--- /dev/null
+From stable+bounces-227162-greg=kroah.com@vger.kernel.org Wed Mar 18 22:03:28 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 17:03:22 -0400
+Subject: cifs: open files should not hold ref on superblock
+To: stable@vger.kernel.org
+Cc: Shyam Prasad N <sprasad@microsoft.com>, Steve French <stfrench@microsoft.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260318210322.1281192-1-sashal@kernel.org>
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+[ Upstream commit 340cea84f691c5206561bb2e0147158fe02070be ]
+
+Today whenever we deal with a file, in addition to holding
+a reference on the dentry, we also get a reference on the
+superblock. This happens in two cases:
+1. when a new cinode is allocated
+2. when an oplock break is being processed
+
+The reasoning for holding the superblock ref was to make sure
+that when umount happens, if there are users of inodes and
+dentries, it does not try to clean them up and wait for the
+last ref to superblock to be dropped by last of such users.
+
+But the side effect of doing that is that umount silently drops
+a ref on the superblock and we could have deferred closes and
+lease breaks still holding these refs.
+
+Ideally, we should ensure that all of these users of inodes and
+dentries are cleaned up at the time of umount, which is what this
+code is doing.
+
+This code change allows these code paths to use a ref on the
+dentry (and hence the inode). That way, umount is
+ensured to clean up SMB client resources when it's the last
+ref on the superblock (For ex: when same objects are shared).
+
+The code change also moves the call to close all the files in
+deferred close list to the umount code path. It also waits for
+oplock_break workers to be flushed before calling
+kill_anon_super (which eventually frees up those objects).
+
+Fixes: 24261fc23db9 ("cifs: delay super block destruction until all cifsFileInfo objects are gone")
+Fixes: 705c79101ccf ("smb: client: fix use-after-free in cifs_oplock_break")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+[ replaced kmalloc_obj() with kmalloc(sizeof(...)) ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cifsfs.c | 7 +++++--
+ fs/smb/client/cifsproto.h | 1 +
+ fs/smb/client/file.c | 11 -----------
+ fs/smb/client/misc.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ fs/smb/client/trace.h | 2 ++
+ 5 files changed, 50 insertions(+), 13 deletions(-)
+
+--- a/fs/smb/client/cifsfs.c
++++ b/fs/smb/client/cifsfs.c
+@@ -331,10 +331,14 @@ static void cifs_kill_sb(struct super_bl
+
+ /*
+ * We need to release all dentries for the cached directories
+- * before we kill the sb.
++ * and close all deferred file handles before we kill the sb.
+ */
+ if (cifs_sb->root) {
+ close_all_cached_dirs(cifs_sb);
++ cifs_close_all_deferred_files_sb(cifs_sb);
++
++ /* Wait for all pending oplock breaks to complete */
++ flush_workqueue(cifsoplockd_wq);
+
+ /* finally release root dentry */
+ dput(cifs_sb->root);
+@@ -865,7 +869,6 @@ static void cifs_umount_begin(struct sup
+ spin_unlock(&tcon->tc_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+
+- cifs_close_all_deferred_files(tcon);
+ /* cancel_brl_requests(tcon); */ /* BB mark all brl mids as exiting */
+ /* cancel_notify_requests(tcon); */
+ if (tcon->ses && tcon->ses->server) {
+--- a/fs/smb/client/cifsproto.h
++++ b/fs/smb/client/cifsproto.h
+@@ -302,6 +302,7 @@ extern void cifs_close_deferred_file(str
+
+ extern void cifs_close_all_deferred_files(struct cifs_tcon *cifs_tcon);
+
++void cifs_close_all_deferred_files_sb(struct cifs_sb_info *cifs_sb);
+ void cifs_close_deferred_file_under_dentry(struct cifs_tcon *cifs_tcon,
+ struct dentry *dentry);
+
+--- a/fs/smb/client/file.c
++++ b/fs/smb/client/file.c
+@@ -705,8 +705,6 @@ struct cifsFileInfo *cifs_new_fileinfo(s
+ mutex_init(&cfile->fh_mutex);
+ spin_lock_init(&cfile->file_info_lock);
+
+- cifs_sb_active(inode->i_sb);
+-
+ /*
+ * If the server returned a read oplock and we have mandatory brlocks,
+ * set oplock level to None.
+@@ -761,7 +759,6 @@ static void cifsFileInfo_put_final(struc
+ struct inode *inode = d_inode(cifs_file->dentry);
+ struct cifsInodeInfo *cifsi = CIFS_I(inode);
+ struct cifsLockInfo *li, *tmp;
+- struct super_block *sb = inode->i_sb;
+
+ /*
+ * Delete any outstanding lock records. We'll lose them when the file
+@@ -779,7 +776,6 @@ static void cifsFileInfo_put_final(struc
+
+ cifs_put_tlink(cifs_file->tlink);
+ dput(cifs_file->dentry);
+- cifs_sb_deactive(sb);
+ kfree(cifs_file->symlink_target);
+ kfree(cifs_file);
+ }
+@@ -3151,12 +3147,6 @@ void cifs_oplock_break(struct work_struc
+ __u64 persistent_fid, volatile_fid;
+ __u16 net_fid;
+
+- /*
+- * Hold a reference to the superblock to prevent it and its inodes from
+- * being freed while we are accessing cinode. Otherwise, _cifsFileInfo_put()
+- * may release the last reference to the sb and trigger inode eviction.
+- */
+- cifs_sb_active(sb);
+ wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
+ TASK_UNINTERRUPTIBLE);
+
+@@ -3229,7 +3219,6 @@ oplock_break_ack:
+ cifs_put_tlink(tlink);
+ out:
+ cifs_done_oplock_break(cinode);
+- cifs_sb_deactive(sb);
+ }
+
+ static int cifs_swap_activate(struct swap_info_struct *sis,
+--- a/fs/smb/client/misc.c
++++ b/fs/smb/client/misc.c
+@@ -28,6 +28,11 @@
+ #include "fs_context.h"
+ #include "cached_dir.h"
+
++struct tcon_list {
++ struct list_head entry;
++ struct cifs_tcon *tcon;
++};
++
+ /* The xid serves as a useful identifier for each incoming vfs request,
+ in a similar way to the mid which is useful to track each sent smb,
+ and CurrentXid can also provide a running counter (although it
+@@ -839,6 +844,43 @@ cifs_close_all_deferred_files(struct cif
+ kfree(tmp_list);
+ }
+ }
++
++void cifs_close_all_deferred_files_sb(struct cifs_sb_info *cifs_sb)
++{
++ struct rb_root *root = &cifs_sb->tlink_tree;
++ struct rb_node *node;
++ struct cifs_tcon *tcon;
++ struct tcon_link *tlink;
++ struct tcon_list *tmp_list, *q;
++ LIST_HEAD(tcon_head);
++
++ spin_lock(&cifs_sb->tlink_tree_lock);
++ for (node = rb_first(root); node; node = rb_next(node)) {
++ tlink = rb_entry(node, struct tcon_link, tl_rbnode);
++ tcon = tlink_tcon(tlink);
++ if (IS_ERR(tcon))
++ continue;
++ tmp_list = kmalloc(sizeof(struct tcon_list), GFP_ATOMIC);
++ if (tmp_list == NULL)
++ break;
++ tmp_list->tcon = tcon;
++ /* Take a reference on tcon to prevent it from being freed */
++ spin_lock(&tcon->tc_lock);
++ ++tcon->tc_count;
++ trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count,
++ netfs_trace_tcon_ref_get_close_defer_files);
++ spin_unlock(&tcon->tc_lock);
++ list_add_tail(&tmp_list->entry, &tcon_head);
++ }
++ spin_unlock(&cifs_sb->tlink_tree_lock);
++
++ list_for_each_entry_safe(tmp_list, q, &tcon_head, entry) {
++ cifs_close_all_deferred_files(tmp_list->tcon);
++ list_del(&tmp_list->entry);
++ cifs_put_tcon(tmp_list->tcon, netfs_trace_tcon_ref_put_close_defer_files);
++ kfree(tmp_list);
++ }
++}
+
+ void cifs_close_deferred_file_under_dentry(struct cifs_tcon *tcon,
+ struct dentry *dentry)
+--- a/fs/smb/client/trace.h
++++ b/fs/smb/client/trace.h
+@@ -177,6 +177,7 @@
+ EM(netfs_trace_tcon_ref_get_cached_laundromat, "GET Ch-Lau") \
+ EM(netfs_trace_tcon_ref_get_cached_lease_break, "GET Ch-Lea") \
+ EM(netfs_trace_tcon_ref_get_cancelled_close, "GET Cn-Cls") \
++ EM(netfs_trace_tcon_ref_get_close_defer_files, "GET Cl-Def") \
+ EM(netfs_trace_tcon_ref_get_dfs_refer, "GET DfsRef") \
+ EM(netfs_trace_tcon_ref_get_find, "GET Find ") \
+ EM(netfs_trace_tcon_ref_get_find_sess_tcon, "GET FndSes") \
+@@ -188,6 +189,7 @@
+ EM(netfs_trace_tcon_ref_put_cancelled_close, "PUT Cn-Cls") \
+ EM(netfs_trace_tcon_ref_put_cancelled_close_fid, "PUT Cn-Fid") \
+ EM(netfs_trace_tcon_ref_put_cancelled_mid, "PUT Cn-Mid") \
++ EM(netfs_trace_tcon_ref_put_close_defer_files, "PUT Cl-Def") \
+ EM(netfs_trace_tcon_ref_put_mnt_ctx, "PUT MntCtx") \
+ EM(netfs_trace_tcon_ref_put_dfs_refer, "PUT DfsRfr") \
+ EM(netfs_trace_tcon_ref_put_reconnect_server, "PUT Reconn") \
--- /dev/null
+From stable+bounces-227186-greg=kroah.com@vger.kernel.org Thu Mar 19 01:36:02 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 20:35:55 -0400
+Subject: crypto: atmel-sha204a - Fix OOM ->tfm_count leak
+To: stable@vger.kernel.org
+Cc: Thorsten Blum <thorsten.blum@linux.dev>, Herbert Xu <herbert@gondor.apana.org.au>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260319003555.1847154-1-sashal@kernel.org>
+
+From: Thorsten Blum <thorsten.blum@linux.dev>
+
+[ Upstream commit d240b079a37e90af03fd7dfec94930eb6c83936e ]
+
+If memory allocation fails, decrement ->tfm_count to avoid blocking
+future reads.
+
+Cc: stable@vger.kernel.org
+Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator")
+Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+[ adapted kmalloc_obj() macro to kmalloc(sizeof()) ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/crypto/atmel-sha204a.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/crypto/atmel-sha204a.c
++++ b/drivers/crypto/atmel-sha204a.c
+@@ -52,9 +52,10 @@ static int atmel_sha204a_rng_read_nonblo
+ rng->priv = 0;
+ } else {
+ work_data = kmalloc(sizeof(*work_data), GFP_ATOMIC);
+- if (!work_data)
++ if (!work_data) {
++ atomic_dec(&i2c_priv->tfm_count);
+ return -ENOMEM;
+-
++ }
+ work_data->ctx = i2c_priv;
+ work_data->client = i2c_priv->client;
+
--- /dev/null
+From bb5f1cd10101c2567bff4d0e760b74aee7c42f44 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com>
+Date: Wed, 4 Mar 2026 13:30:10 +0200
+Subject: drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+commit bb5f1cd10101c2567bff4d0e760b74aee7c42f44 upstream.
+
+There are slice row per frame and pic height configuration in DSC Selective
+Update Parameter Set 1 register. Add helper for configuring these.
+
+v2:
+ - Add WARN_ON_ONCE if vdsc instances per pipe > 2
+ - instead of checking vdsc instances per pipe being > 1 check == 2
+
+Bspec: 71709
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Link: https://patch.msgid.link/20260304113011.626542-4-jouni.hogander@intel.com
+(cherry picked from commit c8698d61aeb3f70fe33761ee9d3d0e131b5bc2eb)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+[tursulin: fixup forward declaration conflict]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_vdsc.c | 23 +++++++++++++++++++++++
+ drivers/gpu/drm/i915/display/intel_vdsc.h | 3 +++
+ 2 files changed, 26 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_vdsc.c
++++ b/drivers/gpu/drm/i915/display/intel_vdsc.c
+@@ -767,6 +767,29 @@ void intel_dsc_dp_pps_write(struct intel
+ sizeof(dp_dsc_pps_sdp));
+ }
+
++void intel_dsc_su_et_parameters_configure(struct intel_dsb *dsb, struct intel_encoder *encoder,
++ const struct intel_crtc_state *crtc_state, int su_lines)
++{
++ struct intel_display *display = to_intel_display(crtc_state);
++ struct intel_crtc *crtc = to_intel_crtc(crtc_state->uapi.crtc);
++ const struct drm_dsc_config *vdsc_cfg = &crtc_state->dsc.config;
++ enum pipe pipe = crtc->pipe;
++ int vdsc_instances_per_pipe = intel_dsc_get_vdsc_per_pipe(crtc_state);
++ int slice_row_per_frame = su_lines / vdsc_cfg->slice_height;
++ u32 val;
++
++ drm_WARN_ON_ONCE(display->drm, su_lines % vdsc_cfg->slice_height);
++ drm_WARN_ON_ONCE(display->drm, vdsc_instances_per_pipe > 2);
++
++ val = DSC_SUPS0_SU_SLICE_ROW_PER_FRAME(slice_row_per_frame);
++ val |= DSC_SUPS0_SU_PIC_HEIGHT(su_lines);
++
++ intel_de_write_dsb(display, dsb, LNL_DSC0_SU_PARAMETER_SET_0(pipe), val);
++
++ if (vdsc_instances_per_pipe == 2)
++ intel_de_write_dsb(display, dsb, LNL_DSC1_SU_PARAMETER_SET_0(pipe), val);
++}
++
+ static i915_reg_t dss_ctl1_reg(struct intel_crtc *crtc, enum transcoder cpu_transcoder)
+ {
+ return is_pipe_dsc(crtc, cpu_transcoder) ?
+--- a/drivers/gpu/drm/i915/display/intel_vdsc.h
++++ b/drivers/gpu/drm/i915/display/intel_vdsc.h
+@@ -13,6 +13,7 @@ struct drm_printer;
+ enum transcoder;
+ struct intel_crtc;
+ struct intel_crtc_state;
++struct intel_dsb;
+ struct intel_encoder;
+
+ bool intel_dsc_source_support(const struct intel_crtc_state *crtc_state);
+@@ -31,6 +32,8 @@ void intel_dsc_dsi_pps_write(struct inte
+ const struct intel_crtc_state *crtc_state);
+ void intel_dsc_dp_pps_write(struct intel_encoder *encoder,
+ const struct intel_crtc_state *crtc_state);
++void intel_dsc_su_et_parameters_configure(struct intel_dsb *dsb, struct intel_encoder *encoder,
++ const struct intel_crtc_state *crtc_state, int su_lines);
+ void intel_vdsc_state_dump(struct drm_printer *p, int indent,
+ const struct intel_crtc_state *crtc_state);
+ int intel_vdsc_min_cdclk(const struct intel_crtc_state *crtc_state);
--- /dev/null
+From c2c79c6d5b939ae8a42ddb884f576bddae685672 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com>
+Date: Wed, 4 Mar 2026 13:30:09 +0200
+Subject: drm/i915/dsc: Add Selective Update register definitions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+commit c2c79c6d5b939ae8a42ddb884f576bddae685672 upstream.
+
+Add definitions for DSC_SU_PARAMETER_SET_0_DSC0 and
+DSC_SU_PARAMETER_SET_0_DSC1 registers. These are for Selective Update Early
+Transport configuration.
+
+Bspec: 71709
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Link: https://patch.msgid.link/20260304113011.626542-3-jouni.hogander@intel.com
+(cherry picked from commit 24f96d903daf3dcf8fafe84d3d22b80ef47ba493)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_vdsc_regs.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_vdsc_regs.h
++++ b/drivers/gpu/drm/i915/display/intel_vdsc_regs.h
+@@ -196,6 +196,18 @@
+ #define DSC_PPS18_NSL_BPG_OFFSET(offset) REG_FIELD_PREP(DSC_PPS18_NSL_BPG_OFFSET_MASK, offset)
+ #define DSC_PPS18_SL_OFFSET_ADJ(offset) REG_FIELD_PREP(DSC_PPS18_SL_OFFSET_ADJ_MASK, offset)
+
++#define _LNL_DSC0_SU_PARAMETER_SET_0_PA 0x78064
++#define _LNL_DSC1_SU_PARAMETER_SET_0_PA 0x78164
++#define _LNL_DSC0_SU_PARAMETER_SET_0_PB 0x78264
++#define _LNL_DSC1_SU_PARAMETER_SET_0_PB 0x78364
++#define LNL_DSC0_SU_PARAMETER_SET_0(pipe) _MMIO_PIPE((pipe), _LNL_DSC0_SU_PARAMETER_SET_0_PA, _LNL_DSC0_SU_PARAMETER_SET_0_PB)
++#define LNL_DSC1_SU_PARAMETER_SET_0(pipe) _MMIO_PIPE((pipe), _LNL_DSC1_SU_PARAMETER_SET_0_PA, _LNL_DSC1_SU_PARAMETER_SET_0_PB)
++
++#define DSC_SUPS0_SU_SLICE_ROW_PER_FRAME_MASK REG_GENMASK(31, 20)
++#define DSC_SUPS0_SU_SLICE_ROW_PER_FRAME(rows) REG_FIELD_PREP(DSC_SUPS0_SU_SLICE_ROW_PER_FRAME_MASK, (rows))
++#define DSC_SUPS0_SU_PIC_HEIGHT_MASK REG_GENMASK(15, 0)
++#define DSC_SUPS0_SU_PIC_HEIGHT(h) REG_FIELD_PREP(DSC_SUPS0_SU_PIC_HEIGHT_MASK, (h))
++
+ /* Icelake Rate Control Buffer Threshold Registers */
+ #define DSCA_RC_BUF_THRESH_0 _MMIO(0x6B230)
+ #define DSCA_RC_BUF_THRESH_0_UDW _MMIO(0x6B230 + 4)
--- /dev/null
+From 5923a6e0459fdd3edac4ad5abccb24d777d8f1b6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jouni=20H=C3=B6gander?= <jouni.hogander@intel.com>
+Date: Wed, 4 Mar 2026 13:30:11 +0200
+Subject: drm/i915/psr: Write DSC parameters on Selective Update in ET mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jouni Högander <jouni.hogander@intel.com>
+
+commit 5923a6e0459fdd3edac4ad5abccb24d777d8f1b6 upstream.
+
+There are slice row per frame and pic height parameters in DSC that needs
+to be configured on every Selective Update in Early Transport mode. Use
+helper provided by DSC code to configure these on Selective Update when in
+Early Transport mode. Also fill crtc_state->psr2_su_area with full frame
+area on full frame update for DSC calculation.
+
+v2: move psr2_su_area under skip_sel_fetch_set_loop label
+
+Bspec: 68927, 71709
+Fixes: 467e4e061c44 ("drm/i915/psr: Enable psr2 early transport as possible")
+Cc: <stable@vger.kernel.org> # v6.9+
+Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
+Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Link: https://patch.msgid.link/20260304113011.626542-5-jouni.hogander@intel.com
+(cherry picked from commit 3140af2fab505a4cd47d516284529bf1585628be)
+Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -2597,6 +2597,12 @@ void intel_psr2_program_trans_man_trk_ct
+
+ intel_de_write_dsb(display, dsb, PIPE_SRCSZ_ERLY_TPT(crtc->pipe),
+ crtc_state->pipe_srcsz_early_tpt);
++
++ if (!crtc_state->dsc.compression_enable)
++ return;
++
++ intel_dsc_su_et_parameters_configure(dsb, encoder, crtc_state,
++ drm_rect_height(&crtc_state->psr2_su_area));
+ }
+
+ static void psr2_man_trk_ctl_calc(struct intel_crtc_state *crtc_state,
+@@ -3017,6 +3023,10 @@ int intel_psr2_sel_fetch_update(struct i
+ }
+
+ skip_sel_fetch_set_loop:
++ if (full_update)
++ clip_area_update(&crtc_state->psr2_su_area, &crtc_state->pipe_src,
++ &crtc_state->pipe_src);
++
+ psr2_man_trk_ctl_calc(crtc_state, full_update);
+ crtc_state->pipe_srcsz_early_tpt =
+ psr2_pipe_srcsz_early_tpt_calc(crtc_state, full_update);
--- /dev/null
+From stable+bounces-227156-greg=kroah.com@vger.kernel.org Wed Mar 18 21:41:48 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 16:41:41 -0400
+Subject: drm/xe: Fix memory leak in xe_vm_madvise_ioctl
+To: stable@vger.kernel.org
+Cc: Varun Gupta <varun.gupta@intel.com>, Shuicheng Lin <shuicheng.lin@intel.com>, Matthew Brost <matthew.brost@intel.com>, Tejas Upadhyay <tejas.upadhyay@intel.com>, Rodrigo Vivi <rodrigo.vivi@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260318204141.1139130-1-sashal@kernel.org>
+
+From: Varun Gupta <varun.gupta@intel.com>
+
+[ Upstream commit 0cfe9c4838f1147713f6b5c02094cd4dc0c598fa ]
+
+When check_bo_args_are_sane() validation fails, jump to the new
+free_vmas cleanup label to properly free the allocated resources.
+This ensures proper cleanup in this error path.
+
+Fixes: 293032eec4ba ("drm/xe/bo: Update atomic_access attribute on madvise")
+Cc: stable@vger.kernel.org # v6.18+
+Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Signed-off-by: Varun Gupta <varun.gupta@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260223175145.1532801-1-varun.gupta@intel.com
+Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
+(cherry picked from commit 29bd06faf727a4b76663e4be0f7d770e2d2a7965)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+[ changed old goto target from `madv_fini` to `unlock_vm` ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_vm_madvise.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/xe/xe_vm_madvise.c
++++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
+@@ -390,7 +390,7 @@ int xe_vm_madvise_ioctl(struct drm_devic
+ madvise_range.num_vmas,
+ args->atomic.val)) {
+ err = -EINVAL;
+- goto unlock_vm;
++ goto free_vmas;
+ }
+ }
+
+@@ -426,6 +426,7 @@ int xe_vm_madvise_ioctl(struct drm_devic
+ err_fini:
+ if (madvise_range.has_bo_vmas)
+ drm_exec_fini(&exec);
++free_vmas:
+ kfree(madvise_range.vmas);
+ madvise_range.vmas = NULL;
+ unlock_vm:
--- /dev/null
+From stable+bounces-227288-greg=kroah.com@vger.kernel.org Thu Mar 19 14:18:57 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Mar 2026 09:18:09 -0400
+Subject: firmware: stratix10-svc: Add Multi SVC clients support
+To: stable@vger.kernel.org
+Cc: Muhammad Amirul Asyraf Mohamad Jamian <muhammad.amirul.asyraf.mohamad.jamian@altera.com>, Ang Tien Sung <tien.sung.ang@altera.com>, "Fong, Yan Kei" <yankei.fong@altera.com>, Dinh Nguyen <dinguyen@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260319131809.2432986-2-sashal@kernel.org>
+
+From: Muhammad Amirul Asyraf Mohamad Jamian <muhammad.amirul.asyraf.mohamad.jamian@altera.com>
+
+[ Upstream commit 22fd7f7fed2ae3702f90d1985c326354e86b9c75 ]
+
+In the current implementation, SVC client drivers such as socfpga-hwmon,
+intel_fcs, stratix10-soc, stratix10-rsu each send an SMC command that
+triggers a single thread in the stratix10-svc driver. Upon receiving a
+callback, the initiating client driver sends a stratix10-svc-done signal,
+terminating the thread without waiting for other pending SMC commands to
+complete. This leads to a timeout issue in the firmware SVC mailbox service
+when multiple client drivers send SMC commands concurrently.
+
+To resolve this issue, a dedicated thread is now created per channel. The
+stratix10-svc driver will support up to the number of channels defined by
+SVC_NUM_CHANNEL. Thread synchronization is handled using a mutex to prevent
+simultaneous issuance of SMC commands by multiple threads.
+
+SVC_NUM_DATA_IN_FIFO is reduced from 32 to 8, since each channel now has
+its own dedicated FIFO and the SDM processes commands one at a time.
+8 entries per channel is sufficient while keeping the total aggregate
+capacity the same (4 channels x 8 = 32 entries).
+
+Additionally, a thread task is now validated before invoking kthread_stop
+when the user aborts, ensuring safe termination.
+
+Timeout values have also been adjusted to accommodate the increased load
+from concurrent client driver activity.
+
+Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ang Tien Sung <tien.sung.ang@altera.com>
+Signed-off-by: Fong, Yan Kei <yankei.fong@altera.com>
+Signed-off-by: Muhammad Amirul Asyraf Mohamad Jamian <muhammad.amirul.asyraf.mohamad.jamian@altera.com>
+Link: https://lore.kernel.org/all/20260305093151.2678-1-muhammad.amirul.asyraf.mohamad.jamian@altera.com
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/stratix10-svc.c | 228 +++++++++++---------
+ include/linux/firmware/intel/stratix10-svc-client.h | 8
+ 2 files changed, 130 insertions(+), 106 deletions(-)
+
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -37,15 +37,14 @@
+ * service layer will return error to FPGA manager when timeout occurs,
+ * timeout is set to 30 seconds (30 * 1000) at Intel Stratix10 SoC.
+ */
+-#define SVC_NUM_DATA_IN_FIFO 32
++#define SVC_NUM_DATA_IN_FIFO 8
+ #define SVC_NUM_CHANNEL 4
+-#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS 200
++#define FPGA_CONFIG_DATA_CLAIM_TIMEOUT_MS 2000
+ #define FPGA_CONFIG_STATUS_TIMEOUT_SEC 30
+ #define BYTE_TO_WORD_SIZE 4
+
+ /* stratix10 service layer clients */
+ #define STRATIX10_RSU "stratix10-rsu"
+-#define INTEL_FCS "intel-fcs"
+
+ /* Maximum number of SDM client IDs. */
+ #define MAX_SDM_CLIENT_IDS 16
+@@ -105,11 +104,9 @@ struct stratix10_svc_chan;
+ /**
+ * struct stratix10_svc - svc private data
+ * @stratix10_svc_rsu: pointer to stratix10 RSU device
+- * @intel_svc_fcs: pointer to the FCS device
+ */
+ struct stratix10_svc {
+ struct platform_device *stratix10_svc_rsu;
+- struct platform_device *intel_svc_fcs;
+ };
+
+ /**
+@@ -251,12 +248,10 @@ struct stratix10_async_ctrl {
+ * @num_active_client: number of active service client
+ * @node: list management
+ * @genpool: memory pool pointing to the memory region
+- * @task: pointer to the thread task which handles SMC or HVC call
+- * @svc_fifo: a queue for storing service message data
+ * @complete_status: state for completion
+- * @svc_fifo_lock: protect access to service message data queue
+ * @invoke_fn: function to issue secure monitor call or hypervisor call
+ * @svc: manages the list of client svc drivers
++ * @sdm_lock: only allows a single command single response to SDM
+ * @actrl: async control structure
+ *
+ * This struct is used to create communication channels for service clients, to
+@@ -269,12 +264,10 @@ struct stratix10_svc_controller {
+ int num_active_client;
+ struct list_head node;
+ struct gen_pool *genpool;
+- struct task_struct *task;
+- struct kfifo svc_fifo;
+ struct completion complete_status;
+- spinlock_t svc_fifo_lock;
+ svc_invoke_fn *invoke_fn;
+ struct stratix10_svc *svc;
++ struct mutex sdm_lock;
+ struct stratix10_async_ctrl actrl;
+ };
+
+@@ -283,6 +276,9 @@ struct stratix10_svc_controller {
+ * @ctrl: pointer to service controller which is the provider of this channel
+ * @scl: pointer to service client which owns the channel
+ * @name: service client name associated with the channel
++ * @task: pointer to the thread task which handles SMC or HVC call
++ * @svc_fifo: a queue for storing service message data (separate fifo for every channel)
++ * @svc_fifo_lock: protect access to service message data queue (locking pending fifo)
+ * @lock: protect access to the channel
+ * @async_chan: reference to asynchronous channel object for this channel
+ *
+@@ -293,6 +289,9 @@ struct stratix10_svc_chan {
+ struct stratix10_svc_controller *ctrl;
+ struct stratix10_svc_client *scl;
+ char *name;
++ struct task_struct *task;
++ struct kfifo svc_fifo;
++ spinlock_t svc_fifo_lock;
+ spinlock_t lock;
+ struct stratix10_async_chan *async_chan;
+ };
+@@ -527,10 +526,10 @@ static void svc_thread_recv_status_ok(st
+ */
+ static int svc_normal_to_secure_thread(void *data)
+ {
+- struct stratix10_svc_controller
+- *ctrl = (struct stratix10_svc_controller *)data;
+- struct stratix10_svc_data *pdata;
+- struct stratix10_svc_cb_data *cbdata;
++ struct stratix10_svc_chan *chan = (struct stratix10_svc_chan *)data;
++ struct stratix10_svc_controller *ctrl = chan->ctrl;
++ struct stratix10_svc_data *pdata = NULL;
++ struct stratix10_svc_cb_data *cbdata = NULL;
+ struct arm_smccc_res res;
+ unsigned long a0, a1, a2, a3, a4, a5, a6, a7;
+ int ret_fifo = 0;
+@@ -555,12 +554,12 @@ static int svc_normal_to_secure_thread(v
+ a6 = 0;
+ a7 = 0;
+
+- pr_debug("smc_hvc_shm_thread is running\n");
++ pr_debug("%s: %s: Thread is running!\n", __func__, chan->name);
+
+ while (!kthread_should_stop()) {
+- ret_fifo = kfifo_out_spinlocked(&ctrl->svc_fifo,
++ ret_fifo = kfifo_out_spinlocked(&chan->svc_fifo,
+ pdata, sizeof(*pdata),
+- &ctrl->svc_fifo_lock);
++ &chan->svc_fifo_lock);
+
+ if (!ret_fifo)
+ continue;
+@@ -569,9 +568,25 @@ static int svc_normal_to_secure_thread(v
+ (unsigned int)pdata->paddr, pdata->command,
+ (unsigned int)pdata->size);
+
++ /* SDM can only process one command at a time */
++ pr_debug("%s: %s: Thread is waiting for mutex!\n",
++ __func__, chan->name);
++ if (mutex_lock_interruptible(&ctrl->sdm_lock)) {
++ /* item already dequeued; notify client to unblock it */
++ cbdata->status = BIT(SVC_STATUS_ERROR);
++ cbdata->kaddr1 = NULL;
++ cbdata->kaddr2 = NULL;
++ cbdata->kaddr3 = NULL;
++ if (pdata->chan->scl)
++ pdata->chan->scl->receive_cb(pdata->chan->scl,
++ cbdata);
++ break;
++ }
++
+ switch (pdata->command) {
+ case COMMAND_RECONFIG_DATA_CLAIM:
+ svc_thread_cmd_data_claim(ctrl, pdata, cbdata);
++ mutex_unlock(&ctrl->sdm_lock);
+ continue;
+ case COMMAND_RECONFIG:
+ a0 = INTEL_SIP_SMC_FPGA_CONFIG_START;
+@@ -700,10 +715,11 @@ static int svc_normal_to_secure_thread(v
+ break;
+ default:
+ pr_warn("it shouldn't happen\n");
+- break;
++ mutex_unlock(&ctrl->sdm_lock);
++ continue;
+ }
+- pr_debug("%s: before SMC call -- a0=0x%016x a1=0x%016x",
+- __func__,
++ pr_debug("%s: %s: before SMC call -- a0=0x%016x a1=0x%016x",
++ __func__, chan->name,
+ (unsigned int)a0,
+ (unsigned int)a1);
+ pr_debug(" a2=0x%016x\n", (unsigned int)a2);
+@@ -712,8 +728,8 @@ static int svc_normal_to_secure_thread(v
+ pr_debug(" a5=0x%016x\n", (unsigned int)a5);
+ ctrl->invoke_fn(a0, a1, a2, a3, a4, a5, a6, a7, &res);
+
+- pr_debug("%s: after SMC call -- res.a0=0x%016x",
+- __func__, (unsigned int)res.a0);
++ pr_debug("%s: %s: after SMC call -- res.a0=0x%016x",
++ __func__, chan->name, (unsigned int)res.a0);
+ pr_debug(" res.a1=0x%016x, res.a2=0x%016x",
+ (unsigned int)res.a1, (unsigned int)res.a2);
+ pr_debug(" res.a3=0x%016x\n", (unsigned int)res.a3);
+@@ -728,6 +744,7 @@ static int svc_normal_to_secure_thread(v
+ cbdata->kaddr2 = NULL;
+ cbdata->kaddr3 = NULL;
+ pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata);
++ mutex_unlock(&ctrl->sdm_lock);
+ continue;
+ }
+
+@@ -801,6 +818,8 @@ static int svc_normal_to_secure_thread(v
+ break;
+
+ }
++
++ mutex_unlock(&ctrl->sdm_lock);
+ }
+
+ kfree(cbdata);
+@@ -1696,22 +1715,33 @@ int stratix10_svc_send(struct stratix10_
+ if (!p_data)
+ return -ENOMEM;
+
+- /* first client will create kernel thread */
+- if (!chan->ctrl->task) {
+- chan->ctrl->task =
+- kthread_run_on_cpu(svc_normal_to_secure_thread,
+- (void *)chan->ctrl,
+- cpu, "svc_smc_hvc_thread");
+- if (IS_ERR(chan->ctrl->task)) {
++ /* first caller creates the per-channel kthread */
++ if (!chan->task) {
++ struct task_struct *task;
++
++ task = kthread_run_on_cpu(svc_normal_to_secure_thread,
++ (void *)chan,
++ cpu, "svc_smc_hvc_thread");
++ if (IS_ERR(task)) {
+ dev_err(chan->ctrl->dev,
+ "failed to create svc_smc_hvc_thread\n");
+ kfree(p_data);
+ return -EINVAL;
+ }
++
++ spin_lock(&chan->lock);
++ if (chan->task) {
++ /* another caller won the race; discard our thread */
++ spin_unlock(&chan->lock);
++ kthread_stop(task);
++ } else {
++ chan->task = task;
++ spin_unlock(&chan->lock);
++ }
+ }
+
+- pr_debug("%s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__,
+- p_msg->payload, p_msg->command,
++ pr_debug("%s: %s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__,
++ chan->name, p_msg->payload, p_msg->command,
+ (unsigned int)p_msg->payload_length);
+
+ if (list_empty(&svc_data_mem)) {
+@@ -1747,12 +1777,16 @@ int stratix10_svc_send(struct stratix10_
+ p_data->arg[2] = p_msg->arg[2];
+ p_data->size = p_msg->payload_length;
+ p_data->chan = chan;
+- pr_debug("%s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n", __func__,
+- (unsigned int)p_data->paddr, p_data->command,
+- (unsigned int)p_data->size);
+- ret = kfifo_in_spinlocked(&chan->ctrl->svc_fifo, p_data,
++ pr_debug("%s: %s: put to FIFO pa=0x%016x, cmd=%x, size=%u\n",
++ __func__,
++ chan->name,
++ (unsigned int)p_data->paddr,
++ p_data->command,
++ (unsigned int)p_data->size);
++
++ ret = kfifo_in_spinlocked(&chan->svc_fifo, p_data,
+ sizeof(*p_data),
+- &chan->ctrl->svc_fifo_lock);
++ &chan->svc_fifo_lock);
+
+ kfree(p_data);
+
+@@ -1773,11 +1807,12 @@ EXPORT_SYMBOL_GPL(stratix10_svc_send);
+ */
+ void stratix10_svc_done(struct stratix10_svc_chan *chan)
+ {
+- /* stop thread when thread is running AND only one active client */
+- if (chan->ctrl->task && chan->ctrl->num_active_client <= 1) {
+- pr_debug("svc_smc_hvc_shm_thread is stopped\n");
+- kthread_stop(chan->ctrl->task);
+- chan->ctrl->task = NULL;
++ /* stop thread when thread is running */
++ if (chan->task) {
++ pr_debug("%s: %s: svc_smc_hvc_shm_thread is stopping\n",
++ __func__, chan->name);
++ kthread_stop(chan->task);
++ chan->task = NULL;
+ }
+ }
+ EXPORT_SYMBOL_GPL(stratix10_svc_done);
+@@ -1817,8 +1852,8 @@ void *stratix10_svc_allocate_memory(stru
+ pmem->paddr = pa;
+ pmem->size = s;
+ list_add_tail(&pmem->node, &svc_data_mem);
+- pr_debug("%s: va=%p, pa=0x%016x\n", __func__,
+- pmem->vaddr, (unsigned int)pmem->paddr);
++ pr_debug("%s: %s: va=%p, pa=0x%016x\n", __func__,
++ chan->name, pmem->vaddr, (unsigned int)pmem->paddr);
+
+ return (void *)va;
+ }
+@@ -1855,6 +1890,13 @@ static const struct of_device_id stratix
+ {},
+ };
+
++static const char * const chan_names[SVC_NUM_CHANNEL] = {
++ SVC_CLIENT_FPGA,
++ SVC_CLIENT_RSU,
++ SVC_CLIENT_FCS,
++ SVC_CLIENT_HWMON
++};
++
+ static int stratix10_svc_drv_probe(struct platform_device *pdev)
+ {
+ struct device *dev = &pdev->dev;
+@@ -1862,11 +1904,11 @@ static int stratix10_svc_drv_probe(struc
+ struct stratix10_svc_chan *chans;
+ struct gen_pool *genpool;
+ struct stratix10_svc_sh_memory *sh_memory;
+- struct stratix10_svc *svc;
++ struct stratix10_svc *svc = NULL;
+
+ svc_invoke_fn *invoke_fn;
+ size_t fifo_size;
+- int ret;
++ int ret, i = 0;
+
+ /* get SMC or HVC function */
+ invoke_fn = get_invoke_func(dev);
+@@ -1905,8 +1947,8 @@ static int stratix10_svc_drv_probe(struc
+ controller->num_active_client = 0;
+ controller->chans = chans;
+ controller->genpool = genpool;
+- controller->task = NULL;
+ controller->invoke_fn = invoke_fn;
++ INIT_LIST_HEAD(&controller->node);
+ init_completion(&controller->complete_status);
+
+ ret = stratix10_svc_async_init(controller);
+@@ -1917,32 +1959,20 @@ static int stratix10_svc_drv_probe(struc
+ }
+
+ fifo_size = sizeof(struct stratix10_svc_data) * SVC_NUM_DATA_IN_FIFO;
+- ret = kfifo_alloc(&controller->svc_fifo, fifo_size, GFP_KERNEL);
+- if (ret) {
+- dev_err(dev, "failed to allocate FIFO\n");
+- goto err_async_exit;
+- }
+- spin_lock_init(&controller->svc_fifo_lock);
++ mutex_init(&controller->sdm_lock);
+
+- chans[0].scl = NULL;
+- chans[0].ctrl = controller;
+- chans[0].name = SVC_CLIENT_FPGA;
+- spin_lock_init(&chans[0].lock);
+-
+- chans[1].scl = NULL;
+- chans[1].ctrl = controller;
+- chans[1].name = SVC_CLIENT_RSU;
+- spin_lock_init(&chans[1].lock);
+-
+- chans[2].scl = NULL;
+- chans[2].ctrl = controller;
+- chans[2].name = SVC_CLIENT_FCS;
+- spin_lock_init(&chans[2].lock);
+-
+- chans[3].scl = NULL;
+- chans[3].ctrl = controller;
+- chans[3].name = SVC_CLIENT_HWMON;
+- spin_lock_init(&chans[3].lock);
++ for (i = 0; i < SVC_NUM_CHANNEL; i++) {
++ chans[i].scl = NULL;
++ chans[i].ctrl = controller;
++ chans[i].name = (char *)chan_names[i];
++ spin_lock_init(&chans[i].lock);
++ ret = kfifo_alloc(&chans[i].svc_fifo, fifo_size, GFP_KERNEL);
++ if (ret) {
++ dev_err(dev, "failed to allocate FIFO %d\n", i);
++ goto err_free_fifos;
++ }
++ spin_lock_init(&chans[i].svc_fifo_lock);
++ }
+
+ list_add_tail(&controller->node, &svc_ctrl);
+ platform_set_drvdata(pdev, controller);
+@@ -1951,7 +1981,7 @@ static int stratix10_svc_drv_probe(struc
+ svc = devm_kzalloc(dev, sizeof(*svc), GFP_KERNEL);
+ if (!svc) {
+ ret = -ENOMEM;
+- goto err_free_kfifo;
++ goto err_free_fifos;
+ }
+ controller->svc = svc;
+
+@@ -1959,51 +1989,43 @@ static int stratix10_svc_drv_probe(struc
+ if (!svc->stratix10_svc_rsu) {
+ dev_err(dev, "failed to allocate %s device\n", STRATIX10_RSU);
+ ret = -ENOMEM;
+- goto err_free_kfifo;
++ goto err_free_fifos;
+ }
+
+ ret = platform_device_add(svc->stratix10_svc_rsu);
+- if (ret) {
+- platform_device_put(svc->stratix10_svc_rsu);
+- goto err_free_kfifo;
+- }
+-
+- svc->intel_svc_fcs = platform_device_alloc(INTEL_FCS, 1);
+- if (!svc->intel_svc_fcs) {
+- dev_err(dev, "failed to allocate %s device\n", INTEL_FCS);
+- ret = -ENOMEM;
+- goto err_unregister_rsu_dev;
+- }
+-
+- ret = platform_device_add(svc->intel_svc_fcs);
+- if (ret) {
+- platform_device_put(svc->intel_svc_fcs);
+- goto err_unregister_rsu_dev;
+- }
++ if (ret)
++ goto err_put_device;
+
+ ret = of_platform_default_populate(dev_of_node(dev), NULL, dev);
+ if (ret)
+- goto err_unregister_fcs_dev;
++ goto err_unregister_rsu_dev;
+
+ pr_info("Intel Service Layer Driver Initialized\n");
+
+ return 0;
+
+-err_unregister_fcs_dev:
+- platform_device_unregister(svc->intel_svc_fcs);
+ err_unregister_rsu_dev:
+ platform_device_unregister(svc->stratix10_svc_rsu);
+-err_free_kfifo:
+- kfifo_free(&controller->svc_fifo);
+-err_async_exit:
++ goto err_free_fifos;
++err_put_device:
++ platform_device_put(svc->stratix10_svc_rsu);
++err_free_fifos:
++ /* only remove from list if list_add_tail() was reached */
++ if (!list_empty(&controller->node))
++ list_del(&controller->node);
++ /* free only the FIFOs that were successfully allocated */
++ while (i--)
++ kfifo_free(&chans[i].svc_fifo);
+ stratix10_svc_async_exit(controller);
+ err_destroy_pool:
+ gen_pool_destroy(genpool);
++
+ return ret;
+ }
+
+ static void stratix10_svc_drv_remove(struct platform_device *pdev)
+ {
++ int i;
+ struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
+ struct stratix10_svc *svc = ctrl->svc;
+
+@@ -2011,14 +2033,16 @@ static void stratix10_svc_drv_remove(str
+
+ of_platform_depopulate(ctrl->dev);
+
+- platform_device_unregister(svc->intel_svc_fcs);
+ platform_device_unregister(svc->stratix10_svc_rsu);
+
+- kfifo_free(&ctrl->svc_fifo);
+- if (ctrl->task) {
+- kthread_stop(ctrl->task);
+- ctrl->task = NULL;
++ for (i = 0; i < SVC_NUM_CHANNEL; i++) {
++ if (ctrl->chans[i].task) {
++ kthread_stop(ctrl->chans[i].task);
++ ctrl->chans[i].task = NULL;
++ }
++ kfifo_free(&ctrl->chans[i].svc_fifo);
+ }
++
+ if (ctrl->genpool)
+ gen_pool_destroy(ctrl->genpool);
+ list_del(&ctrl->node);
+--- a/include/linux/firmware/intel/stratix10-svc-client.h
++++ b/include/linux/firmware/intel/stratix10-svc-client.h
+@@ -68,12 +68,12 @@
+ * timeout value used in Stratix10 FPGA manager driver.
+ * timeout value used in RSU driver
+ */
+-#define SVC_RECONFIG_REQUEST_TIMEOUT_MS 300
+-#define SVC_RECONFIG_BUFFER_TIMEOUT_MS 720
+-#define SVC_RSU_REQUEST_TIMEOUT_MS 300
++#define SVC_RECONFIG_REQUEST_TIMEOUT_MS 5000
++#define SVC_RECONFIG_BUFFER_TIMEOUT_MS 5000
++#define SVC_RSU_REQUEST_TIMEOUT_MS 2000
+ #define SVC_FCS_REQUEST_TIMEOUT_MS 2000
+ #define SVC_COMPLETED_TIMEOUT_MS 30000
+-#define SVC_HWMON_REQUEST_TIMEOUT_MS 300
++#define SVC_HWMON_REQUEST_TIMEOUT_MS 2000
+
+ struct stratix10_svc_chan;
+
--- /dev/null
+From stable+bounces-227287-greg=kroah.com@vger.kernel.org Thu Mar 19 14:18:55 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 19 Mar 2026 09:18:08 -0400
+Subject: firmware: stratix10-svc: Delete some stray tabs
+To: stable@vger.kernel.org
+Cc: Dan Carpenter <dan.carpenter@linaro.org>, Dinh Nguyen <dinguyen@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260319131809.2432986-1-sashal@kernel.org>
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+[ Upstream commit 9e51d1da5b245c9bf97fc49b06cca7e901c0fe94 ]
+
+These lines are indented one tab too far. Delete the extra tabs
+for readability.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Stable-dep-of: 22fd7f7fed2a ("firmware: stratix10-svc: Add Multi SVC clients support")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/stratix10-svc.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -1317,7 +1317,7 @@ int stratix10_svc_async_send(struct stra
+ dev_dbg(ctrl->dev,
+ "Async message sent with transaction_id 0x%02x\n",
+ handle->transaction_id);
+- *handler = handle;
++ *handler = handle;
+ return 0;
+ case INTEL_SIP_SMC_STATUS_BUSY:
+ dev_warn(ctrl->dev, "Mailbox is busy, try after some time\n");
+@@ -1702,12 +1702,12 @@ int stratix10_svc_send(struct stratix10_
+ kthread_run_on_cpu(svc_normal_to_secure_thread,
+ (void *)chan->ctrl,
+ cpu, "svc_smc_hvc_thread");
+- if (IS_ERR(chan->ctrl->task)) {
+- dev_err(chan->ctrl->dev,
+- "failed to create svc_smc_hvc_thread\n");
+- kfree(p_data);
+- return -EINVAL;
+- }
++ if (IS_ERR(chan->ctrl->task)) {
++ dev_err(chan->ctrl->dev,
++ "failed to create svc_smc_hvc_thread\n");
++ kfree(p_data);
++ return -EINVAL;
++ }
+ }
+
+ pr_debug("%s: sent P-va=%p, P-com=%x, P-size=%u\n", __func__,
--- /dev/null
+From stable+bounces-226349-greg=kroah.com@vger.kernel.org Tue Mar 17 18:02:04 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Mar 2026 12:51:54 -0400
+Subject: ipmi: Consolidate the run to completion checking for xmit msgs lock
+To: stable@vger.kernel.org
+Cc: Corey Minyard <corey@minyard.net>, Breno Leitao <leitao@debian.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260317165155.226620-1-sashal@kernel.org>
+
+From: Corey Minyard <corey@minyard.net>
+
+[ Upstream commit 1d90e6c1a56f6ab83e5c9d30ded19e7ac8155713 ]
+
+It made things hard to read, move the check to a function.
+
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Stable-dep-of: 62cd145453d5 ("ipmi:msghandler: Handle error returns from the SMI sender")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 42 ++++++++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -602,6 +602,22 @@ static int __ipmi_bmc_register(struct ip
+ static int __scan_channels(struct ipmi_smi *intf,
+ struct ipmi_device_id *id, bool rescan);
+
++static void ipmi_lock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion,
++ unsigned long *flags)
++{
++ if (run_to_completion)
++ return;
++ spin_lock_irqsave(&intf->xmit_msgs_lock, *flags);
++}
++
++static void ipmi_unlock_xmit_msgs(struct ipmi_smi *intf, int run_to_completion,
++ unsigned long *flags)
++{
++ if (run_to_completion)
++ return;
++ spin_unlock_irqrestore(&intf->xmit_msgs_lock, *flags);
++}
++
+ static void free_ipmi_user(struct kref *ref)
+ {
+ struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
+@@ -1878,11 +1894,9 @@ static void smi_send(struct ipmi_smi *in
+ int run_to_completion = READ_ONCE(intf->run_to_completion);
+ unsigned long flags = 0;
+
+- if (!run_to_completion)
+- spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
+ smi_msg = smi_add_send_msg(intf, smi_msg, priority);
+- if (!run_to_completion)
+- spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
+
+ if (smi_msg)
+ handlers->sender(intf->send_info, smi_msg);
+@@ -4826,8 +4840,7 @@ static void smi_work(struct work_struct
+ * message delivery.
+ */
+ restart:
+- if (!run_to_completion)
+- spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
+ if (intf->curr_msg == NULL && !intf->in_shutdown) {
+ struct list_head *entry = NULL;
+
+@@ -4843,8 +4856,7 @@ restart:
+ intf->curr_msg = newmsg;
+ }
+ }
+- if (!run_to_completion)
+- spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
+
+ if (newmsg) {
+ cc = intf->handlers->sender(intf->send_info, newmsg);
+@@ -4852,13 +4864,9 @@ restart:
+ if (newmsg->recv_msg)
+ deliver_err_response(intf,
+ newmsg->recv_msg, cc);
+- if (!run_to_completion)
+- spin_lock_irqsave(&intf->xmit_msgs_lock,
+- flags);
++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
+ intf->curr_msg = NULL;
+- if (!run_to_completion)
+- spin_unlock_irqrestore(&intf->xmit_msgs_lock,
+- flags);
++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
+ ipmi_free_smi_msg(newmsg);
+ newmsg = NULL;
+ goto restart;
+@@ -4928,16 +4936,14 @@ void ipmi_smi_msg_received(struct ipmi_s
+ spin_unlock_irqrestore(&intf->waiting_rcv_msgs_lock,
+ flags);
+
+- if (!run_to_completion)
+- spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
+ /*
+ * We can get an asynchronous event or receive message in addition
+ * to commands we send.
+ */
+ if (msg == intf->curr_msg)
+ intf->curr_msg = NULL;
+- if (!run_to_completion)
+- spin_unlock_irqrestore(&intf->xmit_msgs_lock, flags);
++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
+
+ if (run_to_completion)
+ smi_work(&intf->smi_work);
--- /dev/null
+From stable+bounces-226350-greg=kroah.com@vger.kernel.org Tue Mar 17 18:02:07 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Mar 2026 12:51:55 -0400
+Subject: ipmi:msghandler: Handle error returns from the SMI sender
+To: stable@vger.kernel.org
+Cc: Corey Minyard <corey@minyard.net>, "Rafael J. Wysocki" <rafael@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260317165155.226620-2-sashal@kernel.org>
+
+From: Corey Minyard <corey@minyard.net>
+
+[ Upstream commit 62cd145453d577113f993efd025f258dd86aa183 ]
+
+It used to be, until recently, that the sender operation on the low
+level interfaces would not fail. That's not the case any more with
+recent changes.
+
+So check the return value from the sender operation, and propagate it
+back up from there and handle the errors in all places.
+
+Reported-by: Rafael J. Wysocki <rafael@kernel.org>
+Fixes: bc3a9d217755 ("ipmi:si: Gracefully handle if the BMC is non-functional")
+Cc: stable@vger.kernel.org # 4.18
+Signed-off-by: Corey Minyard <corey@minyard.net>
+Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/char/ipmi/ipmi_msghandler.c | 100 ++++++++++++++++++++++++------------
+ 1 file changed, 68 insertions(+), 32 deletions(-)
+
+--- a/drivers/char/ipmi/ipmi_msghandler.c
++++ b/drivers/char/ipmi/ipmi_msghandler.c
+@@ -1887,19 +1887,32 @@ static struct ipmi_smi_msg *smi_add_send
+ return smi_msg;
+ }
+
+-static void smi_send(struct ipmi_smi *intf,
++static int smi_send(struct ipmi_smi *intf,
+ const struct ipmi_smi_handlers *handlers,
+ struct ipmi_smi_msg *smi_msg, int priority)
+ {
+ int run_to_completion = READ_ONCE(intf->run_to_completion);
+ unsigned long flags = 0;
++ int rv = 0;
+
+ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
+ smi_msg = smi_add_send_msg(intf, smi_msg, priority);
+ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
+
+- if (smi_msg)
+- handlers->sender(intf->send_info, smi_msg);
++ if (smi_msg) {
++ rv = handlers->sender(intf->send_info, smi_msg);
++ if (rv) {
++ ipmi_lock_xmit_msgs(intf, run_to_completion, &flags);
++ intf->curr_msg = NULL;
++ ipmi_unlock_xmit_msgs(intf, run_to_completion, &flags);
++ /*
++ * Something may have been added to the transmit
++ * queue, so schedule a check for that.
++ */
++ queue_work(system_wq, &intf->smi_work);
++ }
++ }
++ return rv;
+ }
+
+ static bool is_maintenance_mode_cmd(struct kernel_ipmi_msg *msg)
+@@ -2312,6 +2325,7 @@ static int i_ipmi_request(struct ipmi_us
+ struct ipmi_recv_msg *recv_msg;
+ int run_to_completion = READ_ONCE(intf->run_to_completion);
+ int rv = 0;
++ bool in_seq_table = false;
+
+ if (supplied_recv) {
+ recv_msg = supplied_recv;
+@@ -2365,33 +2379,50 @@ static int i_ipmi_request(struct ipmi_us
+ rv = i_ipmi_req_ipmb(intf, addr, msgid, msg, smi_msg, recv_msg,
+ source_address, source_lun,
+ retries, retry_time_ms);
++ in_seq_table = true;
+ } else if (is_ipmb_direct_addr(addr)) {
+ rv = i_ipmi_req_ipmb_direct(intf, addr, msgid, msg, smi_msg,
+ recv_msg, source_lun);
+ } else if (is_lan_addr(addr)) {
+ rv = i_ipmi_req_lan(intf, addr, msgid, msg, smi_msg, recv_msg,
+ source_lun, retries, retry_time_ms);
++ in_seq_table = true;
+ } else {
+- /* Unknown address type. */
++ /* Unknown address type. */
+ ipmi_inc_stat(intf, sent_invalid_commands);
+ rv = -EINVAL;
+ }
+
+- if (rv) {
+-out_err:
+- if (!supplied_smi)
+- ipmi_free_smi_msg(smi_msg);
+- if (!supplied_recv)
+- ipmi_free_recv_msg(recv_msg);
+- } else {
++ if (!rv) {
+ dev_dbg(intf->si_dev, "Send: %*ph\n",
+ smi_msg->data_size, smi_msg->data);
+
+- smi_send(intf, intf->handlers, smi_msg, priority);
++ rv = smi_send(intf, intf->handlers, smi_msg, priority);
++ if (rv != IPMI_CC_NO_ERROR)
++ /* smi_send() returns an IPMI err, return a Linux one. */
++ rv = -EIO;
++ if (rv && in_seq_table) {
++ /*
++ * If it's in the sequence table, it will be
++ * retried later, so ignore errors.
++ */
++ rv = 0;
++ /* But we need to fix the timeout. */
++ intf_start_seq_timer(intf, smi_msg->msgid);
++ ipmi_free_smi_msg(smi_msg);
++ smi_msg = NULL;
++ }
+ }
++out_err:
+ if (!run_to_completion)
+ mutex_unlock(&intf->users_mutex);
+
++ if (rv) {
++ if (!supplied_smi)
++ ipmi_free_smi_msg(smi_msg);
++ if (!supplied_recv)
++ ipmi_free_recv_msg(recv_msg);
++ }
+ return rv;
+ }
+
+@@ -3965,12 +3996,12 @@ static int handle_ipmb_get_msg_cmd(struc
+ dev_dbg(intf->si_dev, "Invalid command: %*ph\n",
+ msg->data_size, msg->data);
+
+- smi_send(intf, intf->handlers, msg, 0);
+- /*
+- * We used the message, so return the value that
+- * causes it to not be freed or queued.
+- */
+- rv = -1;
++ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
++ /*
++ * We used the message, so return the value that
++ * causes it to not be freed or queued.
++ */
++ rv = -1;
+ } else if (!IS_ERR(recv_msg)) {
+ /* Extract the source address from the data. */
+ ipmb_addr = (struct ipmi_ipmb_addr *) &recv_msg->addr;
+@@ -4044,12 +4075,12 @@ static int handle_ipmb_direct_rcv_cmd(st
+ msg->data[4] = IPMI_INVALID_CMD_COMPLETION_CODE;
+ msg->data_size = 5;
+
+- smi_send(intf, intf->handlers, msg, 0);
+- /*
+- * We used the message, so return the value that
+- * causes it to not be freed or queued.
+- */
+- rv = -1;
++ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
++ /*
++ * We used the message, so return the value that
++ * causes it to not be freed or queued.
++ */
++ rv = -1;
+ } else if (!IS_ERR(recv_msg)) {
+ /* Extract the source address from the data. */
+ daddr = (struct ipmi_ipmb_direct_addr *)&recv_msg->addr;
+@@ -4189,7 +4220,7 @@ static int handle_lan_get_msg_cmd(struct
+ struct ipmi_smi_msg *msg)
+ {
+ struct cmd_rcvr *rcvr;
+- int rv = 0;
++ int rv = 0; /* Free by default */
+ unsigned char netfn;
+ unsigned char cmd;
+ unsigned char chan;
+@@ -4242,12 +4273,12 @@ static int handle_lan_get_msg_cmd(struct
+ dev_dbg(intf->si_dev, "Invalid command: %*ph\n",
+ msg->data_size, msg->data);
+
+- smi_send(intf, intf->handlers, msg, 0);
+- /*
+- * We used the message, so return the value that
+- * causes it to not be freed or queued.
+- */
+- rv = -1;
++ if (smi_send(intf, intf->handlers, msg, 0) == IPMI_CC_NO_ERROR)
++ /*
++ * We used the message, so return the value that
++ * causes it to not be freed or queued.
++ */
++ rv = -1;
+ } else if (!IS_ERR(recv_msg)) {
+ /* Extract the source address from the data. */
+ lan_addr = (struct ipmi_lan_addr *) &recv_msg->addr;
+@@ -5056,7 +5087,12 @@ static void check_msg_timeout(struct ipm
+ ipmi_inc_stat(intf,
+ retransmitted_ipmb_commands);
+
+- smi_send(intf, intf->handlers, smi_msg, 0);
++ /* If this fails we'll retry later or timeout. */
++ if (smi_send(intf, intf->handlers, smi_msg, 0) != IPMI_CC_NO_ERROR) {
++ /* But fix the timeout. */
++ intf_start_seq_timer(intf, smi_msg->msgid);
++ ipmi_free_smi_msg(smi_msg);
++ }
+ } else
+ ipmi_free_smi_msg(smi_msg);
+
--- /dev/null
+From 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Fri, 13 Mar 2026 10:00:58 +0900
+Subject: ksmbd: unset conn->binding on failed binding request
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit 282343cf8a4a5a3603b1cb0e17a7083e4a593b03 upstream.
+
+When a multichannel SMB2_SESSION_SETUP request with
+SMB2_SESSION_REQ_FLAG_BINDING fails ksmbd sets conn->binding = true
+but never clears it on the error path. This leaves the connection in
+a binding state where all subsequent ksmbd_session_lookup_all() calls
+fall back to the global sessions table. This fix it by clearing
+conn->binding = false in the error path.
+
+Cc: stable@vger.kernel.org
+Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/smb2pdu.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -1947,6 +1947,7 @@ out_err:
+ }
+ }
+ smb2_set_err_rsp(work);
++ conn->binding = false;
+ } else {
+ unsigned int iov_len;
+
--- /dev/null
+From 3a64125730cabc34fccfbc230c2667c2e14f7308 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Fri, 13 Mar 2026 10:01:29 +0900
+Subject: ksmbd: use volume UUID in FS_OBJECT_ID_INFORMATION
+
+From: Namjae Jeon <linkinjeon@kernel.org>
+
+commit 3a64125730cabc34fccfbc230c2667c2e14f7308 upstream.
+
+Use sb->s_uuid for a proper volume identifier as the primary choice.
+For filesystems that do not provide a UUID, fall back to stfs.f_fsid
+obtained from vfs_statfs().
+
+Cc: stable@vger.kernel.org
+Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/server/smb2pdu.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/fs/smb/server/smb2pdu.c
++++ b/fs/smb/server/smb2pdu.c
+@@ -5452,7 +5452,6 @@ static int smb2_get_info_filesystem(stru
+ struct smb2_query_info_req *req,
+ struct smb2_query_info_rsp *rsp)
+ {
+- struct ksmbd_session *sess = work->sess;
+ struct ksmbd_conn *conn = work->conn;
+ struct ksmbd_share_config *share = work->tcon->share_conf;
+ int fsinfoclass = 0;
+@@ -5589,10 +5588,11 @@ static int smb2_get_info_filesystem(stru
+
+ info = (struct object_id_info *)(rsp->Buffer);
+
+- if (!user_guest(sess->user))
+- memcpy(info->objid, user_passkey(sess->user), 16);
++ if (path.mnt->mnt_sb->s_uuid_len == 16)
++ memcpy(info->objid, path.mnt->mnt_sb->s_uuid.b,
++ path.mnt->mnt_sb->s_uuid_len);
+ else
+- memset(info->objid, 0, 16);
++ memcpy(info->objid, &stfs.f_fsid, sizeof(stfs.f_fsid));
+
+ info->extended_info.magic = cpu_to_le32(EXTENDED_INFO_MAGIC);
+ info->extended_info.version = cpu_to_le32(1);
--- /dev/null
+From stable+bounces-227538-greg=kroah.com@vger.kernel.org Fri Mar 20 13:45:45 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Mar 2026 08:42:26 -0400
+Subject: LoongArch: Check return values for set_memory_{rw,rox}
+To: stable@vger.kernel.org
+Cc: Tiezhu Yang <yangtiezhu@loongson.cn>, Huacai Chen <chenhuacai@loongson.cn>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260320124226.4124820-1-sashal@kernel.org>
+
+From: Tiezhu Yang <yangtiezhu@loongson.cn>
+
+[ Upstream commit 431ce839dad66d0d56fb604785452c6a57409f35 ]
+
+set_memory_rw() and set_memory_rox() may fail, so we should check the
+return values and return immediately in larch_insn_text_copy().
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+[ kept `stop_machine()` instead of `stop_machine_cpuslocked()` ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/inst.c | 15 +++++++++++++--
+ 1 file changed, 13 insertions(+), 2 deletions(-)
+
+--- a/arch/loongarch/kernel/inst.c
++++ b/arch/loongarch/kernel/inst.c
+@@ -260,6 +260,7 @@ static int text_copy_cb(void *data)
+ int larch_insn_text_copy(void *dst, void *src, size_t len)
+ {
+ int ret = 0;
++ int err = 0;
+ size_t start, end;
+ struct insn_copy copy = {
+ .dst = dst,
+@@ -271,9 +272,19 @@ int larch_insn_text_copy(void *dst, void
+ start = round_down((size_t)dst, PAGE_SIZE);
+ end = round_up((size_t)dst + len, PAGE_SIZE);
+
+- set_memory_rw(start, (end - start) / PAGE_SIZE);
++ err = set_memory_rw(start, (end - start) / PAGE_SIZE);
++ if (err) {
++ pr_info("%s: set_memory_rw() failed\n", __func__);
++ return err;
++ }
++
+ ret = stop_machine(text_copy_cb, ©, cpu_online_mask);
+- set_memory_rox(start, (end - start) / PAGE_SIZE);
++
++ err = set_memory_rox(start, (end - start) / PAGE_SIZE);
++ if (err) {
++ pr_info("%s: set_memory_rox() failed\n", __func__);
++ return err;
++ }
+
+ return ret;
+ }
--- /dev/null
+From stable+bounces-227536-greg=kroah.com@vger.kernel.org Fri Mar 20 13:42:39 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Mar 2026 08:42:02 -0400
+Subject: net: macb: Introduce gem_init_rx_ring()
+To: stable@vger.kernel.org
+Cc: Kevin Hao <haokexin@gmail.com>, Simon Horman <horms@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260320124203.4124440-1-sashal@kernel.org>
+
+From: Kevin Hao <haokexin@gmail.com>
+
+[ Upstream commit 1a7124ecd655bcaf1845197fe416aa25cff4c3ea ]
+
+Extract the initialization code for the GEM RX ring into a new function.
+This change will be utilized in a subsequent patch. No functional changes
+are introduced.
+
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260312-macb-versal-v1-1-467647173fa4@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Stable-dep-of: 718d0766ce4c ("net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -2669,6 +2669,14 @@ static void macb_init_tieoff(struct macb
+ desc->ctrl = 0;
+ }
+
++static void gem_init_rx_ring(struct macb_queue *queue)
++{
++ queue->rx_tail = 0;
++ queue->rx_prepared_head = 0;
++
++ gem_rx_refill(queue);
++}
++
+ static void gem_init_rings(struct macb *bp)
+ {
+ struct macb_queue *queue;
+@@ -2686,10 +2694,7 @@ static void gem_init_rings(struct macb *
+ queue->tx_head = 0;
+ queue->tx_tail = 0;
+
+- queue->rx_tail = 0;
+- queue->rx_prepared_head = 0;
+-
+- gem_rx_refill(queue);
++ gem_init_rx_ring(queue);
+ }
+
+ macb_init_tieoff(bp);
--- /dev/null
+From stable+bounces-227537-greg=kroah.com@vger.kernel.org Fri Mar 20 13:45:09 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Mar 2026 08:42:03 -0400
+Subject: net: macb: Reinitialize tx/rx queue pointer registers and rx ring during resume
+To: stable@vger.kernel.org
+Cc: Kevin Hao <haokexin@gmail.com>, Quanyang Wang <quanyang.wang@windriver.com>, Simon Horman <horms@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260320124203.4124440-2-sashal@kernel.org>
+
+From: Kevin Hao <haokexin@gmail.com>
+
+[ Upstream commit 718d0766ce4c7634ce62fa78b526ea7263487edd ]
+
+On certain platforms, such as AMD Versal boards, the tx/rx queue pointer
+registers are cleared after suspend, and the rx queue pointer register
+is also disabled during suspend if WOL is enabled. Previously, we assumed
+that these registers would be restored by macb_mac_link_up(). However,
+in commit bf9cf80cab81, macb_init_buffers() was moved from
+macb_mac_link_up() to macb_open(). Therefore, we should call
+macb_init_buffers() to reinitialize the tx/rx queue pointer registers
+during resume.
+
+Due to the reset of these two registers, we also need to adjust the
+tx/rx rings accordingly. The tx ring will be handled by
+gem_shuffle_tx_rings() in macb_mac_link_up(), so we only need to
+initialize the rx ring here.
+
+Fixes: bf9cf80cab81 ("net: macb: Fix tx/rx malfunction after phy link down and up")
+Reported-by: Quanyang Wang <quanyang.wang@windriver.com>
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Tested-by: Quanyang Wang <quanyang.wang@windriver.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20260312-macb-versal-v1-2-467647173fa4@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -5949,8 +5949,18 @@ static int __maybe_unused macb_resume(st
+ rtnl_unlock();
+ }
+
++ if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC))
++ macb_init_buffers(bp);
++
+ for (q = 0, queue = bp->queues; q < bp->num_queues;
+ ++q, ++queue) {
++ if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC)) {
++ if (macb_is_gem(bp))
++ gem_init_rx_ring(queue);
++ else
++ macb_init_rx_ring(queue);
++ }
++
+ napi_enable(&queue->napi_rx);
+ napi_enable(&queue->napi_tx);
+ }
--- /dev/null
+From stable+bounces-227189-greg=kroah.com@vger.kernel.org Thu Mar 19 01:41:42 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Mar 2026 20:41:31 -0400
+Subject: netconsole: fix sysdata_release_enabled_show checking wrong flag
+To: stable@vger.kernel.org
+Cc: Breno Leitao <leitao@debian.org>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260319004131.1853033-1-sashal@kernel.org>
+
+From: Breno Leitao <leitao@debian.org>
+
+[ Upstream commit 5af6e8b54927f7a8d3c7fd02b1bdc09e93d5c079 ]
+
+sysdata_release_enabled_show() checks SYSDATA_TASKNAME instead of
+SYSDATA_RELEASE, causing the configfs release_enabled attribute to
+reflect the taskname feature state rather than the release feature
+state. This is a copy-paste error from the adjacent
+sysdata_taskname_enabled_show() function.
+
+The corresponding _store function already uses the correct
+SYSDATA_RELEASE flag.
+
+Fixes: 343f90227070 ("netconsole: implement configfs for release_enabled")
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260302-sysdata_release_fix-v1-1-e5090f677c7c@debian.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/netconsole.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -508,7 +508,7 @@ static ssize_t sysdata_release_enabled_s
+ bool release_enabled;
+
+ mutex_lock(&dynamic_netconsole_mutex);
+- release_enabled = !!(nt->sysdata_fields & SYSDATA_TASKNAME);
++ release_enabled = !!(nt->sysdata_fields & SYSDATA_RELEASE);
+ mutex_unlock(&dynamic_netconsole_mutex);
+
+ return sysfs_emit(buf, "%d\n", release_enabled);
bluetooth-l2cap-fix-type-confusion-in-l2cap_ecred_reconf_rsp.patch
bluetooth-l2cap-validate-l2cap_info_rsp-payload-length-before-access.patch
drm-amd-fix-hang-on-amdgpu-unload-by-using-pci_dev_is_disconnected.patch
+smb-client-fix-krb5-mount-with-username-option.patch
+ksmbd-unset-conn-binding-on-failed-binding-request.patch
+ksmbd-use-volume-uuid-in-fs_object_id_information.patch
+drm-i915-dsc-add-selective-update-register-definitions.patch
+drm-i915-dsc-add-helper-for-writing-dsc-selective-update-et-parameters.patch
+drm-i915-psr-write-dsc-parameters-on-selective-update-in-et-mode.patch
+loongarch-check-return-values-for-set_memory_-rw-rox.patch
+net-macb-introduce-gem_init_rx_ring.patch
+net-macb-reinitialize-tx-rx-queue-pointer-registers-and-rx-ring-during-resume.patch
+firmware-stratix10-svc-delete-some-stray-tabs.patch
+firmware-stratix10-svc-add-multi-svc-clients-support.patch
+netconsole-fix-sysdata_release_enabled_show-checking-wrong-flag.patch
+crypto-atmel-sha204a-fix-oom-tfm_count-leak.patch
+cifs-open-files-should-not-hold-ref-on-superblock.patch
+drm-xe-fix-memory-leak-in-xe_vm_madvise_ioctl.patch
+ipmi-consolidate-the-run-to-completion-checking-for-xmit-msgs-lock.patch
+ipmi-msghandler-handle-error-returns-from-the-smi-sender.patch
--- /dev/null
+From 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@manguebit.org>
+Date: Fri, 13 Mar 2026 00:03:38 -0300
+Subject: smb: client: fix krb5 mount with username option
+
+From: Paulo Alcantara <pc@manguebit.org>
+
+commit 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 upstream.
+
+Customer reported that some of their krb5 mounts were failing against
+a single server as the client was trying to mount the shares with
+wrong credentials. It turned out the client was reusing SMB session
+from first mount to try mounting the other shares, even though a
+different username= option had been specified to the other mounts.
+
+By using username mount option along with sec=krb5 to search for
+principals from keytab is supported by cifs.upcall(8) since
+cifs-utils-4.8. So fix this by matching username mount option in
+match_session() even with Kerberos.
+
+For example, the second mount below should fail with -ENOKEY as there
+is no 'foobar' principal in keytab (/etc/krb5.keytab). The client
+ends up reusing SMB session from first mount to perform the second
+one, which is wrong.
+
+```
+$ ktutil
+ktutil: add_entry -password -p testuser -k 1 -e aes256-cts
+Password for testuser@ZELDA.TEST:
+ktutil: write_kt /etc/krb5.keytab
+ktutil: quit
+$ klist -ke
+Keytab name: FILE:/etc/krb5.keytab
+KVNO Principal
+ ---- ----------------------------------------------------------------
+ 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96)
+$ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser
+$ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar
+$ mount -t cifs | grep -Po 'username=\K\w+'
+testuser
+testuser
+```
+
+Reported-by: Oscar Santos <ossantos@redhat.com>
+Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
+Cc: David Howells <dhowells@redhat.com>
+Cc: linux-cifs@vger.kernel.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/connect.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -1952,6 +1952,10 @@ static int match_session(struct cifs_ses
+ case Kerberos:
+ if (!uid_eq(ctx->cred_uid, ses->cred_uid))
+ return 0;
++ if (strncmp(ses->user_name ?: "",
++ ctx->username ?: "",
++ CIFS_MAX_USERNAME_LEN))
++ return 0;
+ break;
+ case NTLMv2:
+ case RawNTLMSSP:
projects / thirdparty / kernel / stable-queue.git / commitdiff
