--- /dev/null
+From 2daf8ac812c3d78c642fe7652f62e29df5e3da20 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:11 +0100
+Subject: afs: Fix further netns teardown to cancel the preallocation charger
+
+From: David Howells <dhowells@redhat.com>
+
+commit 2daf8ac812c3d78c642fe7652f62e29df5e3da20 upstream.
+
+When an afs network namespace is torn down, it cancels and waits for the
+work item that keeps the preallocated rxrpc call/conn/peer queue charged
+before disabling incoming (i.e. listen 0), but there's a small window in
+which it can be requeued by an incoming call wending through the I/O
+thread.
+
+Fix this by cancelling the charger work item again after reducing the
+listen backlog to zero.
+
+Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
+cc: Li Daming <d4n.for.sec@gmail.com>
+cc: Ren Wei <n05ec@lzu.edu.cn>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/rxrpc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -128,8 +128,13 @@ void afs_close_socket(struct afs_net *ne
+ _enter("");
+
+ cancel_work_sync(&net->charge_preallocation_work);
++ /* Future work items should now see ->live is false. */
++
+ kernel_listen(net->socket, 0);
++
++ /* Make sure work items are no longer running. */
+ flush_workqueue(afs_async_calls);
++ cancel_work_sync(&net->charge_preallocation_work);
+
+ if (net->spare_incoming_call) {
+ afs_put_call(net->spare_incoming_call);
--- /dev/null
+From 47694fbc9d24ab6bf210f91e8efe06a10a478064 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 9 Jun 2026 15:09:08 +0100
+Subject: afs: Fix netns teardown to cancel the preallocation charger
+
+From: David Howells <dhowells@redhat.com>
+
+commit 47694fbc9d24ab6bf210f91e8efe06a10a478064 upstream.
+
+Fix the teardown of an afs network namespace to make sure it cancels the
+work item that keeps the preallocated rxrpc call/conn/peer queue charged
+before incoming calls are disabled (i.e. listen 0).
+
+Also, if net->live is false because the afs netns is being deleted, make
+afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid
+requeuing the charger.
+
+(This was found by AI review).
+
+Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests")
+Reported-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Li Daming <d4n.for.sec@gmail.com>
+cc: Ren Wei <n05ec@lzu.edu.cn>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260609140911.838677-5-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/rxrpc.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -127,6 +127,7 @@ void afs_close_socket(struct afs_net *ne
+ {
+ _enter("");
+
++ cancel_work_sync(&net->charge_preallocation_work);
+ kernel_listen(net->socket, 0);
+ flush_workqueue(afs_async_calls);
+
+@@ -742,7 +743,7 @@ void afs_charge_preallocation(struct wor
+ container_of(work, struct afs_net, charge_preallocation_work);
+ struct afs_call *call = net->spare_incoming_call;
+
+- for (;;) {
++ while (READ_ONCE(net->live)) {
+ if (!call) {
+ call = afs_alloc_call(net, &afs_RXCMxxxx, GFP_KERNEL);
+ if (!call)
+@@ -792,7 +793,8 @@ static void afs_rx_new_call(struct sock
+ if (!call->server)
+ trace_afs_cm_no_server(call, rxrpc_kernel_remote_srx(call->peer));
+
+- queue_work(afs_wq, &net->charge_preallocation_work);
++ if (net->live)
++ queue_work(afs_wq, &net->charge_preallocation_work);
+ }
+
+ /*
--- /dev/null
+From 0b70716081c6462be9b2928ad736d0d527b09678 Mon Sep 17 00:00:00 2001
+From: Matvey Kovalev <matvey.kovalev@ispras.ru>
+Date: Mon, 22 Jun 2026 10:08:37 +0100
+Subject: afs: fix NULL pointer dereference in afs_get_tree()
+
+From: Matvey Kovalev <matvey.kovalev@ispras.ru>
+
+commit 0b70716081c6462be9b2928ad736d0d527b09678 upstream.
+
+afs_alloc_sbi() uses kzalloc for memory allocation. And, if
+ctx->dyn_root is not null, as->cell and as->volume are null.
+In trace_afs_get_tree() they are dereferenced.
+
+KASAN error message:
+
+KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
+CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1
+04/01/2014
+RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550
+include/trace/events/afs.h:1365
+
+Call Trace:
+trace_afs_get_tree include/trace/events/afs.h:1365 [inline]
+afs_get_tree+0x922/0x1350 fs/afs/super.c:599
+vfs_get_tree+0x8e/0x300 fs/super.c:1572
+do_new_mount fs/namespace.c:3011 [inline]
+path_mount+0x14a5/0x2220 fs/namespace.c:3341
+do_mount fs/namespace.c:3354 [inline]
+__do_sys_mount fs/namespace.c:3562 [inline]
+__se_sys_mount fs/namespace.c:3539 [inline]
+__x64_sys_mount+0x283/0x300 fs/namespace.c:3539
+ do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46
+entry_SYSCALL_64_after_hwframe+0x67/0xd1
+
+Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
+
+Fixes: 80548b03991f5 ("afs: Add more tracepoints")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://patch.msgid.link/20260622090856.2746629-4-dhowells@redhat.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/afs/super.c
++++ b/fs/afs/super.c
+@@ -587,7 +587,8 @@ static int afs_get_tree(struct fs_contex
+ }
+
+ fc->root = dget(sb->s_root);
+- trace_afs_get_tree(as->cell, as->volume);
++ if (!ctx->dyn_root)
++ trace_afs_get_tree(as->cell, as->volume);
+ _leave(" = 0 [%p]", sb);
+ return 0;
+
--- /dev/null
+From a4057e58b07005d0fe0491bdbf1868c1491909ee Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:12 +0100
+Subject: afs: Fix uncancelled rxrpc OOB message handler
+
+From: David Howells <dhowells@redhat.com>
+
+commit a4057e58b07005d0fe0491bdbf1868c1491909ee upstream.
+
+Fix AFS to cancel its OOB message processing (typically to respond to
+security challenges). Also move OOB message processing to afs_wq so that
+it's also waited for and make the OOB handler just return if the net
+namespace is no longer live.
+
+Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
+Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Li Daming <d4n.for.sec@gmail.com>
+cc: Ren Wei <n05ec@lzu.edu.cn>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-6-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/cm_security.c | 3 ++-
+ fs/afs/rxrpc.c | 5 ++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/fs/afs/cm_security.c
++++ b/fs/afs/cm_security.c
+@@ -101,7 +101,8 @@ void afs_process_oob_queue(struct work_s
+ struct sk_buff *oob;
+ enum rxrpc_oob_type type;
+
+- while ((oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) {
++ while (READ_ONCE(net->live) &&
++ (oob = rxrpc_kernel_dequeue_oob(net->socket, &type))) {
+ switch (type) {
+ case RXRPC_OOB_CHALLENGE:
+ afs_respond_to_challenge(oob);
+--- a/fs/afs/rxrpc.c
++++ b/fs/afs/rxrpc.c
+@@ -128,6 +128,7 @@ void afs_close_socket(struct afs_net *ne
+ _enter("");
+
+ cancel_work_sync(&net->charge_preallocation_work);
++ cancel_work_sync(&net->rx_oob_work);
+ /* Future work items should now see ->live is false. */
+
+ kernel_listen(net->socket, 0);
+@@ -148,6 +149,7 @@ void afs_close_socket(struct afs_net *ne
+
+ kernel_sock_shutdown(net->socket, SHUT_RDWR);
+ flush_workqueue(afs_async_calls);
++ cancel_work_sync(&net->rx_oob_work);
+ net->socket->sk->sk_user_data = NULL;
+ sock_release(net->socket);
+ key_put(net->fs_cm_token_key);
+@@ -989,5 +991,6 @@ static void afs_rx_notify_oob(struct soc
+ {
+ struct afs_net *net = sk->sk_user_data;
+
+- schedule_work(&net->rx_oob_work);
++ if (READ_ONCE(net->live))
++ queue_work(afs_wq, &net->rx_oob_work);
+ }
--- /dev/null
+From f3cf725cd284b7912d5522babb44721bf38c8887 Mon Sep 17 00:00:00 2001
+From: Nan Li <tonanli66@gmail.com>
+Date: Mon, 22 Jun 2026 10:08:35 +0100
+Subject: afs: handle CB.InitCallBackState3 requests without a server record
+
+From: Nan Li <tonanli66@gmail.com>
+
+commit f3cf725cd284b7912d5522babb44721bf38c8887 upstream.
+
+The cache manager callback path now attaches the server record to an
+incoming call through the rxrpc peer's app data. That association is
+not guaranteed to exist for every callback request, and most callback
+handlers already tolerate that case.
+
+Make CB.InitCallBackState3 follow the same pattern by checking whether a
+server record was attached before using it. If the peer is not mapped
+to a server record, trace the request and ignore it, matching the
+existing behaviour for other unmatched callback requests.
+
+This keeps the callback handler consistent with the rest of the cache
+manager service and avoids depending on peer state that may not be
+available for a given request.
+
+Fixes: 40e8b52fe8c8 ("afs: Use the per-peer app data provided by rxrpc")
+Cc: stable@kernel.org
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Nan Li <tonanli66@gmail.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Link: https://patch.msgid.link/20260622090856.2746629-2-dhowells@redhat.com
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/afs/cmservice.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/afs/cmservice.c
++++ b/fs/afs/cmservice.c
+@@ -365,6 +365,11 @@ static int afs_deliver_cb_init_call_back
+ if (!afs_check_call_state(call, AFS_CALL_SV_REPLYING))
+ return afs_io_error(call, afs_io_error_cm_reply);
+
++ if (!call->server) {
++ trace_afs_cm_no_server_u(call, call->request);
++ return 0;
++ }
++
+ if (memcmp(call->request, &call->server->_uuid, sizeof(call->server->_uuid)) != 0) {
+ pr_notice("Callback UUID does not match fileserver UUID\n");
+ trace_afs_cm_no_server_u(call, call->request);
--- /dev/null
+From f52524da7084c1a54683ae9fbc73e93fff19dd64 Mon Sep 17 00:00:00 2001
+From: Zhang Heng <zhangheng@kylinos.cn>
+Date: Mon, 13 Jul 2026 18:03:29 +0800
+Subject: ALSA: hda: conexant: Remove mic bias threshold override
+
+From: Zhang Heng <zhangheng@kylinos.cn>
+
+commit f52524da7084c1a54683ae9fbc73e93fff19dd64 upstream.
+
+Remove the mic bias current comparator threshold override (NID 0x1c,
+verb 0x320, value 0x010) from Conexant codec driver.
+
+This override was originally intended to support volume up/down controls on
+headsets with inline remote controls, but it causes microphone detection
+failures on some headsets with impedance less than 1k ohm.
+
+After consulting with the vendor's engineers, it was confirmed that this
+setting is board-specific and should be handled by BIOS/firmware rather
+than the generic codec driver, especially since inline remote support
+is not currently implemented.
+
+Fixes: 7aeb25908648 ("ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
+Link: https://patch.msgid.link/20260713100329.306892-1-zhangheng@kylinos.cn
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/conexant.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/sound/hda/codecs/conexant.c
++++ b/sound/hda/codecs/conexant.c
+@@ -168,9 +168,6 @@ static void cx_fixup_headset_recog(struc
+ {
+ unsigned int mic_present;
+
+- /* fix some headset type recognize fail issue, such as EDIFIER headset */
+- /* set micbias output current comparator threshold from 66% to 55%. */
+- snd_hda_codec_write(codec, 0x1c, 0, 0x320, 0x010);
+ /* set OFF voltage for DFET from -1.2V to -0.8V, set headset micbias register
+ * value adjustment trim from 2.2K ohms to 2.0K ohms.
+ */
--- /dev/null
+From f67be28fdf8b5d31ac1cc1152bb17250f9f8f513 Mon Sep 17 00:00:00 2001
+From: Xu Rao <raoxu@uniontech.com>
+Date: Tue, 7 Jul 2026 21:24:19 +0800
+Subject: ALSA: hda: Fix cached processing coefficient verbs
+
+From: Xu Rao <raoxu@uniontech.com>
+
+commit f67be28fdf8b5d31ac1cc1152bb17250f9f8f513 upstream.
+
+Intel HD Audio defines Coefficient Index and Processing Coefficient as
+separate audio widget controls in the Audio Widget Verb Definitions:
+Coefficient Index selects the coefficient slot, while Processing
+Coefficient accesses the value at the selected slot.
+
+hda_reg_read_coef() selects the slot with AC_VERB_SET_COEF_INDEX, but
+then uses AC_VERB_GET_COEF_INDEX for the value read. That reads back the
+selected index instead of the coefficient value. hda_reg_write_coef()
+has the same issue and builds the value write from AC_VERB_GET_COEF_INDEX
+instead of AC_VERB_SET_PROC_COEF.
+
+This only affects the regmap coefficient cache path used by codecs that
+set codec->cache_coef. Direct coefficient helpers already use the normal
+SET_COEF_INDEX followed by GET_PROC_COEF or SET_PROC_COEF sequence, which
+is likely why this has not been noticed widely.
+
+Use AC_VERB_GET_PROC_COEF for cached coefficient reads and
+AC_VERB_SET_PROC_COEF for cached coefficient writes.
+
+Fixes: 40ba66a702b8 ("ALSA: hda - Add cache support for COEF read/write")
+Cc: stable@vger.kernel.org
+Signed-off-by: Xu Rao <raoxu@uniontech.com>
+Link: https://patch.msgid.link/DB9023BF2920BA99+20260707132419.1731342-1-raoxu@uniontech.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/core/regmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/hda/core/regmap.c
++++ b/sound/hda/core/regmap.c
+@@ -214,7 +214,7 @@ static int hda_reg_read_coef(struct hdac
+ err = snd_hdac_exec_verb(codec, verb, 0, NULL);
+ if (err < 0)
+ return err;
+- verb = (reg & ~0xfffff) | (AC_VERB_GET_COEF_INDEX << 8);
++ verb = (reg & ~0xfffff) | (AC_VERB_GET_PROC_COEF << 8);
+ return snd_hdac_exec_verb(codec, verb, 0, val);
+ }
+
+@@ -232,7 +232,7 @@ static int hda_reg_write_coef(struct hda
+ err = snd_hdac_exec_verb(codec, verb, 0, NULL);
+ if (err < 0)
+ return err;
+- verb = (reg & ~0xfffff) | (AC_VERB_GET_COEF_INDEX << 8) |
++ verb = (reg & ~0xfffff) | (AC_VERB_SET_PROC_COEF << 8) |
+ (val & 0xffff);
+ return snd_hdac_exec_verb(codec, verb, 0, NULL);
+ }
--- /dev/null
+From d595255241e5fec0c94adeebf2565524398e37c5 Mon Sep 17 00:00:00 2001
+From: Eckhart Mohr <e.mohr@tuxedocomputers.com>
+Date: Wed, 8 Jul 2026 15:21:06 +0200
+Subject: ALSA: hda/realtek: Add quirk for TongFang X6xx45xU
+
+From: Eckhart Mohr <e.mohr@tuxedocomputers.com>
+
+commit d595255241e5fec0c94adeebf2565524398e37c5 upstream.
+
+Fix microphone detection on built in headphone jack for some devices.
+
+Signed-off-by: Eckhart Mohr <e.mohr@tuxedocomputers.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
+Link: https://patch.msgid.link/20260708132135.102680-1-wse@tuxedocomputers.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -7550,6 +7550,7 @@ static const struct hda_quirk alc269_fix
+ SND_PCI_QUIRK(0x1d05, 0x300f, "TongFang X6AR5xxY", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d05, 0x3019, "TongFang X6FR5xxY", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d05, 0x3031, "TongFang X6AR55xU", ALC2XX_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1d05, 0x3034, "TongFang X6xx45xU", ALC2XX_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d17, 0x3288, "Haier Boyue G42", ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS),
+ SND_PCI_QUIRK(0x1d72, 0x1602, "RedmiBook", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1d72, 0x1701, "XiaomiNotebook Pro", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE),
--- /dev/null
+From d35dfb6329accfe1cfa0b57e35214b5cbbe0f9ae Mon Sep 17 00:00:00 2001
+From: Damien Laine <damien.laine@gmail.com>
+Date: Sun, 12 Jul 2026 23:37:08 +0200
+Subject: ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7
+
+From: Damien Laine <damien.laine@gmail.com>
+
+commit d35dfb6329accfe1cfa0b57e35214b5cbbe0f9ae upstream.
+
+Some units of the Lenovo Legion Pro 7 16ARX8H (82WS) report codec
+subsystem ID 17aa:38a7 instead of 17aa:38a8. Since only 38a8 has a
+codec SSID quirk, these machines fall through to the PCI SSID match
+17aa:386f (Legion Pro 7i 16IAX7) and get ALC287_FIXUP_CS35L41_I2C_2,
+which probes the Cirrus amplifiers of the Intel variant. The TI
+TAS2781 amplifier (ACPI TIAS2781:00) present on this AMD variant is
+never bound and the internal speakers remain silent.
+
+Add a codec SSID quirk for 17aa:38a7 pointing to
+ALC287_FIXUP_TAS2781_I2C, mirroring the existing 38a8 entry.
+
+Tested on a Legion Pro 7 16ARX8H (82WS, BIOS LPCN62WW): with the codec
+SSID overridden to 17aa:38a8 via the HDA patch loader, the TAS2781
+amplifier binds and the internal speakers work.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Damien Laine <damien.laine@gmail.com>
+Link: https://patch.msgid.link/20260712213708.1835469-1-damien.laine@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/hda/codecs/realtek/alc269.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/hda/codecs/realtek/alc269.c
++++ b/sound/hda/codecs/realtek/alc269.c
+@@ -7435,6 +7435,7 @@ static const struct hda_quirk alc269_fix
+ HDA_CODEC_QUIRK(0x17aa, 0x386e, "Legion Y9000X 2022 IAH7", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x17aa, 0x386e, "Yoga Pro 7 14ARP8", ALC285_FIXUP_SPEAKER2_TO_DAC1),
+ HDA_CODEC_QUIRK(0x17aa, 0x38a8, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C), /* this must match before PCI SSID 17aa:386f below */
++ HDA_CODEC_QUIRK(0x17aa, 0x38a7, "Legion Pro 7 16ARX8H", ALC287_FIXUP_TAS2781_I2C), /* this must match before PCI SSID 17aa:386f below */
+ SND_PCI_QUIRK(0x17aa, 0x386f, "Legion Pro 7i 16IAX7", ALC287_FIXUP_CS35L41_I2C_2),
+ SND_PCI_QUIRK(0x17aa, 0x3870, "Lenovo Yoga 7 14ARB7", ALC287_FIXUP_YOGA7_14ARB7_I2C),
+ SND_PCI_QUIRK(0x17aa, 0x3877, "Lenovo Legion 7 Slim 16ARHA7", ALC287_FIXUP_CS35L41_I2C_2),
--- /dev/null
+From 018f2dc3a42098d3b04edd1480adc51d268adb14 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@kernel.org>
+Date: Thu, 25 Dec 2025 18:36:12 +0800
+Subject: dt-bindings: media: sun4i-a10-video-engine: Add interconnect properties
+
+From: Chen-Yu Tsai <wens@kernel.org>
+
+commit 018f2dc3a42098d3b04edd1480adc51d268adb14 upstream.
+
+The Allwinner video engine sits behind the MBUS that is represented as
+an interconnect.
+
+Make sure that the interconnect properties are valid in the binding.
+
+Fixes: d41662e52a03 ("media: dt-bindings: media: allwinner,sun4i-a10-video-engine: Add R40 compatible")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
+Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml
++++ b/Documentation/devicetree/bindings/media/allwinner,sun4i-a10-video-engine.yaml
+@@ -63,6 +63,16 @@ properties:
+ CMA pool to use for buffers allocation instead of the default
+ CMA pool.
+
++ # FIXME: This should be made required eventually once every SoC will
++ # have the MBUS declared.
++ interconnects:
++ maxItems: 1
++
++ # FIXME: This should be made required eventually once every SoC will
++ # have the MBUS declared.
++ interconnect-names:
++ const: dma-mem
++
+ required:
+ - compatible
+ - reg
--- /dev/null
+From 6aa38ef0eab32df5409b72d62509de6ba09cea50 Mon Sep 17 00:00:00 2001
+From: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
+Date: Tue, 9 Jun 2026 14:26:40 +0800
+Subject: dt-bindings: power: imx93: Add MIPI PHY power domain
+
+From: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
+
+commit 6aa38ef0eab32df5409b72d62509de6ba09cea50 upstream.
+
+Add MIPI PHY power domain for shared PHY resources used by both
+MIPI DSI and CSI blocks.
+
+Signed-off-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
+Reviewed-by: Frank Li <Frank.Li@nxp.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
+Reviewed-by: Peng Fan <peng.fan@nxp.com>
+Fixes: e9aa77d413c9 ("soc: imx: add i.MX93 media blk ctrl driver")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulfh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/dt-bindings/power/fsl,imx93-power.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/dt-bindings/power/fsl,imx93-power.h
++++ b/include/dt-bindings/power/fsl,imx93-power.h
+@@ -11,5 +11,6 @@
+ #define IMX93_MEDIABLK_PD_PXP 2
+ #define IMX93_MEDIABLK_PD_LCDIF 3
+ #define IMX93_MEDIABLK_PD_ISI 4
++#define IMX93_MEDIABLK_PD_MIPI_PHY 5
+
+ #endif
--- /dev/null
+From 5fae9a928482d4845bca169a3a098789203a1ca4 Mon Sep 17 00:00:00 2001
+From: Ian Bridges <icb@fastmail.org>
+Date: Wed, 24 Jun 2026 16:11:36 -0500
+Subject: fbcon: fix NULL pointer dereference for a console without vc_data
+
+From: Ian Bridges <icb@fastmail.org>
+
+commit 5fae9a928482d4845bca169a3a098789203a1ca4 upstream.
+
+fbcon_new_modelist() runs when a framebuffer's modelist changes. For each
+console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and
+passes the vc_num to fbcon_set_disp(). This assumes a console with a mode
+set has a vc_data, but it can be NULL. fbcon_set_disp() sets
+fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the
+mode set after the vc_data is freed. fbcon_new_modelist() then dereferences
+the NULL vc_data.
+
+Keep fb_display[i].mode set only while the console has a vc_data. Check
+vc_data before setting the mode in fbcon_set_disp(), and clear the mode in
+fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips
+such consoles.
+
+Reported-by: syzbot+42525d636f430fd5d983@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=42525d636f430fd5d983
+Cc: stable@vger.kernel.org
+Assisted-by: Claude:claude-opus-4-8
+Signed-off-by: Ian Bridges <icb@fastmail.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbcon.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -1205,6 +1205,7 @@ static void fbcon_deinit(struct vc_data
+ int idx;
+
+ fbcon_free_font(p);
++ p->mode = NULL;
+ idx = con2fb_map[vc->vc_num];
+
+ if (idx == -1)
+@@ -1375,14 +1376,14 @@ static void fbcon_set_disp(struct fb_inf
+
+ p = &fb_display[unit];
+
+- if (var_to_display(p, var, info))
+- return;
+-
+ vc = vc_cons[unit].d;
+
+ if (!vc)
+ return;
+
++ if (var_to_display(p, var, info))
++ return;
++
+ default_mode = vc->vc_display_fg;
+ svc = *default_mode;
+ t = &fb_display[svc->vc_num];
--- /dev/null
+From 84202754fb1727dc3ee87f47104e4162ecc8ba3a Mon Sep 17 00:00:00 2001
+From: Jiacheng Yu <yujiacheng3@huawei.com>
+Date: Thu, 14 May 2026 17:19:18 +0800
+Subject: fbcon: Use correct type for vc_resize() return value
+
+From: Jiacheng Yu <yujiacheng3@huawei.com>
+
+commit 84202754fb1727dc3ee87f47104e4162ecc8ba3a upstream.
+
+The return value of vc_resize() is int, but fbcon_set_disp() stores it
+in an unsigned long variable. While the !ret check happens to work
+correctly by coincidence (negative values become large positive values),
+the types should match. Use int instead.
+
+Eliminates the following W=3 warning:
+
+ drivers/video/fbdev/core/fbcon.c: In function 'fbcon_set_disp':
+ drivers/video/fbdev/core/fbcon.c:1494:14: warning: implicit conversion from 'int' to 'unsigned long' [-Wconversion]
+
+Fixes: af0db3c1f898 ("fbdev: Fix vmalloc out-of-bounds write in fast_imageblit")
+Cc: stable@vger.kernel.org # v6.17+
+Signed-off-by: Jiacheng Yu <yujiacheng3@huawei.com>
+Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/fbdev/core/fbcon.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -1371,8 +1371,7 @@ static void fbcon_set_disp(struct fb_inf
+ struct vc_data **default_mode, *vc;
+ struct vc_data *svc;
+ struct fbcon_par *par = info->fbcon_par;
+- int rows, cols;
+- unsigned long ret = 0;
++ int rows, cols, ret;
+
+ p = &fb_display[unit];
+
--- /dev/null
+From a15b773fe4ffa450b56347cc506b2d1405600f5d Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Fri, 17 Apr 2026 05:19:29 +0000
+Subject: media: uvcvideo: Avoid partial metadata buffers
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit a15b773fe4ffa450b56347cc506b2d1405600f5d upstream.
+
+If the metadata queue that is empty receives a new buffer while we are
+in the middle of processing a frame, the first metadata buffer will
+contain partial information.
+
+Avoid this by tracking the state of the metadata buffer and making sure
+that it is in sync with the data buffer.
+
+Now that we are at it, make sure that we skip buffers of size 1 or 0.
+They are not allowed by the spec... but it is a simple check to add and
+better be safe than sorry.
+
+Fixes: 088ead255245 ("media: uvcvideo: Add a metadata device node")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20260417-uvc-meta-partial-v2-2-31d274af7d2d@chromium.org
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -1157,7 +1157,9 @@ static void uvc_video_stats_stop(struct
+ * uvc_video_decode_end will never be called with a NULL buffer.
+ */
+ static int uvc_video_decode_start(struct uvc_streaming *stream,
+- struct uvc_buffer *buf, const u8 *data, int len)
++ struct uvc_buffer *buf,
++ struct uvc_buffer *meta_buf,
++ const u8 *data, int len)
+ {
+ u8 header_len;
+ u8 fid;
+@@ -1230,6 +1232,8 @@ static int uvc_video_decode_start(struct
+
+ /* TODO: Handle PTS and SCR. */
+ buf->state = UVC_BUF_STATE_ACTIVE;
++ if (meta_buf)
++ meta_buf->state = UVC_BUF_STATE_ACTIVE;
+ }
+
+ /*
+@@ -1432,7 +1436,7 @@ static void uvc_video_decode_meta(struct
+ ktime_t time;
+ const u8 *scr;
+
+- if (!meta_buf || length == 2)
++ if (length <= 2 || !meta_buf || meta_buf->state != UVC_BUF_STATE_ACTIVE)
+ return;
+
+ has_pts = mem[1] & UVC_STREAM_PTS;
+@@ -1549,7 +1553,7 @@ static void uvc_video_decode_isoc(struct
+ /* Decode the payload header. */
+ mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
+ do {
+- ret = uvc_video_decode_start(stream, buf, mem,
++ ret = uvc_video_decode_start(stream, buf, meta_buf, mem,
+ urb->iso_frame_desc[i].actual_length);
+ if (ret == -EAGAIN)
+ uvc_video_next_buffers(stream, &buf, &meta_buf);
+@@ -1598,7 +1602,8 @@ static void uvc_video_decode_bulk(struct
+ */
+ if (stream->bulk.header_size == 0 && !stream->bulk.skip_payload) {
+ do {
+- ret = uvc_video_decode_start(stream, buf, mem, len);
++ ret = uvc_video_decode_start(stream, buf, meta_buf, mem,
++ len);
+ if (ret == -EAGAIN)
+ uvc_video_next_buffers(stream, &buf, &meta_buf);
+ } while (ret == -EAGAIN);
--- /dev/null
+From ba649fff36c1fe68489a86d00285224907edd436 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Wed, 13 May 2026 11:49:23 +0000
+Subject: media: uvcvideo: Do not add clock samples with small sof delta
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit ba649fff36c1fe68489a86d00285224907edd436 upstream.
+
+Some UVC 1.1 cameras running in fast isochronous mode tend to spam the
+USB host with a lot of empty packets. These packets contain clock
+information and are added to the clock buffer but do not add any
+accuracy to the calculation. In fact, it is quite the opposite, in our
+calculations, only the first and the last timestamp is used, and we only
+have 32 slots.
+
+Ignore the samples that will produce less than MIN_HW_TIMESTAMP_DIFF
+data.
+
+Fixes: 141270bd95d4 ("media: uvcvideo: Refactor clock circular buffer")
+Cc: stable@vger.kernel.org
+Tested-by: Yunke Cao <yunkec@google.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-4-7a64838b0b02@chromium.org
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -537,6 +537,15 @@ static void uvc_video_clock_add_sample(s
+ spin_unlock_irqrestore(&clock->lock, flags);
+ }
+
++static inline u16 sof_diff(u16 a, u16 b)
++{
++ /*
++ * Because the result is modulo 2048 (via & 2047), we do not need a
++ * special case for a < b.
++ */
++ return (a - b) & 2047;
++}
++
+ static void
+ uvc_video_clock_decode(struct uvc_streaming *stream, struct uvc_buffer *buf,
+ const u8 *data, int len)
+@@ -657,12 +666,13 @@ uvc_video_clock_decode(struct uvc_stream
+ sample.dev_sof = (sample.dev_sof + stream->clock.sof_offset) & 2047;
+
+ /*
+- * To limit the amount of data, drop SCRs with an SOF identical to the
++ * To limit the amount of data, drop SCRs with an SOF similar to the
+ * previous one. This filtering is also needed to support UVC 1.5, where
+ * all the data packets of the same frame contains the same SOF. In that
+ * case only the first one will match the host_sof.
+ */
+- if (sample.dev_sof == stream->clock.last_sof)
++ if (sof_diff(sample.dev_sof, stream->clock.last_sof) <=
++ (UVC_MIN_HW_TIMESTAMP_DIFF / stream->clock.size))
+ return;
+
+ uvc_video_clock_add_sample(&stream->clock, &sample);
--- /dev/null
+From 2f24ac8dd87983a55f0498898f34a5f2b735b802 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 23 Mar 2026 09:53:53 +0000
+Subject: media: uvcvideo: Fix buffer sequence in frame gaps
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 2f24ac8dd87983a55f0498898f34a5f2b735b802 upstream.
+
+In UVC, the FID flips with every frame. For every FID flip, we increase
+the stream sequence number.
+
+Now, if a FID flips multiple times and there is no data transferred between
+the flips, the buffer sequence number will be set to the value of the
+stream sequence number after the first flip.
+
+Userspace uses the buffer sequence number to determine if there have been
+missing frames. With the current behaviour, userspace will think that the
+gap is in the wrong location.
+
+This patch modifies uvc_video_decode_start() to provide the correct buffer
+sequence number and timestamp.
+
+Cc: stable@kernel.org
+Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost")
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -1186,6 +1186,19 @@ static int uvc_video_decode_start(struct
+ stream->sequence++;
+ if (stream->sequence)
+ uvc_video_stats_update(stream);
++
++ /*
++ * On a FID flip initialize sequence number and timestamp.
++ *
++ * The driver already takes care of injecting FID flips for
++ * UVC_QUIRK_STREAM_NO_FID and UVC_QUIRK_MJPEG_NO_EOF.
++ */
++ if (buf) {
++ buf->buf.field = V4L2_FIELD_NONE;
++ buf->buf.sequence = stream->sequence;
++ buf->buf.vb2_buf.timestamp =
++ ktime_to_ns(uvc_video_get_time());
++ }
+ }
+
+ uvc_video_clock_decode(stream, buf, data, len);
+@@ -1226,10 +1239,6 @@ static int uvc_video_decode_start(struct
+ return -ENODATA;
+ }
+
+- buf->buf.field = V4L2_FIELD_NONE;
+- buf->buf.sequence = stream->sequence;
+- buf->buf.vb2_buf.timestamp = ktime_to_ns(uvc_video_get_time());
+-
+ /* TODO: Handle PTS and SCR. */
+ buf->state = UVC_BUF_STATE_ACTIVE;
+ if (meta_buf)
--- /dev/null
+From edc1917599c5339aedc83135cade66517e0a2972 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Wed, 13 May 2026 11:49:20 +0000
+Subject: media: uvcvideo: Fix dev_sof filtering in hw timestamp
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit edc1917599c5339aedc83135cade66517e0a2972 upstream.
+
+To avoid filling the clock circular buffer with duplicated data we only
+add it if the new value sof is different than the last added sof.
+
+The issue is that we compare the unprocess sof with the processed sof.
+If there is a sof_offset, or UVC_QUIRK_INVALID_DEVICE_SOF is enabled,
+the comparison will not work as expected.
+
+This patch moves the comparison to the right place.
+
+Fixes: 141270bd95d4 ("media: uvcvideo: Refactor clock circular buffer")
+Cc: stable@vger.kernel.org
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Tested-by: Yunke Cao <yunkec@google.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-1-7a64838b0b02@chromium.org
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -583,16 +583,7 @@ uvc_video_clock_decode(struct uvc_stream
+ if (!has_scr)
+ return;
+
+- /*
+- * To limit the amount of data, drop SCRs with an SOF identical to the
+- * previous one. This filtering is also needed to support UVC 1.5, where
+- * all the data packets of the same frame contains the same SOF. In that
+- * case only the first one will match the host_sof.
+- */
+ sample.dev_sof = get_unaligned_le16(&data[header_size - 2]);
+- if (sample.dev_sof == stream->clock.last_sof)
+- return;
+-
+ sample.dev_stc = get_unaligned_le32(&data[header_size - 6]);
+
+ /*
+@@ -664,6 +655,16 @@ uvc_video_clock_decode(struct uvc_stream
+ }
+
+ sample.dev_sof = (sample.dev_sof + stream->clock.sof_offset) & 2047;
++
++ /*
++ * To limit the amount of data, drop SCRs with an SOF identical to the
++ * previous one. This filtering is also needed to support UVC 1.5, where
++ * all the data packets of the same frame contains the same SOF. In that
++ * case only the first one will match the host_sof.
++ */
++ if (sample.dev_sof == stream->clock.last_sof)
++ return;
++
+ uvc_video_clock_add_sample(&stream->clock, &sample);
+ stream->clock.last_sof = sample.dev_sof;
+ }
--- /dev/null
+From f078966ca1fb1b3865d8e6bbe2705cfd277fc637 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Mon, 23 Mar 2026 09:53:52 +0000
+Subject: media: uvcvideo: Fix sequence number when no EOF
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit f078966ca1fb1b3865d8e6bbe2705cfd277fc637 upstream.
+
+If the driver could not detect the EOF, the sequence number is increased
+twice:
+ 1) When we enter uvc_video_decode_start() with the old buffer and FID has
+ flipped => We return -EAGAIN and last_fid is not flipped
+ 2) When we enter uvc_video_decode_start() with the new buffer.
+
+Fix this issue by moving the new frame detection logic earlier in
+uvc_video_decode_start().
+
+This also has some nice side affects:
+
+- The error status from the new packet will no longer get propagated
+ to the previous frame-buffer.
+- uvc_video_clock_decode() will no longer update the previous frame
+ buf->stf with info from the new packet.
+- uvc_video_clock_decode() and uvc_video_stats_decode() will no longer
+ get called twice for the same packet.
+
+Cc: stable@kernel.org
+Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost")
+Reported-by: Hans de Goede <hansg@kernel.org>
+Closes: https://lore.kernel.org/linux-media/CANiDSCuj4cPuB5_v2xyvAagA5FjoN8V5scXiFFOeD3aKDMqkCg@mail.gmail.com/T/#me39fb134e8c2c085567a31548c3403eb639625e4
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 92 +++++++++++++++++++-------------------
+ 1 file changed, 47 insertions(+), 45 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -1197,6 +1197,53 @@ static int uvc_video_decode_start(struct
+ fid = data[1] & UVC_STREAM_FID;
+
+ /*
++ * Mark the buffer as done if we're at the beginning of a new frame.
++ * End of frame detection is better implemented by checking the EOF
++ * bit (FID bit toggling is delayed by one frame compared to the EOF
++ * bit), but some devices don't set the bit at end of frame (and the
++ * last payload can be lost anyway). We thus must check if the FID has
++ * been toggled.
++ *
++ * stream->last_fid is initialized to -1, and buf->bytesused to 0,
++ * so the first isochronous frame will never trigger an end of frame
++ * detection.
++ *
++ * Empty buffers (bytesused == 0) don't trigger end of frame detection
++ * as it doesn't make sense to return an empty buffer. This also
++ * avoids detecting end of frame conditions at FID toggling if the
++ * previous payload had the EOF bit set.
++ */
++ if (fid != stream->last_fid && buf && buf->bytesused != 0) {
++ uvc_dbg(stream->dev, FRAME,
++ "Frame complete (FID bit toggled)\n");
++ buf->state = UVC_BUF_STATE_READY;
++
++ return -EAGAIN;
++ }
++
++ /*
++ * Some cameras, when running two parallel streams (one MJPEG alongside
++ * another non-MJPEG stream), are known to lose the EOF packet for a frame.
++ * We can detect the end of a frame by checking for a new SOI marker, as
++ * the SOI always lies on the packet boundary between two frames for
++ * these devices.
++ */
++ if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF &&
++ (stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG ||
++ stream->cur_format->fcc == V4L2_PIX_FMT_JPEG) &&
++ buf && buf->bytesused != 0) {
++ const u8 *packet = data + header_len;
++
++ if (len >= header_len + 2 &&
++ packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI) {
++ buf->state = UVC_BUF_STATE_READY;
++ buf->error = 1;
++ stream->last_fid ^= UVC_STREAM_FID;
++ return -EAGAIN;
++ }
++ }
++
++ /*
+ * Increase the sequence number regardless of any buffer states, so
+ * that discontinuous sequence numbers always indicate lost frames.
+ */
+@@ -1263,51 +1310,6 @@ static int uvc_video_decode_start(struct
+ meta_buf->state = UVC_BUF_STATE_ACTIVE;
+ }
+
+- /*
+- * Mark the buffer as done if we're at the beginning of a new frame.
+- * End of frame detection is better implemented by checking the EOF
+- * bit (FID bit toggling is delayed by one frame compared to the EOF
+- * bit), but some devices don't set the bit at end of frame (and the
+- * last payload can be lost anyway). We thus must check if the FID has
+- * been toggled.
+- *
+- * stream->last_fid is initialized to -1, so the first isochronous
+- * frame will never trigger an end of frame detection.
+- *
+- * Empty buffers (bytesused == 0) don't trigger end of frame detection
+- * as it doesn't make sense to return an empty buffer. This also
+- * avoids detecting end of frame conditions at FID toggling if the
+- * previous payload had the EOF bit set.
+- */
+- if (fid != stream->last_fid && buf->bytesused != 0) {
+- uvc_dbg(stream->dev, FRAME,
+- "Frame complete (FID bit toggled)\n");
+- buf->state = UVC_BUF_STATE_READY;
+- return -EAGAIN;
+- }
+-
+- /*
+- * Some cameras, when running two parallel streams (one MJPEG alongside
+- * another non-MJPEG stream), are known to lose the EOF packet for a frame.
+- * We can detect the end of a frame by checking for a new SOI marker, as
+- * the SOI always lies on the packet boundary between two frames for
+- * these devices.
+- */
+- if (stream->dev->quirks & UVC_QUIRK_MJPEG_NO_EOF &&
+- (stream->cur_format->fcc == V4L2_PIX_FMT_MJPEG ||
+- stream->cur_format->fcc == V4L2_PIX_FMT_JPEG)) {
+- const u8 *packet = data + header_len;
+-
+- if (len >= header_len + 2 &&
+- packet[0] == 0xff && packet[1] == JPEG_MARKER_SOI &&
+- buf->bytesused != 0) {
+- buf->state = UVC_BUF_STATE_READY;
+- buf->error = 1;
+- stream->last_fid ^= UVC_STREAM_FID;
+- return -EAGAIN;
+- }
+- }
+-
+ stream->last_fid = fid;
+
+ return header_len;
--- /dev/null
+From 1719d78f832dda8dd3f09a867ba74e05d6f11308 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Wed, 13 May 2026 11:49:22 +0000
+Subject: media: uvcvideo: Relax the constrains for interpolating the hw clock
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit 1719d78f832dda8dd3f09a867ba74e05d6f11308 upstream.
+
+In the initial version we set the min value to 250msec. Looks like
+100msec can also provide a good value.
+
+Now that we are at it, add a macro to make it cleaner.
+
+Fixes: 6243c83be6ee8 ("media: uvcvideo: Allow hw clock updates with buffers not full")
+Cc: stable@vger.kernel.org
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Tested-by: Yunke Cao <yunkec@google.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-3-7a64838b0b02@chromium.org
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -494,6 +494,13 @@ static int uvc_commit_video(struct uvc_s
+ * Clocks and timestamps
+ */
+
++/*
++ * The accuracy of the hardware timestamping depends on having enough data to
++ * interpolate between the different clock domains. This value is sof cycles,
++ * this is, milliseconds.
++ */
++#define UVC_MIN_HW_TIMESTAMP_DIFF 100
++
+ static inline ktime_t uvc_video_get_time(void)
+ {
+ if (uvc_clock_param == CLOCK_MONOTONIC)
+@@ -854,13 +861,13 @@ void uvc_video_clock_update(struct uvc_s
+ * buffer, but RAM is expensive these days, specially the infinitely
+ * big.
+ *
+- * The value of 1/4th of a second was determined by running Android's
+- * CTS on different devices.
++ * The value of UVC_MIN_HW_TIMESTAMP_DIFF was determined by running
++ * Android's CTS on different devices.
+ *
+- * dev_sof runs at 1KHz, and we have a fixed point precision of
+- * 16 bits.
++ * y1 and y2 are dev_sof with a fixed point precision of 16 bits.
+ */
+- if (clock->size != clock->count && (y2 - y1) < ((1000 / 4) << 16))
++ if (clock->size != clock->count &&
++ (y2 - y1) < (UVC_MIN_HW_TIMESTAMP_DIFF << 16))
+ goto done;
+
+ y = (u64)(y2 - y1) * (1ULL << 31) + (u64)y1 * (u64)x2
--- /dev/null
+From ede7de6e6b3db552d10ac50557d69c50d1b08486 Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda <ribalda@chromium.org>
+Date: Wed, 13 May 2026 11:49:21 +0000
+Subject: media: uvcvideo: Use hw timestaming if the clock buffer is full
+
+From: Ricardo Ribalda <ribalda@chromium.org>
+
+commit ede7de6e6b3db552d10ac50557d69c50d1b08486 upstream.
+
+In some situations, even with a full clock buffer, it does not contain
+250msec of data. This results in the driver jumping back from software
+to hardware timestapsing creating a nasty artifact in the video.
+
+If the clock buffer is full, use it to calculate the timestamp instead
+of defaulting to software stamps, the reduced accuracy is less visible
+than jumping from one timestamping mechanism to the other.
+
+Fixes: 6243c83be6ee8 ("media: uvcvideo: Allow hw clock updates with buffers not full")
+Cc: stable@vger.kernel.org
+Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Tested-by: Yunke Cao <yunkec@google.com>
+Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
+Link: https://patch.msgid.link/20260513-uvc-hwtimestamp-v3-2-7a64838b0b02@chromium.org
+Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
+Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/usb/uvc/uvc_video.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -834,15 +834,22 @@ void uvc_video_clock_update(struct uvc_s
+ y2 += 2048 << 16;
+
+ /*
+- * Have at least 1/4 of a second of timestamps before we
+- * try to do any calculation. Otherwise we do not have enough
+- * precision. This value was determined by running Android CTS
+- * on different devices.
++ * If the buffer is not full, we want to gather at least 1/4th of
++ * timestamps before using HW timestamping. We do this to avoid jitter
++ * on the initial frames.
++ *
++ * If the buffer is full we would use it regardless of how much data
++ * it represents. This could be solved with an infinite big circular
++ * buffer, but RAM is expensive these days, specially the infinitely
++ * big.
++ *
++ * The value of 1/4th of a second was determined by running Android's
++ * CTS on different devices.
+ *
+ * dev_sof runs at 1KHz, and we have a fixed point precision of
+ * 16 bits.
+ */
+- if ((y2 - y1) < ((1000 / 4) << 16))
++ if (clock->size != clock->count && (y2 - y1) < ((1000 / 4) << 16))
+ goto done;
+
+ y = (u64)(y2 - y1) * (1ULL << 31) + (u64)y1 * (u64)x2
--- /dev/null
+From 5801cff7d5d7b4e9d877dfb627b23eb63167f02c Mon Sep 17 00:00:00 2001
+From: Hyunwoo Kim <imv4bel@gmail.com>
+Date: Tue, 9 Jun 2026 15:09:06 +0100
+Subject: rxrpc: Don't move a peeked OOB message onto the pending queue
+
+From: Hyunwoo Kim <imv4bel@gmail.com>
+
+commit 5801cff7d5d7b4e9d877dfb627b23eb63167f02c upstream.
+
+rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and,
+if a response is needed, moves it onto the pending_oobq tree. However,
+only the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto
+pending_oobq always runs.
+
+As a result, reading a challenge with MSG_PEEK leaves the skb on
+recvmsg_oobq while also adding it to pending_oobq. Since struct
+sk_buff's rbnode shares storage with its next and prev pointers,
+rb_insert_color() overwrites the list linkage, and the skb, which holds
+a single reference, becomes reachable from both queues at once.
+
+When the socket is closed both queues are drained in turn. While
+draining recvmsg_oobq, __skb_unlink() follows the next and prev
+pointers that rbnode has overwritten and writes to a bad address. Also,
+as the skb holds a single reference but is freed from each queue, both
+the skb and the connection reference it holds are released twice. This
+leads to memory corruption and to a use-after-free caused by the
+connection refcount underflow.
+
+MSG_PEEK does not consume the message from the queue, so only unlink it
+from recvmsg_oobq and then move it onto pending_oobq or free it when
+the message is actually consumed.
+
+Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
+Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260609140911.838677-3-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/recvmsg.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
+index a3cf5358f16e..82614cbdb60f 100644
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -262,12 +262,13 @@ static int rxrpc_recvmsg_oob(struct socket *sock, struct msghdr *msg,
+ break;
+ }
+
+- if (!(flags & MSG_PEEK))
++ if (!(flags & MSG_PEEK)) {
+ skb_unlink(skb, &rx->recvmsg_oobq);
+- if (need_response)
+- rxrpc_add_pending_oob(rx, skb);
+- else
+- rxrpc_free_skb(skb, rxrpc_skb_put_oob);
++ if (need_response)
++ rxrpc_add_pending_oob(rx, skb);
++ else
++ rxrpc_free_skb(skb, rxrpc_skb_put_oob);
++ }
+ return ret;
+ }
+
+--
+2.55.0
+
--- /dev/null
+From 9b6ce594808580b2a19e6e1aa459ef56c0153ac1 Mon Sep 17 00:00:00 2001
+From: Wyatt Feng <bronzed_45_vested@icloud.com>
+Date: Wed, 24 Jun 2026 17:38:08 +0100
+Subject: rxrpc: Fix ACKALL packet handling
+
+From: Wyatt Feng <bronzed_45_vested@icloud.com>
+
+commit 9b6ce594808580b2a19e6e1aa459ef56c0153ac1 upstream.
+
+rxrpc_input_ackall() accepts ACKALL packets without checking whether the
+call is in a state that can legitimately have outstanding transmit buffers.
+A forged ACKALL can therefore reach a new service call in
+RXRPC_CALL_SERVER_RECV_REQUEST before any reply packets have been queued.
+
+In that state call->tx_top is zero and call->tx_queue is NULL, so
+rxrpc_rotate_tx_window() dereferences a NULL txqueue and triggers a
+null-pointer dereference.
+
+Fix the handling of ACKALL packets by the following means:
+
+ (1) Add two new call states: RXRPC_CALL_CLIENT_PRE_SEND which indicates
+ that the client call is connected, but nothing has been transmitted as
+ yet; and RXRPC_CALL_CLIENT_AWAIT_ACK, which indicates that everything
+ has been transmitted at least once, but we're now waiting for the
+ stuff remaining in the Tx buffer to be ACK'd (retransmissions may
+ still happen).
+
+ The RXRPC_CALL_CLIENT_PRE_SEND state is set when the call is assigned
+ a channel and transitions to RXRPC_CALL_CLIENT_SEND_REQUEST when the
+ first packet is transmitted.
+
+ RXRPC_CALL_CLIENT_AWAIT_REPLY is then narrowed in scope to indicate
+ that all Tx packets have been ACK'd and we're now waiting for the
+ reply to be received.
+
+ (2) As per Wyatt Feng's original patch[1], the ACKALL handler then checks
+ that the call state is one in which there might be stuff in the Tx
+ buffer to ACK, but now this includes AWAIT_ACK rather than
+ AWAIT_REPLY. ACKALL packets are ignored if received in the wrong
+ state.
+
+ Note that unlike Wyatt Feng's patch, it's no longer necessary to check
+ to see if the Tx buffer exists as this the state set now covers this.
+
+ (3) Make the ACKALL handler use call->tx_transmitted rather than
+ call->tx_top as the former is explicitly the highest packet seq number
+ transmitted, whereas the latter has a looser definition.
+
+Thanks to Jeffrey Altman for a description of the history of the ACKALL
+packet[1].
+
+Fixes: b341a0263b1b ("rxrpc: Implement progressive transmission queue struct")
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
+Co-developed-by: David Howells <dhowells@redhat.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Ren Wei <n05ec@lzu.edu.cn>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20260616155749.2125907-2-dhowells@redhat.com/ [1]
+Link: https://lore.kernel.org/r/c0fd4fec-1576-4070-b31e-a37d5506f5ed@auristor.com/ [2]
+Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
+Link: https://patch.msgid.link/20260624163819.3017002-2-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/ar-internal.h | 2 ++
+ net/rxrpc/call_event.c | 5 ++++-
+ net/rxrpc/call_object.c | 2 ++
+ net/rxrpc/conn_client.c | 2 +-
+ net/rxrpc/input.c | 23 +++++++++++++++++++----
+ net/rxrpc/sendmsg.c | 3 ++-
+ 6 files changed, 30 insertions(+), 7 deletions(-)
+
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -650,7 +650,9 @@ enum rxrpc_call_event {
+ enum rxrpc_call_state {
+ RXRPC_CALL_UNINITIALISED,
+ RXRPC_CALL_CLIENT_AWAIT_CONN, /* - client waiting for connection to become available */
++ RXRPC_CALL_CLIENT_PRE_SEND, /* - client is connected, but hasn't sent anything yet */
+ RXRPC_CALL_CLIENT_SEND_REQUEST, /* - client sending request phase */
++ RXRPC_CALL_CLIENT_AWAIT_ACK, /* - client awaiting ACKs of request */
+ RXRPC_CALL_CLIENT_AWAIT_REPLY, /* - client awaiting reply */
+ RXRPC_CALL_CLIENT_RECV_REPLY, /* - client receiving reply phase */
+ RXRPC_CALL_SERVER_PREALLOC, /* - service preallocation */
+--- a/net/rxrpc/call_event.c
++++ b/net/rxrpc/call_event.c
+@@ -178,7 +178,7 @@ static void rxrpc_close_tx_phase(struct
+
+ switch (__rxrpc_call_state(call)) {
+ case RXRPC_CALL_CLIENT_SEND_REQUEST:
+- rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_AWAIT_REPLY);
++ rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_AWAIT_ACK);
+ break;
+ case RXRPC_CALL_SERVER_SEND_REPLY:
+ rxrpc_set_call_state(call, RXRPC_CALL_SERVER_AWAIT_ACK);
+@@ -244,6 +244,8 @@ static void rxrpc_transmit_fresh_data(st
+ break;
+ } while (req.n < limit && before(seq, send_top));
+
++ if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_PRE_SEND)
++ rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_SEND_REQUEST);
+ if (txb->flags & RXRPC_LAST_PACKET) {
+ rxrpc_close_tx_phase(call);
+ tq = NULL;
+@@ -267,6 +269,7 @@ void rxrpc_transmit_some_data(struct rxr
+ fallthrough;
+
+ case RXRPC_CALL_SERVER_SEND_REPLY:
++ case RXRPC_CALL_CLIENT_PRE_SEND:
+ case RXRPC_CALL_CLIENT_SEND_REQUEST:
+ if (!rxrpc_tx_window_space(call))
+ return;
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -18,7 +18,9 @@
+ const char *const rxrpc_call_states[NR__RXRPC_CALL_STATES] = {
+ [RXRPC_CALL_UNINITIALISED] = "Uninit ",
+ [RXRPC_CALL_CLIENT_AWAIT_CONN] = "ClWtConn",
++ [RXRPC_CALL_CLIENT_PRE_SEND] = "ClPreSnd",
+ [RXRPC_CALL_CLIENT_SEND_REQUEST] = "ClSndReq",
++ [RXRPC_CALL_CLIENT_AWAIT_ACK] = "ClAwtAck",
+ [RXRPC_CALL_CLIENT_AWAIT_REPLY] = "ClAwtRpl",
+ [RXRPC_CALL_CLIENT_RECV_REPLY] = "ClRcvRpl",
+ [RXRPC_CALL_SERVER_PREALLOC] = "SvPrealc",
+--- a/net/rxrpc/conn_client.c
++++ b/net/rxrpc/conn_client.c
+@@ -449,7 +449,7 @@ static void rxrpc_activate_one_channel(s
+ trace_rxrpc_connect_call(call);
+ call->tx_last_sent = ktime_get_real();
+ rxrpc_start_call_timer(call);
+- rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_SEND_REQUEST);
++ rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_PRE_SEND);
+ wake_up(&call->waitq);
+ }
+
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -181,7 +181,8 @@ void rxrpc_congestion_degrade(struct rxr
+ if (call->cong_ca_state != RXRPC_CA_SLOW_START &&
+ call->cong_ca_state != RXRPC_CA_CONGEST_AVOIDANCE)
+ return;
+- if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_REPLY)
++ if (__rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_ACK ||
++ __rxrpc_call_state(call) == RXRPC_CALL_CLIENT_AWAIT_REPLY)
+ return;
+
+ rtt = ns_to_ktime(call->srtt_us * (NSEC_PER_USEC / 8));
+@@ -359,6 +360,7 @@ static void rxrpc_end_tx_phase(struct rx
+
+ switch (__rxrpc_call_state(call)) {
+ case RXRPC_CALL_CLIENT_SEND_REQUEST:
++ case RXRPC_CALL_CLIENT_AWAIT_ACK:
+ case RXRPC_CALL_CLIENT_AWAIT_REPLY:
+ if (reply_begun) {
+ rxrpc_set_call_state(call, RXRPC_CALL_CLIENT_RECV_REPLY);
+@@ -697,6 +699,7 @@ static void rxrpc_input_data(struct rxrp
+
+ switch (__rxrpc_call_state(call)) {
+ case RXRPC_CALL_CLIENT_SEND_REQUEST:
++ case RXRPC_CALL_CLIENT_AWAIT_ACK:
+ case RXRPC_CALL_CLIENT_AWAIT_REPLY:
+ /* Received data implicitly ACKs all of the request
+ * packets we sent when we're acting as a client.
+@@ -1157,10 +1160,12 @@ static void rxrpc_input_ack(struct rxrpc
+ if (hard_ack + 1 == 0)
+ return rxrpc_proto_abort(call, 0, rxrpc_eproto_ackr_zero);
+
+- /* Ignore ACKs unless we are or have just been transmitting. */
++ /* Ignore ACKs unless we are transmitting or are waiting for
++ * acknowledgement of the packets we've just been transmitting.
++ */
+ switch (__rxrpc_call_state(call)) {
+ case RXRPC_CALL_CLIENT_SEND_REQUEST:
+- case RXRPC_CALL_CLIENT_AWAIT_REPLY:
++ case RXRPC_CALL_CLIENT_AWAIT_ACK:
+ case RXRPC_CALL_SERVER_SEND_REPLY:
+ case RXRPC_CALL_SERVER_AWAIT_ACK:
+ break;
+@@ -1218,7 +1223,17 @@ static void rxrpc_input_ackall(struct rx
+ {
+ struct rxrpc_ack_summary summary = { 0 };
+
+- if (rxrpc_rotate_tx_window(call, call->tx_top, &summary))
++ switch (__rxrpc_call_state(call)) {
++ case RXRPC_CALL_CLIENT_SEND_REQUEST:
++ case RXRPC_CALL_CLIENT_AWAIT_ACK:
++ case RXRPC_CALL_SERVER_SEND_REPLY:
++ case RXRPC_CALL_SERVER_AWAIT_ACK:
++ break;
++ default:
++ return;
++ }
++
++ if (rxrpc_rotate_tx_window(call, call->tx_transmitted, &summary))
+ rxrpc_end_tx_phase(call, false, rxrpc_eproto_unexpected_ackall);
+ }
+
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -366,7 +366,8 @@ reload:
+ if (state >= RXRPC_CALL_COMPLETE)
+ goto maybe_error;
+ ret = -EPROTO;
+- if (state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
++ if (state != RXRPC_CALL_CLIENT_PRE_SEND &&
++ state != RXRPC_CALL_CLIENT_SEND_REQUEST &&
+ state != RXRPC_CALL_SERVER_ACK_REQUEST &&
+ state != RXRPC_CALL_SERVER_SEND_REPLY) {
+ /* Request phase complete for this client call */
--- /dev/null
+From a2f299b4d5510147fa8629a6aba2869bbcc88aea Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:10 +0100
+Subject: rxrpc: Fix double unlock in rxrpc_recvmsg()
+
+From: David Howells <dhowells@redhat.com>
+
+commit a2f299b4d5510147fa8629a6aba2869bbcc88aea upstream.
+
+Fix a double unlock in rxrpc_recvmsg() when dealing with OOB messages.
+
+Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
+Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-4-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/recvmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -470,7 +470,7 @@ try_again:
+ release_sock(&rx->sk);
+ if (ret == -EAGAIN)
+ goto try_again;
+- goto error_no_call;
++ goto error_trace;
+ }
+
+ /* Find the next call and dequeue it if we're not just peeking. If we
--- /dev/null
+From 4b28876e78fd60979afa91fd2ec6ad9cc8b7a6d0 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:09 +0100
+Subject: rxrpc: Fix leak of connection from OOB challenge
+
+From: David Howells <dhowells@redhat.com>
+
+commit 4b28876e78fd60979afa91fd2ec6ad9cc8b7a6d0 upstream.
+
+Fix leak of connection object from OOB challenge queue when response is
+provided by userspace.
+
+Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
+Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-3-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/oob.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/rxrpc/oob.c
++++ b/net/rxrpc/oob.c
+@@ -213,6 +213,11 @@ static int rxrpc_respond_to_oob(struct r
+ break;
+ }
+
++ switch (skb->mark) {
++ case RXRPC_OOB_CHALLENGE:
++ rxrpc_put_connection(sp->chall.conn, rxrpc_conn_put_oob);
++ break;
++ }
+ rxrpc_free_skb(skb, rxrpc_skb_put_oob);
+ return ret;
+ }
--- /dev/null
+From 4bdb9e471f5b1ac9cbe4add5de7ff085a0ec303c Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:17 +0100
+Subject: rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
+
+From: David Howells <dhowells@redhat.com>
+
+commit 4bdb9e471f5b1ac9cbe4add5de7ff085a0ec303c upstream.
+
+Fix rxrpc_recvmsg() to also drop the ref it holds on an already-released
+call if MSG_PEEK is in force (the function holds a ref on the call
+irrespective of whether MSG_PEEK is specified or not).
+
+Fixes: 962fb1f651c2 ("rxrpc: Fix recv-recv race of completed call")
+Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-11-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/recvmsg.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -528,8 +528,7 @@ try_again:
+ if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
+ rxrpc_see_call(call, rxrpc_call_see_already_released);
+ mutex_unlock(&call->user_mutex);
+- if (!(flags & MSG_PEEK))
+- rxrpc_put_call(call, rxrpc_call_put_recvmsg);
++ rxrpc_put_call(call, rxrpc_call_put_recvmsg);
+ goto try_again;
+ }
+
--- /dev/null
+From 092275882aec4a70ba55c3efb66fff947c81656a Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:14 +0100
+Subject: rxrpc: Fix oob challenge leak in cleanup after notification failure
+
+From: David Howells <dhowells@redhat.com>
+
+commit 092275882aec4a70ba55c3efb66fff947c81656a upstream.
+
+Fix rxrpc_notify_socket_oob() to return an indication of failure in the
+event that it failed to queue a packet and fix rxrpc_post_challenge() to
+clean up the connection ref in such an event.
+
+Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
+Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-8-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/ar-internal.h | 4 ++--
+ net/rxrpc/conn_event.c | 9 +++++++--
+ net/rxrpc/oob.c | 7 +++++--
+ 3 files changed, 14 insertions(+), 6 deletions(-)
+
+--- a/net/rxrpc/ar-internal.h
++++ b/net/rxrpc/ar-internal.h
+@@ -1355,9 +1355,9 @@ static inline struct rxrpc_net *rxrpc_ne
+ }
+
+ /*
+- * out_of_band.c
++ * oob.c
+ */
+-void rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb);
++bool rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb);
+ void rxrpc_add_pending_oob(struct rxrpc_sock *rx, struct sk_buff *skb);
+ int rxrpc_sendmsg_oob(struct rxrpc_sock *rx, struct msghdr *msg, size_t len);
+
+--- a/net/rxrpc/conn_event.c
++++ b/net/rxrpc/conn_event.c
+@@ -436,7 +436,7 @@ static bool rxrpc_post_challenge(struct
+ struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+ struct rxrpc_call *call = NULL;
+ struct rxrpc_sock *rx;
+- bool respond = false;
++ bool respond = false, queued = false;
+
+ sp->chall.conn =
+ rxrpc_get_connection(conn, rxrpc_conn_get_challenge_input);
+@@ -472,8 +472,13 @@ static bool rxrpc_post_challenge(struct
+ }
+
+ if (call)
+- rxrpc_notify_socket_oob(call, skb);
++ queued = rxrpc_notify_socket_oob(call, skb);
+ rcu_read_unlock();
++ if (call && !queued) {
++ rxrpc_put_connection(conn, rxrpc_conn_put_challenge_input);
++ sp->chall.conn = NULL;
++ return false;
++ }
+
+ if (!call)
+ rxrpc_post_packet_to_conn(conn, skb);
+--- a/net/rxrpc/oob.c
++++ b/net/rxrpc/oob.c
+@@ -32,11 +32,12 @@ struct rxrpc_oob_params {
+ * Post an out-of-band message for attention by the socket or kernel service
+ * associated with a reference call.
+ */
+-void rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb)
++bool rxrpc_notify_socket_oob(struct rxrpc_call *call, struct sk_buff *skb)
+ {
+ struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+ struct rxrpc_sock *rx;
+ struct sock *sk;
++ bool queued = false;
+
+ rcu_read_lock();
+
+@@ -49,6 +50,7 @@ void rxrpc_notify_socket_oob(struct rxrp
+ skb->skb_mstamp_ns = rx->oob_id_counter++;
+ rxrpc_get_skb(skb, rxrpc_skb_get_post_oob);
+ skb_queue_tail(&rx->recvmsg_oobq, skb);
++ queued = true;
+
+ trace_rxrpc_notify_socket(call->debug_id, sp->hdr.serial);
+ if (rx->app_ops)
+@@ -56,11 +58,12 @@ void rxrpc_notify_socket_oob(struct rxrp
+ }
+
+ spin_unlock_irq(&rx->recvmsg_lock);
+- if (!rx->app_ops && !sock_flag(sk, SOCK_DEAD))
++ if (queued && !rx->app_ops && !sock_flag(sk, SOCK_DEAD))
+ sk->sk_data_ready(sk);
+ }
+
+ rcu_read_unlock();
++ return queued;
+ }
+
+ /*
--- /dev/null
+From 67a0332f442ef07713cd2d9c13d59db0f1c23648 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:15 +0100
+Subject: rxrpc: Fix potential infinite loop in rxrpc_recvmsg()
+
+From: David Howells <dhowells@redhat.com>
+
+commit 67a0332f442ef07713cd2d9c13d59db0f1c23648 upstream.
+
+Fix the wait in rxrpc_recvmsg() also take check the oob queue.
+
+Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
+Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-9-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/recvmsg.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -436,7 +436,8 @@ try_again:
+ return -EAGAIN;
+ }
+
+- if (list_empty(&rx->recvmsg_q)) {
++ if (list_empty(&rx->recvmsg_q) &&
++ skb_queue_empty_lockless(&rx->recvmsg_oobq)) {
+ ret = -EWOULDBLOCK;
+ if (timeo == 0) {
+ call = NULL;
--- /dev/null
+From a5462da5a349fc7f17ad5ebd899380260d03e7ed Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:18 +0100
+Subject: rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate
+
+From: David Howells <dhowells@redhat.com>
+
+commit a5462da5a349fc7f17ad5ebd899380260d03e7ed upstream.
+
+Fix rxrpc_rotate_tx_rotate() to check that there's something in the
+transmission buffer to be rotated before it attempts to rotate anything.
+
+Fixes: b341a0263b1b ("rxrpc: Implement progressive transmission queue struct")
+Link: https://sashiko.dev/#/patchset/20260618134802.2477777-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-12-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/input.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -236,6 +236,9 @@ static bool rxrpc_rotate_tx_window(struc
+ call->acks_lowest_nak = to;
+ }
+
++ if (after(seq, to))
++ return false;
++
+ /* We may have a left over fully-consumed buffer at the front that we
+ * couldn't drop before (rotate_and_keep below).
+ */
--- /dev/null
+From e66f8f32f50116670dbbee5bc9e692cd2cd0c8f8 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:16 +0100
+Subject: rxrpc: Fix socket notification race
+
+From: David Howells <dhowells@redhat.com>
+
+commit e66f8f32f50116670dbbee5bc9e692cd2cd0c8f8 upstream.
+
+There's a race between rxrpc_recvmsg() and rxrpc_notify_socket(), whereby
+the latter's attempt to avoid disabling interrupts and taking the socket's
+recvmsg_lock if the call is already queued may happen simultaneously with
+the former's discarding of a call that has nothing queued.
+
+Fix this by removing the shortcut. Note that this only affects userspace's
+use of AF_RXRPC; the AFS filesystem driver doesn't use the socket queue.
+
+Fixes: 248f219cb8bc ("rxrpc: Rewrite the data and ack handling code")
+Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-10-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/recvmsg.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -27,8 +27,6 @@ void rxrpc_notify_socket(struct rxrpc_ca
+
+ _enter("%d", call->debug_id);
+
+- if (!list_empty(&call->recvmsg_link))
+- return;
+ if (test_bit(RXRPC_CALL_RELEASED, &call->flags)) {
+ rxrpc_see_call(call, rxrpc_call_see_notify_released);
+ return;
--- /dev/null
+From a58e33405acd2584e730c1da72635f822ada6b49 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Wed, 24 Jun 2026 17:38:13 +0100
+Subject: rxrpc: Fix the reception of a reply packet before data transmission
+
+From: David Howells <dhowells@redhat.com>
+
+commit a58e33405acd2584e730c1da72635f822ada6b49 upstream.
+
+Fix rxrpc_receiving_reply() to handle the reception of an apparent reply
+DATA packet before rxrpc has had a chance to send any request DATA packets
+on a client call by checking to see if the call has been exposed yet by
+sending the first packet.
+
+Without this, rxrpc_rotate_tx_window() might oops.
+
+Also fix rxrpc_rotate_tx_window() to handle the Tx queue being empty by
+changing the do...while loop into a while loop, just in case a call is
+abnormally terminated by an early reply before the last request packet is
+transmitted.
+
+Fixes: b341a0263b1b ("rxrpc: Implement progressive transmission queue struct")
+Link: https://sashiko.dev/#/patchset/20260616155749.2125907-1-dhowells%40redhat.com
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260624163819.3017002-7-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/input.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/net/rxrpc/input.c
++++ b/net/rxrpc/input.c
+@@ -251,7 +251,7 @@ static bool rxrpc_rotate_tx_window(struc
+ tq = call->tx_queue;
+ }
+
+- do {
++ while (before_eq(seq, to)) {
+ unsigned int ix = seq - call->tx_qbase;
+
+ _debug("tq=%x seq=%x i=%d f=%x", tq->qbase, seq, ix, tq->bufs[ix]->flags);
+@@ -321,8 +321,7 @@ static bool rxrpc_rotate_tx_window(struc
+ break;
+ }
+ }
+-
+- } while (before_eq(seq, to));
++ }
+
+ if (trace)
+ trace_rxrpc_rack_update(call, summary);
+@@ -397,6 +396,14 @@ static bool rxrpc_receiving_reply(struct
+ trace_rxrpc_timer_can(call, rxrpc_timer_trace_delayed_ack);
+ }
+
++ /* Deal with an apparent reply coming in before we've got the request
++ * queued or transmitted.
++ */
++ if (!test_bit(RXRPC_CALL_EXPOSED, &call->flags)) {
++ rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply);
++ return false;
++ }
++
+ if (!test_bit(RXRPC_CALL_TX_LAST, &call->flags)) {
+ if (!rxrpc_rotate_tx_window(call, top, &summary)) {
+ rxrpc_proto_abort(call, top, rxrpc_eproto_early_reply);
--- /dev/null
+From 107a4cb0d47e735830f852d83970d5c81f8e1e08 Mon Sep 17 00:00:00 2001
+From: David Howells <dhowells@redhat.com>
+Date: Tue, 9 Jun 2026 15:09:07 +0100
+Subject: rxrpc: Fix UAF in rxgk_issue_challenge()
+
+From: David Howells <dhowells@redhat.com>
+
+commit 107a4cb0d47e735830f852d83970d5c81f8e1e08 upstream.
+
+Fix rxgk_issue_challenge() to free the page containing the challenge
+content after invoking the tracepoint as the whdr passed to the tracepoint
+points into the page just freed.
+
+Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
+Reported-by: Marc Dionne <marc.dionne@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260609140911.838677-4-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/rxgk.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/rxrpc/rxgk.c b/net/rxrpc/rxgk.c
+index a1ee102abae1..77a67ace1d24 100644
+--- a/net/rxrpc/rxgk.c
++++ b/net/rxrpc/rxgk.c
+@@ -687,16 +687,17 @@ static int rxgk_issue_challenge(struct rxrpc_connection *conn)
+ ret = do_udp_sendmsg(conn->local->socket, &msg, len);
+ if (ret > 0)
+ rxrpc_peer_mark_tx(conn->peer);
+- __free_page(page);
+
+ if (ret < 0) {
+ trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
+ rxrpc_tx_point_rxgk_challenge);
++ __free_page(page);
+ return -EAGAIN;
+ }
+
+ trace_rxrpc_tx_packet(conn->debug_id, whdr,
+ rxrpc_tx_point_rxgk_challenge);
++ __free_page(page);
+ _leave(" = 0");
+ return 0;
+ }
+--
+2.55.0
+
--- /dev/null
+From 16c8ae9735c5bd7e54dd7478d6348e0fc860842d Mon Sep 17 00:00:00 2001
+From: Jeffrey Altman <jaltman@auristor.com>
+Date: Tue, 9 Jun 2026 15:09:05 +0100
+Subject: rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc
+
+From: Jeffrey Altman <jaltman@auristor.com>
+
+commit 16c8ae9735c5bd7e54dd7478d6348e0fc860842d upstream.
+
+rxrpc_recvmsg_data() calls rxrpc_verify_data() whenever the
+rxrpc_call.rx_dec_buffer is unallocated and assumes that upon
+successful return that rx_dec_buffer must be allocated.
+However, rxrpc_verify_data() does not request an allocation if
+the rxrpc_skb_priv.len is zero.
+
+In addition, failure to allocate rx_dec_buffer will result in a
+call to skb_copy_bits() with a NULL destination which can
+trigger a NULL pointer dereference.
+
+To prevent these issues rxrpc_verify_data() is modified to
+always attempt to allocate the rxrpc_call.rx_dec_buffer if it
+is NULL.
+
+This issue was identified with assistance of a private
+sashiko instance.
+
+Fixes: d2bc90cf6c75cb ("rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg")
+Reported-by: Simon Horman <simon.horman@redhat.com>
+Signed-off-by: Jeffrey Altman <jaltman@auristor.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Jiayuan Chen <jiayuan.chen@linux.dev>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260609140911.838677-2-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/recvmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -161,7 +161,7 @@ static int rxrpc_verify_data(struct rxrp
+ struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
+ int ret;
+
+- if (sp->len > call->rx_dec_bsize) {
++ if (sp->len > call->rx_dec_bsize || !call->rx_dec_buffer) {
+ /* Make sure we can hold a 1412-byte jumbo subpacket and make
+ * sure that the buffer size is aligned to a crypto blocksize.
+ */
--- /dev/null
+From dc175389b18c29a5303ee83169ec653adfae3e17 Mon Sep 17 00:00:00 2001
+From: Li Daming <d4n.for.sec@gmail.com>
+Date: Tue, 9 Jun 2026 15:09:09 +0100
+Subject: rxrpc: serialize kernel accept preallocation with socket teardown
+
+From: Li Daming <d4n.for.sec@gmail.com>
+
+commit dc175389b18c29a5303ee83169ec653adfae3e17 upstream.
+
+rxrpc_kernel_charge_accept() reads rx->backlog without any
+socket/backlog synchronization and passes that raw pointer into
+rxrpc_service_prealloc_one(). A concurrent rxrpc_discard_prealloc()
+sets rx->backlog = NULL and frees the backlog rings, so a kernel
+preallocation worker can keep using a freed struct rxrpc_backlog
+while updating *_backlog_head/tail and array slots.
+
+Serialize the state check and backlog lookup with the socket lock,
+and reject kernel preallocation once teardown has disabled
+listening or discarded the service backlog.
+
+Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests")
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Li Daming <d4n.for.sec@gmail.com>
+Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
+Signed-off-by: David Howells <dhowells@redhat.com>
+cc: Marc Dionne <marc.dionne@auristor.com>
+cc: Jeffrey Altman <jaltman@auristor.com>
+cc: Simon Horman <horms@kernel.org>
+cc: linux-afs@lists.infradead.org
+cc: stable@kernel.org
+Link: https://patch.msgid.link/20260609140911.838677-6-dhowells@redhat.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/rxrpc/call_accept.c | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+--- a/net/rxrpc/call_accept.c
++++ b/net/rxrpc/call_accept.c
+@@ -471,13 +471,26 @@ int rxrpc_kernel_charge_accept(struct so
+ unsigned long user_call_ID, gfp_t gfp,
+ unsigned int debug_id)
+ {
+- struct rxrpc_sock *rx = rxrpc_sk(sock->sk);
+- struct rxrpc_backlog *b = rx->backlog;
++ struct rxrpc_backlog *b;
++ struct rxrpc_sock *rx;
++ struct sock *sk;
++ int ret;
+
+- if (sock->sk->sk_state == RXRPC_CLOSE)
+- return -ESHUTDOWN;
++ sk = sock->sk;
++ rx = rxrpc_sk(sk);
+
+- return rxrpc_service_prealloc_one(rx, b, notify_rx, user_call_ID,
+- gfp, debug_id);
++ lock_sock(sk);
++ if (sk->sk_state != RXRPC_SERVER_LISTENING || !rx->backlog) {
++ ret = -ESHUTDOWN;
++ goto out;
++ }
++
++ b = rx->backlog;
++ ret = rxrpc_service_prealloc_one(rx, b, notify_rx, user_call_ID,
++ gfp, debug_id);
++
++out:
++ release_sock(sk);
++ return ret;
+ }
+ EXPORT_SYMBOL(rxrpc_kernel_charge_accept);
--- /dev/null
+From 061b627ba534230a18ec4d7251562af12325d06a Mon Sep 17 00:00:00 2001
+From: Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
+Date: Tue, 26 May 2026 07:35:09 +0000
+Subject: serial: 8250_omap: clear rx_running on zero-length DMA completes
+
+From: Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
+
+commit 061b627ba534230a18ec4d7251562af12325d06a upstream.
+
+On AM33xx RX DMA only triggers when the FIFO reaches the
+configured threshold (typically 48 bytes). For smaller bursts
+no DMA request is issued and the FIFO is drained by RX timeout.
+
+In this case __dma_rx_do_complete() can legitimately see count == 0.
+
+The current code exits early in this case and does not clear
+dma->rx_running, leaving the DMA state inconsistent. This can
+prevent RX DMA from restarting and may cause
+omap_8250_rx_dma_flush() to fail, marking DMA as broken.
+
+Fix this by clearing dma->rx_running once the DMA transfer has
+completed or been terminated, even if no data was transferred.
+
+Fixes: a5fd8945a478 ("serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
+Reviewed-by: Moteen Shah <m-shah@ti.com>
+Link: https://patch.msgid.link/BE3P281MB55155F2F5795E411F5A65282EE0B2@BE3P281MB5515.DEUP281.PROD.OUTLOOK.COM
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/8250/8250_omap.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -960,11 +960,12 @@ static void __dma_rx_do_complete(struct
+ dev_err(p->port.dev, "teardown incomplete\n");
+ }
+ }
++
++ dma->rx_running = 0;
+ if (!count)
+ goto out;
+ ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
+
+- dma->rx_running = 0;
+ p->port.icount.rx += ret;
+ p->port.icount.buf_overrun += count - ret;
+ out:
--- /dev/null
+From a483b1a91b33b7533280e7c3efd2bc1275caef18 Mon Sep 17 00:00:00 2001
+From: Tapio Reijonen <tapio.reijonen@vaisala.com>
+Date: Mon, 15 Jun 2026 06:38:40 +0000
+Subject: serial: max310x: implement gpio_chip::get_direction()
+
+From: Tapio Reijonen <tapio.reijonen@vaisala.com>
+
+commit a483b1a91b33b7533280e7c3efd2bc1275caef18 upstream.
+
+It's strongly recommended for GPIO drivers to always implement the
+.get_direction() callback - even when the direction is tracked in
+software. The GPIO core emits a warning when the callback is missing
+and a user reads the direction of a line, e.g. via
+/sys/kernel/debug/gpio.
+
+The MAX310X keeps the GPIO direction in the GPIOCFG register (a set bit
+selects output), which the existing direction_input/output callbacks
+already program, so the current direction can be read back directly.
+
+Fixes: f65444187a66 ("serial: New serial driver MAX310X")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com>
+Reviewed-by: Linus Walleij <linusw@kernel.org>
+Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
+Reviewed-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Link: https://patch.msgid.link/20260615-b4-serial-max310x-gpio-get-direction-v2-1-4704ba2b181a@vaisala.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/max310x.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/tty/serial/max310x.c
++++ b/drivers/tty/serial/max310x.c
+@@ -1212,6 +1212,17 @@ static int max310x_gpio_set(struct gpio_
+ return 0;
+ }
+
++static int max310x_gpio_get_direction(struct gpio_chip *chip, unsigned int offset)
++{
++ struct max310x_port *s = gpiochip_get_data(chip);
++ struct uart_port *port = &s->p[offset / 4].port;
++ unsigned int val;
++
++ val = max310x_port_read(port, MAX310X_GPIOCFG_REG);
++
++ return val & BIT(offset % 4) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN;
++}
++
+ static int max310x_gpio_direction_input(struct gpio_chip *chip, unsigned int offset)
+ {
+ struct max310x_port *s = gpiochip_get_data(chip);
+@@ -1421,6 +1432,7 @@ static int max310x_probe(struct device *
+ s->gpio.owner = THIS_MODULE;
+ s->gpio.parent = dev;
+ s->gpio.label = devtype->name;
++ s->gpio.get_direction = max310x_gpio_get_direction;
+ s->gpio.direction_input = max310x_gpio_direction_input;
+ s->gpio.get = max310x_gpio_get;
+ s->gpio.direction_output= max310x_gpio_direction_output;
--- /dev/null
+From 22dd2777e6c180e1c945b00f6d18550979436324 Mon Sep 17 00:00:00 2001
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+Date: Mon, 6 Jul 2026 20:03:32 +0200
+Subject: serial: msm: Disable DMA for kernel console UART
+
+From: Stephan Gerhold <stephan.gerhold@linaro.org>
+
+commit 22dd2777e6c180e1c945b00f6d18550979436324 upstream.
+
+At the moment, concurrent writes from userspace and the kernel to the
+console can trigger a race condition that results in an infinite loop of
+the same messages printed over and over again. This is most likely to
+happen during system startup or shutdown when the init system starts/stops
+a large number of system services that interact with various kernel code.
+
+When userspace writes to the TTY device, the driver initiates an
+asynchronous DMA transfer and releases the port lock. At the same moment,
+the kernel printk path might grab the port lock and re-configure the UART
+controller for PIO, without waiting for the DMA operation to complete. It
+seems like this collision results in zero progress being reported for the
+DMA engine, so the same text is printed to the console over and over again.
+
+For the kernel console, we want a reliable output path that will be
+functional even during crashes etc. So rather than implementing complex
+code to synchronize the kernel console write routines with the userspace
+DMA write routines, simply disable DMA for the console UART instance.
+
+Similar checks exist in many other serial drivers, e.g. 8250_port.c,
+imx.c, sh-sci.c etc.
+
+Cc: stable <stable@kernel.org>
+Fixes: 3a878c430fd6 ("tty: serial: msm: Add TX DMA support")
+Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
+Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
+Link: https://patch.msgid.link/20260706-serial-msm-console-dma-collision-v1-1-3179b8cb1d89@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/msm_serial.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -1228,7 +1228,8 @@ static int msm_startup(struct uart_port
+ data |= MSM_UART_MR1_AUTO_RFR_LEVEL0 & rfr_level;
+ msm_write(port, data, MSM_UART_MR1);
+
+- if (msm_port->is_uartdm) {
++ /* Disable DMA for console to prevent PIO/DMA collisions */
++ if (msm_port->is_uartdm && !uart_console(port)) {
+ msm_request_tx_dma(msm_port, msm_port->uart.mapbase);
+ msm_request_rx_dma(msm_port, msm_port->uart.mapbase);
+ }
iommu-amd-use-maximum-event-log-buffer-size-when-snp.patch
iommu-amd-use-maximum-ppr-log-buffer-size-when-snp-i.patch
af_unix-drop-all-scm-attributes-for-sockmap.patch
+alsa-hda-realtek-add-quirk-for-tongfang-x6xx45xu.patch
+alsa-hda-conexant-remove-mic-bias-threshold-override.patch
+alsa-hda-fix-cached-processing-coefficient-verbs.patch
+alsa-hda-realtek-fix-speakers-on-legion-pro-7-16arx8h-with-codec-ssid-17aa-38a7.patch
+media-uvcvideo-use-hw-timestaming-if-the-clock-buffer-is-full.patch
+media-uvcvideo-avoid-partial-metadata-buffers.patch
+media-uvcvideo-fix-buffer-sequence-in-frame-gaps.patch
+media-uvcvideo-fix-dev_sof-filtering-in-hw-timestamp.patch
+media-uvcvideo-do-not-add-clock-samples-with-small-sof-delta.patch
+media-uvcvideo-relax-the-constrains-for-interpolating-the-hw-clock.patch
+media-uvcvideo-fix-sequence-number-when-no-eof.patch
+dt-bindings-media-sun4i-a10-video-engine-add-interconnect-properties.patch
+dt-bindings-power-imx93-add-mipi-phy-power-domain.patch
+serial-msm-disable-dma-for-kernel-console-uart.patch
+serial-max310x-implement-gpio_chip-get_direction.patch
+serial-8250_omap-clear-rx_running-on-zero-length-dma-completes.patch
+rxrpc-serialize-kernel-accept-preallocation-with-socket-teardown.patch
+rxrpc-rxrpc_verify_data-ensure-rx_dec_buffer-alloc.patch
+rxrpc-don-t-move-a-peeked-oob-message-onto-the-pending-queue.patch
+rxrpc-fix-uaf-in-rxgk_issue_challenge.patch
+rxrpc-fix-socket-notification-race.patch
+rxrpc-fix-leak-of-released-call-in-recvmsg-msg_peek.patch
+rxrpc-fix-potential-infinite-loop-in-rxrpc_recvmsg.patch
+rxrpc-fix-rxrpc_rotate_tx_rotate-to-check-there-s-something-to-rotate.patch
+rxrpc-fix-oob-challenge-leak-in-cleanup-after-notification-failure.patch
+rxrpc-fix-ackall-packet-handling.patch
+rxrpc-fix-the-reception-of-a-reply-packet-before-data-transmission.patch
+rxrpc-fix-leak-of-connection-from-oob-challenge.patch
+rxrpc-fix-double-unlock-in-rxrpc_recvmsg.patch
+afs-fix-netns-teardown-to-cancel-the-preallocation-charger.patch
+afs-fix-null-pointer-dereference-in-afs_get_tree.patch
+afs-handle-cb.initcallbackstate3-requests-without-a-server-record.patch
+afs-fix-further-netns-teardown-to-cancel-the-preallocation-charger.patch
+afs-fix-uncancelled-rxrpc-oob-message-handler.patch
+fbcon-fix-null-pointer-dereference-for-a-console-without-vc_data.patch
+fbcon-use-correct-type-for-vc_resize-return-value.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
