emit(const u32 insn, struct rv_jit_context *ctx) - { -diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c -index 7b70ccb7fec34..f57b95e830ac0 100644 ---- a/arch/riscv/net/bpf_jit_core.c -+++ b/arch/riscv/net/bpf_jit_core.c -@@ -182,13 +182,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) - prog = orig_prog; - goto out_offset; - } -- /* -- * The instructions have now been copied to the ROX region from -- * where they will execute. -- * Write any modified data cache blocks out to memory and -- * invalidate the corresponding blocks in the instruction cache. -- */ -- bpf_flush_icache(jit_data->ro_header, ctx->ro_insns + ctx->ninsns); - for (i = 0; i < prog->len; i++) - ctx->offset[i] = ninsns_rvoff(ctx->offset[i]); - bpf_prog_fill_jited_linfo(prog, ctx->offset); --- -2.53.0 - diff --git a/queue-6.6/i3c-master-fix-error-codes-at-send_ccc_cmd.patch b/queue-6.6/i3c-master-fix-error-codes-at-send_ccc_cmd.patch deleted file mode 100644 index 9aea7a5e33..0000000000 --- a/queue-6.6/i3c-master-fix-error-codes-at-send_ccc_cmd.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 9fd2905ed85547b975137ca97c29ef14b272bf37 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Mar 2026 17:11:32 +0100 -Subject: i3c: master: Fix error codes at send_ccc_cmd - -From: Jorge Marques - -[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ] - -i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, -Mx codes) to the ret variable, cascading down multiple methods until -reaching methods that explicitly stated they would return 0 on success -or negative error code. For example, the call chain: - - i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- - master->ops.enable_ibi <- i3c_master_enec_locked <- - i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked - -Fix this by returning the ret value, callers can still read the cmd->err -value if ret is negative. - -All corner cases where the Mx codes do need to be handled individually, -are resolved in previous commits. Those corner cases are all scenarios -when I3C_ERROR_M2 is expected and acceptable. -The prerequisite patches for the fix are: - - i3c: master: Move rstdaa error suppression - i3c: master: Move entdaa error suppression - i3c: master: Move bus_init error suppression - -Reported-by: Dan Carpenter -Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ -Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") -Reviewed-by: Adrian Hunter -Signed-off-by: Jorge Marques -Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com -Signed-off-by: Alexandre Belloni -Signed-off-by: Sasha Levin ---- - drivers/i3c/master.c | 32 +++++++++++++------------------- - 1 file changed, 13 insertions(+), 19 deletions(-) - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index f74ef65d257d7..84fe0de5a9bc7 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -792,11 +792,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, - cmd->err = I3C_ERROR_UNKNOWN; - } - -+/** -+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) -+ * @master: master used to send frames on the bus -+ * @cmd: command to send -+ * -+ * Return: 0 in case of success, or a negative error code otherwise. -+ * I3C Mx error codes are stored in cmd->err. -+ */ - static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - struct i3c_ccc_cmd *cmd) - { -- int ret; -- - if (!cmd || !master) - return -EINVAL; - -@@ -814,15 +820,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - !master->ops->supports_ccc_cmd(master, cmd)) - return -ENOTSUPP; - -- ret = master->ops->send_ccc_cmd(master, cmd); -- if (ret) { -- if (cmd->err != I3C_ERROR_UNKNOWN) -- return cmd->err; -- -- return ret; -- } -- -- return 0; -+ return master->ops->send_ccc_cmd(master, cmd); - } - - static struct i2c_dev_desc * -@@ -926,8 +924,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_entdaa_locked(struct i3c_master_controller *master) - { -@@ -979,8 +976,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1000,8 +996,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1026,8 +1021,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_defslvs_locked(struct i3c_master_controller *master) - { --- -2.53.0 - diff --git a/queue-6.6/series b/queue-6.6/series index 78684211e1..6bd51a1cc0 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -233,7 +233,6 @@ mtd-parsers-ofpart-call-of_node_get-for-dedicated-su.patch mtd-rawnand-sunxi-fix-sunxi_nfc_hw_ecc_read_extra_oo.patch hid-usbhid-fix-deadlock-in-hid_post_reset.patch bpf-arm64-fix-off-by-one-in-check_imm-signed-range-c.patch -bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch bpf-sockmap-fix-af_unix-iter-deadlock.patch bpf-sockmap-fix-af_unix-null-ptr-deref-in-proto-upda.patch bpf-sockmap-take-state-lock-for-af_unix-iter.patch @@ -254,7 +253,6 @@ ipmi-ssif_bmc-fix-missing-check-for-copy_to_user-par.patch ipmi-ssif_bmc-fix-message-desynchronization-after-tr.patch ipmi-ssif_bmc-change-log-level-to-dbg-in-irq-callbac.patch perf-util-kill-die-prototype-dead-for-a-long-time.patch -i3c-master-fix-error-codes-at-send_ccc_cmd.patch i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch dev_printk-add-new-dev_err_probe-helpers.patch backlight-sky81452-backlight-check-return-value-of-d.patch diff --git a/queue-7.0/fuse-fix-premature-writetrhough-request-for-large-fo.patch b/queue-7.0/fuse-fix-premature-writetrhough-request-for-large-fo.patch deleted file mode 100644 index 7c9884ebec..0000000000 --- a/queue-7.0/fuse-fix-premature-writetrhough-request-for-large-fo.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 0b66c8bb08a71cff5ba359be7ead3c7108a04a7d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 15 Jan 2026 10:36:07 +0800 -Subject: fuse: fix premature writetrhough request for large folio - -From: Jingbo Xu - -[ Upstream commit 5223e0470e7bb7910038fe3d31171490e00fbbb9 ] - -When large folio is enabled and the initial folio offset exceeds -PAGE_SIZE, e.g. the position resides in the second page of a large -folio, after the folio copying the offset (in the page) won't be updated -to 0 even though the expected range is successfully copied until the end -of the folio. In this case fuse_fill_write_pages() exits prematurelly -before the request has reached the max_write/max_pages limit. - -Fix this by eliminating page offset entirely and use folio offset -instead. - -Fixes: d60a6015e1a2 ("fuse: support large folios for writethrough writes") -Reviewed-by: Horst Birthelmer -Reviewed-by: Joanne Koong -Signed-off-by: Jingbo Xu -Signed-off-by: Miklos Szeredi -Signed-off-by: Sasha Levin ---- - fs/fuse/file.c | 10 ++++------ - 1 file changed, 4 insertions(+), 6 deletions(-) - -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 676fd9856bfbf..3939f90d1b4d2 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -1242,7 +1242,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - { - struct fuse_args_pages *ap = &ia->ap; - struct fuse_conn *fc = get_fuse_conn(mapping->host); -- unsigned offset = pos & (PAGE_SIZE - 1); - size_t count = 0; - unsigned int num; - int err = 0; -@@ -1269,7 +1268,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - if (mapping_writably_mapped(mapping)) - flush_dcache_folio(folio); - -- folio_offset = ((index - folio->index) << PAGE_SHIFT) + offset; -+ folio_offset = offset_in_folio(folio, pos); - bytes = min(folio_size(folio) - folio_offset, num); - - tmp = copy_folio_from_iter_atomic(folio, folio_offset, bytes, ii); -@@ -1299,9 +1298,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - count += tmp; - pos += tmp; - num -= tmp; -- offset += tmp; -- if (offset == folio_size(folio)) -- offset = 0; - - /* If we copied full folio, mark it uptodate */ - if (tmp == folio_size(folio)) -@@ -1313,7 +1309,9 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia, - ia->write.folio_locked = true; - break; - } -- if (!fc->big_writes || offset != 0) -+ if (!fc->big_writes) -+ break; -+ if (folio_offset + tmp != folio_size(folio)) - break; - } - --- -2.53.0 - diff --git a/queue-7.0/i3c-master-fix-error-codes-at-send_ccc_cmd.patch b/queue-7.0/i3c-master-fix-error-codes-at-send_ccc_cmd.patch deleted file mode 100644 index bdeed62c59..0000000000 --- a/queue-7.0/i3c-master-fix-error-codes-at-send_ccc_cmd.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 38fb9b7df6c8a2fa7a3f55be62bfa08c6a0a08d4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 23 Mar 2026 17:11:32 +0100 -Subject: i3c: master: Fix error codes at send_ccc_cmd - -From: Jorge Marques - -[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ] - -i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive, -Mx codes) to the ret variable, cascading down multiple methods until -reaching methods that explicitly stated they would return 0 on success -or negative error code. For example, the call chain: - - i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <- - master->ops.enable_ibi <- i3c_master_enec_locked <- - i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked - -Fix this by returning the ret value, callers can still read the cmd->err -value if ret is negative. - -All corner cases where the Mx codes do need to be handled individually, -are resolved in previous commits. Those corner cases are all scenarios -when I3C_ERROR_M2 is expected and acceptable. -The prerequisite patches for the fix are: - - i3c: master: Move rstdaa error suppression - i3c: master: Move entdaa error suppression - i3c: master: Move bus_init error suppression - -Reported-by: Dan Carpenter -Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/ -Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") -Reviewed-by: Adrian Hunter -Signed-off-by: Jorge Marques -Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com -Signed-off-by: Alexandre Belloni -Signed-off-by: Sasha Levin ---- - drivers/i3c/master.c | 32 +++++++++++++------------------- - 1 file changed, 13 insertions(+), 19 deletions(-) - -diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c -index 9e6be49bebb2c..930c4dad632fc 100644 ---- a/drivers/i3c/master.c -+++ b/drivers/i3c/master.c -@@ -898,11 +898,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id, - cmd->err = I3C_ERROR_UNKNOWN; - } - -+/** -+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes) -+ * @master: master used to send frames on the bus -+ * @cmd: command to send -+ * -+ * Return: 0 in case of success, or a negative error code otherwise. -+ * I3C Mx error codes are stored in cmd->err. -+ */ - static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - struct i3c_ccc_cmd *cmd) - { -- int ret; -- - if (!cmd || !master) - return -EINVAL; - -@@ -920,15 +926,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master, - !master->ops->supports_ccc_cmd(master, cmd)) - return -EOPNOTSUPP; - -- ret = master->ops->send_ccc_cmd(master, cmd); -- if (ret) { -- if (cmd->err != I3C_ERROR_UNKNOWN) -- return cmd->err; -- -- return ret; -- } -- -- return 0; -+ return master->ops->send_ccc_cmd(master, cmd); - } - - static struct i2c_dev_desc * -@@ -1032,8 +1030,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_entdaa_locked(struct i3c_master_controller *master) - { -@@ -1085,8 +1082,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master, - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1106,8 +1102,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr, - u8 evts) -@@ -1132,8 +1127,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked); - * - * This function must be called with the bus lock held in write mode. - * -- * Return: 0 in case of success, a positive I3C error code if the error is -- * one of the official Mx error codes, and a negative error code otherwise. -+ * Return: 0 in case of success, or a negative error code otherwise. - */ - int i3c_master_defslvs_locked(struct i3c_master_controller *master) - { --- -2.53.0 - diff --git a/queue-7.0/series b/queue-7.0/series index fc21a347b1..ae18c89a48 100644 --- a/queue-7.0/series +++ b/queue-7.0/series @@ -442,7 +442,6 @@ alsa-hda-realtek-fixed-speaker-no-sound-update.patch gfs2-call-unlock_new_inode-before-d_instantiate.patch fanotify-avoid-silence-premature-lsm-capability-chec.patch fanotify-call-fanotify_events_supported-before-path_.patch -fuse-fix-premature-writetrhough-request-for-large-fo.patch fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch ktest-avoid-undef-warning-when-warnings_file-is-unse.patch ktest-honor-empty-per-test-option-overrides.patch @@ -653,7 +652,6 @@ i3c-master-dw-i3c-fix-missing-reset-assertion-in-rem.patch i3c-master-dw-i3c-balance-pm-runtime-usage-count-on-.patch i3c-master-renesas-fix-memory-leak-in-renesas_i3c_i3.patch i3c-dw-fix-memory-leak-in-dw_i3c_master_i3c_xfers.patch -i3c-master-fix-error-codes-at-send_ccc_cmd.patch i3c-master-adi-fix-error-propagation-for-cccs.patch i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch fs-ntfs3-prevent-uninitialized-lcn-caused-by-zero-le.patch -- 2.47.3