--- /dev/null
+From 82fca3d8a4a34667f01ec2351a607135249c9cff Mon Sep 17 00:00:00 2001
+From: Gui-Dong Han <hanguidong02@gmail.com>
+Date: Thu, 20 Nov 2025 20:06:57 +0800
+Subject: atm/fore200e: Fix possible data race in fore200e_open()
+
+From: Gui-Dong Han <hanguidong02@gmail.com>
+
+commit 82fca3d8a4a34667f01ec2351a607135249c9cff upstream.
+
+Protect access to fore200e->available_cell_rate with rate_mtx lock in the
+error handling path of fore200e_open() to prevent a data race.
+
+The field fore200e->available_cell_rate is a shared resource used to track
+available bandwidth. It is concurrently accessed by fore200e_open(),
+fore200e_close(), and fore200e_change_qos().
+
+In fore200e_open(), the lock rate_mtx is correctly held when subtracting
+vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth.
+However, if the subsequent call to fore200e_activate_vcin() fails, the
+function restores the reserved bandwidth by adding back to
+available_cell_rate without holding the lock.
+
+This introduces a race condition because available_cell_rate is a global
+device resource shared across all VCCs. If the error path in
+fore200e_open() executes concurrently with operations like
+fore200e_close() or fore200e_change_qos() on other VCCs, a
+read-modify-write race occurs.
+
+Specifically, the error path reads the rate without the lock. If another
+CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in
+fore200e_close()) between this read and the subsequent write, the error
+path will overwrite the concurrent update with a stale value. This results
+in incorrect bandwidth accounting.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20251120120657.2462194-1-hanguidong02@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/atm/fore200e.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/atm/fore200e.c
++++ b/drivers/atm/fore200e.c
+@@ -1379,7 +1379,9 @@ fore200e_open(struct atm_vcc *vcc)
+
+ vcc->dev_data = NULL;
+
++ mutex_lock(&fore200e->rate_mtx);
+ fore200e->available_cell_rate += vcc->qos.txtp.max_pcr;
++ mutex_unlock(&fore200e->rate_mtx);
+
+ kfree(fore200e_vcc);
+ return -EINVAL;
--- /dev/null
+From 30db4451c7f6aabcada029b15859a76962ec0cf8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Thomas=20M=C3=BChlbacher?= <tmuehlbacher@posteo.net>
+Date: Sat, 15 Nov 2025 15:34:56 +0000
+Subject: can: sja1000: fix max irq loop handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Thomas Mühlbacher <tmuehlbacher@posteo.net>
+
+commit 30db4451c7f6aabcada029b15859a76962ec0cf8 upstream.
+
+Reading the interrupt register `SJA1000_IR` causes all of its bits to be
+reset. If we ever reach the condition of handling more than
+`SJA1000_MAX_IRQ` IRQs, we will have read the register and reset all its
+bits but without actually handling the interrupt inside of the loop
+body.
+
+This may, among other issues, cause us to never `netif_wake_queue()`
+again after a transmission interrupt.
+
+Fixes: 429da1cc841b ("can: Driver for the SJA1000 CAN controller")
+Cc: stable@vger.kernel.org
+Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
+Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Link: https://patch.msgid.link/20251115153437.11419-1-tmuehlbacher@posteo.net
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/sja1000/sja1000.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -511,8 +511,8 @@ irqreturn_t sja1000_interrupt(int irq, v
+ if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
+ goto out;
+
+- while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
+- (n < SJA1000_MAX_IRQ)) {
++ while ((n < SJA1000_MAX_IRQ) &&
++ (isrc = priv->read_reg(priv, SJA1000_IR))) {
+
+ status = priv->read_reg(priv, SJA1000_SR);
+ /* check for absent controller due to hw unplug */
--- /dev/null
+From 76544beea7cfe5bcce6d60f53811657b88ec8be1 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Sun, 16 Nov 2025 16:55:26 +0100
+Subject: can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+
+commit 76544beea7cfe5bcce6d60f53811657b88ec8be1 upstream.
+
+Reading the interrupt register `SUN4I_REG_INT_ADDR` causes all of its bits
+to be reset. If we ever reach the condition of handling more than
+`SUN4I_CAN_MAX_IRQ` IRQs, we will have read the register and reset all its
+bits but without actually handling the interrupt inside of the loop body.
+
+This may, among other issues, cause us to never `netif_wake_queue()` again
+after a transmission interrupt.
+
+Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module")
+Cc: stable@vger.kernel.org
+Co-developed-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
+Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Link: https://patch.msgid.link/20251116-sun4i-fix-loop-v1-1-3d76d3f81950@pengutronix.de
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/can/sun4i_can.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/sun4i_can.c
++++ b/drivers/net/can/sun4i_can.c
+@@ -644,8 +644,8 @@ static irqreturn_t sun4i_can_interrupt(i
+ u8 isrc, status;
+ int n = 0;
+
+- while ((isrc = readl(priv->base + SUN4I_REG_INT_ADDR)) &&
+- (n < SUN4I_CAN_MAX_IRQ)) {
++ while ((n < SUN4I_CAN_MAX_IRQ) &&
++ (isrc = readl(priv->base + SUN4I_REG_INT_ADDR))) {
+ n++;
+ status = readl(priv->base + SUN4I_REG_STA_ADDR);
+
--- /dev/null
+From fe680d8c747f4e676ac835c8c7fb0f287cd98758 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 17 Nov 2025 21:42:02 +0100
+Subject: dm-verity: fix unreliable memory allocation
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit fe680d8c747f4e676ac835c8c7fb0f287cd98758 upstream.
+
+GFP_NOWAIT allocation may fail anytime. It needs to be changed to
+GFP_NOIO. There's no need to handle an error because mempool_alloc with
+GFP_NOIO can't fail.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Reviewed-by: Eric Biggers <ebiggers@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-verity-fec.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/md/dm-verity-fec.c
++++ b/drivers/md/dm-verity-fec.c
+@@ -314,11 +314,7 @@ static int fec_alloc_bufs(struct dm_veri
+ if (fio->bufs[n])
+ continue;
+
+- fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOWAIT);
+- if (unlikely(!fio->bufs[n])) {
+- DMERR("failed to allocate FEC buffer");
+- return -ENOMEM;
+- }
++ fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOIO);
+ }
+
+ /* try to allocate the maximum number of buffers */
--- /dev/null
+From d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 Mon Sep 17 00:00:00 2001
+From: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
+Date: Mon, 3 Nov 2025 07:21:28 +0800
+Subject: firmware: stratix10-svc: fix bug in saving controller data
+
+From: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
+
+commit d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 upstream.
+
+Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They
+both are of the same data and overrides each other. This resulted in the
+rmmod of the svc driver to fail and throw a kernel panic for kthread_stop
+and fifo free.
+
+Fixes: b5dc75c915cd ("firmware: stratix10-svc: extend svc to support new RSU features")
+Cc: stable@vger.kernel.org # 6.6+
+Signed-off-by: Ang Tien Sung <tiensung.ang@altera.com>
+Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
+Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/firmware/stratix10-svc.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/firmware/stratix10-svc.c
++++ b/drivers/firmware/stratix10-svc.c
+@@ -127,6 +127,7 @@ struct stratix10_svc_data {
+ * @complete_status: state for completion
+ * @svc_fifo_lock: protect access to service message data queue
+ * @invoke_fn: function to issue secure monitor call or hypervisor call
++ * @svc: manages the list of client svc drivers
+ *
+ * This struct is used to create communication channels for service clients, to
+ * handle secure monitor or hypervisor call.
+@@ -143,6 +144,7 @@ struct stratix10_svc_controller {
+ struct completion complete_status;
+ spinlock_t svc_fifo_lock;
+ svc_invoke_fn *invoke_fn;
++ struct stratix10_svc *svc;
+ };
+
+ /**
+@@ -1038,6 +1040,7 @@ static int stratix10_svc_drv_probe(struc
+ ret = -ENOMEM;
+ goto err_free_kfifo;
+ }
++ controller->svc = svc;
+
+ svc->stratix10_svc_rsu = platform_device_alloc(STRATIX10_RSU, 0);
+ if (!svc->stratix10_svc_rsu) {
+@@ -1050,8 +1053,6 @@ static int stratix10_svc_drv_probe(struc
+ if (ret)
+ goto err_put_device;
+
+- dev_set_drvdata(dev, svc);
+-
+ pr_info("Intel Service Layer Driver Initialized\n");
+
+ return 0;
+@@ -1065,8 +1066,8 @@ err_free_kfifo:
+
+ static int stratix10_svc_drv_remove(struct platform_device *pdev)
+ {
+- struct stratix10_svc *svc = dev_get_drvdata(&pdev->dev);
+ struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
++ struct stratix10_svc *svc = ctrl->svc;
+
+ platform_device_unregister(svc->stratix10_svc_rsu);
+
--- /dev/null
+From eb4917f557d43c7a1c805dd73ffcdfddb2aba39a Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Mon, 27 Oct 2025 17:20:50 +0800
+Subject: serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit eb4917f557d43c7a1c805dd73ffcdfddb2aba39a upstream.
+
+Check for returned DMA addresses using specialized dma_mapping_error()
+helper which is generally recommended for this purpose by
+Documentation/core-api/dma-api.rst:
+
+ "In some circumstances dma_map_single(), ...
+will fail to create a mapping. A driver can check for these errors
+by testing the returned DMA address with dma_mapping_error()."
+
+Found via static analysis and this is similar to commit fa0308134d26
+("ALSA: memalloc: prefer dma_mapping_error() over explicit address checking")
+
+Fixes: 58ac1b379979 ("ARM: PL011: Fix DMA support")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
+Link: https://patch.msgid.link/20251027092053.87937-1-linmq006@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/amba-pl011.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -636,7 +636,7 @@ static int pl011_dma_tx_refill(struct ua
+ dmatx->len = count;
+ dmatx->dma = dma_map_single(dma_dev->dev, dmatx->buf, count,
+ DMA_TO_DEVICE);
+- if (dmatx->dma == DMA_MAPPING_ERROR) {
++ if (dma_mapping_error(dma_dev->dev, dmatx->dma)) {
+ uap->dmatx.queued = false;
+ dev_dbg(uap->port.dev, "unable to map TX DMA\n");
+ return -EBUSY;
iio-common-ssp_sensors-fix-an-error-handling-path-ssp_probe.patch
mips-mm-prevent-a-tlb-shutdown-on-initial-uniquification.patch
mips-mm-kmalloc-tlb_vpn-array-to-avoid-stack-overflow.patch
+atm-fore200e-fix-possible-data-race-in-fore200e_open.patch
+can-sja1000-fix-max-irq-loop-handling.patch
+can-sun4i_can-sun4i_can_interrupt-fix-max-irq-loop-handling.patch
+dm-verity-fix-unreliable-memory-allocation.patch
+thunderbolt-add-support-for-intel-wildcat-lake.patch
+slimbus-ngd-fix-reference-count-leak-in-qcom_slim_ngd_notify_slaves.patch
+firmware-stratix10-svc-fix-bug-in-saving-controller-data.patch
+serial-amba-pl011-prefer-dma_mapping_error-over-explicit-address-checking.patch
--- /dev/null
+From 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e Mon Sep 17 00:00:00 2001
+From: Miaoqian Lin <linmq006@gmail.com>
+Date: Mon, 27 Oct 2025 14:06:01 +0800
+Subject: slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+commit 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e upstream.
+
+The function qcom_slim_ngd_notify_slaves() calls of_slim_get_device() which
+internally uses device_find_child() to obtain a device reference.
+According to the device_find_child() documentation,
+the caller must drop the reference with put_device() after use.
+
+Found via static analysis and this is similar to commit 4e65bda8273c
+("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
+
+Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Link: https://patch.msgid.link/20251027060601.33228-1-linmq006@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/slimbus/qcom-ngd-ctrl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/slimbus/qcom-ngd-ctrl.c
++++ b/drivers/slimbus/qcom-ngd-ctrl.c
+@@ -1149,6 +1149,7 @@ static void qcom_slim_ngd_notify_slaves(
+
+ if (slim_get_logical_addr(sbdev))
+ dev_err(ctrl->dev, "Failed to get logical address\n");
++ put_device(&sbdev->dev);
+ }
+ }
+
--- /dev/null
+From 3575254546a27210a4b661ea37fbbfb836c0815d Mon Sep 17 00:00:00 2001
+From: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
+Date: Thu, 14 Nov 2024 10:55:44 +0100
+Subject: thunderbolt: Add support for Intel Wildcat Lake
+
+From: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
+
+commit 3575254546a27210a4b661ea37fbbfb836c0815d upstream.
+
+Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar
+Lake platform. Add Wildcat Lake PCI ID to the driver list of supported
+devices.
+
+Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/thunderbolt/nhi.c | 2 ++
+ drivers/thunderbolt/nhi.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+--- a/drivers/thunderbolt/nhi.c
++++ b/drivers/thunderbolt/nhi.c
+@@ -1375,6 +1375,8 @@ static struct pci_device_id nhi_ids[] =
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1),
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_WCL_NHI0),
++ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
+
+--- a/drivers/thunderbolt/nhi.h
++++ b/drivers/thunderbolt/nhi.h
+@@ -75,6 +75,7 @@ extern const struct tb_nhi_ops icl_nhi_o
+ #define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef
+ #define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e
+ #define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d
++#define PCI_DEVICE_ID_INTEL_WCL_NHI0 0x4d33
+ #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781
+ #define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784
+ #define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2
projects / thirdparty / kernel / stable-queue.git / commitdiff
