From d3c762c5b76b6dd5a1f3196295564c0589cef15c Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 24 Jul 2025 10:15:02 -0400 Subject: [PATCH] Fixes for 6.12 Signed-off-by: Sasha Levin --- ...-adc-ad7949-use-spi_is_bpw_supported.patch | 55 ++++++++++ ...m-sc7280-add-missing-num_links-to-xm.patch | 36 +++++++ ...x-mlxbf-pmc-remove-newline-char-from.patch | 66 ++++++++++++ ...x-mlxbf-pmc-use-kstrtobool-to-check-.patch | 68 ++++++++++++ ...x-mlxbf-pmc-validate-event-enable-in.patch | 55 ++++++++++ ...s-nb-wmi-add-dmi-quirk-for-asus-zenb.patch | 48 +++++++++ ...-initialization-order-for-firmware_a.patch | 51 +++++++++ ...ate-limit-gid-cache-warning-messages.patch | 44 ++++++++ ...-potential-memory-leak-of-regmap_bus.patch | 44 ++++++++ ...ix-null-dereference-on-unbind-due-to.patch | 44 ++++++++ queue-6.12/series | 15 +++ ...q_arm-make-vchiq_shutdown-never-fail.patch | 40 +++++++ ...y-fix-incorrect-file-path-conversion.patch | 100 ++++++++++++++++++ ...ce-minimum-tx-ring-size-for-reliabil.patch | 58 ++++++++++ ...-error-reporting-in-virtqueue_resize.patch | 66 ++++++++++++ ...sage-of-cpu_online_mask-to-get-valid.patch | 56 ++++++++++ 16 files changed, 846 insertions(+) create mode 100644 queue-6.12/iio-adc-ad7949-use-spi_is_bpw_supported.patch create mode 100644 queue-6.12/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch create mode 100644 queue-6.12/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch create mode 100644 queue-6.12/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch create mode 100644 queue-6.12/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch create mode 100644 queue-6.12/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch create mode 100644 queue-6.12/platform-x86-fix-initialization-order-for-firmware_a.patch create mode 100644 queue-6.12/rdma-core-rate-limit-gid-cache-warning-messages.patch create mode 100644 queue-6.12/regmap-fix-potential-memory-leak-of-regmap_bus.patch create mode 100644 queue-6.12/regulator-core-fix-null-dereference-on-unbind-due-to.patch create mode 100644 queue-6.12/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch create mode 100644 queue-6.12/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch create mode 100644 queue-6.12/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch create mode 100644 queue-6.12/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch create mode 100644 queue-6.12/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch diff --git a/queue-6.12/iio-adc-ad7949-use-spi_is_bpw_supported.patch b/queue-6.12/iio-adc-ad7949-use-spi_is_bpw_supported.patch new file mode 100644 index 0000000000..05fd421997 --- /dev/null +++ b/queue-6.12/iio-adc-ad7949-use-spi_is_bpw_supported.patch @@ -0,0 +1,55 @@ +From 71e399f816a34f215c57aca1d348c8d22941efcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Jun 2025 10:04:58 -0500 +Subject: iio: adc: ad7949: use spi_is_bpw_supported() + +From: David Lechner + +[ Upstream commit 7b86482632788acd48d7b9ee1867f5ad3a32ccbb ] + +Use spi_is_bpw_supported() instead of directly accessing spi->controller +->bits_per_word_mask. bits_per_word_mask may be 0, which implies that +8-bits-per-word is supported. spi_is_bpw_supported() takes this into +account while spi_ctrl_mask == SPI_BPW_MASK(8) does not. + +Fixes: 0b2a740b424e ("iio: adc: ad7949: enable use with non 14/16-bit controllers") +Closes: https://lore.kernel.org/linux-spi/c8b8a963-6cef-4c9b-bfef-dab2b7bd0b0f@sirena.org.uk/ +Signed-off-by: David Lechner +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20250611-iio-adc-ad7949-use-spi_is_bpw_supported-v1-1-c4e15bfd326e@baylibre.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ad7949.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/adc/ad7949.c b/drivers/iio/adc/ad7949.c +index edd0c3a35ab73..202561cad4012 100644 +--- a/drivers/iio/adc/ad7949.c ++++ b/drivers/iio/adc/ad7949.c +@@ -308,7 +308,6 @@ static void ad7949_disable_reg(void *reg) + + static int ad7949_spi_probe(struct spi_device *spi) + { +- u32 spi_ctrl_mask = spi->controller->bits_per_word_mask; + struct device *dev = &spi->dev; + const struct ad7949_adc_spec *spec; + struct ad7949_adc_chip *ad7949_adc; +@@ -337,11 +336,11 @@ static int ad7949_spi_probe(struct spi_device *spi) + ad7949_adc->resolution = spec->resolution; + + /* Set SPI bits per word */ +- if (spi_ctrl_mask & SPI_BPW_MASK(ad7949_adc->resolution)) { ++ if (spi_is_bpw_supported(spi, ad7949_adc->resolution)) { + spi->bits_per_word = ad7949_adc->resolution; +- } else if (spi_ctrl_mask == SPI_BPW_MASK(16)) { ++ } else if (spi_is_bpw_supported(spi, 16)) { + spi->bits_per_word = 16; +- } else if (spi_ctrl_mask == SPI_BPW_MASK(8)) { ++ } else if (spi_is_bpw_supported(spi, 8)) { + spi->bits_per_word = 8; + } else { + dev_err(dev, "unable to find common BPW with spi controller\n"); +-- +2.39.5 + diff --git a/queue-6.12/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch b/queue-6.12/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch new file mode 100644 index 0000000000..c855e75060 --- /dev/null +++ b/queue-6.12/interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch @@ -0,0 +1,36 @@ +From 82f7e4182d9ba7c5608d3426adbbc975db249704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Jun 2025 22:53:38 +0800 +Subject: interconnect: qcom: sc7280: Add missing num_links to xm_pcie3_1 node + +From: Xilin Wu + +[ Upstream commit 886a94f008dd1a1702ee66dd035c266f70fd9e90 ] + +This allows adding interconnect paths for PCIe 1 in device tree later. + +Fixes: 46bdcac533cc ("interconnect: qcom: Add SC7280 interconnect provider driver") +Signed-off-by: Xilin Wu +Reviewed-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20250613-sc7280-icc-pcie1-fix-v1-1-0b09813e3b09@radxa.com +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sc7280.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/interconnect/qcom/sc7280.c b/drivers/interconnect/qcom/sc7280.c +index 167971f8e8bec..fdb02a87e3124 100644 +--- a/drivers/interconnect/qcom/sc7280.c ++++ b/drivers/interconnect/qcom/sc7280.c +@@ -238,6 +238,7 @@ static struct qcom_icc_node xm_pcie3_1 = { + .id = SC7280_MASTER_PCIE_1, + .channels = 1, + .buswidth = 8, ++ .num_links = 1, + .links = { SC7280_SLAVE_ANOC_PCIE_GEM_NOC }, + }; + +-- +2.39.5 + diff --git a/queue-6.12/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch b/queue-6.12/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch new file mode 100644 index 0000000000..f1f6ea7fde --- /dev/null +++ b/queue-6.12/platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch @@ -0,0 +1,66 @@ +From 9cb0b869619a81ff26ea71dda70fbee06bf92768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 06:09:01 -0400 +Subject: platform/mellanox: mlxbf-pmc: Remove newline char from event name + input +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shravan Kumar Ramani + +[ Upstream commit 44e6ca8faeeed12206f3e7189c5ac618b810bb9c ] + +Since the input string passed via the command line appends a newline char, +it needs to be removed before comparison with the event_list. + +Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver") +Signed-off-by: Shravan Kumar Ramani +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/4978c18e33313b48fa2ae7f3aa6dbcfce40877e4.1751380187.git.shravankr@nvidia.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index fbb8128d19de4..afc07905e235e 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + + #define MLXBF_PMC_WRITE_REG_32 0x82000009 +@@ -1625,6 +1626,7 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev, + attr, struct mlxbf_pmc_attribute, dev_attr); + unsigned int blk_num, cnt_num; + bool is_l3 = false; ++ char *evt_name; + int evt_num; + int err; + +@@ -1632,8 +1634,14 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev, + cnt_num = attr_event->index; + + if (isalpha(buf[0])) { ++ /* Remove the trailing newline character if present */ ++ evt_name = kstrdup_and_replace(buf, '\n', '\0', GFP_KERNEL); ++ if (!evt_name) ++ return -ENOMEM; ++ + evt_num = mlxbf_pmc_get_event_num(pmc->block_name[blk_num], +- buf); ++ evt_name); ++ kfree(evt_name); + if (evt_num < 0) + return -EINVAL; + } else { +-- +2.39.5 + diff --git a/queue-6.12/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch b/queue-6.12/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch new file mode 100644 index 0000000000..5ab3b554f3 --- /dev/null +++ b/queue-6.12/platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch @@ -0,0 +1,68 @@ +From 59ce39a537d61b5aa15f6d53519f909a9c603a0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 06:09:02 -0400 +Subject: platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shravan Kumar Ramani + +[ Upstream commit 0e2cebd72321caeef84b6ba7084e85be0287fb4b ] + +For setting the enable value, the input should be 0 or 1 only. Use +kstrtobool() in place of kstrtoint() in mlxbf_pmc_enable_store() to +accept only valid input. + +Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") +Signed-off-by: Shravan Kumar Ramani +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com +[ij: split kstrbool() change to own commit.] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index d305d23cf5199..9a0220b4de3c8 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1731,13 +1731,14 @@ static ssize_t mlxbf_pmc_enable_store(struct device *dev, + { + struct mlxbf_pmc_attribute *attr_enable = container_of( + attr, struct mlxbf_pmc_attribute, dev_attr); +- unsigned int en, blk_num; ++ unsigned int blk_num; + u32 word; + int err; ++ bool en; + + blk_num = attr_enable->nr; + +- err = kstrtouint(buf, 0, &en); ++ err = kstrtobool(buf, &en); + if (err < 0) + return err; + +@@ -1757,14 +1758,11 @@ static ssize_t mlxbf_pmc_enable_store(struct device *dev, + MLXBF_PMC_CRSPACE_PERFMON_CTL(pmc->block[blk_num].counters), + MLXBF_PMC_WRITE_REG_32, word); + } else { +- if (en && en != 1) +- return -EINVAL; +- + err = mlxbf_pmc_config_l3_counters(blk_num, false, !!en); + if (err) + return err; + +- if (en == 1) { ++ if (en) { + err = mlxbf_pmc_config_l3_counters(blk_num, true, false); + if (err) + return err; +-- +2.39.5 + diff --git a/queue-6.12/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch b/queue-6.12/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch new file mode 100644 index 0000000000..dbec943c63 --- /dev/null +++ b/queue-6.12/platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch @@ -0,0 +1,55 @@ +From 1aae1684fee43d9b1024a384c5244d216a96cc07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jul 2025 06:09:02 -0400 +Subject: platform/mellanox: mlxbf-pmc: Validate event/enable input +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shravan Kumar Ramani + +[ Upstream commit f8c1311769d3b2c82688b294b4ae03e94f1c326d ] + +Before programming the event info, validate the event number received as input +by checking if it exists in the event_list. Also fix a typo in the comment for +mlxbf_pmc_get_event_name() to correctly mention that it returns the event name +when taking the event number as input, and not the other way round. + +Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3") +Signed-off-by: Shravan Kumar Ramani +Reviewed-by: David Thompson +Link: https://lore.kernel.org/r/2ee618c59976bcf1379d5ddce2fc60ab5014b3a9.1751380187.git.shravankr@nvidia.com +[ij: split kstrbool() change to own commit.] +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/mellanox/mlxbf-pmc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c +index afc07905e235e..d305d23cf5199 100644 +--- a/drivers/platform/mellanox/mlxbf-pmc.c ++++ b/drivers/platform/mellanox/mlxbf-pmc.c +@@ -1068,7 +1068,7 @@ static int mlxbf_pmc_get_event_num(const char *blk, const char *evt) + return -ENODEV; + } + +-/* Get the event number given the name */ ++/* Get the event name given the number */ + static char *mlxbf_pmc_get_event_name(const char *blk, u32 evt) + { + const struct mlxbf_pmc_events *events; +@@ -1648,6 +1648,9 @@ static ssize_t mlxbf_pmc_event_store(struct device *dev, + err = kstrtouint(buf, 0, &evt_num); + if (err < 0) + return err; ++ ++ if (!mlxbf_pmc_get_event_name(pmc->block_name[blk_num], evt_num)) ++ return -EINVAL; + } + + if (strstr(pmc->block_name[blk_num], "l3cache")) +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch b/queue-6.12/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch new file mode 100644 index 0000000000..6f7ed01990 --- /dev/null +++ b/queue-6.12/platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch @@ -0,0 +1,48 @@ +From 21b2ca2cfcb00f73bc838c64c86e22ff32e97cb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jun 2025 03:33:01 -0400 +Subject: platform/x86: asus-nb-wmi: add DMI quirk for ASUS Zenbook Duo + UX8406CA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rahul Chandra + +[ Upstream commit 7dc6b2d3b5503bcafebbeaf9818112bf367107b4 ] + +Add a DMI quirk entry for the ASUS Zenbook Duo UX8406CA 2025 model to use +the existing zenbook duo keyboard quirk. + +Signed-off-by: Rahul Chandra +Link: https://lore.kernel.org/r/20250624073301.602070-1-rahul@chandra.net +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index a5933980ade3d..90ad0045fec5f 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -529,6 +529,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_zenbook_duo_kbd, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUS Zenbook Duo UX8406CA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "UX8406CA"), ++ }, ++ .driver_data = &quirk_asus_zenbook_duo_kbd, ++ }, + {}, + }; + +-- +2.39.5 + diff --git a/queue-6.12/platform-x86-fix-initialization-order-for-firmware_a.patch b/queue-6.12/platform-x86-fix-initialization-order-for-firmware_a.patch new file mode 100644 index 0000000000..8bc015ede3 --- /dev/null +++ b/queue-6.12/platform-x86-fix-initialization-order-for-firmware_a.patch @@ -0,0 +1,51 @@ +From 3128a50b8a58cb429e1d157c879827270655ce50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jul 2025 12:32:54 +0200 +Subject: platform/x86: Fix initialization order for firmware_attributes_class +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Torsten Hilbrich + +[ Upstream commit 2bfe3ae1aa45f8b61cb0dc462114fd0c9636ad32 ] + +The think-lmi driver uses the firwmare_attributes_class. But this class +is registered after think-lmi, causing the "think-lmi" directory in +"/sys/class/firmware-attributes" to be missing when the driver is +compiled as builtin. + +Fixes: 55922403807a ("platform/x86: think-lmi: Directly use firmware_attributes_class") +Signed-off-by: Torsten Hilbrich +Link: https://lore.kernel.org/r/7dce5f7f-c348-4350-ac53-d14a8e1e8034@secunet.com +Reviewed-by: Ilpo Järvinen +Signed-off-by: Ilpo Järvinen +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile +index e1b1429470674..4631c7bb22cd0 100644 +--- a/drivers/platform/x86/Makefile ++++ b/drivers/platform/x86/Makefile +@@ -58,6 +58,8 @@ obj-$(CONFIG_X86_PLATFORM_DRIVERS_HP) += hp/ + # Hewlett Packard Enterprise + obj-$(CONFIG_UV_SYSFS) += uv_sysfs.o + ++obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o ++ + # IBM Thinkpad and Lenovo + obj-$(CONFIG_IBM_RTL) += ibm_rtl.o + obj-$(CONFIG_IDEAPAD_LAPTOP) += ideapad-laptop.o +@@ -120,7 +122,6 @@ obj-$(CONFIG_SYSTEM76_ACPI) += system76_acpi.o + obj-$(CONFIG_TOPSTAR_LAPTOP) += topstar-laptop.o + + # Platform drivers +-obj-$(CONFIG_FW_ATTR_CLASS) += firmware_attributes_class.o + obj-$(CONFIG_SERIAL_MULTI_INSTANTIATE) += serial-multi-instantiate.o + obj-$(CONFIG_MLX_PLATFORM) += mlx-platform.o + obj-$(CONFIG_TOUCHSCREEN_DMI) += touchscreen_dmi.o +-- +2.39.5 + diff --git a/queue-6.12/rdma-core-rate-limit-gid-cache-warning-messages.patch b/queue-6.12/rdma-core-rate-limit-gid-cache-warning-messages.patch new file mode 100644 index 0000000000..dcc82cad93 --- /dev/null +++ b/queue-6.12/rdma-core-rate-limit-gid-cache-warning-messages.patch @@ -0,0 +1,44 @@ +From cf03ef75dfc90a763ff88e11c6e4d21af2d265dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Jun 2025 11:26:21 +0300 +Subject: RDMA/core: Rate limit GID cache warning messages + +From: Maor Gottlieb + +[ Upstream commit 333e4d79316c9ed5877d7aac8b8ed22efc74e96d ] + +The GID cache warning messages can flood the kernel log when there are +multiple failed attempts to add GIDs. This can happen when creating many +virtual interfaces without having enough space for their GIDs in the GID +table. + +Change pr_warn to pr_warn_ratelimited to prevent log flooding while still +maintaining visibility of the issue. + +Link: https://patch.msgid.link/r/fd45ed4a1078e743f498b234c3ae816610ba1b18.1750062357.git.leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cache.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c +index b7c078b7f7cfd..a1291f475466d 100644 +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -582,8 +582,8 @@ static int __ib_cache_gid_add(struct ib_device *ib_dev, u32 port, + out_unlock: + mutex_unlock(&table->lock); + if (ret) +- pr_warn("%s: unable to add gid %pI6 error=%d\n", +- __func__, gid->raw, ret); ++ pr_warn_ratelimited("%s: unable to add gid %pI6 error=%d\n", ++ __func__, gid->raw, ret); + return ret; + } + +-- +2.39.5 + diff --git a/queue-6.12/regmap-fix-potential-memory-leak-of-regmap_bus.patch b/queue-6.12/regmap-fix-potential-memory-leak-of-regmap_bus.patch new file mode 100644 index 0000000000..b88e7afaeb --- /dev/null +++ b/queue-6.12/regmap-fix-potential-memory-leak-of-regmap_bus.patch @@ -0,0 +1,44 @@ +From a0d5883e76440d7004ec596f7ba668d9c73e9159 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jun 2025 22:58:21 +0530 +Subject: regmap: fix potential memory leak of regmap_bus + +From: Abdun Nihaal + +[ Upstream commit c871c199accb39d0f4cb941ad0dccabfc21e9214 ] + +When __regmap_init() is called from __regmap_init_i2c() and +__regmap_init_spi() (and their devm versions), the bus argument +obtained from regmap_get_i2c_bus() and regmap_get_spi_bus(), may be +allocated using kmemdup() to support quirks. In those cases, the +bus->free_on_exit field is set to true. + +However, inside __regmap_init(), buf is not freed on any error path. +This could lead to a memory leak of regmap_bus when __regmap_init() +fails. Fix that by freeing bus on error path when free_on_exit is set. + +Fixes: ea030ca68819 ("regmap-i2c: Set regmap max raw r/w from quirks") +Signed-off-by: Abdun Nihaal +Link: https://patch.msgid.link/20250626172823.18725-1-abdun.nihaal@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 5962ea1230a17..de4e2f3db942a 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1174,6 +1174,8 @@ struct regmap *__regmap_init(struct device *dev, + err_map: + kfree(map); + err: ++ if (bus && bus->free_on_exit) ++ kfree(bus); + return ERR_PTR(ret); + } + EXPORT_SYMBOL_GPL(__regmap_init); +-- +2.39.5 + diff --git a/queue-6.12/regulator-core-fix-null-dereference-on-unbind-due-to.patch b/queue-6.12/regulator-core-fix-null-dereference-on-unbind-due-to.patch new file mode 100644 index 0000000000..91889274d9 --- /dev/null +++ b/queue-6.12/regulator-core-fix-null-dereference-on-unbind-due-to.patch @@ -0,0 +1,44 @@ +From 3b10224ca48a2ea52f843e8a9f9035778a0f09f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Jun 2025 08:38:09 +0000 +Subject: regulator: core: fix NULL dereference on unbind due to stale coupling + data + +From: Alessandro Carminati + +[ Upstream commit ca46946a482238b0cdea459fb82fc837fb36260e ] + +Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can +lead to NULL pointer dereference when regulators are accessed post-unbind. + +This can happen during runtime PM or other regulator operations that rely +on coupling metadata. + +For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers +a panic in regulator_lock_recursive() due to stale coupling state. + +Ensure n_coupled is set to 0 to prevent access to invalid pointers. + +Signed-off-by: Alessandro Carminati +Link: https://patch.msgid.link/20250626083809.314842-1-acarmina@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 1f4698d724bb7..e7f2a8b659477 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -5536,6 +5536,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev) + ERR_PTR(err)); + } + ++ rdev->coupling_desc.n_coupled = 0; + kfree(rdev->coupling_desc.coupled_rdevs); + rdev->coupling_desc.coupled_rdevs = NULL; + } +-- +2.39.5 + diff --git a/queue-6.12/series b/queue-6.12/series index 98349dff6d..73ee2f11bc 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -1,2 +1,17 @@ x86-traps-initialize-dr7-by-writing-its-architectural-reset-value.patch input-gpio-keys-fix-a-sleep-while-atomic-with-preempt_rt.patch +virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch +virtio_ring-fix-error-reporting-in-virtqueue_resize.patch +regulator-core-fix-null-dereference-on-unbind-due-to.patch +platform-x86-asus-nb-wmi-add-dmi-quirk-for-asus-zenb.patch +rdma-core-rate-limit-gid-cache-warning-messages.patch +interconnect-qcom-sc7280-add-missing-num_links-to-xm.patch +iio-adc-ad7949-use-spi_is_bpw_supported.patch +regmap-fix-potential-memory-leak-of-regmap_bus.patch +platform-mellanox-mlxbf-pmc-remove-newline-char-from.patch +platform-mellanox-mlxbf-pmc-validate-event-enable-in.patch +platform-mellanox-mlxbf-pmc-use-kstrtobool-to-check-.patch +tools-hv-fcopy-fix-incorrect-file-path-conversion.patch +x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch +platform-x86-fix-initialization-order-for-firmware_a.patch +staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch diff --git a/queue-6.12/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch b/queue-6.12/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch new file mode 100644 index 0000000000..0cc2e393c1 --- /dev/null +++ b/queue-6.12/staging-vchiq_arm-make-vchiq_shutdown-never-fail.patch @@ -0,0 +1,40 @@ +From 8f077057a702cc097ae189b3bb224a0284880388 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jul 2025 18:11:08 +0200 +Subject: staging: vchiq_arm: Make vchiq_shutdown never fail + +From: Stefan Wahren + +[ Upstream commit f2b8ebfb867011ddbefbdf7b04ad62626cbc2afd ] + +Most of the users of vchiq_shutdown ignore the return value, +which is bad because this could lead to resource leaks. +So instead of changing all calls to vchiq_shutdown, it's easier +to make vchiq_shutdown never fail. + +Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20250715161108.3411-4-wahrenst@gmx.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +index 97787002080a1..20ad6b1e44bc4 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +@@ -739,8 +739,7 @@ int vchiq_shutdown(struct vchiq_instance *instance) + struct vchiq_state *state = instance->state; + int ret = 0; + +- if (mutex_lock_killable(&state->mutex)) +- return -EAGAIN; ++ mutex_lock(&state->mutex); + + /* Remove all services */ + vchiq_shutdown_internal(state, instance); +-- +2.39.5 + diff --git a/queue-6.12/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch b/queue-6.12/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch new file mode 100644 index 0000000000..17933c43e8 --- /dev/null +++ b/queue-6.12/tools-hv-fcopy-fix-incorrect-file-path-conversion.patch @@ -0,0 +1,100 @@ +From 6431f765a73ea5602889fa7ba7f3ff767e610dc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Jun 2025 11:22:17 +0900 +Subject: tools/hv: fcopy: Fix incorrect file path conversion + +From: Yasumasa Suenaga + +[ Upstream commit 0d86a8d65c1e69610bfe1a7a774f71ff111ed8c1 ] + +The hv_fcopy_uio_daemon fails to correctly handle file copy requests +from Windows hosts (e.g. via Copy-VMFile) due to wchar_t size +differences between Windows and Linux. On Linux, wchar_t is 32 bit, +whereas Windows uses 16 bit wide characters. + +Fix this by ensuring that file transfers from host to Linux guest +succeed with correctly decoded file names and paths. + +- Treats file name and path as __u16 arrays, not wchar_t*. +- Allocates fixed-size buffers (W_MAX_PATH) for converted strings + instead of using malloc. +- Adds a check for target path length to prevent snprintf() buffer + overflow. + +Fixes: 82b0945ce2c2 ("tools: hv: Add new fcopy application based on uio driver") +Signed-off-by: Yasumasa Suenaga +Reviewed-by: Naman Jain +Link: https://lore.kernel.org/r/20250628022217.1514-2-yasuenag@gmail.com +Signed-off-by: Wei Liu +Message-ID: <20250628022217.1514-2-yasuenag@gmail.com> +Signed-off-by: Sasha Levin +--- + tools/hv/hv_fcopy_uio_daemon.c | 37 +++++++++++++--------------------- + 1 file changed, 14 insertions(+), 23 deletions(-) + +diff --git a/tools/hv/hv_fcopy_uio_daemon.c b/tools/hv/hv_fcopy_uio_daemon.c +index 12743d7f164f0..9caa24caa0801 100644 +--- a/tools/hv/hv_fcopy_uio_daemon.c ++++ b/tools/hv/hv_fcopy_uio_daemon.c +@@ -62,8 +62,11 @@ static int hv_fcopy_create_file(char *file_name, char *path_name, __u32 flags) + + filesize = 0; + p = path_name; +- snprintf(target_fname, sizeof(target_fname), "%s/%s", +- path_name, file_name); ++ if (snprintf(target_fname, sizeof(target_fname), "%s/%s", ++ path_name, file_name) >= sizeof(target_fname)) { ++ syslog(LOG_ERR, "target file name is too long: %s/%s", path_name, file_name); ++ goto done; ++ } + + /* + * Check to see if the path is already in place; if not, +@@ -270,7 +273,7 @@ static void wcstoutf8(char *dest, const __u16 *src, size_t dest_size) + { + size_t len = 0; + +- while (len < dest_size) { ++ while (len < dest_size && *src) { + if (src[len] < 0x80) + dest[len++] = (char)(*src++); + else +@@ -282,27 +285,15 @@ static void wcstoutf8(char *dest, const __u16 *src, size_t dest_size) + + static int hv_fcopy_start(struct hv_start_fcopy *smsg_in) + { +- setlocale(LC_ALL, "en_US.utf8"); +- size_t file_size, path_size; +- char *file_name, *path_name; +- char *in_file_name = (char *)smsg_in->file_name; +- char *in_path_name = (char *)smsg_in->path_name; +- +- file_size = wcstombs(NULL, (const wchar_t *restrict)in_file_name, 0) + 1; +- path_size = wcstombs(NULL, (const wchar_t *restrict)in_path_name, 0) + 1; +- +- file_name = (char *)malloc(file_size * sizeof(char)); +- path_name = (char *)malloc(path_size * sizeof(char)); +- +- if (!file_name || !path_name) { +- free(file_name); +- free(path_name); +- syslog(LOG_ERR, "Can't allocate memory for file name and/or path name"); +- return HV_E_FAIL; +- } ++ /* ++ * file_name and path_name should have same length with appropriate ++ * member of hv_start_fcopy. ++ */ ++ char file_name[W_MAX_PATH], path_name[W_MAX_PATH]; + +- wcstoutf8(file_name, (__u16 *)in_file_name, file_size); +- wcstoutf8(path_name, (__u16 *)in_path_name, path_size); ++ setlocale(LC_ALL, "en_US.utf8"); ++ wcstoutf8(file_name, smsg_in->file_name, W_MAX_PATH - 1); ++ wcstoutf8(path_name, smsg_in->path_name, W_MAX_PATH - 1); + + return hv_fcopy_create_file(file_name, path_name, smsg_in->copy_flags); + } +-- +2.39.5 + diff --git a/queue-6.12/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch b/queue-6.12/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch new file mode 100644 index 0000000000..94d8e5ef8a --- /dev/null +++ b/queue-6.12/virtio_net-enforce-minimum-tx-ring-size-for-reliabil.patch @@ -0,0 +1,58 @@ +From f470a01e42a2570b4bb5ef080fb2c8d16dce1de5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 May 2025 11:22:36 +0200 +Subject: virtio_net: Enforce minimum TX ring size for reliability + +From: Laurent Vivier + +[ Upstream commit 24b2f5df86aaebbe7bac40304eaf5a146c02367c ] + +The `tx_may_stop()` logic stops TX queues if free descriptors +(`sq->vq->num_free`) fall below the threshold of (`MAX_SKB_FRAGS` + 2). +If the total ring size (`ring_num`) is not strictly greater than this +value, queues can become persistently stopped or stop after minimal +use, severely degrading performance. + +A single sk_buff transmission typically requires descriptors for: +- The virtio_net_hdr (1 descriptor) +- The sk_buff's linear data (head) (1 descriptor) +- Paged fragments (up to MAX_SKB_FRAGS descriptors) + +This patch enforces that the TX ring size ('ring_num') must be strictly +greater than (MAX_SKB_FRAGS + 2). This ensures that the ring is +always large enough to hold at least one maximally-fragmented packet +plus at least one additional slot. + +Reported-by: Lei Yang +Signed-off-by: Laurent Vivier +Reviewed-by: Xuan Zhuo +Acked-by: Jason Wang +Link: https://patch.msgid.link/20250521092236.661410-4-lvivier@redhat.com +Tested-by: Lei Yang +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 0408c21bb1220..fb3908798458b 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -3275,6 +3275,12 @@ static int virtnet_tx_resize(struct virtnet_info *vi, struct send_queue *sq, + { + int qindex, err; + ++ if (ring_num <= MAX_SKB_FRAGS + 2) { ++ netdev_err(vi->dev, "tx size (%d) cannot be smaller than %d\n", ++ ring_num, MAX_SKB_FRAGS + 2); ++ return -EINVAL; ++ } ++ + qindex = sq - vi->sq; + + virtnet_tx_pause(vi, sq); +-- +2.39.5 + diff --git a/queue-6.12/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch b/queue-6.12/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch new file mode 100644 index 0000000000..0143a30cb0 --- /dev/null +++ b/queue-6.12/virtio_ring-fix-error-reporting-in-virtqueue_resize.patch @@ -0,0 +1,66 @@ +From 99ea7e49bd314d8b846edac97b4432cb34487bc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 May 2025 11:22:34 +0200 +Subject: virtio_ring: Fix error reporting in virtqueue_resize + +From: Laurent Vivier + +[ Upstream commit 45ebc7e6c125ce93d2ddf82cd5bea20121bb0258 ] + +The virtqueue_resize() function was not correctly propagating error codes +from its internal resize helper functions, specifically +virtqueue_resize_packet() and virtqueue_resize_split(). If these helpers +returned an error, but the subsequent call to virtqueue_enable_after_reset() +succeeded, the original error from the resize operation would be masked. +Consequently, virtqueue_resize() could incorrectly report success to its +caller despite an underlying resize failure. + +This change restores the original code behavior: + + if (vdev->config->enable_vq_after_reset(_vq)) + return -EBUSY; + + return err; + +Fix: commit ad48d53b5b3f ("virtio_ring: separate the logic of reset/enable from virtqueue_resize") +Cc: xuanzhuo@linux.alibaba.com +Signed-off-by: Laurent Vivier +Acked-by: Jason Wang +Link: https://patch.msgid.link/20250521092236.661410-2-lvivier@redhat.com +Tested-by: Lei Yang +Acked-by: Michael S. Tsirkin +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 147926c8bae09..c0276979675df 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -2741,7 +2741,7 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num, + void (*recycle_done)(struct virtqueue *vq)) + { + struct vring_virtqueue *vq = to_vvq(_vq); +- int err; ++ int err, err_reset; + + if (num > vq->vq.num_max) + return -E2BIG; +@@ -2763,7 +2763,11 @@ int virtqueue_resize(struct virtqueue *_vq, u32 num, + else + err = virtqueue_resize_split(_vq, num); + +- return virtqueue_enable_after_reset(_vq); ++ err_reset = virtqueue_enable_after_reset(_vq); ++ if (err_reset) ++ return err_reset; ++ ++ return err; + } + EXPORT_SYMBOL_GPL(virtqueue_resize); + +-- +2.39.5 + diff --git a/queue-6.12/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch b/queue-6.12/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch new file mode 100644 index 0000000000..83f6f6710c --- /dev/null +++ b/queue-6.12/x86-hyperv-fix-usage-of-cpu_online_mask-to-get-valid.patch @@ -0,0 +1,56 @@ +From b8b8099fe641def0ab075436b3f5c997d768f929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jul 2025 15:44:34 -0700 +Subject: x86/hyperv: Fix usage of cpu_online_mask to get valid cpu + +From: Nuno Das Neves + +[ Upstream commit bb169f80ed5a156ec3405e0e49c6b8e9ae264718 ] + +Accessing cpu_online_mask here is problematic because the cpus read lock +is not held in this context. + +However, cpu_online_mask isn't needed here since the effective affinity +mask is guaranteed to be valid in this callback. So, just use +cpumask_first() to get the cpu instead of ANDing it with cpus_online_mask +unnecessarily. + +Fixes: e39397d1fd68 ("x86/hyperv: implement an MSI domain for root partition") +Reported-by: Michael Kelley +Closes: https://lore.kernel.org/linux-hyperv/SN6PR02MB4157639630F8AD2D8FD8F52FD475A@SN6PR02MB4157.namprd02.prod.outlook.com/ +Suggested-by: Thomas Gleixner +Signed-off-by: Nuno Das Neves +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com +Signed-off-by: Wei Liu +Message-ID: <1751582677-30930-4-git-send-email-nunodasneves@linux.microsoft.com> +Signed-off-by: Sasha Levin +--- + arch/x86/hyperv/irqdomain.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/x86/hyperv/irqdomain.c b/arch/x86/hyperv/irqdomain.c +index 3215a4a07408a..939b7081c5ab9 100644 +--- a/arch/x86/hyperv/irqdomain.c ++++ b/arch/x86/hyperv/irqdomain.c +@@ -192,7 +192,6 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + struct pci_dev *dev; + struct hv_interrupt_entry out_entry, *stored_entry; + struct irq_cfg *cfg = irqd_cfg(data); +- const cpumask_t *affinity; + int cpu; + u64 status; + +@@ -204,8 +203,7 @@ static void hv_irq_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + return; + } + +- affinity = irq_data_get_effective_affinity_mask(data); +- cpu = cpumask_first_and(affinity, cpu_online_mask); ++ cpu = cpumask_first(irq_data_get_effective_affinity_mask(data)); + + if (data->chip_data) { + /* +-- +2.39.5 + -- 2.47.2