--- /dev/null
+From 3ce62c189693e8ed7b3abe551802bbc67f3ace54 Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@amd.com>
+Date: Fri, 7 Nov 2025 15:35:58 -0700
+Subject: drm/amd/display: Check NULL before accessing
+
+From: Alex Hung <alex.hung@amd.com>
+
+commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 upstream.
+
+[WHAT]
+IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic
+fails with NULL pointer dereference. This can be reproduced with
+both an eDP panel and a DP monitors connected.
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ #PF: supervisor read access in kernel mode
+ #PF: error_code(0x0000) - not-present page
+ PGD 0 P4D 0
+ Oops: Oops: 0000 [#1] SMP NOPTI
+ CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted
+6.16.0-99-custom #8 PREEMPT(voluntary)
+ Hardware name: AMD ........
+ RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu]
+ Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49
+ 89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30
+ c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02
+ RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668
+ RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000
+ RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760
+ R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000
+ R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c
+ FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000)
+knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0
+ PKRU: 55555554
+ Call Trace:
+ <TASK>
+ dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu]
+ amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu]
+ ? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu]
+ amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu]
+ drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400
+ drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30
+ drm_crtc_get_last_vbltimestamp+0x55/0x90
+ drm_crtc_next_vblank_start+0x45/0xa0
+ drm_atomic_helper_wait_for_fences+0x81/0x1f0
+ ...
+
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+@@ -634,9 +634,14 @@ bool dc_stream_get_scanoutpos(const stru
+ {
+ uint8_t i;
+ bool ret = false;
+- struct dc *dc = stream->ctx->dc;
+- struct resource_context *res_ctx =
+- &dc->current_state->res_ctx;
++ struct dc *dc;
++ struct resource_context *res_ctx;
++
++ if (!stream->ctx)
++ return false;
++
++ dc = stream->ctx->dc;
++ res_ctx = &dc->current_state->res_ctx;
+
+ for (i = 0; i < MAX_PIPES; i++) {
+ struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
--- /dev/null
+From 620a8f131154250f6a64a07d049a4f235d6451a5 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 22 Sep 2025 14:20:12 +0200
+Subject: drm: sti: fix device leaks at component probe
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 620a8f131154250f6a64a07d049a4f235d6451a5 upstream.
+
+Make sure to drop the references taken to the vtg devices by
+of_find_device_by_node() when looking up their driver data during
+component probe.
+
+Note that holding a reference to a platform device does not prevent its
+driver data from going away so there is no point in keeping the
+reference after the lookup helper returns.
+
+Fixes: cc6b741c6f63 ("drm: sti: remove useless fields from vtg structure")
+Cc: stable@vger.kernel.org # 4.16
+Cc: Benjamin Gaignard <benjamin.gaignard@collabora.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org
+Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sti/sti_vtg.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/sti/sti_vtg.c
++++ b/drivers/gpu/drm/sti/sti_vtg.c
+@@ -143,12 +143,17 @@ struct sti_vtg {
+ struct sti_vtg *of_vtg_find(struct device_node *np)
+ {
+ struct platform_device *pdev;
++ struct sti_vtg *vtg;
+
+ pdev = of_find_device_by_node(np);
+ if (!pdev)
+ return NULL;
+
+- return (struct sti_vtg *)platform_get_drvdata(pdev);
++ vtg = platform_get_drvdata(pdev);
++
++ put_device(&pdev->dev);
++
++ return vtg;
+ }
+
+ static void vtg_reset(struct sti_vtg *vtg)
--- /dev/null
+From 076381c261374c587700b3accf410bdd2dba334e Mon Sep 17 00:00:00 2001
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Mon, 3 Nov 2025 21:34:01 +0100
+Subject: libceph: fix potential use-after-free in have_mon_and_osd_map()
+
+From: Ilya Dryomov <idryomov@gmail.com>
+
+commit 076381c261374c587700b3accf410bdd2dba334e upstream.
+
+The wait loop in __ceph_open_session() can race with the client
+receiving a new monmap or osdmap shortly after the initial map is
+received. Both ceph_monc_handle_map() and handle_one_map() install
+a new map immediately after freeing the old one
+
+ kfree(monc->monmap);
+ monc->monmap = monmap;
+
+ ceph_osdmap_destroy(osdc->osdmap);
+ osdc->osdmap = newmap;
+
+under client->monc.mutex and client->osdc.lock respectively, but
+because neither is taken in have_mon_and_osd_map() it's possible for
+client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in
+
+ client->monc.monmap && client->monc.monmap->epoch &&
+ client->osdc.osdmap && client->osdc.osdmap->epoch;
+
+condition to dereference an already freed map. This happens to be
+reproducible with generic/395 and generic/397 with KASAN enabled:
+
+ BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70
+ Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305
+ CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266
+ ...
+ Call Trace:
+ <TASK>
+ have_mon_and_osd_map+0x56/0x70
+ ceph_open_session+0x182/0x290
+ ceph_get_tree+0x333/0x680
+ vfs_get_tree+0x49/0x180
+ do_new_mount+0x1a3/0x2d0
+ path_mount+0x6dd/0x730
+ do_mount+0x99/0xe0
+ __do_sys_mount+0x141/0x180
+ do_syscall_64+0x9f/0x100
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+ </TASK>
+
+ Allocated by task 13305:
+ ceph_osdmap_alloc+0x16/0x130
+ ceph_osdc_init+0x27a/0x4c0
+ ceph_create_client+0x153/0x190
+ create_fs_client+0x50/0x2a0
+ ceph_get_tree+0xff/0x680
+ vfs_get_tree+0x49/0x180
+ do_new_mount+0x1a3/0x2d0
+ path_mount+0x6dd/0x730
+ do_mount+0x99/0xe0
+ __do_sys_mount+0x141/0x180
+ do_syscall_64+0x9f/0x100
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+ Freed by task 9475:
+ kfree+0x212/0x290
+ handle_one_map+0x23c/0x3b0
+ ceph_osdc_handle_map+0x3c9/0x590
+ mon_dispatch+0x655/0x6f0
+ ceph_con_process_message+0xc3/0xe0
+ ceph_con_v1_try_read+0x614/0x760
+ ceph_con_workfn+0x2de/0x650
+ process_one_work+0x486/0x7c0
+ process_scheduled_works+0x73/0x90
+ worker_thread+0x1c8/0x2a0
+ kthread+0x2ec/0x300
+ ret_from_fork+0x24/0x40
+ ret_from_fork_asm+0x1a/0x30
+
+Rewrite the wait loop to check the above condition directly with
+client->monc.mutex and client->osdc.lock taken as appropriate. While
+at it, improve the timeout handling (previously mount_timeout could be
+exceeded in case wait_event_interruptible_timeout() slept more than
+once) and access client->auth_err under client->monc.mutex to match
+how it's set in finish_auth().
+
+monmap_show() and osdmap_show() now take the respective lock before
+accessing the map as well.
+
+Cc: stable@vger.kernel.org
+Reported-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++++++--------------------
+ net/ceph/debugfs.c | 14 +++++++++---
+ 2 files changed, 42 insertions(+), 25 deletions(-)
+
+--- a/net/ceph/ceph_common.c
++++ b/net/ceph/ceph_common.c
+@@ -786,41 +786,52 @@ void ceph_reset_client_addr(struct ceph_
+ EXPORT_SYMBOL(ceph_reset_client_addr);
+
+ /*
+- * true if we have the mon map (and have thus joined the cluster)
+- */
+-static bool have_mon_and_osd_map(struct ceph_client *client)
+-{
+- return client->monc.monmap && client->monc.monmap->epoch &&
+- client->osdc.osdmap && client->osdc.osdmap->epoch;
+-}
+-
+-/*
+ * mount: join the ceph cluster, and open root directory.
+ */
+ int __ceph_open_session(struct ceph_client *client, unsigned long started)
+ {
+- unsigned long timeout = client->options->mount_timeout;
+- long err;
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
++ long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
++ bool have_monmap, have_osdmap;
++ int err;
+
+ /* open session, and wait for mon and osd maps */
+ err = ceph_monc_open_session(&client->monc);
+ if (err < 0)
+ return err;
+
+- while (!have_mon_and_osd_map(client)) {
+- if (timeout && time_after_eq(jiffies, started + timeout))
+- return -ETIMEDOUT;
++ add_wait_queue(&client->auth_wq, &wait);
++ for (;;) {
++ mutex_lock(&client->monc.mutex);
++ err = client->auth_err;
++ have_monmap = client->monc.monmap && client->monc.monmap->epoch;
++ mutex_unlock(&client->monc.mutex);
++
++ down_read(&client->osdc.lock);
++ have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
++ up_read(&client->osdc.lock);
++
++ if (err || (have_monmap && have_osdmap))
++ break;
++
++ if (signal_pending(current)) {
++ err = -ERESTARTSYS;
++ break;
++ }
++
++ if (!timeout) {
++ err = -ETIMEDOUT;
++ break;
++ }
+
+ /* wait */
+ dout("mount waiting for mon_map\n");
+- err = wait_event_interruptible_timeout(client->auth_wq,
+- have_mon_and_osd_map(client) || (client->auth_err < 0),
+- ceph_timeout_jiffies(timeout));
+- if (err < 0)
+- return err;
+- if (client->auth_err < 0)
+- return client->auth_err;
++ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
+ }
++ remove_wait_queue(&client->auth_wq, &wait);
++
++ if (err)
++ return err;
+
+ pr_info("client%llu fsid %pU\n", ceph_client_gid(client),
+ &client->fsid);
+--- a/net/ceph/debugfs.c
++++ b/net/ceph/debugfs.c
+@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *
+ int i;
+ struct ceph_client *client = s->private;
+
++ mutex_lock(&client->monc.mutex);
+ if (client->monc.monmap == NULL)
+- return 0;
++ goto out_unlock;
+
+ seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
+ for (i = 0; i < client->monc.monmap->num_mon; i++) {
+@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *
+ ENTITY_NAME(inst->name),
+ ceph_pr_addr(&inst->addr));
+ }
++
++out_unlock:
++ mutex_unlock(&client->monc.mutex);
+ return 0;
+ }
+
+@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *
+ int i;
+ struct ceph_client *client = s->private;
+ struct ceph_osd_client *osdc = &client->osdc;
+- struct ceph_osdmap *map = osdc->osdmap;
++ struct ceph_osdmap *map;
+ struct rb_node *n;
+
++ down_read(&osdc->lock);
++ map = osdc->osdmap;
+ if (map == NULL)
+- return 0;
++ goto out_unlock;
+
+- down_read(&osdc->lock);
+ seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch,
+ osdc->epoch_barrier, map->flags);
+
+@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *
+ seq_printf(s, "]\n");
+ }
+
++out_unlock:
+ up_read(&osdc->lock);
+ return 0;
+ }
--- /dev/null
+From 7fce830ecd0a0256590ee37eb65a39cbad3d64fc Mon Sep 17 00:00:00 2001
+From: ziming zhang <ezrakiez@gmail.com>
+Date: Fri, 14 Nov 2025 16:56:10 +0800
+Subject: libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
+
+From: ziming zhang <ezrakiez@gmail.com>
+
+commit 7fce830ecd0a0256590ee37eb65a39cbad3d64fc upstream.
+
+The len field originates from untrusted network packets. Boundary
+checks have been added to prevent potential out-of-bounds writes when
+decrypting the connection secret or processing service tickets.
+
+[ idryomov: changelog ]
+
+Cc: stable@vger.kernel.org
+Signed-off-by: ziming zhang <ezrakiez@gmail.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ceph/auth_x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/ceph/auth_x.c
++++ b/net/ceph/auth_x.c
+@@ -631,6 +631,7 @@ static int handle_auth_session_key(struc
+
+ /* connection secret */
+ ceph_decode_32_safe(p, end, len, e_inval);
++ ceph_decode_need(p, end, len, e_inval);
+ dout("%s connection secret blob len %d\n", __func__, len);
+ if (len > 0) {
+ dp = *p + ceph_x_encrypt_offset();
+@@ -648,6 +649,7 @@ static int handle_auth_session_key(struc
+
+ /* service tickets */
+ ceph_decode_32_safe(p, end, len, e_inval);
++ ceph_decode_need(p, end, len, e_inval);
+ dout("%s service tickets blob len %d\n", __func__, len);
+ if (len > 0) {
+ ret = ceph_x_proc_ticket_reply(ac, &th->session_key,
--- /dev/null
+From ec3797f043756a94ea2d0f106022e14ac4946c02 Mon Sep 17 00:00:00 2001
+From: ziming zhang <ezrakiez@gmail.com>
+Date: Mon, 17 Nov 2025 18:07:41 +0800
+Subject: libceph: replace BUG_ON with bounds check for map->max_osd
+
+From: ziming zhang <ezrakiez@gmail.com>
+
+commit ec3797f043756a94ea2d0f106022e14ac4946c02 upstream.
+
+OSD indexes come from untrusted network packets. Boundary checks are
+added to validate these against map->max_osd.
+
+[ idryomov: drop BUG_ON in ceph_get_primary_affinity(), minor cosmetic
+ edits ]
+
+Cc: stable@vger.kernel.org
+Signed-off-by: ziming zhang <ezrakiez@gmail.com>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ceph/osdmap.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -1504,8 +1504,6 @@ static int decode_new_primary_temp(void
+
+ u32 ceph_get_primary_affinity(struct ceph_osdmap *map, int osd)
+ {
+- BUG_ON(osd >= map->max_osd);
+-
+ if (!map->osd_primary_affinity)
+ return CEPH_OSD_DEFAULT_PRIMARY_AFFINITY;
+
+@@ -1514,8 +1512,6 @@ u32 ceph_get_primary_affinity(struct cep
+
+ static int set_primary_affinity(struct ceph_osdmap *map, int osd, u32 aff)
+ {
+- BUG_ON(osd >= map->max_osd);
+-
+ if (!map->osd_primary_affinity) {
+ int i;
+
+@@ -1577,6 +1573,8 @@ static int decode_new_primary_affinity(v
+
+ ceph_decode_32_safe(p, end, osd, e_inval);
+ ceph_decode_32_safe(p, end, aff, e_inval);
++ if (osd >= map->max_osd)
++ goto e_inval;
+
+ ret = set_primary_affinity(map, osd, aff);
+ if (ret)
+@@ -1879,7 +1877,9 @@ static int decode_new_up_state_weight(vo
+ ceph_decode_need(p, end, 2*sizeof(u32), e_inval);
+ osd = ceph_decode_32(p);
+ w = ceph_decode_32(p);
+- BUG_ON(osd >= map->max_osd);
++ if (osd >= map->max_osd)
++ goto e_inval;
++
+ osdmap_info(map, "osd%d weight 0x%x %s\n", osd, w,
+ w == CEPH_OSD_IN ? "(in)" :
+ (w == CEPH_OSD_OUT ? "(out)" : ""));
+@@ -1905,13 +1905,15 @@ static int decode_new_up_state_weight(vo
+ u32 xorstate;
+
+ osd = ceph_decode_32(p);
++ if (osd >= map->max_osd)
++ goto e_inval;
++
+ if (struct_v >= 5)
+ xorstate = ceph_decode_32(p);
+ else
+ xorstate = ceph_decode_8(p);
+ if (xorstate == 0)
+ xorstate = CEPH_OSD_UP;
+- BUG_ON(osd >= map->max_osd);
+ if ((map->osd_state[osd] & CEPH_OSD_UP) &&
+ (xorstate & CEPH_OSD_UP))
+ osdmap_info(map, "osd%d down\n", osd);
+@@ -1937,7 +1939,9 @@ static int decode_new_up_state_weight(vo
+ struct ceph_entity_addr addr;
+
+ osd = ceph_decode_32(p);
+- BUG_ON(osd >= map->max_osd);
++ if (osd >= map->max_osd)
++ goto e_inval;
++
+ if (struct_v >= 7)
+ ret = ceph_decode_entity_addrvec(p, end, msgr2, &addr);
+ else
--- /dev/null
+From 7b3c09e1667977edee11de94a85e2593a7c15e87 Mon Sep 17 00:00:00 2001
+From: "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@bootlin.com>
+Date: Thu, 20 Nov 2025 10:12:00 +0100
+Subject: net: dsa: microchip: common: Fix checks on irq_find_mapping()
+
+From: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
+
+commit 7b3c09e1667977edee11de94a85e2593a7c15e87 upstream.
+
+irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found
+but it never returns a negative value. However, on each
+irq_find_mapping() call, we verify that the returned value isn't
+negative.
+
+Fix the irq_find_mapping() checks to enter error paths when 0 is
+returned. Return -EINVAL in such cases.
+
+CC: stable@vger.kernel.org
+Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
+Link: https://patch.msgid.link/20251120-ksz-fix-v6-1-891f80ae7f8f@bootlin.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/microchip/ksz_common.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/microchip/ksz_common.c
++++ b/drivers/net/dsa/microchip/ksz_common.c
+@@ -1870,8 +1870,8 @@ static int ksz_irq_phy_setup(struct ksz_
+ if (BIT(phy) & ds->phys_mii_mask) {
+ irq = irq_find_mapping(dev->ports[phy].pirq.domain,
+ PORT_SRC_PHY_INT);
+- if (irq < 0) {
+- ret = irq;
++ if (!irq) {
++ ret = -EINVAL;
+ goto out;
+ }
+ ds->slave_mii_bus->irq[phy] = irq;
+@@ -2095,8 +2095,8 @@ static int ksz_pirq_setup(struct ksz_dev
+ snprintf(pirq->name, sizeof(pirq->name), "port_irq-%d", p);
+
+ pirq->irq_num = irq_find_mapping(dev->girq.domain, p);
+- if (pirq->irq_num < 0)
+- return pirq->irq_num;
++ if (!pirq->irq_num)
++ return -EINVAL;
+
+ return ksz_irq_common_setup(dev, pirq);
+ }
--- /dev/null
+From 9e059305be41a5bd27e03458d8333cf30d70be34 Mon Sep 17 00:00:00 2001
+From: "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@bootlin.com>
+Date: Thu, 20 Nov 2025 10:12:01 +0100
+Subject: net: dsa: microchip: ptp: Fix checks on irq_find_mapping()
+
+From: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
+
+commit 9e059305be41a5bd27e03458d8333cf30d70be34 upstream.
+
+irq_find_mapping() returns a positive IRQ number or 0 if no IRQ is found
+but it never returns a negative value. However, during the PTP IRQ setup,
+we verify that its returned value isn't negative.
+
+Fix the irq_find_mapping() check to enter the error path when 0 is
+returned. Return -EINVAL in such case.
+
+Cc: stable@vger.kernel.org
+Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
+Link: https://patch.msgid.link/20251120-ksz-fix-v6-2-891f80ae7f8f@bootlin.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/microchip/ksz_ptp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/microchip/ksz_ptp.c
++++ b/drivers/net/dsa/microchip/ksz_ptp.c
+@@ -1145,8 +1145,8 @@ int ksz_ptp_irq_setup(struct dsa_switch
+ irq_create_mapping(ptpirq->domain, irq);
+
+ ptpirq->irq_num = irq_find_mapping(port->pirq.domain, PORT_SRC_PTP_INT);
+- if (ptpirq->irq_num < 0) {
+- ret = ptpirq->irq_num;
++ if (!ptpirq->irq_num) {
++ ret = -EINVAL;
+ goto out;
+ }
+
usb-dwc3-fix-race-condition-between-concurrent-dwc3_remove_requests-call-paths.patch
xhci-dbgtty-fix-data-corruption-when-transmitting-data-form-dbc-to-host.patch
xhci-dbgtty-fix-device-unregister.patch
+usb-serial-ftdi_sio-add-support-for-u-blox-evk-m101.patch
+usb-serial-option-add-support-for-rolling-rw101r-gl.patch
+drm-sti-fix-device-leaks-at-component-probe.patch
+drm-amd-display-check-null-before-accessing.patch
+net-dsa-microchip-common-fix-checks-on-irq_find_mapping.patch
+net-dsa-microchip-ptp-fix-checks-on-irq_find_mapping.patch
+libceph-fix-potential-use-after-free-in-have_mon_and_osd_map.patch
+libceph-prevent-potential-out-of-bounds-writes-in-handle_auth_session_key.patch
+libceph-replace-bug_on-with-bounds-check-for-map-max_osd.patch
--- /dev/null
+From 2d8ab771d5316de64f3bb920b82575c58eb00b1b Mon Sep 17 00:00:00 2001
+From: Oleksandr Suvorov <cryosay@gmail.com>
+Date: Thu, 30 Oct 2025 17:42:54 +0200
+Subject: USB: serial: ftdi_sio: add support for u-blox EVK-M101
+
+From: Oleksandr Suvorov <cryosay@gmail.com>
+
+commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b upstream.
+
+The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces:
+- EVK-M101 current sensors
+- EVK-M101 I2C
+- EVK-M101 UART
+- EVK-M101 port D
+
+Only the third USB interface is a UART. This change lets ftdi_sio probe
+the VID/PID and registers only interface #3 as a TTY, leaving the rest
+available for other drivers.
+
+[1]
+usb 5-1.3: new high-speed USB device number 11 using xhci_hcd
+usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00
+usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
+usb 5-1.3: Product: EVK-M101
+usb 5-1.3: Manufacturer: u-blox AG
+
+Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf
+
+Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
+Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/
+Cc: stable@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/ftdi_sio.c | 1 +
+ drivers/usb/serial/ftdi_sio_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1074,6 +1074,7 @@ static const struct usb_device_id id_tab
+ /* U-Blox devices */
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
+ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
++ { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },
+ /* FreeCalypso USB adapters */
+ { USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1614,6 +1614,7 @@
+ #define UBLOX_VID 0x1546
+ #define UBLOX_C099F9P_ZED_PID 0x0502
+ #define UBLOX_C099F9P_ODIN_PID 0x0503
++#define UBLOX_EVK_M101_PID 0x0506
+
+ /*
+ * GMC devices
--- /dev/null
+From 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 Mon Sep 17 00:00:00 2001
+From: Vanillan Wang <vanillanwang@163.com>
+Date: Mon, 10 Nov 2025 12:20:41 +0800
+Subject: USB: serial: option: add support for Rolling RW101R-GL
+
+From: Vanillan Wang <vanillanwang@163.com>
+
+commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 upstream.
+
+- VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM
+ interface for Linux/Chrome OS)
+
+ 0x0301: mbim, pipe
+
+T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=33f8 ProdID=0301 Rev=05.04
+S: Manufacturer=Rolling Wireless S.a.r.l.
+S: Product=Rolling RW101R-GL Module
+S: SerialNumber=3ec4efdf
+C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+
+- VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM
+ interface for Linux/Chrome OS)
+
+ 0x01a8: mbim, diag, AT, ADB, pipe1, pipe2
+
+T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
+D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
+P: Vendor=33f8 ProdID=01a8 Rev=05.04
+S: Manufacturer=Rolling Wireless S.a.r.l.
+S: Product=Rolling RW101R-GL Module
+S: SerialNumber=3ec4efdf
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
+E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+
+- VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM
+ interface for Linux/Chrome OS)
+
+ 0x0302: mbim, pipe
+
+T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=33f8 ProdID=0302 Rev=05.04
+S: Manufacturer=Rolling Wireless S.a.r.l.
+S: Product=Rolling RW101R-GL Module
+S: SerialNumber=3ec4efdf
+C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+
+- VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM
+ interface for Linux/Chrome OS)
+
+ 0x01a9: mbim, diag, AT, ADB, pipe1, pipe2
+
+T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=33f8 ProdID=01a9 Rev=05.04
+S: Manufacturer=Rolling Wireless S.a.r.l.
+S: Product=Rolling RW101R-GL Module
+S: SerialNumber=3ec4efdf
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
+I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
+
+Signed-off-by: Vanillan Wang <vanillanwang@163.com>
+Cc: stable@vger.kernel.org
+[ johan: sort vendor entries, edit commit message slightly ]
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/serial/option.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -2424,12 +2424,18 @@ static const struct usb_device_id option
+ { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
+ { USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */
+ .driver_info = RSVD(4) | RSVD(5) },
++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */
++ .driver_info = RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */
+ .driver_info = RSVD(4) },
+- { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */
+- .driver_info = RSVD(5) },
++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a8, 0xff), /* Rolling RW101R-GL (laptop MBIM) */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a9, 0xff), /* Rolling RW101R-GL (laptop MBIM) */
++ .driver_info = RSVD(4) },
++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0301, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */
++ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */
+ .driver_info = RSVD(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
projects / thirdparty / kernel / stable-queue.git / commitdiff
