From be07055c2afdb3e9b8ace2907ffa649fc3c9570e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 3 Feb 2026 13:51:51 +0100 Subject: [PATCH] 6.1-stable patches added patches: asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch efivarfs-fix-error-propagation-in-efivar_entry_get.patch flex_proportions-make-fprop_new_period-hardirq-safe.patch mptcp-only-reset-subflow-errors-when-propagated.patch pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch riscv-compat-fix-compat_uts_machine-definition.patch scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch --- ...uirk-for-acer-travelmate-p216-41-tco.patch | 39 ++++++++ ...not-force-slot-width-to-sample-width.patch | 47 ++++++++++ ...rror-propagation-in-efivar_entry_get.patch | 37 ++++++++ ...s-make-fprop_new_period-hardirq-safe.patch | 84 +++++++++++++++++ ...reset-subflow-errors-when-propagated.patch | 57 ++++++++++++ ...t-.get_direction-for-the-gpio-driver.patch | 59 ++++++++++++ ...mark-the-gpio-controller-as-sleeping.patch | 90 +++++++++++++++++++ ...at-fix-compat_uts_machine-definition.patch | 34 +++++++ ...emory-leak-in-beiscsi_boot_get_sinfo.patch | 32 +++++++ ...2xxx-edif-fix-dma_free_coherent-size.patch | 34 +++++++ queue-6.1/series | 10 +++ 11 files changed, 523 insertions(+) create mode 100644 queue-6.1/asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch create mode 100644 queue-6.1/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch create mode 100644 queue-6.1/efivarfs-fix-error-propagation-in-efivar_entry_get.patch create mode 100644 queue-6.1/flex_proportions-make-fprop_new_period-hardirq-safe.patch create mode 100644 queue-6.1/mptcp-only-reset-subflow-errors-when-propagated.patch create mode 100644 queue-6.1/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch create mode 100644 queue-6.1/pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch create mode 100644 queue-6.1/riscv-compat-fix-compat_uts_machine-definition.patch create mode 100644 queue-6.1/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch create mode 100644 queue-6.1/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch diff --git a/queue-6.1/asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch b/queue-6.1/asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch new file mode 100644 index 0000000000..f0f2176aaf --- /dev/null +++ b/queue-6.1/asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch @@ -0,0 +1,39 @@ +From 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d Mon Sep 17 00:00:00 2001 +From: Zhang Heng +Date: Mon, 26 Jan 2026 09:49:52 +0800 +Subject: ASoC: amd: yc: Add DMI quirk for Acer TravelMate P216-41-TCO + +From: Zhang Heng + +commit 9502b7df5a3c7e174f74f20324ac1fe781fc5c2d upstream. + +Add a DMI quirk for the Acer TravelMate P216-41-TCO fixing the +issue where the internal microphone was not detected. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=220983 +Cc: stable@vger.kernel.org +Signed-off-by: Zhang Heng +Link: https://patch.msgid.link/20260126014952.3674450-1-zhangheng@kylinos.cn +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/amd/yc/acp6x-mach.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/soc/amd/yc/acp6x-mach.c ++++ b/sound/soc/amd/yc/acp6x-mach.c +@@ -528,6 +528,14 @@ static const struct dmi_system_id yc_acp + DMI_MATCH(DMI_PRODUCT_NAME, "GOH-X"), + } + }, ++ { ++ .driver_data = &acp6x_card, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "RB"), ++ DMI_MATCH(DMI_BOARD_NAME, "XyloD5_RBU"), ++ } ++ }, ++ + {} + }; + diff --git a/queue-6.1/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch b/queue-6.1/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch new file mode 100644 index 0000000000..e153889fdf --- /dev/null +++ b/queue-6.1/asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch @@ -0,0 +1,47 @@ +From 9210f5ff6318163835d9e42ee68006be4da0f531 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sun, 18 Jan 2026 17:50:30 -0300 +Subject: ASoC: fsl: imx-card: Do not force slot width to sample width + +From: Fabio Estevam + +commit 9210f5ff6318163835d9e42ee68006be4da0f531 upstream. + +imx-card currently sets the slot width to the physical sample width +for I2S links. This breaks controllers that use fixed-width slots +(e.g. 32-bit FIFO words), causing the unused bits in the slot to +contain undefined data when playing 16-bit streams. + +Do not override the slot width in the machine driver and let the CPU +DAI select an appropriate default instead. This matches the behavior +of simple-audio-card and avoids embedding controller-specific policy +in the machine driver. + +On an i.MX8MP-based board using SAI as the I2S master with 32-bit slots, +playing 16-bit audio resulted in spurious frequencies and an incorrect +SAI data waveform, as the slot width was forced to 16 bits. After this +change, audio artifacts are eliminated and the 16-bit samples correctly +occupy the first half of the 32-bit slot, with the remaining bits padded +with zeroes. + +Cc: stable@vger.kernel.org +Fixes: aa736700f42f ("ASoC: imx-card: Add imx-card machine driver") +Signed-off-by: Fabio Estevam +Acked-by: Shengjiu Wang +Link: https://patch.msgid.link/20260118205030.1532696-1-festevam@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/imx-card.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/soc/fsl/imx-card.c ++++ b/sound/soc/fsl/imx-card.c +@@ -314,7 +314,6 @@ static int imx_aif_hw_params(struct snd_ + SND_SOC_DAIFMT_PDM; + } else { + slots = 2; +- slot_width = params_physical_width(params); + fmt = (rtd->dai_link->dai_fmt & ~SND_SOC_DAIFMT_FORMAT_MASK) | + SND_SOC_DAIFMT_I2S; + } diff --git a/queue-6.1/efivarfs-fix-error-propagation-in-efivar_entry_get.patch b/queue-6.1/efivarfs-fix-error-propagation-in-efivar_entry_get.patch new file mode 100644 index 0000000000..e9ab4a4771 --- /dev/null +++ b/queue-6.1/efivarfs-fix-error-propagation-in-efivar_entry_get.patch @@ -0,0 +1,37 @@ +From 4b22ec1685ce1fc0d862dcda3225d852fb107995 Mon Sep 17 00:00:00 2001 +From: Kohei Enju +Date: Sat, 17 Jan 2026 16:00:45 +0000 +Subject: efivarfs: fix error propagation in efivar_entry_get() + +From: Kohei Enju + +commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 upstream. + +efivar_entry_get() always returns success even if the underlying +__efivar_entry_get() fails, masking errors. + +This may result in uninitialized heap memory being copied to userspace +in the efivarfs_file_read() path. + +Fix it by returning the error from __efivar_entry_get(). + +Fixes: 2d82e6227ea1 ("efi: vars: Move efivar caching layer into efivarfs") +Cc: # v6.1+ +Signed-off-by: Kohei Enju +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman +--- + fs/efivarfs/vars.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/efivarfs/vars.c ++++ b/fs/efivarfs/vars.c +@@ -609,7 +609,7 @@ int efivar_entry_get(struct efivar_entry + err = __efivar_entry_get(entry, attributes, size, data); + efivar_unlock(); + +- return 0; ++ return err; + } + + /** diff --git a/queue-6.1/flex_proportions-make-fprop_new_period-hardirq-safe.patch b/queue-6.1/flex_proportions-make-fprop_new_period-hardirq-safe.patch new file mode 100644 index 0000000000..6fd587615c --- /dev/null +++ b/queue-6.1/flex_proportions-make-fprop_new_period-hardirq-safe.patch @@ -0,0 +1,84 @@ +From dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 21 Jan 2026 12:27:30 +0100 +Subject: flex_proportions: make fprop_new_period() hardirq safe + +From: Jan Kara + +commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc upstream. + +Bernd has reported a lockdep splat from flexible proportions code that is +essentially complaining about the following race: + + +run_timer_softirq - we are in softirq context + call_timer_fn + writeout_period + fprop_new_period + write_seqcount_begin(&p->sequence); + + + ... + blk_mq_end_request() + blk_update_request() + ext4_end_bio() + folio_end_writeback() + __wb_writeout_add() + __fprop_add_percpu_max() + if (unlikely(max_frac < FPROP_FRAC_BASE)) { + fprop_fraction_percpu() + seq = read_seqcount_begin(&p->sequence); + - sees odd sequence so loops indefinitely + +Note that a deadlock like this is only possible if the bdi has configured +maximum fraction of writeout throughput which is very rare in general but +frequent for example for FUSE bdis. To fix this problem we have to make +sure write section of the sequence counter is irqsafe. + +Link: https://lkml.kernel.org/r/20260121112729.24463-2-jack@suse.cz +Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()") +Signed-off-by: Jan Kara +Reported-by: Bernd Schubert +Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/ +Reviewed-by: Matthew Wilcox (Oracle) +Cc: Joanne Koong +Cc: Miklos Szeredi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + lib/flex_proportions.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/lib/flex_proportions.c b/lib/flex_proportions.c +index 84ecccddc771..012d5614efb9 100644 +--- a/lib/flex_proportions.c ++++ b/lib/flex_proportions.c +@@ -64,13 +64,14 @@ void fprop_global_destroy(struct fprop_global *p) + bool fprop_new_period(struct fprop_global *p, int periods) + { + s64 events = percpu_counter_sum(&p->events); ++ unsigned long flags; + + /* + * Don't do anything if there are no events. + */ + if (events <= 1) + return false; +- preempt_disable_nested(); ++ local_irq_save(flags); + write_seqcount_begin(&p->sequence); + if (periods < 64) + events -= events >> periods; +@@ -78,7 +79,7 @@ bool fprop_new_period(struct fprop_global *p, int periods) + percpu_counter_add(&p->events, -events); + p->period += periods; + write_seqcount_end(&p->sequence); +- preempt_enable_nested(); ++ local_irq_restore(flags); + + return true; + } +-- +2.53.0 + diff --git a/queue-6.1/mptcp-only-reset-subflow-errors-when-propagated.patch b/queue-6.1/mptcp-only-reset-subflow-errors-when-propagated.patch new file mode 100644 index 0000000000..ca78b70c0d --- /dev/null +++ b/queue-6.1/mptcp-only-reset-subflow-errors-when-propagated.patch @@ -0,0 +1,57 @@ +From dccf46179ddd6c04c14be8ed584dc54665f53f0e Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Tue, 27 Jan 2026 20:27:25 +0100 +Subject: mptcp: only reset subflow errors when propagated + +From: Matthieu Baerts (NGI0) + +commit dccf46179ddd6c04c14be8ed584dc54665f53f0e upstream. + +Some subflow socket errors need to be reported to the MPTCP socket: the +initial subflow connect (MP_CAPABLE), and the ones from the fallback +sockets. The others are not propagated. + +The issue is that sock_error() was used to retrieve the error, which was +also resetting the sk_err field. Because of that, when notifying the +userspace about subflow close events later on from the MPTCP worker, the +ssk->sk_err field was always 0. + +Now, the error (sk_err) is only reset when propagating it to the msk. + +Fixes: 15cc10453398 ("mptcp: deliver ssk errors to msk") +Cc: stable@vger.kernel.org +Reviewed-by: Geliang Tang +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20260127-net-mptcp-dup-nl-events-v1-3-7f71e1bc4feb@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/mptcp/protocol.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -807,11 +807,8 @@ static bool __mptcp_ofo_queue(struct mpt + + static bool __mptcp_subflow_error_report(struct sock *sk, struct sock *ssk) + { +- int err = sock_error(ssk); + int ssk_state; +- +- if (!err) +- return false; ++ int err; + + /* only propagate errors on fallen-back sockets or + * on MPC connect +@@ -819,6 +816,10 @@ static bool __mptcp_subflow_error_report + if (sk->sk_state != TCP_SYN_SENT && !__mptcp_check_fallback(mptcp_sk(sk))) + return false; + ++ err = sock_error(ssk); ++ if (!err) ++ return false; ++ + /* We need to propagate only transition to CLOSE state. + * Orphaned socket will see such state change via + * subflow_sched_work_if_closed() and that path will properly diff --git a/queue-6.1/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch b/queue-6.1/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch new file mode 100644 index 0000000000..f82fb943bf --- /dev/null +++ b/queue-6.1/pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch @@ -0,0 +1,59 @@ +From 4f0d22ec60cee420125f4055af76caa0f373a3fe Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Mon, 26 Jan 2026 14:56:27 +0100 +Subject: pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver + +From: Bartosz Golaszewski + +commit 4f0d22ec60cee420125f4055af76caa0f373a3fe upstream. + +GPIO controller driver should typically implement the .get_direction() +callback as GPIOLIB internals may try to use it to determine the state +of a pin. Add it for the LPASS LPI driver. + +Reported-by: Abel Vesa +Cc: stable@vger.kernel.org +Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Konrad Dybcio +Tested-by: Konrad Dybcio # X1E CRD +Tested-by: Abel Vesa +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c ++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +@@ -248,6 +248,22 @@ static const struct pinconf_ops lpi_gpio + .pin_config_group_set = lpi_config_set, + }; + ++static int lpi_gpio_get_direction(struct gpio_chip *chip, unsigned int pin) ++{ ++ unsigned long config = pinconf_to_config_packed(PIN_CONFIG_LEVEL, 0); ++ struct lpi_pinctrl *state = gpiochip_get_data(chip); ++ unsigned long arg; ++ int ret; ++ ++ ret = lpi_config_get(state->ctrl, pin, &config); ++ if (ret) ++ return ret; ++ ++ arg = pinconf_to_config_argument(config); ++ ++ return arg ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN; ++} ++ + static int lpi_gpio_direction_input(struct gpio_chip *chip, unsigned int pin) + { + struct lpi_pinctrl *state = gpiochip_get_data(chip); +@@ -346,6 +362,7 @@ static void lpi_gpio_dbg_show(struct seq + #endif + + static const struct gpio_chip lpi_gpio_template = { ++ .get_direction = lpi_gpio_get_direction, + .direction_input = lpi_gpio_direction_input, + .direction_output = lpi_gpio_direction_output, + .get = lpi_gpio_get, diff --git a/queue-6.1/pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch b/queue-6.1/pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..088750dd84 --- /dev/null +++ b/queue-6.1/pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,90 @@ +From 28f24068387169722b508bba6b5257cb68b86e74 Mon Sep 17 00:00:00 2001 +From: Bartosz Golaszewski +Date: Mon, 5 Jan 2026 16:05:08 +0100 +Subject: pinctrl: meson: mark the GPIO controller as sleeping + +From: Bartosz Golaszewski + +commit 28f24068387169722b508bba6b5257cb68b86e74 upstream. + +The GPIO controller is configured as non-sleeping but it uses generic +pinctrl helpers which use a mutex for synchronization. + +This can cause the following lockdep splat with shared GPIOs enabled on +boards which have multiple devices using the same GPIO: + +BUG: sleeping function called from invalid context at +kernel/locking/mutex.c:591 +in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 142, name: +kworker/u25:3 +preempt_count: 1, expected: 0 +RCU nest depth: 0, expected: 0 +INFO: lockdep is turned off. +irq event stamp: 46379 +hardirqs last enabled at (46379): [] +_raw_spin_unlock_irqrestore+0x74/0x78 +hardirqs last disabled at (46378): [] +_raw_spin_lock_irqsave+0x84/0x88 +softirqs last enabled at (46330): [] +handle_softirqs+0x4c4/0x4dc +softirqs last disabled at (46295): [] +__do_softirq+0x14/0x20 +CPU: 1 UID: 0 PID: 142 Comm: kworker/u25:3 Tainted: G C +6.19.0-rc4-next-20260105+ #11963 PREEMPT +Tainted: [C]=CRAP +Hardware name: Khadas VIM3 (DT) +Workqueue: events_unbound deferred_probe_work_func +Call trace: + show_stack+0x18/0x24 (C) + dump_stack_lvl+0x90/0xd0 + dump_stack+0x18/0x24 + __might_resched+0x144/0x248 + __might_sleep+0x48/0x98 + __mutex_lock+0x5c/0x894 + mutex_lock_nested+0x24/0x30 + pinctrl_get_device_gpio_range+0x44/0x128 + pinctrl_gpio_set_config+0x40/0xdc + gpiochip_generic_config+0x28/0x3c + gpio_do_set_config+0xa8/0x194 + gpiod_set_config+0x34/0xfc + gpio_shared_proxy_set_config+0x6c/0xfc [gpio_shared_proxy] + gpio_do_set_config+0xa8/0x194 + gpiod_set_transitory+0x4c/0xf0 + gpiod_configure_flags+0xa4/0x480 + gpiod_find_and_request+0x1a0/0x574 + gpiod_get_index+0x58/0x84 + devm_gpiod_get_index+0x20/0xb4 + devm_gpiod_get+0x18/0x24 + mmc_pwrseq_emmc_probe+0x40/0xb8 + platform_probe+0x5c/0xac + really_probe+0xbc/0x298 + __driver_probe_device+0x78/0x12c + driver_probe_device+0xdc/0x164 + __device_attach_driver+0xb8/0x138 + bus_for_each_drv+0x80/0xdc + __device_attach+0xa8/0x1b0 + +Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") +Cc: stable@vger.kernel.org +Reported-by: Marek Szyprowski +Closes: https://lore.kernel.org/all/00107523-7737-4b92-a785-14ce4e93b8cb@samsung.com/ +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/meson/pinctrl-meson.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/meson/pinctrl-meson.c ++++ b/drivers/pinctrl/meson/pinctrl-meson.c +@@ -619,7 +619,7 @@ static int meson_gpiolib_register(struct + pc->chip.set = meson_gpio_set; + pc->chip.base = -1; + pc->chip.ngpio = pc->data->num_pins; +- pc->chip.can_sleep = false; ++ pc->chip.can_sleep = true; + + ret = gpiochip_add_data(&pc->chip, pc); + if (ret) { diff --git a/queue-6.1/riscv-compat-fix-compat_uts_machine-definition.patch b/queue-6.1/riscv-compat-fix-compat_uts_machine-definition.patch new file mode 100644 index 0000000000..17d03e3d92 --- /dev/null +++ b/queue-6.1/riscv-compat-fix-compat_uts_machine-definition.patch @@ -0,0 +1,34 @@ +From 0ea05c4f7527a98f5946f96c829733788934311d Mon Sep 17 00:00:00 2001 +From: Han Gao +Date: Wed, 28 Jan 2026 03:07:11 +0800 +Subject: riscv: compat: fix COMPAT_UTS_MACHINE definition + +From: Han Gao + +commit 0ea05c4f7527a98f5946f96c829733788934311d upstream. + +The COMPAT_UTS_MACHINE for riscv was incorrectly defined as "riscv". +Change it to "riscv32" to reflect the correct 32-bit compat name. + +Fixes: 06d0e3723647 ("riscv: compat: Add basic compat data type implementation") +Cc: stable@vger.kernel.org +Signed-off-by: Han Gao +Reviewed-by: Guo Ren (Alibaba Damo Academy) +Link: https://patch.msgid.link/20260127190711.2264664-1-gaohan@iscas.ac.cn +Signed-off-by: Paul Walmsley +Signed-off-by: Greg Kroah-Hartman +--- + arch/riscv/include/asm/compat.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/riscv/include/asm/compat.h ++++ b/arch/riscv/include/asm/compat.h +@@ -2,7 +2,7 @@ + #ifndef __ASM_COMPAT_H + #define __ASM_COMPAT_H + +-#define COMPAT_UTS_MACHINE "riscv\0\0" ++#define COMPAT_UTS_MACHINE "riscv32\0\0" + + /* + * Architecture specific compatibility types diff --git a/queue-6.1/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch b/queue-6.1/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch new file mode 100644 index 0000000000..fdc257fdf5 --- /dev/null +++ b/queue-6.1/scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch @@ -0,0 +1,32 @@ +From 4747bafaa50115d9667ece446b1d2d4aba83dc7f Mon Sep 17 00:00:00 2001 +From: Haoxiang Li +Date: Sat, 13 Dec 2025 16:36:43 +0800 +Subject: scsi: be2iscsi: Fix a memory leak in beiscsi_boot_get_sinfo() + +From: Haoxiang Li + +commit 4747bafaa50115d9667ece446b1d2d4aba83dc7f upstream. + +If nonemb_cmd->va fails to be allocated, free the allocation previously +made by alloc_mcc_wrb(). + +Fixes: 50a4b824be9e ("scsi: be2iscsi: Fix to make boot discovery non-blocking") +Cc: stable@vger.kernel.org +Signed-off-by: Haoxiang Li +Link: https://patch.msgid.link/20251213083643.301240-1-lihaoxiang@isrc.iscas.ac.cn +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/be2iscsi/be_mgmt.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/be2iscsi/be_mgmt.c ++++ b/drivers/scsi/be2iscsi/be_mgmt.c +@@ -1025,6 +1025,7 @@ unsigned int beiscsi_boot_get_sinfo(stru + &nonemb_cmd->dma, + GFP_KERNEL); + if (!nonemb_cmd->va) { ++ free_mcc_wrb(ctrl, tag); + mutex_unlock(&ctrl->mbox_lock); + return 0; + } diff --git a/queue-6.1/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch b/queue-6.1/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch new file mode 100644 index 0000000000..ac583a3402 --- /dev/null +++ b/queue-6.1/scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch @@ -0,0 +1,34 @@ +From 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 Mon Sep 17 00:00:00 2001 +From: Thomas Fourier +Date: Mon, 12 Jan 2026 14:43:24 +0100 +Subject: scsi: qla2xxx: edif: Fix dma_free_coherent() size + +From: Thomas Fourier + +commit 56bd3c0f749f45793d1eae1d0ddde4255c749bf6 upstream. + +Earlier in the function, the ha->flt buffer is allocated with size +sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE but freed in the error +path with size SFP_DEV_SIZE. + +Fixes: 84318a9f01ce ("scsi: qla2xxx: edif: Add send, receive, and accept for auth_els") +Cc: stable@vger.kernel.org +Signed-off-by: Thomas Fourier +Link: https://patch.msgid.link/20260112134326.55466-2-fourier.thomas@gmail.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -4464,7 +4464,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha + fail_elsrej: + dma_pool_destroy(ha->purex_dma_pool); + fail_flt: +- dma_free_coherent(&ha->pdev->dev, SFP_DEV_SIZE, ++ dma_free_coherent(&ha->pdev->dev, sizeof(struct qla_flt_header) + FLT_REGIONS_SIZE, + ha->flt, ha->flt_dma); + + fail_flt_buffer: diff --git a/queue-6.1/series b/queue-6.1/series index 833797dc31..18a1c4388b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -203,3 +203,13 @@ scsi-firewire-sbp-target-fix-overflow-in-sbp_make_tp.patch asoc-intel-sof_es8336-fix-headphone-gpio-logic-inver.patch gpiolib-acpi-use-bit_ull-for-u64-mask-in-address-spa.patch dma-pool-distinguish-between-missing-and-exhausted-a.patch +pinctrl-lpass-lpi-implement-.get_direction-for-the-gpio-driver.patch +pinctrl-meson-mark-the-gpio-controller-as-sleeping.patch +riscv-compat-fix-compat_uts_machine-definition.patch +asoc-fsl-imx-card-do-not-force-slot-width-to-sample-width.patch +scsi-be2iscsi-fix-a-memory-leak-in-beiscsi_boot_get_sinfo.patch +asoc-amd-yc-add-dmi-quirk-for-acer-travelmate-p216-41-tco.patch +scsi-qla2xxx-edif-fix-dma_free_coherent-size.patch +efivarfs-fix-error-propagation-in-efivar_entry_get.patch +mptcp-only-reset-subflow-errors-when-propagated.patch +flex_proportions-make-fprop_new_period-hardirq-safe.patch -- 2.47.3