From 9419c1bb3e4d26e41210e7059b71c8a1a61a3b6f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 3 Feb 2026 13:51:40 +0100 Subject: [PATCH] 5.15-stable patches added patches: asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch mptcp-only-reset-subflow-errors-when-propagated.patch pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch --- ...not-force-slot-width-to-sample-width.patch | 47 +++++++++++++++ ...reset-subflow-errors-when-propagated.patch | 57 ++++++++++++++++++ ...t-.get_direction-for-the-gpio-driver.patch | 59 +++++++++++++++++++ ...emory-leak-in-beiscsi_boot_get_sinfo.patch | 32 ++++++++++ ...2xxx-edif-fix-dma_free_coherent-size.patch | 34 +++++++++++ queue-5.15/series | 5 ++ 6 files changed, 234 insertions(+) create mode 100644 queue-5.15/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch create mode 100644 queue-5.15/mptcp-only-reset-subflow-errors-when-propagated.patch create mode 100644 queue-5.15/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch create mode 100644 queue-5.15/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch create mode 100644 queue-5.15/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch diff --git a/queue-5.15/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch b/queue-5.15/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch new file mode 100644 index 0000000000..e153889fdf --- /dev/null +++ b/queue-5.15/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch @@ -0,0 +1,47 @@ +From 9210f5ff6318163835d9e42ee68006be4da0f531 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sun, 18 Jan 2026 17:50:30 -0300 +Subject: ASoC: fsl: imx-card: Do not force slot width to sample width + +From: Fabio Estevam + +commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream. + +imx-card currently sets the slot width to the physical sample width +for I2S links. This breaks controllers that use fixed-width slots +(e.g. 32-bit FIFO words), causing the unused bits in the slot to +contain undefined data when playing 16-bit streams. + +Do not override the slot width in the machine driver and let the CPU +DAI select an appropriate default instead. This matches the behavior +of simple-audio-card and avoids embedding controller-specific policy +in the machine driver. + +On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots, +playing 16-bit audio resulted in spurious frequencies and an incorrect +SAI data waveform, as the slot width was forced to 16 bits. After this +change, audio artifacts are eliminated and the 16-bit samples correctly +occupy the first half of the 32-bit slot, with the remaining bits padded +with zeroes. + +Cc: stable@vger.kernel.org +Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver") +Signed-off-by: Fabio Estevam +Acked-by: Shengjiu Wang +Link: https://patch.msgid.link/20260118205030.1532696-1-festevam@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/imx-card.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/fsl/imx-card.c ++++ b/sound/soc/fsl/imx-card.c +@@ -314,7 +314,6 @@ static int imx_aif_hw_params(struct snd_ + SND_SOC_DAIFMT_PDM; + } else { + slots = 2; +- slot_width = params_physical_width(params); + fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK) | + SND_SOC_DAIFMT_I2S; + } diff --git a/queue-5.15/mptcp-only-reset-subflow-errors-when-propagated.patch b/queue-5.15/mptcp-only-reset-subflow-errors-when-propagated.patch new file mode 100644 index 0000000000..f09848f67a --- /dev/null +++ b/queue-5.15/mptcp-only-reset-subflow-errors-when-propagated.patch @@ -0,0 +1,57 @@ +From dccf46179ddd6c04c14be8ed584dc54665f53f0e Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Tue, 27 Jan 2026 20:27:25 +0100 +Subject: mptcp: only reset subflow errors when propagated + +From: Matthieu Baerts (NGI0) + +commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream. + +Some subflow socket errors need to be reported to the MPTCP socket: the +initial subflow connect (MP_CAPABLE), and the ones from the fallback +sockets. The others are not propagated. + +The issue is that sock_error() was used to retrieve the error, which was +also resetting the sk_err field. Because of that, when notifying the +userspace about subflow close events later on from the MPTCP worker, the +ssk->sk_err field was always 0. + +Now, the error (sk_err) is only reset when propagating it to the msk. + +Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-3-7f71e1bc4feb@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -736,11 +736,8 @@ static bool __mptcp_ofo_queue(struct mpt + + static bool __mptcp_subflow_error_report(struct sock *sk, struct sock *ssk) + { +- int err = sock_error(ssk); + int ssk_state; +- +- if (!err) +- return false; ++ int err; + + /* only propagate errors on fallen-back sockets or + * on MPC connect +@@ -748,6 +745,10 @@ static bool __mptcp_subflow_error_report + if (sk->sk_state != TCP_SYN_SENT && !__mptcp_check_fallback(mptcp_sk(sk))) + return false; + ++ err = sock_error(ssk); ++ if (!err) ++ return false; ++ + /* We need to propagate only transition to CLOSE state. + * Orphaned socket will see such state change via + * subflow_sched_work_if_closed() and that path will properly diff --git a/queue-5.15/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch b/queue-5.15/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch new file mode 100644 index 0000000000..3523b0d99b --- /dev/null +++ b/queue-5.15/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch @@ -0,0 +1,59 @@ +From 4f0d22ec60cee420125f4055af76caa0f373a3fe Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Mon, 26 Jan 2026 14:56:27 +0100 +Subject: pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver + +From: Bartosz Golaszewski + +commit 4f0d22ec60cee420125f4055af76caa0f373a3fe upstream. + +GPIO controller driver should typically implement the .get_direction() +callback as GPIOLIB internals may try to use it to determine the state +of a pin. Add it for the LPASS LPI driver. + +Reported-by: Abel Vesa +Cc: stable@vger.kernel.org +Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Konrad Dybcio +Tested-by: Konrad Dybcio # X1E CRD +Tested-by: Abel Vesa +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c ++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +@@ -484,6 +484,22 @@ static const struct pinconf_ops lpi_gpio + .pin_config_group_set = lpi_config_set, + }; + ++static int lpi_gpio_get_direction(struct gpio_chip *chip, unsigned int pin) ++{ ++ unsigned long config = pinconf_to_config_packed(PIN_CONFIG_LEVEL, 0); ++ struct lpi_pinctrl *state = gpiochip_get_data(chip); ++ unsigned long arg; ++ int ret; ++ ++ ret = lpi_config_get(state->ctrl, pin, &config); ++ if (ret) ++ return ret; ++ ++ arg = pinconf_to_config_argument(config); ++ ++ return arg ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN; ++} ++ + static int lpi_gpio_direction_input(struct gpio_chip *chip, unsigned int pin) + { + struct lpi_pinctrl *state = gpiochip_get_data(chip); +@@ -582,6 +598,7 @@ static void lpi_gpio_dbg_show(struct seq + #endif + + static const struct gpio_chip lpi_gpio_template = { ++ .get_direction = lpi_gpio_get_direction, + .direction_input = lpi_gpio_direction_input, + .direction_output = lpi_gpio_direction_output, + .get = lpi_gpio_get, diff --git a/queue-5.15/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch b/queue-5.15/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch new file mode 100644 index 0000000000..fdc257fdf5 --- /dev/null +++ b/queue-5.15/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch @@ -0,0 +1,32 @@ +From 4747bafaa50115d9667ece446b1d2d4aba83dc7f Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Sat, 13 Dec 2025 16:36:43 +0800 +Subject: scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() + +From: Haoxiang Li + +commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream. + +If nonemb_cmd->va fails to be allocated, free the allocation previously +made by alloc_mcc_wrb(). + +Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/be2iscsi/be_mgmt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/be2iscsi/be_mgmt.c ++++ b/drivers/scsi/be2iscsi/be_mgmt.c +@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru + &nonemb_cmd->dma, + GFP_KERNEL); + if (!nonemb_cmd->va) { ++ free_mcc_wrb(ctrl, tag); + mutex_unlock(&ctrl->mbox_lock); + return 0; + } diff --git a/queue-5.15/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch b/queue-5.15/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch new file mode 100644 index 0000000000..9d6ffbcff4 --- /dev/null +++ b/queue-5.15/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch @@ -0,0 +1,34 @@ +From 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Mon, 12 Jan 2026 14:43:24 +0100 +Subject: scsi: qla2xxx: edif: Fix dma_free_coherent() size + +From: Thomas Fourier + +commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream. + +Earlier in the function, the ha->flt buffer is allocated with size +sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error +path with size SFP_DEV_SIZE. + +Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Fourier +Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -4431,7 +4431,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha + fail_elsrej: + dma_pool_destroy(ha->purex_dma_pool); + fail_flt: +- dma_free_coherent(&ha->pdev->dev, SFP_DEV_SIZE, ++ dma_free_coherent(&ha->pdev->dev, sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE, + ha->flt, ha->flt_dma); + + fail_flt_buffer: diff --git a/queue-5.15/series b/queue-5.15/series index 638567924a..96d25165a0 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -148,3 +148,8 @@ net-bridge-fix-static-key-check.patch scsi-firewire-sbp-target-fix-overflow-in-sbp_make_tp.patch gpiolib-acpi-use-bit_ull-for-u64-mask-in-address-spa.patch dma-pool-distinguish-between-missing-and-exhausted-a.patch +pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch +asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch +scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch +scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch +mptcp-only-reset-subflow-errors-when-propagated.patch -- 2.47.3