From: Sasha Levin Date: Mon, 5 Aug 2024 12:18:09 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v6.1.104~23 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=068531222f414f26e71a72c0f0ec3d569cc005c4;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/drm-nouveau-prime-fix-refcount-underflow.patch b/queue-5.10/drm-nouveau-prime-fix-refcount-underflow.patch new file mode 100644 index 00000000000..fa0b4de0714 --- /dev/null +++ b/queue-5.10/drm-nouveau-prime-fix-refcount-underflow.patch @@ -0,0 +1,47 @@ +From 49c4c217a24cb181bd826aaf5a43a71f71a3671d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jul 2024 18:58:46 +0200 +Subject: drm/nouveau: prime: fix refcount underflow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Danilo Krummrich + +[ Upstream commit a9bf3efc33f1fbf88787a277f7349459283c9b95 ] + +Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and +hence the backing ttm_bo) leads to a refcount underflow. + +Instead of calling nouveau_bo_ref() in the unwind path of +drm_gem_object_init(), clean things up manually. + +Fixes: ab9ccb96a6e6 ("drm/nouveau: use prime helpers") +Reviewed-by: Ben Skeggs +Reviewed-by: Christian König +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240718165959.3983-2-dakr@kernel.org +(cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5) +Signed-off-by: Danilo Krummrich +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_prime.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c +index f08bda533bd94..65874a48dc807 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_prime.c ++++ b/drivers/gpu/drm/nouveau/nouveau_prime.c +@@ -81,7 +81,8 @@ struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, + * to the caller, instead of a normal nouveau_bo ttm reference. */ + ret = drm_gem_object_init(dev, &nvbo->bo.base, size); + if (ret) { +- nouveau_bo_ref(NULL, &nvbo); ++ drm_gem_object_release(&nvbo->bo.base); ++ kfree(nvbo); + obj = ERR_PTR(-ENOMEM); + goto unlock; + } +-- +2.43.0 + diff --git a/queue-5.10/drm-vmwgfx-fix-overlay-when-using-screen-targets.patch b/queue-5.10/drm-vmwgfx-fix-overlay-when-using-screen-targets.patch new file mode 100644 index 00000000000..a449afc69f9 --- /dev/null +++ b/queue-5.10/drm-vmwgfx-fix-overlay-when-using-screen-targets.patch @@ -0,0 +1,41 @@ +From 648351ae21506090fe27a4bdea9e947d731d971e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jul 2024 11:36:27 -0500 +Subject: drm/vmwgfx: Fix overlay when using Screen Targets + +From: Ian Forbes + +[ Upstream commit cb372a505a994cb39aa75acfb8b3bcf94787cf94 ] + +This code was never updated to support Screen Targets. +Fixes a bug where Xv playback displays a green screen instead of actual +video contents when 3D acceleration is disabled in the guest. + +Fixes: c8261a961ece ("vmwgfx: Major KMS refactoring / cleanup in preparation of screen targets") +Reported-by: Doug Brown +Closes: https://lore.kernel.org/all/bd9cb3c7-90e8-435d-bc28-0e38fee58977@schmorgal.com +Signed-off-by: Ian Forbes +Tested-by: Doug Brown +Signed-off-by: Zack Rusin +Link: https://patchwork.freedesktop.org/patch/msgid/20240719163627.20888-1-ian.forbes@broadcom.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c +index cd7ed1650d60c..7aa1d9218ea6b 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c +@@ -98,7 +98,7 @@ static int vmw_overlay_send_put(struct vmw_private *dev_priv, + { + struct vmw_escape_video_flush *flush; + size_t fifo_size; +- bool have_so = (dev_priv->active_display_unit == vmw_du_screen_object); ++ bool have_so = (dev_priv->active_display_unit != vmw_du_legacy); + int i, num_items; + SVGAGuestPtr ptr; + +-- +2.43.0 + diff --git a/queue-5.10/ipv6-fix-ndisc_is_useropt-handling-for-pio.patch b/queue-5.10/ipv6-fix-ndisc_is_useropt-handling-for-pio.patch new file mode 100644 index 00000000000..0447f268fde --- /dev/null +++ b/queue-5.10/ipv6-fix-ndisc_is_useropt-handling-for-pio.patch @@ -0,0 +1,92 @@ +From 641519fdb56e18a3ef3e506da67bdb0b994795e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jul 2024 17:17:48 -0700 +Subject: ipv6: fix ndisc_is_useropt() handling for PIO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Żenczykowski + +[ Upstream commit a46c68debf3be3a477a69ccbf0a1d050df841676 ] + +The current logic only works if the PIO is between two +other ND user options. This fixes it so that the PIO +can also be either before or after other ND user options +(for example the first or last option in the RA). + +side note: there's actually Android tests verifying +a portion of the old broken behaviour, so: + https://android-review.googlesource.com/c/kernel/tests/+/3196704 +fixes those up. + +Cc: Jen Linkova +Cc: Lorenzo Colitti +Cc: Patrick Rohr +Cc: David Ahern +Cc: YOSHIFUJI Hideaki / 吉藤英明 +Cc: Jakub Kicinski +Signed-off-by: Maciej Żenczykowski +Fixes: 048c796beb6e ("ipv6: adjust ndisc_is_useropt() to also return true for PIO") +Link: https://patch.msgid.link/20240730001748.147636-1-maze@google.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/ndisc.c | 34 ++++++++++++++++++---------------- + 1 file changed, 18 insertions(+), 16 deletions(-) + +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index 14251347c4a50..4f46b0a2e5680 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -226,6 +226,7 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev, + return NULL; + memset(ndopts, 0, sizeof(*ndopts)); + while (opt_len) { ++ bool unknown = false; + int l; + if (opt_len < sizeof(struct nd_opt_hdr)) + return NULL; +@@ -261,22 +262,23 @@ struct ndisc_options *ndisc_parse_options(const struct net_device *dev, + break; + #endif + default: +- if (ndisc_is_useropt(dev, nd_opt)) { +- ndopts->nd_useropts_end = nd_opt; +- if (!ndopts->nd_useropts) +- ndopts->nd_useropts = nd_opt; +- } else { +- /* +- * Unknown options must be silently ignored, +- * to accommodate future extension to the +- * protocol. +- */ +- ND_PRINTK(2, notice, +- "%s: ignored unsupported option; type=%d, len=%d\n", +- __func__, +- nd_opt->nd_opt_type, +- nd_opt->nd_opt_len); +- } ++ unknown = true; ++ } ++ if (ndisc_is_useropt(dev, nd_opt)) { ++ ndopts->nd_useropts_end = nd_opt; ++ if (!ndopts->nd_useropts) ++ ndopts->nd_useropts = nd_opt; ++ } else if (unknown) { ++ /* ++ * Unknown options must be silently ignored, ++ * to accommodate future extension to the ++ * protocol. ++ */ ++ ND_PRINTK(2, notice, ++ "%s: ignored unsupported option; type=%d, len=%d\n", ++ __func__, ++ nd_opt->nd_opt_type, ++ nd_opt->nd_opt_len); + } + next_opt: + opt_len -= l; +-- +2.43.0 + diff --git a/queue-5.10/net-iucv-fix-use-after-free-in-iucv_sock_close.patch b/queue-5.10/net-iucv-fix-use-after-free-in-iucv_sock_close.patch new file mode 100644 index 00000000000..3778f67c27f --- /dev/null +++ b/queue-5.10/net-iucv-fix-use-after-free-in-iucv_sock_close.patch @@ -0,0 +1,75 @@ +From b0c87c0da5c396d6af6dc6b651471e1af236e3b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jul 2024 14:28:16 +0200 +Subject: net/iucv: fix use after free in iucv_sock_close() + +From: Alexandra Winter + +[ Upstream commit f558120cd709682b739207b48cf7479fd9568431 ] + +iucv_sever_path() is called from process context and from bh context. +iucv->path is used as indicator whether somebody else is taking care of +severing the path (or it is already removed / never existed). +This needs to be done with atomic compare and swap, otherwise there is a +small window where iucv_sock_close() will try to work with a path that has +already been severed and freed by iucv_callback_connrej() called by +iucv_tasklet_fn(). + +Example: +[452744.123844] Call Trace: +[452744.123845] ([<0000001e87f03880>] 0x1e87f03880) +[452744.123966] [<00000000d593001e>] iucv_path_sever+0x96/0x138 +[452744.124330] [<000003ff801ddbca>] iucv_sever_path+0xc2/0xd0 [af_iucv] +[452744.124336] [<000003ff801e01b6>] iucv_sock_close+0xa6/0x310 [af_iucv] +[452744.124341] [<000003ff801e08cc>] iucv_sock_release+0x3c/0xd0 [af_iucv] +[452744.124345] [<00000000d574794e>] __sock_release+0x5e/0xe8 +[452744.124815] [<00000000d5747a0c>] sock_close+0x34/0x48 +[452744.124820] [<00000000d5421642>] __fput+0xba/0x268 +[452744.124826] [<00000000d51b382c>] task_work_run+0xbc/0xf0 +[452744.124832] [<00000000d5145710>] do_notify_resume+0x88/0x90 +[452744.124841] [<00000000d5978096>] system_call+0xe2/0x2c8 +[452744.125319] Last Breaking-Event-Address: +[452744.125321] [<00000000d5930018>] iucv_path_sever+0x90/0x138 +[452744.125324] +[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt + +Note that bh_lock_sock() is not serializing the tasklet context against +process context, because the check for sock_owned_by_user() and +corresponding handling is missing. + +Ideas for a future clean-up patch: +A) Correct usage of bh_lock_sock() in tasklet context, as described in +Link: https://lore.kernel.org/netdev/1280155406.2899.407.camel@edumazet-laptop/ +Re-enqueue, if needed. This may require adding return values to the +tasklet functions and thus changes to all users of iucv. + +B) Change iucv tasklet into worker and use only lock_sock() in af_iucv. + +Fixes: 7d316b945352 ("af_iucv: remove IUCV-pathes completely") +Reviewed-by: Halil Pasic +Signed-off-by: Alexandra Winter +Link: https://patch.msgid.link/20240729122818.947756-1-wintera@linux.ibm.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/iucv/af_iucv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index 7c73faa5336cd..3d0424e4ae6c9 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -359,8 +359,8 @@ static void iucv_sever_path(struct sock *sk, int with_user_data) + struct iucv_sock *iucv = iucv_sk(sk); + struct iucv_path *path = iucv->path; + +- if (iucv->path) { +- iucv->path = NULL; ++ /* Whoever resets the path pointer, must sever and free it. */ ++ if (xchg(&iucv->path, NULL)) { + if (with_user_data) { + low_nmcpy(user_data, iucv->src_name); + high_nmcpy(user_data, iucv->dst_name); +-- +2.43.0 + diff --git a/queue-5.10/net-mlx5e-add-a-check-for-the-return-value-from-mlx5.patch b/queue-5.10/net-mlx5e-add-a-check-for-the-return-value-from-mlx5.patch new file mode 100644 index 00000000000..fc5517b8cd5 --- /dev/null +++ b/queue-5.10/net-mlx5e-add-a-check-for-the-return-value-from-mlx5.patch @@ -0,0 +1,48 @@ +From 337fe8751159d28f58d5c6272e5dc8a59c11c4ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jul 2024 09:16:37 +0300 +Subject: net/mlx5e: Add a check for the return value from + mlx5_port_set_eth_ptys + +From: Shahar Shitrit + +[ Upstream commit 3f8e82a020a5c22f9b791f4ac499b8e18007fbda ] + +Since the documentation for mlx5_toggle_port_link states that it should +only be used after setting the port register, we add a check for the +return value from mlx5_port_set_eth_ptys to ensure the register was +successfully set before calling it. + +Fixes: 667daedaecd1 ("net/mlx5e: Toggle link only after modifying port parameters") +Signed-off-by: Shahar Shitrit +Reviewed-by: Carolina Jubran +Signed-off-by: Tariq Toukan +Reviewed-by: Wojciech Drewek +Link: https://patch.msgid.link/20240730061638.1831002-9-tariqt@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index d3817dd07e3dc..1fdb42899a9f3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1155,7 +1155,12 @@ int mlx5e_ethtool_set_link_ksettings(struct mlx5e_priv *priv, + if (!an_changes && link_modes == eproto.admin) + goto out; + +- mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext); ++ err = mlx5_port_set_eth_ptys(mdev, an_disable, link_modes, ext); ++ if (err) { ++ netdev_err(priv->netdev, "%s: failed to set ptys reg: %d\n", __func__, err); ++ goto out; ++ } ++ + mlx5_toggle_port_link(mdev); + + out: +-- +2.43.0 + diff --git a/queue-5.10/riscv-mm-add-handling-for-vm_fault_sigsegv-in-mm_fau.patch b/queue-5.10/riscv-mm-add-handling-for-vm_fault_sigsegv-in-mm_fau.patch new file mode 100644 index 00000000000..b57aada75bb --- /dev/null +++ b/queue-5.10/riscv-mm-add-handling-for-vm_fault_sigsegv-in-mm_fau.patch @@ -0,0 +1,65 @@ +From 20bbe136398b3eae3d45e77d263e4d2c858e9740 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2024 16:45:47 +0800 +Subject: riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() + +From: Zhe Qiao + +[ Upstream commit 0c710050c47d45eb77b28c271cddefc5c785cb40 ] + +Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly +kill the process and we don't BUG() the kernel. + +Fixes: 07037db5d479 ("RISC-V: Paging and MMU") +Signed-off-by: Zhe Qiao +Reviewed-by: Alexandre Ghiti +Link: https://lore.kernel.org/r/20240731084547.85380-1-qiaozhe@iscas.ac.cn +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/fault.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c +index 54b12943cc7b0..9bed320891974 100644 +--- a/arch/riscv/mm/fault.c ++++ b/arch/riscv/mm/fault.c +@@ -39,26 +39,27 @@ static inline void no_context(struct pt_regs *regs, unsigned long addr) + + static inline void mm_fault_error(struct pt_regs *regs, unsigned long addr, vm_fault_t fault) + { ++ if (!user_mode(regs)) { ++ no_context(regs, addr); ++ return; ++ } ++ + if (fault & VM_FAULT_OOM) { + /* + * We ran out of memory, call the OOM killer, and return the userspace + * (which will retry the fault, or kill us if we got oom-killed). + */ +- if (!user_mode(regs)) { +- no_context(regs, addr); +- return; +- } + pagefault_out_of_memory(); + return; + } else if (fault & VM_FAULT_SIGBUS) { + /* Kernel mode? Handle exceptions or die */ +- if (!user_mode(regs)) { +- no_context(regs, addr); +- return; +- } + do_trap(regs, SIGBUS, BUS_ADRERR, addr); + return; ++ } else if (fault & VM_FAULT_SIGSEGV) { ++ do_trap(regs, SIGSEGV, SEGV_MAPERR, addr); ++ return; + } ++ + BUG(); + } + +-- +2.43.0 + diff --git a/queue-5.10/sched-act_ct-take-care-of-padding-in-struct-zones_ht.patch b/queue-5.10/sched-act_ct-take-care-of-padding-in-struct-zones_ht.patch new file mode 100644 index 00000000000..cd417dce9f3 --- /dev/null +++ b/queue-5.10/sched-act_ct-take-care-of-padding-in-struct-zones_ht.patch @@ -0,0 +1,90 @@ +From db68f62c343536bc16d019f944991184f748f46b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 09:27:45 +0000 +Subject: sched: act_ct: take care of padding in struct zones_ht_key + +From: Eric Dumazet + +[ Upstream commit 2191a54f63225b548fd8346be3611c3219a24738 ] + +Blamed commit increased lookup key size from 2 bytes to 16 bytes, +because zones_ht_key got a struct net pointer. + +Make sure rhashtable_lookup() is not using the padding bytes +which are not initialized. + + BUG: KMSAN: uninit-value in rht_ptr_rcu include/linux/rhashtable.h:376 [inline] + BUG: KMSAN: uninit-value in __rhashtable_lookup include/linux/rhashtable.h:607 [inline] + BUG: KMSAN: uninit-value in rhashtable_lookup include/linux/rhashtable.h:646 [inline] + BUG: KMSAN: uninit-value in rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] + BUG: KMSAN: uninit-value in tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 + rht_ptr_rcu include/linux/rhashtable.h:376 [inline] + __rhashtable_lookup include/linux/rhashtable.h:607 [inline] + rhashtable_lookup include/linux/rhashtable.h:646 [inline] + rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] + tcf_ct_flow_table_get+0x611/0x2260 net/sched/act_ct.c:329 + tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 + tcf_action_init_1+0x6cc/0xb30 net/sched/act_api.c:1425 + tcf_action_init+0x458/0xf00 net/sched/act_api.c:1488 + tcf_action_add net/sched/act_api.c:2061 [inline] + tc_ctl_action+0x4be/0x19d0 net/sched/act_api.c:2118 + rtnetlink_rcv_msg+0x12fc/0x1410 net/core/rtnetlink.c:6647 + netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2550 + rtnetlink_rcv+0x34/0x40 net/core/rtnetlink.c:6665 + netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] + netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1357 + netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1901 + sock_sendmsg_nosec net/socket.c:730 [inline] + __sock_sendmsg+0x30f/0x380 net/socket.c:745 + ____sys_sendmsg+0x877/0xb60 net/socket.c:2597 + ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2651 + __sys_sendmsg net/socket.c:2680 [inline] + __do_sys_sendmsg net/socket.c:2689 [inline] + __se_sys_sendmsg net/socket.c:2687 [inline] + __x64_sys_sendmsg+0x307/0x4a0 net/socket.c:2687 + x64_sys_call+0x2dd6/0x3c10 arch/x86/include/generated/asm/syscalls_64.h:47 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + +Local variable key created at: + tcf_ct_flow_table_get+0x4a/0x2260 net/sched/act_ct.c:324 + tcf_ct_init+0xa67/0x2890 net/sched/act_ct.c:1408 + +Fixes: 88c67aeb1407 ("sched: act_ct: add netns into the key of tcf_ct_flow_table") +Reported-by: syzbot+1b5e4e187cc586d05ea0@syzkaller.appspotmail.com +Signed-off-by: Eric Dumazet +Cc: Xin Long +Reviewed-by: Simon Horman +Reviewed-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/act_ct.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c +index a59a8ad387211..4ea7a81707f3f 100644 +--- a/net/sched/act_ct.c ++++ b/net/sched/act_ct.c +@@ -41,6 +41,8 @@ static DEFINE_MUTEX(zones_mutex); + struct zones_ht_key { + struct net *net; + u16 zone; ++ /* Note : pad[] must be the last field. */ ++ u8 pad[]; + }; + + struct tcf_ct_flow_table { +@@ -57,7 +59,7 @@ struct tcf_ct_flow_table { + static const struct rhashtable_params zones_params = { + .head_offset = offsetof(struct tcf_ct_flow_table, node), + .key_offset = offsetof(struct tcf_ct_flow_table, key), +- .key_len = sizeof_field(struct tcf_ct_flow_table, key), ++ .key_len = offsetof(struct zones_ht_key, pad), + .automatic_shrinking = true, + }; + +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index e67dc8ee69e..38598405a5f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -241,3 +241,10 @@ irqchip-imx-irqsteer-handle-runtime-power-management.patch remoteproc-imx_rproc-ignore-mapping-vdev-regions.patch remoteproc-imx_rproc-fix-ignoring-mapping-vdev-regio.patch remoteproc-imx_rproc-skip-over-memory-region-when-no.patch +drm-nouveau-prime-fix-refcount-underflow.patch +drm-vmwgfx-fix-overlay-when-using-screen-targets.patch +sched-act_ct-take-care-of-padding-in-struct-zones_ht.patch +net-iucv-fix-use-after-free-in-iucv_sock_close.patch +net-mlx5e-add-a-check-for-the-return-value-from-mlx5.patch +ipv6-fix-ndisc_is_useropt-handling-for-pio.patch +riscv-mm-add-handling-for-vm_fault_sigsegv-in-mm_fau.patch