+++ /dev/null
-From 9adcb0df3f767e218a2e03f4b4ebdc1e71d68005 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2026 17:11:32 +0100
-Subject: i3c: master: Fix error codes at send_ccc_cmd
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
-
-i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive,
-Mx codes) to the ret variable, cascading down multiple methods until
-reaching methods that explicitly stated they would return 0 on success
-or negative error code. For example, the call chain:
-
- i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <-
- master->ops.enable_ibi <- i3c_master_enec_locked <-
- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
-
-Fix this by returning the ret value, callers can still read the cmd->err
-value if ret is negative.
-
-All corner cases where the Mx codes do need to be handled individually,
-are resolved in previous commits. Those corner cases are all scenarios
-when I3C_ERROR_M2 is expected and acceptable.
-The prerequisite patches for the fix are:
-
- i3c: master: Move rstdaa error suppression
- i3c: master: Move entdaa error suppression
- i3c: master: Move bus_init error suppression
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/
-Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
-index f3fc7fe3779fe..7539e7d563032 100644
---- a/drivers/i3c/master.c
-+++ b/drivers/i3c/master.c
-@@ -700,11 +700,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id,
- cmd->err = I3C_ERROR_UNKNOWN;
- }
-
-+/**
-+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
-+ * @master: master used to send frames on the bus
-+ * @cmd: command to send
-+ *
-+ * Return: 0 in case of success, or a negative error code otherwise.
-+ * I3C Mx error codes are stored in cmd->err.
-+ */
- static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- struct i3c_ccc_cmd *cmd)
- {
-- int ret;
--
- if (!cmd || !master)
- return -EINVAL;
-
-@@ -722,15 +728,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- !master->ops->supports_ccc_cmd(master, cmd))
- return -ENOTSUPP;
-
-- ret = master->ops->send_ccc_cmd(master, cmd);
-- if (ret) {
-- if (cmd->err != I3C_ERROR_UNKNOWN)
-- return cmd->err;
--
-- return ret;
-- }
--
-- return 0;
-+ return master->ops->send_ccc_cmd(master, cmd);
- }
-
- static struct i2c_dev_desc *
-@@ -834,8 +832,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_entdaa_locked(struct i3c_master_controller *master)
- {
-@@ -887,8 +884,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -908,8 +904,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -934,8 +929,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_defslvs_locked(struct i3c_master_controller *master)
- {
---
-2.53.0
-
pinctrl-abx500-fix-type-of-argument-variable.patch
perf-expr-return-einval-for-syntax-error-in-expr__fi.patch
perf-util-kill-die-prototype-dead-for-a-long-time.patch
-i3c-master-fix-error-codes-at-send_ccc_cmd.patch
driver-core-device.h-remove-extern-from-function-pro.patch
driver-core-move-dev_err_probe-to-where-it-belogs.patch
dev_printk-add-new-dev_err_probe-helpers.patch
+++ /dev/null
-From 4d1def74095aaf84519e1f118fb0d96640b731dc Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2026 17:11:32 +0100
-Subject: i3c: master: Fix error codes at send_ccc_cmd
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
-
-i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive,
-Mx codes) to the ret variable, cascading down multiple methods until
-reaching methods that explicitly stated they would return 0 on success
-or negative error code. For example, the call chain:
-
- i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <-
- master->ops.enable_ibi <- i3c_master_enec_locked <-
- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
-
-Fix this by returning the ret value, callers can still read the cmd->err
-value if ret is negative.
-
-All corner cases where the Mx codes do need to be handled individually,
-are resolved in previous commits. Those corner cases are all scenarios
-when I3C_ERROR_M2 is expected and acceptable.
-The prerequisite patches for the fix are:
-
- i3c: master: Move rstdaa error suppression
- i3c: master: Move entdaa error suppression
- i3c: master: Move bus_init error suppression
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/
-Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
-index 5df943d25cf0a..6153f5af0b13e 100644
---- a/drivers/i3c/master.c
-+++ b/drivers/i3c/master.c
-@@ -654,11 +654,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id,
- cmd->err = I3C_ERROR_UNKNOWN;
- }
-
-+/**
-+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
-+ * @master: master used to send frames on the bus
-+ * @cmd: command to send
-+ *
-+ * Return: 0 in case of success, or a negative error code otherwise.
-+ * I3C Mx error codes are stored in cmd->err.
-+ */
- static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- struct i3c_ccc_cmd *cmd)
- {
-- int ret;
--
- if (!cmd || !master)
- return -EINVAL;
-
-@@ -676,15 +682,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- !master->ops->supports_ccc_cmd(master, cmd))
- return -ENOTSUPP;
-
-- ret = master->ops->send_ccc_cmd(master, cmd);
-- if (ret) {
-- if (cmd->err != I3C_ERROR_UNKNOWN)
-- return cmd->err;
--
-- return ret;
-- }
--
-- return 0;
-+ return master->ops->send_ccc_cmd(master, cmd);
- }
-
- static struct i2c_dev_desc *
-@@ -788,8 +786,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_entdaa_locked(struct i3c_master_controller *master)
- {
-@@ -841,8 +838,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -862,8 +858,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -888,8 +883,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_defslvs_locked(struct i3c_master_controller *master)
- {
---
-2.53.0
-
pinctrl-abx500-fix-type-of-argument-variable.patch
perf-expr-return-einval-for-syntax-error-in-expr__fi.patch
perf-util-kill-die-prototype-dead-for-a-long-time.patch
-i3c-master-fix-error-codes-at-send_ccc_cmd.patch
i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch
driver-core-device.h-remove-extern-from-function-pro.patch
driver-core-move-dev_err_probe-to-where-it-belogs.patch
+++ /dev/null
-From e14277f0eac3588ba398919b6fd16632a855f7b4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2026 17:11:32 +0100
-Subject: i3c: master: Fix error codes at send_ccc_cmd
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
-
-i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive,
-Mx codes) to the ret variable, cascading down multiple methods until
-reaching methods that explicitly stated they would return 0 on success
-or negative error code. For example, the call chain:
-
- i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <-
- master->ops.enable_ibi <- i3c_master_enec_locked <-
- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
-
-Fix this by returning the ret value, callers can still read the cmd->err
-value if ret is negative.
-
-All corner cases where the Mx codes do need to be handled individually,
-are resolved in previous commits. Those corner cases are all scenarios
-when I3C_ERROR_M2 is expected and acceptable.
-The prerequisite patches for the fix are:
-
- i3c: master: Move rstdaa error suppression
- i3c: master: Move entdaa error suppression
- i3c: master: Move bus_init error suppression
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/
-Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
-index 74138c499642e..74cadaf638936 100644
---- a/drivers/i3c/master.c
-+++ b/drivers/i3c/master.c
-@@ -792,11 +792,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id,
- cmd->err = I3C_ERROR_UNKNOWN;
- }
-
-+/**
-+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
-+ * @master: master used to send frames on the bus
-+ * @cmd: command to send
-+ *
-+ * Return: 0 in case of success, or a negative error code otherwise.
-+ * I3C Mx error codes are stored in cmd->err.
-+ */
- static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- struct i3c_ccc_cmd *cmd)
- {
-- int ret;
--
- if (!cmd || !master)
- return -EINVAL;
-
-@@ -814,15 +820,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- !master->ops->supports_ccc_cmd(master, cmd))
- return -ENOTSUPP;
-
-- ret = master->ops->send_ccc_cmd(master, cmd);
-- if (ret) {
-- if (cmd->err != I3C_ERROR_UNKNOWN)
-- return cmd->err;
--
-- return ret;
-- }
--
-- return 0;
-+ return master->ops->send_ccc_cmd(master, cmd);
- }
-
- static struct i2c_dev_desc *
-@@ -926,8 +924,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_entdaa_locked(struct i3c_master_controller *master)
- {
-@@ -979,8 +976,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1000,8 +996,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1026,8 +1021,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_defslvs_locked(struct i3c_master_controller *master)
- {
---
-2.53.0
-
pinctrl-abx500-fix-type-of-argument-variable.patch
perf-expr-return-einval-for-syntax-error-in-expr__fi.patch
perf-util-kill-die-prototype-dead-for-a-long-time.patch
-i3c-master-fix-error-codes-at-send_ccc_cmd.patch
i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch
driver-core-device.h-remove-extern-from-function-pro.patch
driver-core-move-dev_err_probe-to-where-it-belogs.patch
+++ /dev/null
-From 5e410791dbced5ee143653e38daf4ac927e23634 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Apr 2026 12:11:09 -0700
-Subject: bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator
- finalize
-
-From: Puranjay Mohan <puranjay@kernel.org>
-
-[ Upstream commit 46ee1342b887c9387a933397d846ff6c9584322c ]
-
-bpf_flush_icache() calls flush_icache_range() to clean the data cache
-and invalidate the instruction cache for the JITed code region. However,
-since commit 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the
-BPF JIT"), this flush is redundant.
-
-bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX
-region via bpf_arch_text_copy() -> patch_text_nosync(), and
-patch_text_nosync() already calls flush_icache_range() on the written
-range. The subsequent bpf_flush_icache() repeats the same cache
-maintenance on an overlapping range.
-
-Remove the redundant bpf_flush_icache() call and its now-unused
-definition.
-
-Fixes: 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT")
-Acked-by: Song Liu <song@kernel.org>
-Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
-Reviewed-by: Pu Lehui <pulehui@huawei.com>
-Tested-by: Paul Chaignon <paul.chaignon@gmail.com>
-Link: https://lore.kernel.org/r/20260413191111.3426023-3-puranjay@kernel.org
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h | 6 ------
- arch/riscv/net/bpf_jit_core.c | 7 -------
- 2 files changed, 13 deletions(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index 1d1c78d4cff1e..f87bad9a0578c 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -11,7 +11,6 @@
-
- #include <linux/bpf.h>
- #include <linux/filter.h>
--#include <asm/cacheflush.h>
-
- static inline bool rvc_enabled(void)
- {
-@@ -109,11 +108,6 @@ static inline void bpf_fill_ill_insns(void *area, unsigned int size)
- memset(area, 0, size);
- }
-
--static inline void bpf_flush_icache(void *start, void *end)
--{
-- flush_icache_range((unsigned long)start, (unsigned long)end);
--}
--
- /* Emit a 4-byte riscv instruction. */
- static inline void emit(const u32 insn, struct rv_jit_context *ctx)
- {
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index 6de753c667f42..fe362030ed2a9 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -184,13 +184,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- prog = orig_prog;
- goto out_offset;
- }
-- /*
-- * The instructions have now been copied to the ROX region from
-- * where they will execute.
-- * Write any modified data cache blocks out to memory and
-- * invalidate the corresponding blocks in the instruction cache.
-- */
-- bpf_flush_icache(jit_data->ro_header, ctx->ro_insns + ctx->ninsns);
- for (i = 0; i < prog->len; i++)
- ctx->offset[i] = ninsns_rvoff(ctx->offset[i]);
- bpf_prog_fill_jited_linfo(prog, ctx->offset);
---
-2.53.0
-
+++ /dev/null
-From e248e53a772d2d27f13bbbb77e4e2307de793485 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2026 17:11:32 +0100
-Subject: i3c: master: Fix error codes at send_ccc_cmd
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
-
-i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive,
-Mx codes) to the ret variable, cascading down multiple methods until
-reaching methods that explicitly stated they would return 0 on success
-or negative error code. For example, the call chain:
-
- i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <-
- master->ops.enable_ibi <- i3c_master_enec_locked <-
- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
-
-Fix this by returning the ret value, callers can still read the cmd->err
-value if ret is negative.
-
-All corner cases where the Mx codes do need to be handled individually,
-are resolved in previous commits. Those corner cases are all scenarios
-when I3C_ERROR_M2 is expected and acceptable.
-The prerequisite patches for the fix are:
-
- i3c: master: Move rstdaa error suppression
- i3c: master: Move entdaa error suppression
- i3c: master: Move bus_init error suppression
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/
-Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
-index fe6f956cc3111..8e2bff031aac9 100644
---- a/drivers/i3c/master.c
-+++ b/drivers/i3c/master.c
-@@ -825,11 +825,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id,
- cmd->err = I3C_ERROR_UNKNOWN;
- }
-
-+/**
-+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
-+ * @master: master used to send frames on the bus
-+ * @cmd: command to send
-+ *
-+ * Return: 0 in case of success, or a negative error code otherwise.
-+ * I3C Mx error codes are stored in cmd->err.
-+ */
- static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- struct i3c_ccc_cmd *cmd)
- {
-- int ret;
--
- if (!cmd || !master)
- return -EINVAL;
-
-@@ -847,15 +853,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- !master->ops->supports_ccc_cmd(master, cmd))
- return -ENOTSUPP;
-
-- ret = master->ops->send_ccc_cmd(master, cmd);
-- if (ret) {
-- if (cmd->err != I3C_ERROR_UNKNOWN)
-- return cmd->err;
--
-- return ret;
-- }
--
-- return 0;
-+ return master->ops->send_ccc_cmd(master, cmd);
- }
-
- static struct i2c_dev_desc *
-@@ -959,8 +957,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_entdaa_locked(struct i3c_master_controller *master)
- {
-@@ -1012,8 +1009,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1033,8 +1029,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1059,8 +1054,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_defslvs_locked(struct i3c_master_controller *master)
- {
---
-2.53.0
-
hid-usbhid-fix-deadlock-in-hid_post_reset.patch
ext4-fix-possible-null-ptr-deref-in-mbt_kunit_exit.patch
bpf-arm64-fix-off-by-one-in-check_imm-signed-range-c.patch
-bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch
bpf-sockmap-fix-af_unix-iter-deadlock.patch
bpf-sockmap-fix-af_unix-null-ptr-deref-in-proto-upda.patch
bpf-sockmap-take-state-lock-for-af_unix-iter.patch
reset-add-devres-helpers-to-request-pre-deasserted-r.patch
i3c-master-dw-i3c-fix-missing-reset-assertion-in-rem.patch
i3c-dw-fix-memory-leak-in-dw_i3c_master_i3c_xfers.patch
-i3c-master-fix-error-codes-at-send_ccc_cmd.patch
i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch
backlight-sky81452-backlight-check-return-value-of-d.patch
platform-surface-surfacepro3_button-drop-wakeup-sour.patch
+++ /dev/null
-From 88644bdd783993d2a9fdb534da073e398205736d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 14:53:07 +0100
-Subject: dcache: export shrink_dentry_list() and add new helper
- d_dispose_if_unused()
-
-From: Luis Henriques <luis@igalia.com>
-
-[ Upstream commit 395b95530343e7f4bdd2870190d985a222997fb6 ]
-
-Add and export a new helper d_dispose_if_unused() which is simply a wrapper
-around to_shrink_list(), to add an entry to a dispose list if it's not used
-anymore.
-
-Also export shrink_dentry_list() to kill all dentries in a dispose list.
-
-Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
-Signed-off-by: Luis Henriques <luis@igalia.com>
-Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
-Stable-dep-of: 5a6baf204610 ("fuse: fix uninit-value in fuse_dentry_revalidate()")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/dcache.c | 18 ++++++++++++------
- include/linux/dcache.h | 2 ++
- 2 files changed, 14 insertions(+), 6 deletions(-)
-
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 8bf82b002b4d4..fcc8ddf7d3fa4 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -1086,6 +1086,15 @@ struct dentry *d_find_alias_rcu(struct inode *inode)
- return de;
- }
-
-+void d_dispose_if_unused(struct dentry *dentry, struct list_head *dispose)
-+{
-+ spin_lock(&dentry->d_lock);
-+ if (!dentry->d_lockref.count)
-+ to_shrink_list(dentry, dispose);
-+ spin_unlock(&dentry->d_lock);
-+}
-+EXPORT_SYMBOL(d_dispose_if_unused);
-+
- /*
- * Try to kill dentries associated with this inode.
- * WARNING: you must own a reference to inode.
-@@ -1096,12 +1105,8 @@ void d_prune_aliases(struct inode *inode)
- struct dentry *dentry;
-
- spin_lock(&inode->i_lock);
-- hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
-- spin_lock(&dentry->d_lock);
-- if (!dentry->d_lockref.count)
-- to_shrink_list(dentry, &dispose);
-- spin_unlock(&dentry->d_lock);
-- }
-+ hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias)
-+ d_dispose_if_unused(dentry, &dispose);
- spin_unlock(&inode->i_lock);
- shrink_dentry_list(&dispose);
- }
-@@ -1141,6 +1146,7 @@ void shrink_dentry_list(struct list_head *list)
- shrink_kill(dentry);
- }
- }
-+EXPORT_SYMBOL(shrink_dentry_list);
-
- static enum lru_status dentry_lru_isolate(struct list_head *item,
- struct list_lru_one *lru, void *arg)
-diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index c83e02b943894..2bc1339bf6d03 100644
---- a/include/linux/dcache.h
-+++ b/include/linux/dcache.h
-@@ -268,6 +268,8 @@ extern void d_tmpfile(struct file *, struct inode *);
-
- extern struct dentry *d_find_alias(struct inode *);
- extern void d_prune_aliases(struct inode *);
-+extern void d_dispose_if_unused(struct dentry *, struct list_head *);
-+extern void shrink_dentry_list(struct list_head *);
-
- extern struct dentry *d_find_alias_rcu(struct inode *);
-
---
-2.53.0
-
+++ /dev/null
-From 1c13ac55d34912bf60ed4b2e1e5711c3bd454fda Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jan 2026 10:36:07 +0800
-Subject: fuse: fix premature writetrhough request for large folio
-
-From: Jingbo Xu <jefflexu@linux.alibaba.com>
-
-[ Upstream commit 5223e0470e7bb7910038fe3d31171490e00fbbb9 ]
-
-When large folio is enabled and the initial folio offset exceeds
-PAGE_SIZE, e.g. the position resides in the second page of a large
-folio, after the folio copying the offset (in the page) won't be updated
-to 0 even though the expected range is successfully copied until the end
-of the folio. In this case fuse_fill_write_pages() exits prematurelly
-before the request has reached the max_write/max_pages limit.
-
-Fix this by eliminating page offset entirely and use folio offset
-instead.
-
-Fixes: d60a6015e1a2 ("fuse: support large folios for writethrough writes")
-Reviewed-by: Horst Birthelmer <hbirthelmer@ddn.com>
-Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
-Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
-Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/fuse/file.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 6014d588845cd..00ff6374dc76b 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -1183,7 +1183,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- {
- struct fuse_args_pages *ap = &ia->ap;
- struct fuse_conn *fc = get_fuse_conn(mapping->host);
-- unsigned offset = pos & (PAGE_SIZE - 1);
- size_t count = 0;
- unsigned int num;
- int err = 0;
-@@ -1210,7 +1209,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- if (mapping_writably_mapped(mapping))
- flush_dcache_folio(folio);
-
-- folio_offset = ((index - folio->index) << PAGE_SHIFT) + offset;
-+ folio_offset = offset_in_folio(folio, pos);
- bytes = min(folio_size(folio) - folio_offset, num);
-
- tmp = copy_folio_from_iter_atomic(folio, folio_offset, bytes, ii);
-@@ -1240,9 +1239,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- count += tmp;
- pos += tmp;
- num -= tmp;
-- offset += tmp;
-- if (offset == folio_size(folio))
-- offset = 0;
-
- /* If we copied full folio, mark it uptodate */
- if (tmp == folio_size(folio))
-@@ -1254,7 +1250,9 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- ia->write.folio_locked = true;
- break;
- }
-- if (!fc->big_writes || offset != 0)
-+ if (!fc->big_writes)
-+ break;
-+ if (folio_offset + tmp != folio_size(folio))
- break;
- }
-
---
-2.53.0
-
+++ /dev/null
-From 68854a07f0897fe16e57d0847472cb835719fac8 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jan 2026 15:53:38 +0100
-Subject: fuse: fix race when disposing stale dentries
-
-From: Miklos Szeredi <mszeredi@redhat.com>
-
-[ Upstream commit cb8d2bdcb8241b66ca4ac4868f20e12cd6881ebc ]
-
-In fuse_dentry_tree_work() just before d_dispose_if_unused() the dentry
-could get evicted, resulting in UAF.
-
-Move unlocking dentry_hash[i].lock to after the dispose. To do this,
-fuse_dentry_tree_del_node() needs to be moved from fuse_dentry_prune() to
-fuse_dentry_release() to prevent an ABBA deadlock.
-
-The lock ordering becomes:
-
- -> dentry_bucket.lock
- -> dentry.d_lock
-
-Reported-by: Al Viro <viro@zeniv.linux.org.uk>
-Closes: https://lore.kernel.org/all/20251206014242.GO1712166@ZenIV/
-Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries")
-Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
-Link: https://patch.msgid.link/20260114145344.468856-2-mszeredi@redhat.com
-Signed-off-by: Christian Brauner <brauner@kernel.org>
-Stable-dep-of: 1e2c1af1beb3 ("fuse: make sure dentry is evicted if stale")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/fuse/dir.c | 11 ++---------
- 1 file changed, 2 insertions(+), 9 deletions(-)
-
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index 98b174bd802f0..b7a6a5b6bbc8a 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -172,8 +172,8 @@ static void fuse_dentry_tree_work(struct work_struct *work)
- if (time_after64(get_jiffies_64(), fd->time)) {
- rb_erase(&fd->node, &dentry_hash[i].tree);
- RB_CLEAR_NODE(&fd->node);
-- spin_unlock(&dentry_hash[i].lock);
- d_dispose_if_unused(fd->dentry, &dispose);
-+ spin_unlock(&dentry_hash[i].lock);
- cond_resched();
- spin_lock(&dentry_hash[i].lock);
- } else
-@@ -464,18 +464,12 @@ static int fuse_dentry_init(struct dentry *dentry)
- return 0;
- }
-
--static void fuse_dentry_prune(struct dentry *dentry)
-+static void fuse_dentry_release(struct dentry *dentry)
- {
- struct fuse_dentry *fd = dentry->d_fsdata;
-
- if (!RB_EMPTY_NODE(&fd->node))
- fuse_dentry_tree_del_node(dentry);
--}
--
--static void fuse_dentry_release(struct dentry *dentry)
--{
-- struct fuse_dentry *fd = dentry->d_fsdata;
--
- kfree_rcu(fd, rcu);
- }
-
-@@ -512,7 +506,6 @@ const struct dentry_operations fuse_dentry_operations = {
- .d_revalidate = fuse_dentry_revalidate,
- .d_delete = fuse_dentry_delete,
- .d_init = fuse_dentry_init,
-- .d_prune = fuse_dentry_prune,
- .d_release = fuse_dentry_release,
- .d_automount = fuse_dentry_automount,
- };
---
-2.53.0
-
+++ /dev/null
-From 9d94da18b3c4059def7eeb38cf054cf6ff6fb148 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 16 Feb 2026 14:48:30 +0000
-Subject: fuse: fix uninit-value in fuse_dentry_revalidate()
-
-From: Luis Henriques <luis@igalia.com>
-
-[ Upstream commit 5a6baf204610589f8a5b5a1cd69d1fe661d9d3cd ]
-
-fuse_dentry_revalidate() may be called with a dentry that didn't had
-->d_time initialised. The issue was found with KMSAN, where lookup_open()
-calls __d_alloc(), followed by d_revalidate(), as shown below:
-
-=====================================================
-BUG: KMSAN: uninit-value in fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394
- fuse_dentry_revalidate+0x150/0x13d0 fs/fuse/dir.c:394
- d_revalidate fs/namei.c:1030 [inline]
- lookup_open fs/namei.c:4405 [inline]
- open_last_lookups fs/namei.c:4583 [inline]
- path_openat+0x1614/0x64c0 fs/namei.c:4827
- do_file_open+0x2aa/0x680 fs/namei.c:4859
-[...]
-
-Uninit was created at:
- slab_post_alloc_hook mm/slub.c:4466 [inline]
- slab_alloc_node mm/slub.c:4788 [inline]
- kmem_cache_alloc_lru_noprof+0x382/0x1280 mm/slub.c:4807
- __d_alloc+0x55/0xa00 fs/dcache.c:1740
- d_alloc_parallel+0x99/0x2740 fs/dcache.c:2604
- lookup_open fs/namei.c:4398 [inline]
- open_last_lookups fs/namei.c:4583 [inline]
- path_openat+0x135f/0x64c0 fs/namei.c:4827
- do_file_open+0x2aa/0x680 fs/namei.c:4859
-[...]
-=====================================================
-
-Reported-by: syzbot+fdebb2dc960aa56c600a@syzkaller.appspotmail.com
-Closes: https://lore.kernel.org/all/69917e0d.050a0220.340abe.02e2.GAE@google.com
-Fixes: 2396356a945b ("fuse: add more control over cache invalidation behaviour")
-Signed-off-by: Luis Henriques <luis@igalia.com>
-Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/fuse/dir.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index 77982fdbcf278..98b174bd802f0 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -455,6 +455,11 @@ static int fuse_dentry_init(struct dentry *dentry)
- fd->dentry = dentry;
- RB_CLEAR_NODE(&fd->node);
- dentry->d_fsdata = fd;
-+ /*
-+ * Initialising d_time (epoch) to '0' ensures the dentry is invalid
-+ * if compared to fc->epoch, which is initialized to '1'.
-+ */
-+ dentry->d_time = 0;
-
- return 0;
- }
---
-2.53.0
-
+++ /dev/null
-From 40ee0619112f06285afaf85be5ea372030084484 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 14 Jan 2026 15:53:39 +0100
-Subject: fuse: make sure dentry is evicted if stale
-
-From: Miklos Szeredi <mszeredi@redhat.com>
-
-[ Upstream commit 1e2c1af1beb395841743e240a59ab37edc9a7d33 ]
-
-d_dispose_if_unused() may find the dentry with a positive refcount, in
-which case it won't be put on the dispose list even though it has already
-timed out.
-
-"Reinstall" the d_delete() callback, which was optimized out in
-fuse_dentry_settime(). This will result in the dentry being evicted as
-soon as the refcount hits zero.
-
-Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries")
-Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
-Link: https://patch.msgid.link/20260114145344.468856-3-mszeredi@redhat.com
-Signed-off-by: Christian Brauner <brauner@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/fuse/dir.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index b7a6a5b6bbc8a..ac5d0c305b51f 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -172,6 +172,10 @@ static void fuse_dentry_tree_work(struct work_struct *work)
- if (time_after64(get_jiffies_64(), fd->time)) {
- rb_erase(&fd->node, &dentry_hash[i].tree);
- RB_CLEAR_NODE(&fd->node);
-+ spin_lock(&fd->dentry->d_lock);
-+ /* If dentry is still referenced, let next dput release it */
-+ fd->dentry->d_flags |= DCACHE_OP_DELETE;
-+ spin_unlock(&fd->dentry->d_lock);
- d_dispose_if_unused(fd->dentry, &dispose);
- spin_unlock(&dentry_hash[i].lock);
- cond_resched();
---
-2.53.0
-
+++ /dev/null
-From 7c1baac1eefd9a824efda7b370cdbea5a2960189 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 16 Sep 2025 14:53:08 +0100
-Subject: fuse: new work queue to periodically invalidate expired dentries
-
-From: Luis Henriques <luis@igalia.com>
-
-[ Upstream commit ab84ad5973869a660ca3ad0c54a2b84d975d47c4 ]
-
-This patch adds the necessary infrastructure to keep track of all dentries
-created for FUSE file systems. A set of rbtrees, protected by hashed
-locks, will be used to keep all these dentries sorted by expiry time.
-
-A new module parameter 'inval_wq' is also added. When set, it will start
-a work queue which will periodically invalidate expired dentries. The
-value of this new parameter is the period, in seconds, for this work
-queue. Once this parameter is set, every new dentry will be added to one
-of the rbtrees.
-
-When the work queue is executed, it will check all the rbtrees and will
-invalidate those dentries that have timed-out.
-
-The work queue period can not be smaller than 5 seconds, but can be
-disabled by setting 'inval_wq' to zero (which is the default).
-
-Signed-off-by: Luis Henriques <luis@igalia.com>
-Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
-Stable-dep-of: 5a6baf204610 ("fuse: fix uninit-value in fuse_dentry_revalidate()")
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/fuse/dir.c | 216 ++++++++++++++++++++++++++++++++++++++++++-----
- fs/fuse/fuse_i.h | 10 +++
- fs/fuse/inode.c | 3 +
- 3 files changed, 208 insertions(+), 21 deletions(-)
-
-diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
-index ecaec0fea3a13..77982fdbcf278 100644
---- a/fs/fuse/dir.c
-+++ b/fs/fuse/dir.c
-@@ -27,6 +27,67 @@ module_param(allow_sys_admin_access, bool, 0644);
- MODULE_PARM_DESC(allow_sys_admin_access,
- "Allow users with CAP_SYS_ADMIN in initial userns to bypass allow_other access check");
-
-+struct dentry_bucket {
-+ struct rb_root tree;
-+ spinlock_t lock;
-+};
-+
-+#define HASH_BITS 5
-+#define HASH_SIZE (1 << HASH_BITS)
-+static struct dentry_bucket dentry_hash[HASH_SIZE];
-+struct delayed_work dentry_tree_work;
-+
-+/* Minimum invalidation work queue frequency */
-+#define FUSE_DENTRY_INVAL_FREQ_MIN 5
-+
-+unsigned __read_mostly inval_wq;
-+static int inval_wq_set(const char *val, const struct kernel_param *kp)
-+{
-+ unsigned int num;
-+ unsigned int old = inval_wq;
-+ int ret;
-+
-+ if (!val)
-+ return -EINVAL;
-+
-+ ret = kstrtouint(val, 0, &num);
-+ if (ret)
-+ return ret;
-+
-+ if ((num < FUSE_DENTRY_INVAL_FREQ_MIN) && (num != 0))
-+ return -EINVAL;
-+
-+ /* This should prevent overflow in secs_to_jiffies() */
-+ if (num > USHRT_MAX)
-+ return -EINVAL;
-+
-+ *((unsigned int *)kp->arg) = num;
-+
-+ if (num && !old)
-+ schedule_delayed_work(&dentry_tree_work,
-+ secs_to_jiffies(num));
-+ else if (!num && old)
-+ cancel_delayed_work_sync(&dentry_tree_work);
-+
-+ return 0;
-+}
-+static const struct kernel_param_ops inval_wq_ops = {
-+ .set = inval_wq_set,
-+ .get = param_get_uint,
-+};
-+module_param_cb(inval_wq, &inval_wq_ops, &inval_wq, 0644);
-+__MODULE_PARM_TYPE(inval_wq, "uint");
-+MODULE_PARM_DESC(inval_wq,
-+ "Dentries invalidation work queue period in secs (>= "
-+ __stringify(FUSE_DENTRY_INVAL_FREQ_MIN) ").");
-+
-+static inline struct dentry_bucket *get_dentry_bucket(struct dentry *dentry)
-+{
-+ int i = hash_ptr(dentry, HASH_BITS);
-+
-+ return &dentry_hash[i];
-+}
-+
- static void fuse_advise_use_readdirplus(struct inode *dir)
- {
- struct fuse_inode *fi = get_fuse_inode(dir);
-@@ -34,33 +95,131 @@ static void fuse_advise_use_readdirplus(struct inode *dir)
- set_bit(FUSE_I_ADVISE_RDPLUS, &fi->state);
- }
-
--#if BITS_PER_LONG >= 64
--static inline void __fuse_dentry_settime(struct dentry *entry, u64 time)
-+struct fuse_dentry {
-+ u64 time;
-+ union {
-+ struct rcu_head rcu;
-+ struct rb_node node;
-+ };
-+ struct dentry *dentry;
-+};
-+
-+static void __fuse_dentry_tree_del_node(struct fuse_dentry *fd,
-+ struct dentry_bucket *bucket)
- {
-- entry->d_fsdata = (void *) time;
-+ if (!RB_EMPTY_NODE(&fd->node)) {
-+ rb_erase(&fd->node, &bucket->tree);
-+ RB_CLEAR_NODE(&fd->node);
-+ }
- }
-
--static inline u64 fuse_dentry_time(const struct dentry *entry)
-+static void fuse_dentry_tree_del_node(struct dentry *dentry)
- {
-- return (u64)entry->d_fsdata;
-+ struct fuse_dentry *fd = dentry->d_fsdata;
-+ struct dentry_bucket *bucket = get_dentry_bucket(dentry);
-+
-+ spin_lock(&bucket->lock);
-+ __fuse_dentry_tree_del_node(fd, bucket);
-+ spin_unlock(&bucket->lock);
- }
-
--#else
--union fuse_dentry {
-- u64 time;
-- struct rcu_head rcu;
--};
-+static void fuse_dentry_tree_add_node(struct dentry *dentry)
-+{
-+ struct fuse_dentry *fd = dentry->d_fsdata;
-+ struct dentry_bucket *bucket;
-+ struct fuse_dentry *cur;
-+ struct rb_node **p, *parent = NULL;
-+
-+ if (!inval_wq)
-+ return;
-+
-+ bucket = get_dentry_bucket(dentry);
-+
-+ spin_lock(&bucket->lock);
-+
-+ __fuse_dentry_tree_del_node(fd, bucket);
-+
-+ p = &bucket->tree.rb_node;
-+ while (*p) {
-+ parent = *p;
-+ cur = rb_entry(*p, struct fuse_dentry, node);
-+ if (fd->time < cur->time)
-+ p = &(*p)->rb_left;
-+ else
-+ p = &(*p)->rb_right;
-+ }
-+ rb_link_node(&fd->node, parent, p);
-+ rb_insert_color(&fd->node, &bucket->tree);
-+ spin_unlock(&bucket->lock);
-+}
-+
-+/*
-+ * work queue which, when enabled, will periodically check for expired dentries
-+ * in the dentries tree.
-+ */
-+static void fuse_dentry_tree_work(struct work_struct *work)
-+{
-+ LIST_HEAD(dispose);
-+ struct fuse_dentry *fd;
-+ struct rb_node *node;
-+ int i;
-+
-+ for (i = 0; i < HASH_SIZE; i++) {
-+ spin_lock(&dentry_hash[i].lock);
-+ node = rb_first(&dentry_hash[i].tree);
-+ while (node) {
-+ fd = rb_entry(node, struct fuse_dentry, node);
-+ if (time_after64(get_jiffies_64(), fd->time)) {
-+ rb_erase(&fd->node, &dentry_hash[i].tree);
-+ RB_CLEAR_NODE(&fd->node);
-+ spin_unlock(&dentry_hash[i].lock);
-+ d_dispose_if_unused(fd->dentry, &dispose);
-+ cond_resched();
-+ spin_lock(&dentry_hash[i].lock);
-+ } else
-+ break;
-+ node = rb_first(&dentry_hash[i].tree);
-+ }
-+ spin_unlock(&dentry_hash[i].lock);
-+ shrink_dentry_list(&dispose);
-+ }
-+
-+ if (inval_wq)
-+ schedule_delayed_work(&dentry_tree_work,
-+ secs_to_jiffies(inval_wq));
-+}
-+
-+void fuse_dentry_tree_init(void)
-+{
-+ int i;
-+
-+ for (i = 0; i < HASH_SIZE; i++) {
-+ spin_lock_init(&dentry_hash[i].lock);
-+ dentry_hash[i].tree = RB_ROOT;
-+ }
-+ INIT_DELAYED_WORK(&dentry_tree_work, fuse_dentry_tree_work);
-+}
-+
-+void fuse_dentry_tree_cleanup(void)
-+{
-+ int i;
-+
-+ inval_wq = 0;
-+ cancel_delayed_work_sync(&dentry_tree_work);
-+
-+ for (i = 0; i < HASH_SIZE; i++)
-+ WARN_ON_ONCE(!RB_EMPTY_ROOT(&dentry_hash[i].tree));
-+}
-
- static inline void __fuse_dentry_settime(struct dentry *dentry, u64 time)
- {
-- ((union fuse_dentry *) dentry->d_fsdata)->time = time;
-+ ((struct fuse_dentry *) dentry->d_fsdata)->time = time;
- }
-
- static inline u64 fuse_dentry_time(const struct dentry *entry)
- {
-- return ((union fuse_dentry *) entry->d_fsdata)->time;
-+ return ((struct fuse_dentry *) entry->d_fsdata)->time;
- }
--#endif
-
- static void fuse_dentry_settime(struct dentry *dentry, u64 time)
- {
-@@ -81,6 +240,7 @@ static void fuse_dentry_settime(struct dentry *dentry, u64 time)
- }
-
- __fuse_dentry_settime(dentry, time);
-+ fuse_dentry_tree_add_node(dentry);
- }
-
- /*
-@@ -283,21 +443,36 @@ static int fuse_dentry_revalidate(struct inode *dir, const struct qstr *name,
- goto out;
- }
-
--#if BITS_PER_LONG < 64
- static int fuse_dentry_init(struct dentry *dentry)
- {
-- dentry->d_fsdata = kzalloc(sizeof(union fuse_dentry),
-- GFP_KERNEL_ACCOUNT | __GFP_RECLAIMABLE);
-+ struct fuse_dentry *fd;
-
-- return dentry->d_fsdata ? 0 : -ENOMEM;
-+ fd = kzalloc(sizeof(struct fuse_dentry),
-+ GFP_KERNEL_ACCOUNT | __GFP_RECLAIMABLE);
-+ if (!fd)
-+ return -ENOMEM;
-+
-+ fd->dentry = dentry;
-+ RB_CLEAR_NODE(&fd->node);
-+ dentry->d_fsdata = fd;
-+
-+ return 0;
-+}
-+
-+static void fuse_dentry_prune(struct dentry *dentry)
-+{
-+ struct fuse_dentry *fd = dentry->d_fsdata;
-+
-+ if (!RB_EMPTY_NODE(&fd->node))
-+ fuse_dentry_tree_del_node(dentry);
- }
-+
- static void fuse_dentry_release(struct dentry *dentry)
- {
-- union fuse_dentry *fd = dentry->d_fsdata;
-+ struct fuse_dentry *fd = dentry->d_fsdata;
-
- kfree_rcu(fd, rcu);
- }
--#endif
-
- static int fuse_dentry_delete(const struct dentry *dentry)
- {
-@@ -331,10 +506,9 @@ static struct vfsmount *fuse_dentry_automount(struct path *path)
- const struct dentry_operations fuse_dentry_operations = {
- .d_revalidate = fuse_dentry_revalidate,
- .d_delete = fuse_dentry_delete,
--#if BITS_PER_LONG < 64
- .d_init = fuse_dentry_init,
-+ .d_prune = fuse_dentry_prune,
- .d_release = fuse_dentry_release,
--#endif
- .d_automount = fuse_dentry_automount,
- };
-
-diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
-index c288f28f6c6ea..276dfddce5b53 100644
---- a/fs/fuse/fuse_i.h
-+++ b/fs/fuse/fuse_i.h
-@@ -54,6 +54,13 @@
- /** Frequency (in jiffies) of request timeout checks, if opted into */
- extern const unsigned long fuse_timeout_timer_freq;
-
-+/*
-+ * Dentries invalidation workqueue period, in seconds. The value of this
-+ * parameter shall be >= FUSE_DENTRY_INVAL_FREQ_MIN seconds, or 0 (zero), in
-+ * which case no workqueue will be created.
-+ */
-+extern unsigned inval_wq __read_mostly;
-+
- /** Maximum of max_pages received in init_out */
- extern unsigned int fuse_max_pages_limit;
- /*
-@@ -1278,6 +1285,9 @@ void fuse_wait_aborted(struct fuse_conn *fc);
- /* Check if any requests timed out */
- void fuse_check_timeout(struct work_struct *work);
-
-+void fuse_dentry_tree_init(void);
-+void fuse_dentry_tree_cleanup(void);
-+
- /**
- * Invalidate inode attributes
- */
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index e9ed693fc7b37..a090c91abb89d 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -2296,6 +2296,8 @@ static int __init fuse_init(void)
- if (res)
- goto err_sysfs_cleanup;
-
-+ fuse_dentry_tree_init();
-+
- sanitize_global_limit(&max_user_bgreq);
- sanitize_global_limit(&max_user_congthresh);
-
-@@ -2315,6 +2317,7 @@ static void __exit fuse_exit(void)
- {
- pr_debug("exit\n");
-
-+ fuse_dentry_tree_cleanup();
- fuse_ctl_cleanup();
- fuse_sysfs_cleanup();
- fuse_fs_cleanup();
---
-2.53.0
-
+++ /dev/null
-From 39647fb4e58b4bfc240ea22d9ee7ae1bbeb147d7 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2026 17:11:32 +0100
-Subject: i3c: master: Fix error codes at send_ccc_cmd
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
-
-i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive,
-Mx codes) to the ret variable, cascading down multiple methods until
-reaching methods that explicitly stated they would return 0 on success
-or negative error code. For example, the call chain:
-
- i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <-
- master->ops.enable_ibi <- i3c_master_enec_locked <-
- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
-
-Fix this by returning the ret value, callers can still read the cmd->err
-value if ret is negative.
-
-All corner cases where the Mx codes do need to be handled individually,
-are resolved in previous commits. Those corner cases are all scenarios
-when I3C_ERROR_M2 is expected and acceptable.
-The prerequisite patches for the fix are:
-
- i3c: master: Move rstdaa error suppression
- i3c: master: Move entdaa error suppression
- i3c: master: Move bus_init error suppression
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/
-Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
-index 425e36b36009b..4ecbabcec48b4 100644
---- a/drivers/i3c/master.c
-+++ b/drivers/i3c/master.c
-@@ -826,11 +826,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id,
- cmd->err = I3C_ERROR_UNKNOWN;
- }
-
-+/**
-+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
-+ * @master: master used to send frames on the bus
-+ * @cmd: command to send
-+ *
-+ * Return: 0 in case of success, or a negative error code otherwise.
-+ * I3C Mx error codes are stored in cmd->err.
-+ */
- static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- struct i3c_ccc_cmd *cmd)
- {
-- int ret;
--
- if (!cmd || !master)
- return -EINVAL;
-
-@@ -848,15 +854,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- !master->ops->supports_ccc_cmd(master, cmd))
- return -EOPNOTSUPP;
-
-- ret = master->ops->send_ccc_cmd(master, cmd);
-- if (ret) {
-- if (cmd->err != I3C_ERROR_UNKNOWN)
-- return cmd->err;
--
-- return ret;
-- }
--
-- return 0;
-+ return master->ops->send_ccc_cmd(master, cmd);
- }
-
- static struct i2c_dev_desc *
-@@ -960,8 +958,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_entdaa_locked(struct i3c_master_controller *master)
- {
-@@ -1013,8 +1010,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1034,8 +1030,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1060,8 +1055,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_defslvs_locked(struct i3c_master_controller *master)
- {
---
-2.53.0
-
gfs2-call-unlock_new_inode-before-d_instantiate.patch
fanotify-avoid-silence-premature-lsm-capability-chec.patch
fanotify-call-fanotify_events_supported-before-path_.patch
-fuse-fix-premature-writetrhough-request-for-large-fo.patch
-dcache-export-shrink_dentry_list-and-add-new-helper-.patch
-fuse-new-work-queue-to-periodically-invalidate-expir.patch
-fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch
ktest-avoid-undef-warning-when-warnings_file-is-unse.patch
ktest-honor-empty-per-test-option-overrides.patch
ktest-run-post_ktest-hooks-on-failure-and-cancellati.patch
i3c-master-dw-i3c-fix-missing-reset-assertion-in-rem.patch
i3c-master-renesas-fix-memory-leak-in-renesas_i3c_i3.patch
i3c-dw-fix-memory-leak-in-dw_i3c_master_i3c_xfers.patch
-i3c-master-fix-error-codes-at-send_ccc_cmd.patch
i3c-master-adi-fix-error-propagation-for-cccs.patch
i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch
backlight-sky81452-backlight-check-return-value-of-d.patch
pci-initialize-temporary-device-in-new_id_store.patch
bpf-fix-sync_linked_regs-regarding-bpf_add_const32-z.patch
net-airoha-fix-a-copy-and-paste-bug-in-probe.patch
-fuse-fix-race-when-disposing-stale-dentries.patch
-fuse-make-sure-dentry-is-evicted-if-stale.patch
rtla-fix-parse_cpu_set-bug-introduced-by-strtoi.patch
net-airoha-move-entries-to-queue-head-in-case-of-dma.patch
net-airoha-move-ndesc-initialization-at-end-of-airoh.patch-22905
+++ /dev/null
-From ddafa9c6f5ea9f016f183d830c0ebc4d990d8a54 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Apr 2026 12:11:09 -0700
-Subject: bpf, riscv: Remove redundant bpf_flush_icache() after pack allocator
- finalize
-
-From: Puranjay Mohan <puranjay@kernel.org>
-
-[ Upstream commit 46ee1342b887c9387a933397d846ff6c9584322c ]
-
-bpf_flush_icache() calls flush_icache_range() to clean the data cache
-and invalidate the instruction cache for the JITed code region. However,
-since commit 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the
-BPF JIT"), this flush is redundant.
-
-bpf_jit_binary_pack_finalize() copies the JITed instructions to the ROX
-region via bpf_arch_text_copy() -> patch_text_nosync(), and
-patch_text_nosync() already calls flush_icache_range() on the written
-range. The subsequent bpf_flush_icache() repeats the same cache
-maintenance on an overlapping range.
-
-Remove the redundant bpf_flush_icache() call and its now-unused
-definition.
-
-Fixes: 48a8f78c50bd ("bpf, riscv: use prog pack allocator in the BPF JIT")
-Acked-by: Song Liu <song@kernel.org>
-Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
-Reviewed-by: Pu Lehui <pulehui@huawei.com>
-Tested-by: Paul Chaignon <paul.chaignon@gmail.com>
-Link: https://lore.kernel.org/r/20260413191111.3426023-3-puranjay@kernel.org
-Signed-off-by: Alexei Starovoitov <ast@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- arch/riscv/net/bpf_jit.h | 6 ------
- arch/riscv/net/bpf_jit_core.c | 7 -------
- 2 files changed, 13 deletions(-)
-
-diff --git a/arch/riscv/net/bpf_jit.h b/arch/riscv/net/bpf_jit.h
-index a5ce1ab76ecee..c444c79596703 100644
---- a/arch/riscv/net/bpf_jit.h
-+++ b/arch/riscv/net/bpf_jit.h
-@@ -11,7 +11,6 @@
-
- #include <linux/bpf.h>
- #include <linux/filter.h>
--#include <asm/cacheflush.h>
-
- static inline bool rvc_enabled(void)
- {
-@@ -97,11 +96,6 @@ static inline void bpf_fill_ill_insns(void *area, unsigned int size)
- memset(area, 0, size);
- }
-
--static inline void bpf_flush_icache(void *start, void *end)
--{
-- flush_icache_range((unsigned long)start, (unsigned long)end);
--}
--
- /* Emit a 4-byte riscv instruction. */
- static inline void emit(const u32 insn, struct rv_jit_context *ctx)
- {
-diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
-index 7b70ccb7fec34..f57b95e830ac0 100644
---- a/arch/riscv/net/bpf_jit_core.c
-+++ b/arch/riscv/net/bpf_jit_core.c
-@@ -182,13 +182,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
- prog = orig_prog;
- goto out_offset;
- }
-- /*
-- * The instructions have now been copied to the ROX region from
-- * where they will execute.
-- * Write any modified data cache blocks out to memory and
-- * invalidate the corresponding blocks in the instruction cache.
-- */
-- bpf_flush_icache(jit_data->ro_header, ctx->ro_insns + ctx->ninsns);
- for (i = 0; i < prog->len; i++)
- ctx->offset[i] = ninsns_rvoff(ctx->offset[i]);
- bpf_prog_fill_jited_linfo(prog, ctx->offset);
---
-2.53.0
-
+++ /dev/null
-From 9fd2905ed85547b975137ca97c29ef14b272bf37 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2026 17:11:32 +0100
-Subject: i3c: master: Fix error codes at send_ccc_cmd
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
-
-i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive,
-Mx codes) to the ret variable, cascading down multiple methods until
-reaching methods that explicitly stated they would return 0 on success
-or negative error code. For example, the call chain:
-
- i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <-
- master->ops.enable_ibi <- i3c_master_enec_locked <-
- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
-
-Fix this by returning the ret value, callers can still read the cmd->err
-value if ret is negative.
-
-All corner cases where the Mx codes do need to be handled individually,
-are resolved in previous commits. Those corner cases are all scenarios
-when I3C_ERROR_M2 is expected and acceptable.
-The prerequisite patches for the fix are:
-
- i3c: master: Move rstdaa error suppression
- i3c: master: Move entdaa error suppression
- i3c: master: Move bus_init error suppression
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/
-Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
-index f74ef65d257d7..84fe0de5a9bc7 100644
---- a/drivers/i3c/master.c
-+++ b/drivers/i3c/master.c
-@@ -792,11 +792,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id,
- cmd->err = I3C_ERROR_UNKNOWN;
- }
-
-+/**
-+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
-+ * @master: master used to send frames on the bus
-+ * @cmd: command to send
-+ *
-+ * Return: 0 in case of success, or a negative error code otherwise.
-+ * I3C Mx error codes are stored in cmd->err.
-+ */
- static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- struct i3c_ccc_cmd *cmd)
- {
-- int ret;
--
- if (!cmd || !master)
- return -EINVAL;
-
-@@ -814,15 +820,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- !master->ops->supports_ccc_cmd(master, cmd))
- return -ENOTSUPP;
-
-- ret = master->ops->send_ccc_cmd(master, cmd);
-- if (ret) {
-- if (cmd->err != I3C_ERROR_UNKNOWN)
-- return cmd->err;
--
-- return ret;
-- }
--
-- return 0;
-+ return master->ops->send_ccc_cmd(master, cmd);
- }
-
- static struct i2c_dev_desc *
-@@ -926,8 +924,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_entdaa_locked(struct i3c_master_controller *master)
- {
-@@ -979,8 +976,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1000,8 +996,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1026,8 +1021,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_defslvs_locked(struct i3c_master_controller *master)
- {
---
-2.53.0
-
mtd-rawnand-sunxi-fix-sunxi_nfc_hw_ecc_read_extra_oo.patch
hid-usbhid-fix-deadlock-in-hid_post_reset.patch
bpf-arm64-fix-off-by-one-in-check_imm-signed-range-c.patch
-bpf-riscv-remove-redundant-bpf_flush_icache-after-pa.patch
bpf-sockmap-fix-af_unix-iter-deadlock.patch
bpf-sockmap-fix-af_unix-null-ptr-deref-in-proto-upda.patch
bpf-sockmap-take-state-lock-for-af_unix-iter.patch
ipmi-ssif_bmc-fix-message-desynchronization-after-tr.patch
ipmi-ssif_bmc-change-log-level-to-dbg-in-irq-callbac.patch
perf-util-kill-die-prototype-dead-for-a-long-time.patch
-i3c-master-fix-error-codes-at-send_ccc_cmd.patch
i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch
dev_printk-add-new-dev_err_probe-helpers.patch
backlight-sky81452-backlight-check-return-value-of-d.patch
+++ /dev/null
-From 0b66c8bb08a71cff5ba359be7ead3c7108a04a7d Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Thu, 15 Jan 2026 10:36:07 +0800
-Subject: fuse: fix premature writetrhough request for large folio
-
-From: Jingbo Xu <jefflexu@linux.alibaba.com>
-
-[ Upstream commit 5223e0470e7bb7910038fe3d31171490e00fbbb9 ]
-
-When large folio is enabled and the initial folio offset exceeds
-PAGE_SIZE, e.g. the position resides in the second page of a large
-folio, after the folio copying the offset (in the page) won't be updated
-to 0 even though the expected range is successfully copied until the end
-of the folio. In this case fuse_fill_write_pages() exits prematurelly
-before the request has reached the max_write/max_pages limit.
-
-Fix this by eliminating page offset entirely and use folio offset
-instead.
-
-Fixes: d60a6015e1a2 ("fuse: support large folios for writethrough writes")
-Reviewed-by: Horst Birthelmer <hbirthelmer@ddn.com>
-Reviewed-by: Joanne Koong <joannelkoong@gmail.com>
-Signed-off-by: Jingbo Xu <jefflexu@linux.alibaba.com>
-Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- fs/fuse/file.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/fs/fuse/file.c b/fs/fuse/file.c
-index 676fd9856bfbf..3939f90d1b4d2 100644
---- a/fs/fuse/file.c
-+++ b/fs/fuse/file.c
-@@ -1242,7 +1242,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- {
- struct fuse_args_pages *ap = &ia->ap;
- struct fuse_conn *fc = get_fuse_conn(mapping->host);
-- unsigned offset = pos & (PAGE_SIZE - 1);
- size_t count = 0;
- unsigned int num;
- int err = 0;
-@@ -1269,7 +1268,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- if (mapping_writably_mapped(mapping))
- flush_dcache_folio(folio);
-
-- folio_offset = ((index - folio->index) << PAGE_SHIFT) + offset;
-+ folio_offset = offset_in_folio(folio, pos);
- bytes = min(folio_size(folio) - folio_offset, num);
-
- tmp = copy_folio_from_iter_atomic(folio, folio_offset, bytes, ii);
-@@ -1299,9 +1298,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- count += tmp;
- pos += tmp;
- num -= tmp;
-- offset += tmp;
-- if (offset == folio_size(folio))
-- offset = 0;
-
- /* If we copied full folio, mark it uptodate */
- if (tmp == folio_size(folio))
-@@ -1313,7 +1309,9 @@ static ssize_t fuse_fill_write_pages(struct fuse_io_args *ia,
- ia->write.folio_locked = true;
- break;
- }
-- if (!fc->big_writes || offset != 0)
-+ if (!fc->big_writes)
-+ break;
-+ if (folio_offset + tmp != folio_size(folio))
- break;
- }
-
---
-2.53.0
-
+++ /dev/null
-From 38fb9b7df6c8a2fa7a3f55be62bfa08c6a0a08d4 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Mar 2026 17:11:32 +0100
-Subject: i3c: master: Fix error codes at send_ccc_cmd
-
-From: Jorge Marques <jorge.marques@analog.com>
-
-[ Upstream commit ef8b5229348f0719aca557c4ca5530630ae4d134 ]
-
-i3c_master_send_ccc_cmd_locked() would propagate cmd->err (positive,
-Mx codes) to the ret variable, cascading down multiple methods until
-reaching methods that explicitly stated they would return 0 on success
-or negative error code. For example, the call chain:
-
- i3c_device_enable_ibi <- i3c_dev_enable_ibi_locked <-
- master->ops.enable_ibi <- i3c_master_enec_locked <-
- i3c_master_enec_disec_locked <- i3c_master_send_ccc_cmd_locked
-
-Fix this by returning the ret value, callers can still read the cmd->err
-value if ret is negative.
-
-All corner cases where the Mx codes do need to be handled individually,
-are resolved in previous commits. Those corner cases are all scenarios
-when I3C_ERROR_M2 is expected and acceptable.
-The prerequisite patches for the fix are:
-
- i3c: master: Move rstdaa error suppression
- i3c: master: Move entdaa error suppression
- i3c: master: Move bus_init error suppression
-
-Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
-Closes: https://lore.kernel.org/linux-iio/aYXvT5FW0hXQwhm_@stanley.mountain/
-Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
-Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
-Signed-off-by: Jorge Marques <jorge.marques@analog.com>
-Link: https://patch.msgid.link/20260323-ad4062-positive-error-fix-v3-4-30bdc68004be@analog.com
-Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i3c/master.c | 32 +++++++++++++-------------------
- 1 file changed, 13 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
-index 9e6be49bebb2c..930c4dad632fc 100644
---- a/drivers/i3c/master.c
-+++ b/drivers/i3c/master.c
-@@ -898,11 +898,17 @@ static void i3c_ccc_cmd_init(struct i3c_ccc_cmd *cmd, bool rnw, u8 id,
- cmd->err = I3C_ERROR_UNKNOWN;
- }
-
-+/**
-+ * i3c_master_send_ccc_cmd_locked() - send a CCC (Common Command Codes)
-+ * @master: master used to send frames on the bus
-+ * @cmd: command to send
-+ *
-+ * Return: 0 in case of success, or a negative error code otherwise.
-+ * I3C Mx error codes are stored in cmd->err.
-+ */
- static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- struct i3c_ccc_cmd *cmd)
- {
-- int ret;
--
- if (!cmd || !master)
- return -EINVAL;
-
-@@ -920,15 +926,7 @@ static int i3c_master_send_ccc_cmd_locked(struct i3c_master_controller *master,
- !master->ops->supports_ccc_cmd(master, cmd))
- return -EOPNOTSUPP;
-
-- ret = master->ops->send_ccc_cmd(master, cmd);
-- if (ret) {
-- if (cmd->err != I3C_ERROR_UNKNOWN)
-- return cmd->err;
--
-- return ret;
-- }
--
-- return 0;
-+ return master->ops->send_ccc_cmd(master, cmd);
- }
-
- static struct i2c_dev_desc *
-@@ -1032,8 +1030,7 @@ static int i3c_master_rstdaa_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_entdaa_locked(struct i3c_master_controller *master)
- {
-@@ -1085,8 +1082,7 @@ static int i3c_master_enec_disec_locked(struct i3c_master_controller *master,
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_disec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1106,8 +1102,7 @@ EXPORT_SYMBOL_GPL(i3c_master_disec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_enec_locked(struct i3c_master_controller *master, u8 addr,
- u8 evts)
-@@ -1132,8 +1127,7 @@ EXPORT_SYMBOL_GPL(i3c_master_enec_locked);
- *
- * This function must be called with the bus lock held in write mode.
- *
-- * Return: 0 in case of success, a positive I3C error code if the error is
-- * one of the official Mx error codes, and a negative error code otherwise.
-+ * Return: 0 in case of success, or a negative error code otherwise.
- */
- int i3c_master_defslvs_locked(struct i3c_master_controller *master)
- {
---
-2.53.0
-
gfs2-call-unlock_new_inode-before-d_instantiate.patch
fanotify-avoid-silence-premature-lsm-capability-chec.patch
fanotify-call-fanotify_events_supported-before-path_.patch
-fuse-fix-premature-writetrhough-request-for-large-fo.patch
fuse-fix-uninit-value-in-fuse_dentry_revalidate.patch
ktest-avoid-undef-warning-when-warnings_file-is-unse.patch
ktest-honor-empty-per-test-option-overrides.patch
i3c-master-dw-i3c-balance-pm-runtime-usage-count-on-.patch
i3c-master-renesas-fix-memory-leak-in-renesas_i3c_i3.patch
i3c-dw-fix-memory-leak-in-dw_i3c_master_i3c_xfers.patch
-i3c-master-fix-error-codes-at-send_ccc_cmd.patch
i3c-master-adi-fix-error-propagation-for-cccs.patch
i3c-mipi-i3c-hci-fix-ibi-payload-length-calculation-.patch
fs-ntfs3-prevent-uninitialized-lcn-caused-by-zero-le.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
