--- /dev/null
+From adfab6b39202481bb43286fff94def4953793fdb Mon Sep 17 00:00:00 2001
+From: Jeremy Linton <jeremy.linton@arm.com>
+Date: Wed, 7 May 2025 21:30:25 -0500
+Subject: ACPI: PPTT: Fix processor subtable walk
+
+From: Jeremy Linton <jeremy.linton@arm.com>
+
+commit adfab6b39202481bb43286fff94def4953793fdb upstream.
+
+The original PPTT code had a bug where the processor subtable length
+was not correctly validated when encountering a truncated
+acpi_pptt_processor node.
+
+Commit 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of
+sizeof() calls") attempted to fix this by validating the size is as
+large as the acpi_pptt_processor node structure. This introduced a
+regression where the last processor node in the PPTT table is ignored
+if it doesn't contain any private resources. That results errors like:
+
+ ACPI PPTT: PPTT table found, but unable to locate core XX (XX)
+ ACPI: SPE must be homogeneous
+
+Furthermore, it fails in a common case where the node length isn't
+equal to the acpi_pptt_processor structure size, leaving the original
+bug in a modified form.
+
+Correct the regression by adjusting the loop termination conditions as
+suggested by the bug reporters. An additional check performed after
+the subtable node type is detected, validates the acpi_pptt_processor
+node is fully contained in the PPTT table. Repeating the check in
+acpi_pptt_leaf_node() is largely redundant as the node is already
+known to be fully contained in the table.
+
+The case where a final truncated node's parent property is accepted,
+but the node itself is rejected should not be considered a bug.
+
+Fixes: 7ab4f0e37a0f4 ("ACPI PPTT: Fix coding mistakes in a couple of sizeof() calls")
+Reported-by: Maximilian Heyne <mheyne@amazon.de>
+Closes: https://lore.kernel.org/linux-acpi/20250506-draco-taped-15f475cd@mheyne-amazon/
+Reported-by: Yicong Yang <yangyicong@hisilicon.com>
+Closes: https://lore.kernel.org/linux-acpi/20250507035124.28071-1-yangyicong@huawei.com/
+Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
+Tested-by: Yicong Yang <yangyicong@hisilicon.com>
+Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
+Tested-by: Maximilian Heyne <mheyne@amazon.de>
+Cc: All applicable <stable@vger.kernel.org> # 7ab4f0e37a0f4: ACPI PPTT: Fix coding mistakes ...
+Link: https://patch.msgid.link/20250508023025.1301030-1-jeremy.linton@arm.com
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/acpi/pptt.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/pptt.c b/drivers/acpi/pptt.c
+index f73ce6e13065..54676e3d82dd 100644
+--- a/drivers/acpi/pptt.c
++++ b/drivers/acpi/pptt.c
+@@ -231,16 +231,18 @@ static int acpi_pptt_leaf_node(struct acpi_table_header *table_hdr,
+ sizeof(struct acpi_table_pptt));
+ proc_sz = sizeof(struct acpi_pptt_processor);
+
+- while ((unsigned long)entry + proc_sz < table_end) {
++ /* ignore subtable types that are smaller than a processor node */
++ while ((unsigned long)entry + proc_sz <= table_end) {
+ cpu_node = (struct acpi_pptt_processor *)entry;
++
+ if (entry->type == ACPI_PPTT_TYPE_PROCESSOR &&
+ cpu_node->parent == node_entry)
+ return 0;
+ if (entry->length == 0)
+ return 0;
++
+ entry = ACPI_ADD_PTR(struct acpi_subtable_header, entry,
+ entry->length);
+-
+ }
+ return 1;
+ }
+@@ -273,15 +275,18 @@ static struct acpi_pptt_processor *acpi_find_processor_node(struct acpi_table_he
+ proc_sz = sizeof(struct acpi_pptt_processor);
+
+ /* find the processor structure associated with this cpuid */
+- while ((unsigned long)entry + proc_sz < table_end) {
++ while ((unsigned long)entry + proc_sz <= table_end) {
+ cpu_node = (struct acpi_pptt_processor *)entry;
+
+ if (entry->length == 0) {
+ pr_warn("Invalid zero length subtable\n");
+ break;
+ }
++ /* entry->length may not equal proc_sz, revalidate the processor structure length */
+ if (entry->type == ACPI_PPTT_TYPE_PROCESSOR &&
+ acpi_cpu_id == cpu_node->acpi_processor_id &&
++ (unsigned long)entry + entry->length <= table_end &&
++ entry->length == proc_sz + cpu_node->number_of_priv_resources * sizeof(u32) &&
+ acpi_pptt_leaf_node(table_hdr, cpu_node)) {
+ return (struct acpi_pptt_processor *)entry;
+ }
+--
+2.49.0
+
--- /dev/null
+From 54db6d1bdd71fa90172a2a6aca3308bbf7fa7eb5 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 5 May 2025 16:03:16 +0100
+Subject: btrfs: fix discard worker infinite loop after disabling discard
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 54db6d1bdd71fa90172a2a6aca3308bbf7fa7eb5 upstream.
+
+If the discard worker is running and there's currently only one block
+group, that block group is a data block group, it's in the unused block
+groups discard list and is being used (it got an extent allocated from it
+after becoming unused), the worker can end up in an infinite loop if a
+transaction abort happens or the async discard is disabled (during remount
+or unmount for example).
+
+This happens like this:
+
+1) Task A, the discard worker, is at peek_discard_list() and
+ find_next_block_group() returns block group X;
+
+2) Block group X is in the unused block groups discard list (its discard
+ index is BTRFS_DISCARD_INDEX_UNUSED) since at some point in the past
+ it become an unused block group and was added to that list, but then
+ later it got an extent allocated from it, so its ->used counter is not
+ zero anymore;
+
+3) The current transaction is aborted by task B and we end up at
+ __btrfs_handle_fs_error() in the transaction abort path, where we call
+ btrfs_discard_stop(), which clears BTRFS_FS_DISCARD_RUNNING from
+ fs_info, and then at __btrfs_handle_fs_error() we set the fs to RO mode
+ (setting SB_RDONLY in the super block's s_flags field);
+
+4) Task A calls __add_to_discard_list() with the goal of moving the block
+ group from the unused block groups discard list into another discard
+ list, but at __add_to_discard_list() we end up doing nothing because
+ btrfs_run_discard_work() returns false, since the super block has
+ SB_RDONLY set in its flags and BTRFS_FS_DISCARD_RUNNING is not set
+ anymore in fs_info->flags. So block group X remains in the unused block
+ groups discard list;
+
+5) Task A then does a goto into the 'again' label, calls
+ find_next_block_group() again we gets block group X again. Then it
+ repeats the previous steps over and over since there are not other
+ block groups in the discard lists and block group X is never moved
+ out of the unused block groups discard list since
+ btrfs_run_discard_work() keeps returning false and therefore
+ __add_to_discard_list() doesn't move block group X out of that discard
+ list.
+
+When this happens we can get a soft lockup report like this:
+
+ [71.957] watchdog: BUG: soft lockup - CPU#0 stuck for 27s! [kworker/u4:3:97]
+ [71.957] Modules linked in: xfs af_packet rfkill (...)
+ [71.957] CPU: 0 UID: 0 PID: 97 Comm: kworker/u4:3 Tainted: G W 6.14.2-1-default #1 openSUSE Tumbleweed 968795ef2b1407352128b466fe887416c33af6fa
+ [71.957] Tainted: [W]=WARN
+ [71.957] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
+ [71.957] Workqueue: btrfs_discard btrfs_discard_workfn [btrfs]
+ [71.957] RIP: 0010:btrfs_discard_workfn+0xc4/0x400 [btrfs]
+ [71.957] Code: c1 01 48 83 (...)
+ [71.957] RSP: 0018:ffffafaec03efe08 EFLAGS: 00000246
+ [71.957] RAX: ffff897045500000 RBX: ffff8970413ed8d0 RCX: 0000000000000000
+ [71.957] RDX: 0000000000000001 RSI: ffff8970413ed8d0 RDI: 0000000a8f1272ad
+ [71.957] RBP: 0000000a9d61c60e R08: ffff897045500140 R09: 8080808080808080
+ [71.957] R10: ffff897040276800 R11: fefefefefefefeff R12: ffff8970413ed860
+ [71.957] R13: ffff897045500000 R14: ffff8970413ed868 R15: 0000000000000000
+ [71.957] FS: 0000000000000000(0000) GS:ffff89707bc00000(0000) knlGS:0000000000000000
+ [71.957] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [71.957] CR2: 00005605bcc8d2f0 CR3: 000000010376a001 CR4: 0000000000770ef0
+ [71.957] PKRU: 55555554
+ [71.957] Call Trace:
+ [71.957] <TASK>
+ [71.957] process_one_work+0x17e/0x330
+ [71.957] worker_thread+0x2ce/0x3f0
+ [71.957] ? __pfx_worker_thread+0x10/0x10
+ [71.957] kthread+0xef/0x220
+ [71.957] ? __pfx_kthread+0x10/0x10
+ [71.957] ret_from_fork+0x34/0x50
+ [71.957] ? __pfx_kthread+0x10/0x10
+ [71.957] ret_from_fork_asm+0x1a/0x30
+ [71.957] </TASK>
+ [71.957] Kernel panic - not syncing: softlockup: hung tasks
+ [71.987] CPU: 0 UID: 0 PID: 97 Comm: kworker/u4:3 Tainted: G W L 6.14.2-1-default #1 openSUSE Tumbleweed 968795ef2b1407352128b466fe887416c33af6fa
+ [71.989] Tainted: [W]=WARN, [L]=SOFTLOCKUP
+ [71.989] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
+ [71.991] Workqueue: btrfs_discard btrfs_discard_workfn [btrfs]
+ [71.992] Call Trace:
+ [71.993] <IRQ>
+ [71.994] dump_stack_lvl+0x5a/0x80
+ [71.994] panic+0x10b/0x2da
+ [71.995] watchdog_timer_fn.cold+0x9a/0xa1
+ [71.996] ? __pfx_watchdog_timer_fn+0x10/0x10
+ [71.997] __hrtimer_run_queues+0x132/0x2a0
+ [71.997] hrtimer_interrupt+0xff/0x230
+ [71.998] __sysvec_apic_timer_interrupt+0x55/0x100
+ [71.999] sysvec_apic_timer_interrupt+0x6c/0x90
+ [72.000] </IRQ>
+ [72.000] <TASK>
+ [72.001] asm_sysvec_apic_timer_interrupt+0x1a/0x20
+ [72.002] RIP: 0010:btrfs_discard_workfn+0xc4/0x400 [btrfs]
+ [72.002] Code: c1 01 48 83 (...)
+ [72.005] RSP: 0018:ffffafaec03efe08 EFLAGS: 00000246
+ [72.006] RAX: ffff897045500000 RBX: ffff8970413ed8d0 RCX: 0000000000000000
+ [72.006] RDX: 0000000000000001 RSI: ffff8970413ed8d0 RDI: 0000000a8f1272ad
+ [72.007] RBP: 0000000a9d61c60e R08: ffff897045500140 R09: 8080808080808080
+ [72.008] R10: ffff897040276800 R11: fefefefefefefeff R12: ffff8970413ed860
+ [72.009] R13: ffff897045500000 R14: ffff8970413ed868 R15: 0000000000000000
+ [72.010] ? btrfs_discard_workfn+0x51/0x400 [btrfs 23b01089228eb964071fb7ca156eee8cd3bf996f]
+ [72.011] process_one_work+0x17e/0x330
+ [72.012] worker_thread+0x2ce/0x3f0
+ [72.013] ? __pfx_worker_thread+0x10/0x10
+ [72.014] kthread+0xef/0x220
+ [72.014] ? __pfx_kthread+0x10/0x10
+ [72.015] ret_from_fork+0x34/0x50
+ [72.015] ? __pfx_kthread+0x10/0x10
+ [72.016] ret_from_fork_asm+0x1a/0x30
+ [72.017] </TASK>
+ [72.017] Kernel Offset: 0x15000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+ [72.019] Rebooting in 90 seconds..
+
+So fix this by making sure we move a block group out of the unused block
+groups discard list when calling __add_to_discard_list().
+
+Fixes: 2bee7eb8bb81 ("btrfs: discard one region at a time in async discard")
+Link: https://bugzilla.suse.com/show_bug.cgi?id=1242012
+CC: stable@vger.kernel.org # 5.10+
+Reviewed-by: Boris Burkov <boris@bur.io>
+Reviewed-by: Daniel Vacek <neelx@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/discard.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/discard.c
++++ b/fs/btrfs/discard.c
+@@ -78,8 +78,6 @@ static void __add_to_discard_list(struct
+ struct btrfs_block_group *block_group)
+ {
+ lockdep_assert_held(&discard_ctl->lock);
+- if (!btrfs_run_discard_work(discard_ctl))
+- return;
+
+ if (list_empty(&block_group->discard_list) ||
+ block_group->discard_index == BTRFS_DISCARD_INDEX_UNUSED) {
+@@ -102,6 +100,9 @@ static void add_to_discard_list(struct b
+ if (!btrfs_is_block_group_data_only(block_group))
+ return;
+
++ if (!btrfs_run_discard_work(discard_ctl))
++ return;
++
+ spin_lock(&discard_ctl->lock);
+ __add_to_discard_list(discard_ctl, block_group);
+ spin_unlock(&discard_ctl->lock);
+@@ -233,6 +234,18 @@ again:
+ block_group->used != 0) {
+ if (btrfs_is_block_group_data_only(block_group)) {
+ __add_to_discard_list(discard_ctl, block_group);
++ /*
++ * The block group must have been moved to other
++ * discard list even if discard was disabled in
++ * the meantime or a transaction abort happened,
++ * otherwise we can end up in an infinite loop,
++ * always jumping into the 'again' label and
++ * keep getting this block group over and over
++ * in case there are no other block groups in
++ * the discard lists.
++ */
++ ASSERT(block_group->discard_index !=
++ BTRFS_DISCARD_INDEX_UNUSED);
+ } else {
+ list_del_init(&block_group->discard_list);
+ btrfs_put_block_group(block_group);
--- /dev/null
+From df180e65305f8c1e020d54bfc2132349fd693de1 Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <nathan.lynch@amd.com>
+Date: Thu, 3 Apr 2025 11:24:19 -0500
+Subject: dmaengine: Revert "dmaengine: dmatest: Fix dmatest waiting less when interrupted"
+
+From: Nathan Lynch <nathan.lynch@amd.com>
+
+commit df180e65305f8c1e020d54bfc2132349fd693de1 upstream.
+
+Several issues with this change:
+
+* The analysis is flawed and it's unclear what problem is being
+ fixed. There is no difference between wait_event_freezable_timeout()
+ and wait_event_timeout() with respect to device interrupts. And of
+ course "the interrupt notifying the finish of an operation happens
+ during wait_event_freezable_timeout()" -- that's how it's supposed
+ to work.
+
+* The link at the "Closes:" tag appears to be an unrelated
+ use-after-free in idxd.
+
+* It introduces a regression: dmatest threads are meant to be
+ freezable and this change breaks that.
+
+See discussion here:
+https://lore.kernel.org/dmaengine/878qpa13fe.fsf@AUSNATLYNCH.amd.com/
+
+Fixes: e87ca16e9911 ("dmaengine: dmatest: Fix dmatest waiting less when interrupted")
+Signed-off-by: Nathan Lynch <nathan.lynch@amd.com>
+Link: https://lore.kernel.org/r/20250403-dmaengine-dmatest-revert-waiting-less-v1-1-8227c5a3d7c8@amd.com
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma/dmatest.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/dma/dmatest.c
++++ b/drivers/dma/dmatest.c
+@@ -827,9 +827,9 @@ static int dmatest_func(void *data)
+ } else {
+ dma_async_issue_pending(chan);
+
+- wait_event_timeout(thread->done_wait,
+- done->done,
+- msecs_to_jiffies(params->timeout));
++ wait_event_freezable_timeout(thread->done_wait,
++ done->done,
++ msecs_to_jiffies(params->timeout));
+
+ status = dma_async_is_tx_complete(chan, cookie, NULL,
+ NULL);
--- /dev/null
+From d33724ffb743d3d2698bd969e29253ae0cff9739 Mon Sep 17 00:00:00 2001
+From: Wayne Lin <Wayne.Lin@amd.com>
+Date: Tue, 13 May 2025 11:20:24 +0800
+Subject: drm/amd/display: Avoid flooding unnecessary info messages
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+commit d33724ffb743d3d2698bd969e29253ae0cff9739 upstream.
+
+It's expected that we'll encounter temporary exceptions
+during aux transactions. Adjust logging from drm_info to
+drm_dbg_dp to prevent flooding with unnecessary log messages.
+
+Fixes: 3637e457eb00 ("drm/amd/display: Fix wrong handling for AUX_DEFER case")
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://lore.kernel.org/r/20250513032026.838036-1-Wayne.Lin@amd.com
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 9a9c3e1fe5256da14a0a307dff0478f90c55fc8c)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -111,7 +111,7 @@ static ssize_t dm_dp_aux_transfer(struct
+ if (payload.write && result >= 0) {
+ if (result) {
+ /*one byte indicating partially written bytes*/
+- drm_info(adev_to_drm(adev), "amdgpu: AUX partially written\n");
++ drm_dbg_dp(adev_to_drm(adev), "amdgpu: AUX partially written\n");
+ result = payload.data[0];
+ } else if (!payload.reply[0])
+ /*I2C_ACK|AUX_ACK*/
+@@ -137,11 +137,11 @@ static ssize_t dm_dp_aux_transfer(struct
+ break;
+ }
+
+- drm_info(adev_to_drm(adev), "amdgpu: DP AUX transfer fail:%d\n", operation_result);
++ drm_dbg_dp(adev_to_drm(adev), "amdgpu: DP AUX transfer fail:%d\n", operation_result);
+ }
+
+ if (payload.reply[0])
+- drm_info(adev_to_drm(adev), "amdgpu: AUX reply command not ACK: 0x%02x.",
++ drm_dbg_dp(adev_to_drm(adev), "amdgpu: AUX reply command not ACK: 0x%02x.",
+ payload.reply[0]);
+
+ return result;
--- /dev/null
+From d433981385c62c72080e26f1c00a961d18b233be Mon Sep 17 00:00:00 2001
+From: Wayne Lin <Wayne.Lin@amd.com>
+Date: Fri, 25 Apr 2025 14:44:02 +0800
+Subject: drm/amd/display: Correct the reply value when AUX write incomplete
+
+From: Wayne Lin <Wayne.Lin@amd.com>
+
+commit d433981385c62c72080e26f1c00a961d18b233be upstream.
+
+[Why]
+Now forcing aux->transfer to return 0 when incomplete AUX write is
+inappropriate. It should return bytes have been transferred.
+
+[How]
+aux->transfer is asked not to change original msg except reply field of
+drm_dp_aux_msg structure. Copy the msg->buffer when it's write request,
+and overwrite the first byte when sink reply 1 byte indicating partially
+written byte number. Then we can return the correct value without
+changing the original msg.
+
+Fixes: 3637e457eb00 ("drm/amd/display: Fix wrong handling for AUX_DEFER case")
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Ray Wu <ray.wu@amd.com>
+Signed-off-by: Wayne Lin <Wayne.Lin@amd.com>
+Signed-off-by: Ray Wu <ray.wu@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 7ac37f0dcd2e0b729fa7b5513908dc8ab802b540)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++-
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 10 ++++++++--
+ 2 files changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -10707,7 +10707,8 @@ int amdgpu_dm_process_dmub_aux_transfer_
+ /* The reply is stored in the top nibble of the command. */
+ payload->reply[0] = (adev->dm.dmub_notify->aux_reply.command >> 4) & 0xF;
+
+- if (!payload->write && p_notify->aux_reply.length)
++ /*write req may receive a byte indicating partially written number as well*/
++ if (p_notify->aux_reply.length)
+ memcpy(payload->data, p_notify->aux_reply.data,
+ p_notify->aux_reply.length);
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
+@@ -66,6 +66,7 @@ static ssize_t dm_dp_aux_transfer(struct
+ enum aux_return_code_type operation_result;
+ struct amdgpu_device *adev;
+ struct ddc_service *ddc;
++ uint8_t copy[16];
+
+ if (WARN_ON(msg->size > 16))
+ return -E2BIG;
+@@ -81,6 +82,11 @@ static ssize_t dm_dp_aux_transfer(struct
+ (msg->request & DP_AUX_I2C_WRITE_STATUS_UPDATE) != 0;
+ payload.defer_delay = 0;
+
++ if (payload.write) {
++ memcpy(copy, msg->buffer, msg->size);
++ payload.data = copy;
++ }
++
+ result = dc_link_aux_transfer_raw(TO_DM_AUX(aux)->ddc_service, &payload,
+ &operation_result);
+
+@@ -104,9 +110,9 @@ static ssize_t dm_dp_aux_transfer(struct
+ */
+ if (payload.write && result >= 0) {
+ if (result) {
+- /*one byte indicating partially written bytes. Force 0 to retry*/
++ /*one byte indicating partially written bytes*/
+ drm_info(adev_to_drm(adev), "amdgpu: AUX partially written\n");
+- result = 0;
++ result = payload.data[0];
+ } else if (!payload.reply[0])
+ /*I2C_ACK|AUX_ACK*/
+ result = msg->size;
--- /dev/null
+From 90436d234230e9a950ccd87831108b688b27a234 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhuacai@loongson.cn>
+Date: Wed, 14 May 2025 22:17:43 +0800
+Subject: LoongArch: Fix MAX_REG_OFFSET calculation
+
+From: Huacai Chen <chenhuacai@loongson.cn>
+
+commit 90436d234230e9a950ccd87831108b688b27a234 upstream.
+
+Fix MAX_REG_OFFSET calculation, make it point to the last register
+in 'struct pt_regs' and not to the marker itself, which could allow
+regs_get_register() to return an invalid offset.
+
+Cc: stable@vger.kernel.org
+Fixes: 803b0fc5c3f2baa6e5 ("LoongArch: Add process management")
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/include/asm/ptrace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/loongarch/include/asm/ptrace.h
++++ b/arch/loongarch/include/asm/ptrace.h
+@@ -54,7 +54,7 @@ static inline void instruction_pointer_s
+
+ /* Query offset/name of register from its name/offset */
+ extern int regs_query_register_offset(const char *name);
+-#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last))
++#define MAX_REG_OFFSET (offsetof(struct pt_regs, __last) - sizeof(unsigned long))
+
+ /**
+ * regs_get_register() - get register value from its offset
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- fs/nfs/pnfs.c | 9 +++++++++
+ fs/nfs/pnfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
-diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
-index f682869320198..fe0ddbce3bcb2 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
-@@ -732,6 +732,14 @@ pnfs_mark_matching_lsegs_invalid(struct pnfs_layout_hdr *lo,
+@@ -732,6 +732,14 @@ pnfs_mark_matching_lsegs_invalid(struct
return remaining;
}
static void
pnfs_free_returned_lsegs(struct pnfs_layout_hdr *lo,
struct list_head *free_me,
-@@ -1180,6 +1188,7 @@ void pnfs_layoutreturn_free_lsegs(struct pnfs_layout_hdr *lo,
+@@ -1180,6 +1188,7 @@ void pnfs_layoutreturn_free_lsegs(struct
pnfs_mark_matching_lsegs_invalid(lo, &freeme, range, seq);
pnfs_free_returned_lsegs(lo, &freeme, range, seq);
pnfs_set_layout_stateid(lo, stateid, NULL, true);
} else
pnfs_mark_layout_stateid_invalid(lo, &freeme);
out_unlock:
---
-2.39.5
-
octeontx2-pf-macsec-fix-incorrect-max-transmit-size-.patch
net-tls-fix-kernel-panic-when-alloc_page-failed.patch
nfsv4-pnfs-reset-the-layout-state-after-a-layoutretu.patch
+dmaengine-revert-dmaengine-dmatest-fix-dmatest-waiting-less-when-interrupted.patch
+loongarch-fix-max_reg_offset-calculation.patch
+btrfs-fix-discard-worker-infinite-loop-after-disabling-discard.patch
+drm-amd-display-correct-the-reply-value-when-aux-write-incomplete.patch
+drm-amd-display-avoid-flooding-unnecessary-info-messages.patch
+acpi-pptt-fix-processor-subtable-walk.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
