--- /dev/null
+From 2af17c1fd0c7bdc552a33b08bb08e2cacf03be33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 21 Mar 2025 13:52:33 +0300
+Subject: drm/amd/pm: Prevent division by zero
+
+From: Denis Arefev <arefev@swemel.ru>
+
+[ Upstream commit 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c ]
+
+The user can set any speed value.
+If speed is greater than UINT_MAX/8, division by zero is possible.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Fixes: 031db09017da ("drm/amd/powerplay/vega20: enable fan RPM and pwm settings V2")
+Signed-off-by: Denis Arefev <arefev@swemel.ru>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c
+index ce56b93871e8f..d057c6f7e1fce 100644
+--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c
++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_thermal.c
+@@ -189,7 +189,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(struct pp_hwmgr *hwmgr, uint32_t speed)
+ uint32_t tach_period, crystal_clock_freq;
+ int result = 0;
+
+- if (!speed)
++ if (!speed || speed > UINT_MAX/8)
+ return -EINVAL;
+
+ if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) {
+--
+2.39.5
+
--- /dev/null
+From 8b9d01b4f62724ca85ee77c42732cf23baef3efe Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 Feb 2020 16:24:45 +0800
+Subject: ext4: code cleanup for ext4_statfs_project()
+
+From: Chengguang Xu <cgxu519@mykernel.net>
+
+[ Upstream commit a08fe66e4a0e12a3df982b28059f3a90e0f1b31e ]
+
+Calling min_not_zero() to simplify complicated prjquota
+limit comparison in ext4_statfs_project().
+
+Signed-off-by: Chengguang Xu <cgxu519@mykernel.net>
+Link: https://lore.kernel.org/r/20200210082445.2379-1-cgxu519@mykernel.net
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: f87d3af74193 ("ext4: don't over-report free space or inodes in statvfs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 8675b4dcc899d..332849e17b2bd 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5680,10 +5680,8 @@ static int ext4_statfs_project(struct super_block *sb,
+ return PTR_ERR(dquot);
+ spin_lock(&dquot->dq_dqb_lock);
+
+- limit = dquot->dq_dqb.dqb_bsoftlimit;
+- if (dquot->dq_dqb.dqb_bhardlimit &&
+- (!limit || dquot->dq_dqb.dqb_bhardlimit < limit))
+- limit = dquot->dq_dqb.dqb_bhardlimit;
++ limit = min_not_zero(dquot->dq_dqb.dqb_bsoftlimit,
++ dquot->dq_dqb.dqb_bhardlimit);
+ limit >>= sb->s_blocksize_bits;
+
+ if (limit && buf->f_blocks > limit) {
+@@ -5695,11 +5693,8 @@ static int ext4_statfs_project(struct super_block *sb,
+ (buf->f_blocks - curblock) : 0;
+ }
+
+- limit = dquot->dq_dqb.dqb_isoftlimit;
+- if (dquot->dq_dqb.dqb_ihardlimit &&
+- (!limit || dquot->dq_dqb.dqb_ihardlimit < limit))
+- limit = dquot->dq_dqb.dqb_ihardlimit;
+-
++ limit = min_not_zero(dquot->dq_dqb.dqb_isoftlimit,
++ dquot->dq_dqb.dqb_ihardlimit);
+ if (limit && buf->f_files > limit) {
+ buf->f_files = limit;
+ buf->f_ffree =
+--
+2.39.5
+
--- /dev/null
+From f3eb24b0d7528aa319d9cbfce3a4d03a38781b51 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Mar 2025 00:38:42 -0400
+Subject: ext4: don't over-report free space or inodes in statvfs
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit f87d3af7419307ae26e705a2b2db36140db367a2 ]
+
+This fixes an analogus bug that was fixed in xfs in commit
+4b8d867ca6e2 ("xfs: don't over-report free space or inodes in
+statvfs") where statfs can report misleading / incorrect information
+where project quota is enabled, and the free space is less than the
+remaining quota.
+
+This commit will resolve a test failure in generic/762 which tests for
+this bug.
+
+Cc: stable@kernel.org
+Fixes: 689c958cbe6b ("ext4: add project quota support")
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 332849e17b2bd..ff681888a123f 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5684,22 +5684,29 @@ static int ext4_statfs_project(struct super_block *sb,
+ dquot->dq_dqb.dqb_bhardlimit);
+ limit >>= sb->s_blocksize_bits;
+
+- if (limit && buf->f_blocks > limit) {
++ if (limit) {
++ uint64_t remaining = 0;
++
+ curblock = (dquot->dq_dqb.dqb_curspace +
+ dquot->dq_dqb.dqb_rsvspace) >> sb->s_blocksize_bits;
+- buf->f_blocks = limit;
+- buf->f_bfree = buf->f_bavail =
+- (buf->f_blocks > curblock) ?
+- (buf->f_blocks - curblock) : 0;
++ if (limit > curblock)
++ remaining = limit - curblock;
++
++ buf->f_blocks = min(buf->f_blocks, limit);
++ buf->f_bfree = min(buf->f_bfree, remaining);
++ buf->f_bavail = min(buf->f_bavail, remaining);
+ }
+
+ limit = min_not_zero(dquot->dq_dqb.dqb_isoftlimit,
+ dquot->dq_dqb.dqb_ihardlimit);
+- if (limit && buf->f_files > limit) {
+- buf->f_files = limit;
+- buf->f_ffree =
+- (buf->f_files > dquot->dq_dqb.dqb_curinodes) ?
+- (buf->f_files - dquot->dq_dqb.dqb_curinodes) : 0;
++ if (limit) {
++ uint64_t remaining = 0;
++
++ if (limit > dquot->dq_dqb.dqb_curinodes)
++ remaining = limit - dquot->dq_dqb.dqb_curinodes;
++
++ buf->f_files = min(buf->f_files, limit);
++ buf->f_ffree = min(buf->f_ffree, remaining);
+ }
+
+ spin_unlock(&dquot->dq_dqb_lock);
+--
+2.39.5
+
--- /dev/null
+From d1ccb754d6c78da713b0eb69cee29bbd6cdc5680 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Mar 2025 15:46:49 +0000
+Subject: ext4: fix OOB read when checking dotdot dir
+
+From: Acs, Jakub <acsjakub@amazon.de>
+
+[ Upstream commit d5e206778e96e8667d3bde695ad372c296dc9353 ]
+
+Mounting a corrupted filesystem with directory which contains '.' dir
+entry with rec_len == block size results in out-of-bounds read (later
+on, when the corrupted directory is removed).
+
+ext4_empty_dir() assumes every ext4 directory contains at least '.'
+and '..' as directory entries in the first data block. It first loads
+the '.' dir entry, performs sanity checks by calling ext4_check_dir_entry()
+and then uses its rec_len member to compute the location of '..' dir
+entry (in ext4_next_entry). It assumes the '..' dir entry fits into the
+same data block.
+
+If the rec_len of '.' is precisely one block (4KB), it slips through the
+sanity checks (it is considered the last directory entry in the data
+block) and leaves "struct ext4_dir_entry_2 *de" point exactly past the
+memory slot allocated to the data block. The following call to
+ext4_check_dir_entry() on new value of de then dereferences this pointer
+which results in out-of-bounds mem access.
+
+Fix this by extending __ext4_check_dir_entry() to check for '.' dir
+entries that reach the end of data block. Make sure to ignore the phony
+dir entries for checksum (by checking name_len for non-zero).
+
+Note: This is reported by KASAN as use-after-free in case another
+structure was recently freed from the slot past the bound, but it is
+really an OOB read.
+
+This issue was found by syzkaller tool.
+
+Call Trace:
+[ 38.594108] BUG: KASAN: slab-use-after-free in __ext4_check_dir_entry+0x67e/0x710
+[ 38.594649] Read of size 2 at addr ffff88802b41a004 by task syz-executor/5375
+[ 38.595158]
+[ 38.595288] CPU: 0 UID: 0 PID: 5375 Comm: syz-executor Not tainted 6.14.0-rc7 #1
+[ 38.595298] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
+[ 38.595304] Call Trace:
+[ 38.595308] <TASK>
+[ 38.595311] dump_stack_lvl+0xa7/0xd0
+[ 38.595325] print_address_description.constprop.0+0x2c/0x3f0
+[ 38.595339] ? __ext4_check_dir_entry+0x67e/0x710
+[ 38.595349] print_report+0xaa/0x250
+[ 38.595359] ? __ext4_check_dir_entry+0x67e/0x710
+[ 38.595368] ? kasan_addr_to_slab+0x9/0x90
+[ 38.595378] kasan_report+0xab/0xe0
+[ 38.595389] ? __ext4_check_dir_entry+0x67e/0x710
+[ 38.595400] __ext4_check_dir_entry+0x67e/0x710
+[ 38.595410] ext4_empty_dir+0x465/0x990
+[ 38.595421] ? __pfx_ext4_empty_dir+0x10/0x10
+[ 38.595432] ext4_rmdir.part.0+0x29a/0xd10
+[ 38.595441] ? __dquot_initialize+0x2a7/0xbf0
+[ 38.595455] ? __pfx_ext4_rmdir.part.0+0x10/0x10
+[ 38.595464] ? __pfx___dquot_initialize+0x10/0x10
+[ 38.595478] ? down_write+0xdb/0x140
+[ 38.595487] ? __pfx_down_write+0x10/0x10
+[ 38.595497] ext4_rmdir+0xee/0x140
+[ 38.595506] vfs_rmdir+0x209/0x670
+[ 38.595517] ? lookup_one_qstr_excl+0x3b/0x190
+[ 38.595529] do_rmdir+0x363/0x3c0
+[ 38.595537] ? __pfx_do_rmdir+0x10/0x10
+[ 38.595544] ? strncpy_from_user+0x1ff/0x2e0
+[ 38.595561] __x64_sys_unlinkat+0xf0/0x130
+[ 38.595570] do_syscall_64+0x5b/0x180
+[ 38.595583] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: ac27a0ec112a0 ("[PATCH] ext4: initial copy of files from ext3")
+Signed-off-by: Jakub Acs <acsjakub@amazon.de>
+Cc: Theodore Ts'o <tytso@mit.edu>
+Cc: Andreas Dilger <adilger.kernel@dilger.ca>
+Cc: linux-ext4@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Mahmoud Adam <mngyadam@amazon.com>
+Cc: stable@vger.kernel.org
+Cc: security@kernel.org
+Link: https://patch.msgid.link/b3ae36a6794c4a01944c7d70b403db5b@amazon.de
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/dir.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index c4f7fd22a907c..567c47cf4f20c 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -88,6 +88,9 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
+ else if (unlikely(le32_to_cpu(de->inode) >
+ le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
+ error_msg = "inode out of bounds";
++ else if (unlikely(next_offset == size && de->name_len == 1 &&
++ de->name[0] == '.'))
++ error_msg = "'.' directory cannot be the last in data block";
+ else
+ return 0;
+
+--
+2.39.5
+
--- /dev/null
+From 7a594ec25d0e1f63ca58f07e695da80c38412222 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 8 Dec 2019 19:43:46 -0500
+Subject: ext4: optimize __ext4_check_dir_entry()
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+[ Upstream commit 707d1a2f601bea6110a5633054253c0cb71b44c1 ]
+
+Make __ext4_check_dir_entry() a bit easier to understand, and reduce
+the object size of the function by over 11%.
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Link: https://lore.kernel.org/r/20191209004346.38526-1-tytso@mit.edu
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Stable-dep-of: d5e206778e96 ("ext4: fix OOB read when checking dotdot dir")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/dir.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index e8275b5d27439..c4f7fd22a907c 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -72,6 +72,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
+ const char *error_msg = NULL;
+ const int rlen = ext4_rec_len_from_disk(de->rec_len,
+ dir->i_sb->s_blocksize);
++ const int next_offset = ((char *) de - buf) + rlen;
+
+ if (unlikely(rlen < EXT4_DIR_REC_LEN(1)))
+ error_msg = "rec_len is smaller than minimal";
+@@ -79,13 +80,11 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
+ error_msg = "rec_len % 4 != 0";
+ else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len)))
+ error_msg = "rec_len is too small for name_len";
+- else if (unlikely(((char *) de - buf) + rlen > size))
++ else if (unlikely(next_offset > size))
+ error_msg = "directory entry overrun";
+- else if (unlikely(((char *) de - buf) + rlen >
+- size - EXT4_DIR_REC_LEN(1) &&
+- ((char *) de - buf) + rlen != size)) {
++ else if (unlikely(next_offset > size - EXT4_DIR_REC_LEN(1) &&
++ next_offset != size))
+ error_msg = "directory entry too close to block end";
+- }
+ else if (unlikely(le32_to_cpu(de->inode) >
+ le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
+ error_msg = "inode out of bounds";
+--
+2.39.5
+
--- /dev/null
+From 9ecb924db2ebdbf7dc162476ac6f3b9ddb08225e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Jan 2020 12:11:48 +0100
+Subject: ext4: simplify checking quota limits in ext4_statfs()
+
+From: Jan Kara <jack@suse.cz>
+
+[ Upstream commit 46d36880d1c6f9b9a0cbaf90235355ea1f4cab96 ]
+
+Coverity reports that conditions checking quota limits in ext4_statfs()
+contain dead code. Indeed it is right and current conditions can be
+simplified.
+
+Link: https://lore.kernel.org/r/20200130111148.10766-1-jack@suse.cz
+Reported-by: Coverity <scan-admin@coverity.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Stable-dep-of: f87d3af74193 ("ext4: don't over-report free space or inodes in statvfs")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/ext4/super.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 0d4d50c8038fd..8675b4dcc899d 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -5680,10 +5680,7 @@ static int ext4_statfs_project(struct super_block *sb,
+ return PTR_ERR(dquot);
+ spin_lock(&dquot->dq_dqb_lock);
+
+- limit = 0;
+- if (dquot->dq_dqb.dqb_bsoftlimit &&
+- (!limit || dquot->dq_dqb.dqb_bsoftlimit < limit))
+- limit = dquot->dq_dqb.dqb_bsoftlimit;
++ limit = dquot->dq_dqb.dqb_bsoftlimit;
+ if (dquot->dq_dqb.dqb_bhardlimit &&
+ (!limit || dquot->dq_dqb.dqb_bhardlimit < limit))
+ limit = dquot->dq_dqb.dqb_bhardlimit;
+@@ -5698,10 +5695,7 @@ static int ext4_statfs_project(struct super_block *sb,
+ (buf->f_blocks - curblock) : 0;
+ }
+
+- limit = 0;
+- if (dquot->dq_dqb.dqb_isoftlimit &&
+- (!limit || dquot->dq_dqb.dqb_isoftlimit < limit))
+- limit = dquot->dq_dqb.dqb_isoftlimit;
++ limit = dquot->dq_dqb.dqb_isoftlimit;
+ if (dquot->dq_dqb.dqb_ihardlimit &&
+ (!limit || dquot->dq_dqb.dqb_ihardlimit < limit))
+ limit = dquot->dq_dqb.dqb_ihardlimit;
+--
+2.39.5
+
--- /dev/null
+From 53cb4148273bf64b7d7617f938191cceaa6705ae Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 Mar 2025 18:00:29 -0300
+Subject: iio: adc: ad7768-1: Fix conversion result sign
+
+From: Sergiu Cuciurean <sergiu.cuciurean@analog.com>
+
+[ Upstream commit 8236644f5ecb180e80ad92d691c22bc509b747bb ]
+
+The ad7768-1 ADC output code is two's complement, meaning that the voltage
+conversion result is a signed value.. Since the value is a 24 bit one,
+stored in a 32 bit variable, the sign should be extended in order to get
+the correct representation.
+
+Also the channel description has been updated to signed representation,
+to match the ADC specifications.
+
+Fixes: a5f8c7da3dbe ("iio: adc: Add AD7768-1 ADC basic support")
+Reviewed-by: David Lechner <dlechner@baylibre.com>
+Reviewed-by: Marcelo Schmitt <marcelo.schmitt@analog.com>
+Signed-off-by: Sergiu Cuciurean <sergiu.cuciurean@analog.com>
+Signed-off-by: Jonathan Santos <Jonathan.Santos@analog.com>
+Cc: <Stable@vger.kernel.org>
+Link: https://patch.msgid.link/505994d3b71c2aa38ba714d909a68e021f12124c.1741268122.git.Jonathan.Santos@analog.com
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7768-1.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
+index 9b9956c0b076f..c1adb95f2a464 100644
+--- a/drivers/iio/adc/ad7768-1.c
++++ b/drivers/iio/adc/ad7768-1.c
+@@ -142,7 +142,7 @@ static const struct iio_chan_spec ad7768_channels[] = {
+ .channel = 0,
+ .scan_index = 0,
+ .scan_type = {
+- .sign = 'u',
++ .sign = 's',
+ .realbits = 24,
+ .storagebits = 32,
+ .shift = 8,
+@@ -373,7 +373,7 @@ static int ad7768_read_raw(struct iio_dev *indio_dev,
+ iio_device_release_direct_mode(indio_dev);
+ if (ret < 0)
+ return ret;
+- *val = ret;
++ *val = sign_extend32(ret, chan->scan_type.realbits - 1);
+
+ return IIO_VAL_INT;
+
+--
+2.39.5
+
--- /dev/null
+From dbd2d5c74a1e631b0e2d7b6984d925cd2c4df460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Feb 2025 14:16:12 +0000
+Subject: iio: adc: ad7768-1: Move setting of val a bit later to avoid
+ unnecessary return value check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+
+[ Upstream commit 0af1c801a15225304a6328258efbf2bee245c654 ]
+
+The data used is all in local variables so there is no advantage
+in setting *val = ret with the direct mode claim held.
+Move it later to after error check.
+
+Reviewed-by: Nuno Sá <nuno.sa@analog.com>
+Link: https://patch.msgid.link/20250217141630.897334-13-jic23@kernel.org
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Stable-dep-of: 8236644f5ecb ("iio: adc: ad7768-1: Fix conversion result sign")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7768-1.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/iio/adc/ad7768-1.c b/drivers/iio/adc/ad7768-1.c
+index 9e26517870595..9b9956c0b076f 100644
+--- a/drivers/iio/adc/ad7768-1.c
++++ b/drivers/iio/adc/ad7768-1.c
+@@ -369,12 +369,11 @@ static int ad7768_read_raw(struct iio_dev *indio_dev,
+ return ret;
+
+ ret = ad7768_scan_direct(indio_dev);
+- if (ret >= 0)
+- *val = ret;
+
+ iio_device_release_direct_mode(indio_dev);
+ if (ret < 0)
+ return ret;
++ *val = ret;
+
+ return IIO_VAL_INT;
+
+--
+2.39.5
+
--- /dev/null
+From 9aadf91e3fee8bda053784dcf7eb94b15bf3e230 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 19 Feb 2025 14:05:01 -0500
+Subject: media: vim2m: print device name after registering device
+
+From: Matthew Majewski <mattwmajewski@gmail.com>
+
+[ Upstream commit 143d75583f2427f3a97dba62413c4f0604867ebf ]
+
+Move the v4l2_info() call displaying the video device name after the
+device is actually registered.
+
+This fixes a bug where the driver was always displaying "/dev/video0"
+since it was reading from the vfd before it was registered.
+
+Fixes: cf7f34777a5b ("media: vim2m: Register video device after setting up internals")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Majewski <mattwmajewski@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vim2m.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/platform/vim2m.c b/drivers/media/platform/vim2m.c
+index 6fba00e03c67b..10c9e8026d981 100644
+--- a/drivers/media/platform/vim2m.c
++++ b/drivers/media/platform/vim2m.c
+@@ -1334,9 +1334,6 @@ static int vim2m_probe(struct platform_device *pdev)
+ vfd->v4l2_dev = &dev->v4l2_dev;
+
+ video_set_drvdata(vfd, dev);
+- v4l2_info(&dev->v4l2_dev,
+- "Device registered as /dev/video%d\n", vfd->num);
+-
+ platform_set_drvdata(pdev, dev);
+
+ dev->m2m_dev = v4l2_m2m_init(&m2m_ops);
+@@ -1363,6 +1360,9 @@ static int vim2m_probe(struct platform_device *pdev)
+ goto error_m2m;
+ }
+
++ v4l2_info(&dev->v4l2_dev,
++ "Device registered as /dev/video%d\n", vfd->num);
++
+ #ifdef CONFIG_MEDIA_CONTROLLER
+ ret = v4l2_m2m_register_media_controller(dev->m2m_dev, vfd,
+ MEDIA_ENT_F_PROC_VIDEO_SCALER);
+--
+2.39.5
+
--- /dev/null
+From 86d76ef4c1a05f102000ac30c55d42bf710936e8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 25 Feb 2025 20:02:49 +0900
+Subject: misc: pci_endpoint_test: Fix displaying 'irq_type' after
+ 'request_irq' error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+
+[ Upstream commit 919d14603dab6a9cf03ebbeb2cfa556df48737c8 ]
+
+There are two variables that indicate the interrupt type to be used
+in the next test execution, global "irq_type" and "test->irq_type".
+
+The former is referenced from pci_endpoint_test_get_irq() to preserve
+the current type for ioctl(PCITEST_GET_IRQTYPE).
+
+In the pci_endpoint_test_request_irq(), since this global variable
+is referenced when an error occurs, the unintended error message is
+displayed.
+
+For example, after running "pcitest -i 2", the following message
+shows "MSI 3" even if the current IRQ type becomes "MSI-X":
+
+ pci-endpoint-test 0000:01:00.0: Failed to request IRQ 30 for MSI 3
+ SET IRQ TYPE TO MSI-X: NOT OKAY
+
+Fix this issue by using "test->irq_type" instead of global "irq_type".
+
+Cc: stable@vger.kernel.org
+Fixes: b2ba9225e031 ("misc: pci_endpoint_test: Avoid using module parameter to determine irqtype")
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
+Link: https://lore.kernel.org/r/20250225110252.28866-4-hayashi.kunihiko@socionext.com
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/pci_endpoint_test.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index fcb7dc8e79d43..711db6667b087 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -230,7 +230,7 @@ static bool pci_endpoint_test_request_irq(struct pci_endpoint_test *test)
+ return true;
+
+ fail:
+- switch (irq_type) {
++ switch (test->irq_type) {
+ case IRQ_TYPE_INTX:
+ dev_err(dev, "Failed to request IRQ %d for Legacy\n",
+ pci_irq_vector(pdev, i));
+--
+2.39.5
+
--- /dev/null
+From 568838113a59264a0ca7d5eea7ff4e4c56074733 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 15:03:55 +0900
+Subject: misc: pci_endpoint_test: Use INTX instead of LEGACY
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+[ Upstream commit acd288666979a49538d70e0c0d86e1118b445058 ]
+
+In the root complex pci endpoint test function driver, change macros and
+functions names using the term "legacy" to use "intx" instead to
+match the term used in the PCI specifications.
+
+Link: https://lore.kernel.org/r/20231122060406.14695-6-dlemoal@kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Stable-dep-of: 919d14603dab ("misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/misc/pci_endpoint_test.c | 30 +++++++++++++++---------------
+ include/uapi/linux/pcitest.h | 3 ++-
+ 2 files changed, 17 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index f9dd3e6546a50..fcb7dc8e79d43 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -27,14 +27,14 @@
+ #define DRV_MODULE_NAME "pci-endpoint-test"
+
+ #define IRQ_TYPE_UNDEFINED -1
+-#define IRQ_TYPE_LEGACY 0
++#define IRQ_TYPE_INTX 0
+ #define IRQ_TYPE_MSI 1
+ #define IRQ_TYPE_MSIX 2
+
+ #define PCI_ENDPOINT_TEST_MAGIC 0x0
+
+ #define PCI_ENDPOINT_TEST_COMMAND 0x4
+-#define COMMAND_RAISE_LEGACY_IRQ BIT(0)
++#define COMMAND_RAISE_INTX_IRQ BIT(0)
+ #define COMMAND_RAISE_MSI_IRQ BIT(1)
+ #define COMMAND_RAISE_MSIX_IRQ BIT(2)
+ #define COMMAND_READ BIT(3)
+@@ -170,8 +170,8 @@ static bool pci_endpoint_test_alloc_irq_vectors(struct pci_endpoint_test *test,
+ bool res = true;
+
+ switch (type) {
+- case IRQ_TYPE_LEGACY:
+- irq = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_LEGACY);
++ case IRQ_TYPE_INTX:
++ irq = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_INTX);
+ if (irq < 0)
+ dev_err(dev, "Failed to get Legacy interrupt\n");
+ break;
+@@ -231,7 +231,7 @@ static bool pci_endpoint_test_request_irq(struct pci_endpoint_test *test)
+
+ fail:
+ switch (irq_type) {
+- case IRQ_TYPE_LEGACY:
++ case IRQ_TYPE_INTX:
+ dev_err(dev, "Failed to request IRQ %d for Legacy\n",
+ pci_irq_vector(pdev, i));
+ break;
+@@ -281,15 +281,15 @@ static bool pci_endpoint_test_bar(struct pci_endpoint_test *test,
+ return true;
+ }
+
+-static bool pci_endpoint_test_legacy_irq(struct pci_endpoint_test *test)
++static bool pci_endpoint_test_intx_irq(struct pci_endpoint_test *test)
+ {
+ u32 val;
+
+ pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_IRQ_TYPE,
+- IRQ_TYPE_LEGACY);
++ IRQ_TYPE_INTX);
+ pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_IRQ_NUMBER, 0);
+ pci_endpoint_test_writel(test, PCI_ENDPOINT_TEST_COMMAND,
+- COMMAND_RAISE_LEGACY_IRQ);
++ COMMAND_RAISE_INTX_IRQ);
+ val = wait_for_completion_timeout(&test->irq_raised,
+ msecs_to_jiffies(1000));
+ if (!val)
+@@ -344,7 +344,7 @@ static bool pci_endpoint_test_copy(struct pci_endpoint_test *test, size_t size)
+ if (size > SIZE_MAX - alignment)
+ goto err;
+
+- if (irq_type < IRQ_TYPE_LEGACY || irq_type > IRQ_TYPE_MSIX) {
++ if (irq_type < IRQ_TYPE_INTX || irq_type > IRQ_TYPE_MSIX) {
+ dev_err(dev, "Invalid IRQ type option\n");
+ goto err;
+ }
+@@ -440,7 +440,7 @@ static bool pci_endpoint_test_write(struct pci_endpoint_test *test, size_t size)
+ if (size > SIZE_MAX - alignment)
+ goto err;
+
+- if (irq_type < IRQ_TYPE_LEGACY || irq_type > IRQ_TYPE_MSIX) {
++ if (irq_type < IRQ_TYPE_INTX || irq_type > IRQ_TYPE_MSIX) {
+ dev_err(dev, "Invalid IRQ type option\n");
+ goto err;
+ }
+@@ -509,7 +509,7 @@ static bool pci_endpoint_test_read(struct pci_endpoint_test *test, size_t size)
+ if (size > SIZE_MAX - alignment)
+ goto err;
+
+- if (irq_type < IRQ_TYPE_LEGACY || irq_type > IRQ_TYPE_MSIX) {
++ if (irq_type < IRQ_TYPE_INTX || irq_type > IRQ_TYPE_MSIX) {
+ dev_err(dev, "Invalid IRQ type option\n");
+ goto err;
+ }
+@@ -560,7 +560,7 @@ static bool pci_endpoint_test_set_irq(struct pci_endpoint_test *test,
+ struct pci_dev *pdev = test->pdev;
+ struct device *dev = &pdev->dev;
+
+- if (req_irq_type < IRQ_TYPE_LEGACY || req_irq_type > IRQ_TYPE_MSIX) {
++ if (req_irq_type < IRQ_TYPE_INTX || req_irq_type > IRQ_TYPE_MSIX) {
+ dev_err(dev, "Invalid IRQ type option\n");
+ return false;
+ }
+@@ -607,8 +607,8 @@ static long pci_endpoint_test_ioctl(struct file *file, unsigned int cmd,
+ goto ret;
+ ret = pci_endpoint_test_bar(test, bar);
+ break;
+- case PCITEST_LEGACY_IRQ:
+- ret = pci_endpoint_test_legacy_irq(test);
++ case PCITEST_INTX_IRQ:
++ ret = pci_endpoint_test_intx_irq(test);
+ break;
+ case PCITEST_MSI:
+ case PCITEST_MSIX:
+@@ -668,7 +668,7 @@ static int pci_endpoint_test_probe(struct pci_dev *pdev,
+ test->irq_type = IRQ_TYPE_UNDEFINED;
+
+ if (no_msi)
+- irq_type = IRQ_TYPE_LEGACY;
++ irq_type = IRQ_TYPE_INTX;
+
+ data = (struct pci_endpoint_test_data *)ent->driver_data;
+ if (data) {
+diff --git a/include/uapi/linux/pcitest.h b/include/uapi/linux/pcitest.h
+index cbf422e566962..1f358a135de04 100644
+--- a/include/uapi/linux/pcitest.h
++++ b/include/uapi/linux/pcitest.h
+@@ -11,7 +11,8 @@
+ #define __UAPI_LINUX_PCITEST_H
+
+ #define PCITEST_BAR _IO('P', 0x1)
+-#define PCITEST_LEGACY_IRQ _IO('P', 0x2)
++#define PCITEST_INTX_IRQ _IO('P', 0x2)
++#define PCITEST_LEGACY_IRQ PCITEST_INTX_IRQ
+ #define PCITEST_MSI _IOW('P', 0x3, int)
+ #define PCITEST_WRITE _IOW('P', 0x4, unsigned long)
+ #define PCITEST_READ _IOW('P', 0x5, unsigned long)
+--
+2.39.5
+
--- /dev/null
+From f9796cd21d0a430428a9c3068d54ec1c58ba066b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 17 Mar 2025 18:32:44 +0100
+Subject: net: dsa: mv88e6xxx: fix VTU methods for 6320 family
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marek Behún <kabel@kernel.org>
+
+[ Upstream commit f9a457722cf5e3534be5ffab549d6b49737fca72 ]
+
+The VTU registers of the 6320 family use the 6352 semantics, not 6185.
+Fix it.
+
+Fixes: b8fee9571063 ("net: dsa: mv88e6xxx: add VLAN Get Next support")
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Cc: <stable@vger.kernel.org> # 5.15.x
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250317173250.28780-2-kabel@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/mv88e6xxx/chip.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index 86c4ec13b4b64..9264fe6648fdb 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -3861,8 +3861,8 @@ static const struct mv88e6xxx_ops mv88e6320_ops = {
+ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .pot_clear = mv88e6xxx_g2_pot_clear,
+ .reset = mv88e6352_g1_reset,
+- .vtu_getnext = mv88e6185_g1_vtu_getnext,
+- .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
++ .vtu_getnext = mv88e6352_g1_vtu_getnext,
++ .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+ .gpio_ops = &mv88e6352_gpio_ops,
+ .avb_ops = &mv88e6352_avb_ops,
+ .ptp_ops = &mv88e6352_ptp_ops,
+@@ -3905,8 +3905,8 @@ static const struct mv88e6xxx_ops mv88e6321_ops = {
+ .watchdog_ops = &mv88e6390_watchdog_ops,
+ .mgmt_rsvd2cpu = mv88e6352_g2_mgmt_rsvd2cpu,
+ .reset = mv88e6352_g1_reset,
+- .vtu_getnext = mv88e6185_g1_vtu_getnext,
+- .vtu_loadpurge = mv88e6185_g1_vtu_loadpurge,
++ .vtu_getnext = mv88e6352_g1_vtu_getnext,
++ .vtu_loadpurge = mv88e6352_g1_vtu_loadpurge,
+ .gpio_ops = &mv88e6352_gpio_ops,
+ .avb_ops = &mv88e6352_avb_ops,
+ .ptp_ops = &mv88e6352_ptp_ops,
+--
+2.39.5
+
--- /dev/null
+From 27e66ad04f2d78e9cf96be9acf8dba74ce612a28 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Nov 2023 15:03:51 +0900
+Subject: PCI: Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+[ Upstream commit 58ff9c5acb4aef58e118bbf39736cc4d6c11a3d3 ]
+
+Rename PCI_IRQ_LEGACY to PCI_IRQ_INTX to be more explicit about the type
+of IRQ being referenced as well as to match the PCI specifications
+terms. Redefine PCI_IRQ_LEGACY as an alias to PCI_IRQ_INTX to avoid the
+need for doing the renaming tree-wide. New drivers and new code should
+now prefer using PCI_IRQ_INTX instead of PCI_IRQ_LEGACY.
+
+Link: https://lore.kernel.org/r/20231122060406.14695-2-dlemoal@kernel.org
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Stable-dep-of: 919d14603dab ("misc: pci_endpoint_test: Fix displaying 'irq_type' after 'request_irq' error")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/pci.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 7edc6de9e88c2..f2f92eb950cc6 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -935,11 +935,13 @@ enum {
+ PCI_SCAN_ALL_PCIE_DEVS = 0x00000040, /* Scan all, not just dev 0 */
+ };
+
+-#define PCI_IRQ_LEGACY (1 << 0) /* Allow legacy interrupts */
++#define PCI_IRQ_INTX (1 << 0) /* Allow INTx interrupts */
+ #define PCI_IRQ_MSI (1 << 1) /* Allow MSI interrupts */
+ #define PCI_IRQ_MSIX (1 << 2) /* Allow MSI-X interrupts */
+ #define PCI_IRQ_AFFINITY (1 << 3) /* Auto-assign affinity */
+
++#define PCI_IRQ_LEGACY PCI_IRQ_INTX /* Deprecated! Use PCI_IRQ_INTX */
++
+ /* These external functions are only available when PCI support is enabled */
+ #ifdef CONFIG_PCI
+
+--
+2.39.5
+
--- /dev/null
+From 23c7449126ef006f4ba12dca44d246a47e3e7cab Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 28 Mar 2025 15:47:49 -0700
+Subject: platform/x86: ISST: Correct command storage data length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+[ Upstream commit 9462e74c5c983cce34019bfb27f734552bebe59f ]
+
+After resume/online turbo limit ratio (TRL) is restored partially if
+the admin explicitly changed TRL from user space.
+
+A hash table is used to store SST mail box and MSR settings when modified
+to restore those settings after resume or online. This uses a struct
+isst_cmd field "data" to store these settings. This is a 64 bit field.
+But isst_store_new_cmd() is only assigning as u32. This results in
+truncation of 32 bits.
+
+Change the argument to u64 from u32.
+
+Fixes: f607874f35cb ("platform/x86: ISST: Restore state on resume")
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250328224749.2691272-1-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/intel_speed_select_if/isst_if_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel_speed_select_if/isst_if_common.c b/drivers/platform/x86/intel_speed_select_if/isst_if_common.c
+index cf7b6dee82191..d561e49741ba3 100644
+--- a/drivers/platform/x86/intel_speed_select_if/isst_if_common.c
++++ b/drivers/platform/x86/intel_speed_select_if/isst_if_common.c
+@@ -74,7 +74,7 @@ static DECLARE_HASHTABLE(isst_hash, 8);
+ static DEFINE_MUTEX(isst_hash_lock);
+
+ static int isst_store_new_cmd(int cmd, u32 cpu, int mbox_cmd_type, u32 param,
+- u32 data)
++ u64 data)
+ {
+ struct isst_cmd *sst_cmd;
+
+--
+2.39.5
+
mips-dec-declare-which_prom-as-static.patch
mips-cevt-ds1287-add-missing-ds1287.h-include.patch
mips-ds1287-match-ds1287_set_base_clock-function-types.patch
+platform-x86-isst-correct-command-storage-data-lengt.patch
+ext4-simplify-checking-quota-limits-in-ext4_statfs.patch
+ext4-code-cleanup-for-ext4_statfs_project.patch
+ext4-don-t-over-report-free-space-or-inodes-in-statv.patch
+ext4-optimize-__ext4_check_dir_entry.patch
+ext4-fix-oob-read-when-checking-dotdot-dir.patch
+media-vim2m-print-device-name-after-registering-devi.patch
+net-dsa-mv88e6xxx-fix-vtu-methods-for-6320-family.patch
+iio-adc-ad7768-1-move-setting-of-val-a-bit-later-to-.patch
+iio-adc-ad7768-1-fix-conversion-result-sign.patch
+pci-rename-pci_irq_legacy-to-pci_irq_intx.patch
+misc-pci_endpoint_test-use-intx-instead-of-legacy.patch
+misc-pci_endpoint_test-fix-displaying-irq_type-after.patch
+drm-amd-pm-prevent-division-by-zero.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
