* non-error returns are a promise to giveback() the urb later
* we drop ownership so next owner (or urb unlink) can get it
*/
-@@ -5591,6 +5694,7 @@ static const struct hc_driver xhci_hc_dr
+@@ -5600,6 +5703,7 @@ static const struct hc_driver xhci_hc_dr
.endpoint_reset = xhci_endpoint_reset,
.check_bandwidth = xhci_check_bandwidth,
.reset_bandwidth = xhci_reset_bandwidth,
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24024,6 +24024,14 @@ T: git git://linuxtv.org/media.git
+@@ -24023,6 +24023,14 @@ T: git git://linuxtv.org/media.git
F: Documentation/devicetree/bindings/media/i2c/sony,imx415.yaml
F: drivers/media/i2c/imx415.c
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24032,6 +24032,14 @@ T: git git://linuxtv.org/media_tree.git
+@@ -24031,6 +24031,14 @@ T: git git://linuxtv.org/media_tree.git
F: Documentation/devicetree/bindings/media/i2c/imx477.yaml
F: drivers/media/i2c/imx477.c
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24029,6 +24029,7 @@ M: Raspberry Pi Kernel Maintenance <kern
+@@ -24028,6 +24028,7 @@ M: Raspberry Pi Kernel Maintenance <kern
L: linux-media@vger.kernel.org
S: Maintained
T: git git://linuxtv.org/media_tree.git
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24073,6 +24073,14 @@ T: git git://linuxtv.org/media_tree.git
+@@ -24072,6 +24072,14 @@ T: git git://linuxtv.org/media_tree.git
F: Documentation/devicetree/bindings/media/i2c/imx519.yaml
F: drivers/media/i2c/imx519.c
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24078,7 +24078,7 @@ M: Raspberry Pi Kernel Maintenance <kern
+@@ -24077,7 +24077,7 @@ M: Raspberry Pi Kernel Maintenance <kern
L: linux-media@vger.kernel.org
S: Maintained
T: git git://linuxtv.org/media_tree.git
+...
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -22407,6 +22407,13 @@ L: linux-iio@vger.kernel.org
+@@ -22406,6 +22406,13 @@ L: linux-iio@vger.kernel.org
S: Supported
F: drivers/iio/light/rohm-bu27034.c
+
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21522,6 +21522,11 @@ L: linux-edac@vger.kernel.org
+@@ -21521,6 +21521,11 @@ L: linux-edac@vger.kernel.org
S: Maintained
F: drivers/ras/amd/fmpm.c
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21526,6 +21526,7 @@ RASPBERRY PI RP2040 GPIO BRIDGE DRIVER
+@@ -21525,6 +21525,7 @@ RASPBERRY PI RP2040 GPIO BRIDGE DRIVER
M: Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
S: Maintained
F: Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
+
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24078,6 +24078,13 @@ F: Documentation/devicetree/bindings/med
+@@ -24077,6 +24077,13 @@ F: Documentation/devicetree/bindings/med
F: Documentation/devicetree/bindings/media/i2c/imx477.yaml
F: drivers/media/i2c/imx477.c
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24084,6 +24084,7 @@ L: linux-media@vger.kernel.org
+@@ -24083,6 +24083,7 @@ L: linux-media@vger.kernel.org
S: Maintained
T: git git://linuxtv.org/media_tree.git
F: Documentation/devicetree/bindings/media/i2c/sony,imx500.yaml
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21528,6 +21528,16 @@ S: Maintained
+@@ -21527,6 +21527,16 @@ S: Maintained
F: Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
F: drivers/spi/spi-rp2040-gpio-bridge.c
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
-@@ -6293,6 +6293,22 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+@@ -6278,6 +6278,22 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56b1, aspm_l1_acceptable_latency);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56c0, aspm_l1_acceptable_latency);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56c1, aspm_l1_acceptable_latency);
static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
{
struct xhci_segment *seg;
-@@ -4991,7 +4995,7 @@ static u16 xhci_calculate_u1_timeout(str
+@@ -5000,7 +5004,7 @@ static u16 xhci_calculate_u1_timeout(str
}
}
timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
else
timeout_ns = udev->u1_params.sel;
-@@ -5055,7 +5059,7 @@ static u16 xhci_calculate_u2_timeout(str
+@@ -5064,7 +5068,7 @@ static u16 xhci_calculate_u2_timeout(str
}
}
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21528,16 +21528,6 @@ S: Maintained
+@@ -21527,16 +21527,6 @@ S: Maintained
F: Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
F: drivers/spi/spi-rp2040-gpio-bridge.c
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21528,6 +21528,16 @@ S: Maintained
+@@ -21527,6 +21527,16 @@ S: Maintained
F: Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
F: drivers/spi/spi-rp2040-gpio-bridge.c
#define PCIE_AHB_TRANS_BASE0_L 0x438
#define PCIE_AHB_TRANS_BASE0_H 0x43c
#define AHB2PCIE_SIZE(x) ((x) & GENMASK(4, 0))
-@@ -746,6 +752,86 @@ static int mtk_pcie_startup_port_v2(stru
+@@ -750,6 +756,86 @@ static int mtk_pcie_startup_port_v2(stru
return 0;
}
static void __iomem *mtk_pcie_map_bus(struct pci_bus *bus,
unsigned int devfn, int where)
{
-@@ -1107,6 +1193,20 @@ static int mtk_pcie_probe(struct platfor
+@@ -1120,6 +1206,20 @@ static int mtk_pcie_probe(struct platfor
if (err)
goto put_resources;
return 0;
put_resources:
-@@ -1216,12 +1316,19 @@ static const struct mtk_pcie_soc mtk_pci
+@@ -1233,12 +1333,19 @@ static const struct mtk_pcie_soc mtk_pci
.setup_irq = mtk_pcie_setup_irq,
};
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -25056,6 +25056,7 @@ L: netdev@vger.kernel.org
+@@ -25055,6 +25055,7 @@ L: netdev@vger.kernel.org
S: Maintained
F: include/net/pkt_cls.h
F: include/net/pkt_sched.h
+++ /dev/null
-From 53b3e60edb674b442b2b3bbdba484667b0f47a5d Mon Sep 17 00:00:00 2001
-From: Adrian Bente <adibente@gmail.com>
-Date: Thu, 28 May 2026 10:08:51 +0300
-Subject: [PATCH] netfilter: flowtable: fix offloaded ct timeout never being extended
-
-OpenWrt has recently migrated many platforms to kernel 6.18. On the
-MediaTek platform, which supports hardware network offloading, WiFi
-connections accelerated via the WED path were observed to drop after
-roughly 300 seconds.
-
-After several debugging sessions, assisted by the Claude LLM, the
-problem was narrowed down as follows:
-
-nf_flow_table_extend_ct_timeout() extends ct->timeout for offloaded
-flows using:
-
- cmpxchg(&ct->timeout, expires, new_timeout);
-
-'expires' comes from nf_ct_expires(ct) and is a relative value, while
-ct->timeout holds an absolute timestamp. The two are never equal, so
-the cmpxchg always fails and the timeout is never extended.
-
-This goes unnoticed for most flows, but a long-lived hardware (WED)
-offloaded flow on MediaTek MT7986 eventually has ct->timeout decay to
-zero, the conntrack entry is reaped and the connection breaks.
-
-Open-code the relative value from a single READ_ONCE(ct->timeout)
-snapshot and compare against that same absolute snapshot in the
-cmpxchg, so the timeout extension actually takes effect while the
-datapath remains authoritative if it updates ct->timeout concurrently.
-
-Fixes: 03428ca5cee9 ("netfilter: conntrack: rework offload nf_conn timeout extension logic")
-Cc: stable@vger.kernel.org
-Suggested-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Adrian Bente <adibente@gmail.com>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
----
- net/netfilter/nf_flow_table_core.c | 13 +++++++++----
- 1 file changed, 9 insertions(+), 4 deletions(-)
-
---- a/net/netfilter/nf_flow_table_core.c
-+++ b/net/netfilter/nf_flow_table_core.c
-@@ -500,8 +500,13 @@ static u32 nf_flow_table_tcp_timeout(con
- */
- static void nf_flow_table_extend_ct_timeout(struct nf_conn *ct)
- {
-- static const u32 min_timeout = 5 * 60 * HZ;
-- u32 expires = nf_ct_expires(ct);
-+ static const s32 min_timeout = 5 * 60 * HZ;
-+ u32 ct_timeout = READ_ONCE(ct->timeout);
-+ s32 expires;
-+
-+ expires = ct_timeout - nfct_time_stamp;
-+ if (expires <= 0) /* already expired */
-+ return;
-
- /* normal case: large enough timeout, nothing to do. */
- if (likely(expires >= min_timeout))
-@@ -519,7 +524,7 @@ static void nf_flow_table_extend_ct_time
- if (nf_ct_is_confirmed(ct) &&
- test_bit(IPS_OFFLOAD_BIT, &ct->status)) {
- u8 l4proto = nf_ct_protonum(ct);
-- u32 new_timeout = true;
-+ u32 new_timeout = 1;
-
- switch (l4proto) {
- case IPPROTO_UDP:
-@@ -544,7 +549,7 @@ static void nf_flow_table_extend_ct_time
- */
- if (new_timeout) {
- new_timeout += nfct_time_stamp;
-- cmpxchg(&ct->timeout, expires, new_timeout);
-+ cmpxchg(&ct->timeout, ct_timeout, new_timeout);
- }
- }
-
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
-@@ -3308,10 +3308,6 @@ static int snd_bbfpro_controls_create(st
+@@ -3325,10 +3325,6 @@ static int snd_bbfpro_controls_create(st
#define RME_DIGIFACE_REGISTER(reg, mask) (((reg) << 16) | (mask))
#define RME_DIGIFACE_INVERT BIT(31)
--- a/init/Kconfig
+++ b/init/Kconfig
-@@ -2191,7 +2191,7 @@ config PADATA
+@@ -2192,7 +2192,7 @@ config PADATA
bool
config ASN1
-LINUX_VERSION-6.18 = .38
-LINUX_KERNEL_HASH-6.18.38 = ac26e508abd56e9f8b89872b6e10c49fc823bcc70d8068a5d8504c1a7c4ff045
+LINUX_VERSION-6.18 = .39
+LINUX_KERNEL_HASH-6.18.39 = a7a7e3d2ae9d95e74197223a8d4eb5f6be7aac21b6e6de27e9685d001c1f8cb0
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -26274,6 +26274,12 @@ F: Documentation/filesystems/ubifs-authe
+@@ -26273,6 +26273,12 @@ F: Documentation/filesystems/ubifs-authe
F: Documentation/filesystems/ubifs.rst
F: fs/ubifs/
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -15790,7 +15790,9 @@ M: Daniel Golle <daniel@makrotopia.org>
+@@ -15789,7 +15789,9 @@ M: Daniel Golle <daniel@makrotopia.org>
L: netdev@vger.kernel.org
S: Maintained
F: drivers/net/pcs/pcs-mtk-lynxi.c
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
-@@ -316,6 +316,7 @@ static void quirk_mmio_always_on(struct
+@@ -301,6 +301,7 @@ static void quirk_mmio_always_on(struct
DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_ANY_ID, PCI_ANY_ID,
PCI_CLASS_BRIDGE_HOST, 8, quirk_mmio_always_on);
/*
* The Mellanox Tavor device gives false positive parity errors. Disable
* parity error reporting.
-@@ -3519,6 +3520,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
+@@ -3504,6 +3505,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_I
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
/*
* Ivytown NTB BAR sizes are misreported by the hardware due to an erratum.
* To work around this, query the size it should be configured to by the
-@@ -3544,6 +3547,8 @@ static void quirk_intel_ntb(struct pci_d
+@@ -3529,6 +3532,8 @@ static void quirk_intel_ntb(struct pci_d
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0e08, quirk_intel_ntb);
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0e0d, quirk_intel_ntb);
/*
* Some BIOS implementations leave the Intel GPU interrupts enabled, even
* though no one is handling them (e.g., if the i915 driver is never
-@@ -3582,6 +3587,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
+@@ -3567,6 +3572,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21140,6 +21140,13 @@ L: netdev@vger.kernel.org
+@@ -21139,6 +21139,13 @@ L: netdev@vger.kernel.org
S: Maintained
F: drivers/net/ethernet/qualcomm/emac/
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21146,6 +21146,7 @@ L: netdev@vger.kernel.org
+@@ -21145,6 +21145,7 @@ L: netdev@vger.kernel.org
S: Maintained
F: Documentation/devicetree/bindings/net/qcom,ipq4019-ess-edma.yaml
F: drivers/net/ethernet/qualcomm/ipqess/
static const struct qcom_pcie_cfg cfg_2_7_0 = {
.ops = &ops_2_7_0,
};
-@@ -2016,6 +2107,7 @@ static const struct of_device_id qcom_pc
+@@ -2022,6 +2113,7 @@ static const struct of_device_id qcom_pc
{ .compatible = "qcom,pcie-apq8064", .data = &cfg_2_1_0 },
{ .compatible = "qcom,pcie-apq8084", .data = &cfg_1_0_0 },
{ .compatible = "qcom,pcie-ipq4019", .data = &cfg_2_4_0 },
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
-@@ -597,9 +597,9 @@ static void mtk_pcie_intr_handler(struct
+@@ -601,9 +601,9 @@ static void mtk_pcie_intr_handler(struct
if (status & INTX_MASK) {
for_each_set_bit_from(bit, &status, PCI_NUM_INTX + INTX_SHIFT) {
/* Clear the INTx */
struct mtk_pcie_port;
/**
-@@ -1043,6 +1049,27 @@ static int mtk_pcie_setup(struct mtk_pci
+@@ -1051,6 +1057,27 @@ static int mtk_pcie_setup(struct mtk_pci
struct mtk_pcie_port *port, *tmp;
int err, slot;
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
-@@ -427,12 +427,18 @@ static int i2c_init_recovery(struct i2c_
+@@ -428,12 +428,18 @@ static int i2c_init_recovery(struct i2c_
struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
bool is_error_level = true;
char *err_str;
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21240,6 +21240,15 @@ S: Maintained
+@@ -21239,6 +21239,15 @@ S: Maintained
F: Documentation/devicetree/bindings/regulator/vqmmc-ipq4019-regulator.yaml
F: drivers/regulator/vqmmc-ipq4019-regulator.c
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -21668,6 +21668,13 @@ S: Maintained
+@@ -21667,6 +21667,13 @@ S: Maintained
F: include/sound/rt*.h
F: sound/soc/codecs/rt*
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -24566,7 +24566,7 @@ STARFIVE JH71X0 RESET CONTROLLER DRIVERS
+@@ -24565,7 +24565,7 @@ STARFIVE JH71X0 RESET CONTROLLER DRIVERS
M: Emil Renner Berthing <kernel@esmil.dk>
M: Hal Feng <hal.feng@starfivetech.com>
S: Maintained
projects / thirdparty / openwrt.git / commitdiff
