Changelog in Linux kernel 6.18.4

 
af_unix: don't post cmsg for SO_INQ unless explicitly asked for [+ + +]
Author: Jens Axboe <axboe@kernel.dk>
Date:   Thu Dec 18 15:21:28 2025 -0700

    af_unix: don't post cmsg for SO_INQ unless explicitly asked for
    
    commit 4d1442979e4a53b9457ce1e373e187e1511ff688 upstream.
    
    A previous commit added SO_INQ support for AF_UNIX (SOCK_STREAM), but it
    posts a SCM_INQ cmsg even if just msg->msg_get_inq is set. This is
    incorrect, as ->msg_get_inq is just the caller asking for the remainder
    to be passed back in msg->msg_inq, it has nothing to do with cmsg. The
    original commit states that this is done to make sockets
    io_uring-friendly", but it's actually incorrect as io_uring doesn't use
    cmsg headers internally at all, and it's actively wrong as this means
    that cmsg's are always posted if someone does recvmsg via io_uring.
    
    Fix that up by only posting a cmsg if u->recvmsg_inq is set.
    
    Additionally, mirror how TCP handles inquiry handling in that it should
    only be done for a successful return. This makes the logic for the two
    identical.
    
    Cc: stable@vger.kernel.org
    Fixes: df30285b3670 ("af_unix: Introduce SO_INQ.")
    Reported-by: Julian Orth <ju.orth@gmail.com>
    Link: https://github.com/axboe/liburing/issues/1509
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/07adc0c2-2c3b-4d08-8af1-1c466a40b6a8@kernel.dk
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
amd-xgbe: reset retries and mode on RX adapt failures [+ + +]
Author: Raju Rangoju <Raju.Rangoju@amd.com>
Date:   Mon Dec 15 20:47:28 2025 +0530

    amd-xgbe: reset retries and mode on RX adapt failures
    
    [ Upstream commit df60c332caf95d70f967aeace826e7e2f0847361 ]
    
    During the stress tests, early RX adaptation handshakes can fail, such
    as missing the RX_ADAPT ACK or not receiving a coefficient update before
    block lock is established. Continuing to retry RX adaptation in this
    state is often ineffective if the current mode selection is not viable.
    
    Resetting the RX adaptation retry counter when an RX_ADAPT request fails
    to receive ACK or a coefficient update prior to block lock, and clearing
    mode_set so the next bring-up performs a fresh mode selection rather
    than looping on a likely invalid configuration.
    
    Fixes: 4f3b20bfbb75 ("amd-xgbe: add support for rx-adaptation")
    Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
    Link: https://patch.msgid.link/20251215151728.311713-1-Raju.Rangoju@amd.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
arm64: dts: qcom: sm6350: Fix wrong order of freq-table-hz for UFS [+ + +]
Author: Luca Weiss <luca.weiss@fairphone.com>
Date:   Thu Oct 23 13:39:26 2025 +0200

    arm64: dts: qcom: sm6350: Fix wrong order of freq-table-hz for UFS
    
    commit ec9d588391761a08aab5eb4523a48ef3df2c910f upstream.
    
    During upstreaming the order of clocks was adjusted to match the
    upstream sort order, but mistakently freq-table-hz wasn't re-ordered
    with the new order.
    
    Fix that by moving the entry for the ICE clk to the last place.
    
    Fixes: 5a814af5fc22 ("arm64: dts: qcom: sm6350: Add UFS nodes")
    Cc: stable@vger.kernel.org
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
    Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
    Link: https://lore.kernel.org/r/20251023-sm6350-ufs-things-v3-1-b68b74e29d35@fairphone.com
    Signed-off-by: Bjorn Andersson <andersson@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: dts: st: Add memory-region-names property for stm32mp257f-ev1 [+ + +]
Author: Patrice Chotard <patrice.chotard@foss.st.com>
Date:   Fri Oct 31 15:07:03 2025 +0100

    arm64: dts: st: Add memory-region-names property for stm32mp257f-ev1
    
    commit 22f0ae971cf5536349521853737d3e06203286d8 upstream.
    
    In order to set the AMCR register, which configures the
    memory-region split between ospi1 and ospi2, we need to
    identify the ospi instance.
    
    By using memory-region-names, it allows to identify the
    ospi instance this memory-region belongs to.
    
    Fixes: cad2492de91c ("arm64: dts: st: Add SPI NOR flash support on stm32mp257f-ev1 board")
    Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
    Cc: stable@vger.kernel.org
    Link: https://lore.kernel.org/r/20251031-upstream_fix_dts_omm-v4-1-e4a059a50074@foss.st.com
    Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: dts: ti: k3-am62d2-evm: Fix PMIC padconfig [+ + +]
Author: Paresh Bhagat <p-bhagat@ti.com>
Date:   Wed Oct 29 03:06:44 2025 +0530

    arm64: dts: ti: k3-am62d2-evm: Fix PMIC padconfig
    
    commit 394b02210a81c06c4cb879d65ba83d0f1c468c84 upstream.
    
    Fix the PMIC padconfig for AM62D. PMIC's INT pin is connected to the
    SoC's EXTINTn input.
    
    Reference Docs
    Datasheet - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf
    Schematics - https://www.ti.com/lit/zip/sprcal5
    
    Fixes: 1544bca2f188e ("arm64: dts: ti: Add support for AM62D2-EVM")
    Cc: stable@vger.kernel.org
    Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
    Link: https://patch.msgid.link/20251028213645.437957-2-p-bhagat@ti.com
    Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: dts: ti: k3-am62d2-evm: Fix regulator properties [+ + +]
Author: Paresh Bhagat <p-bhagat@ti.com>
Date:   Wed Oct 29 02:31:53 2025 +0530

    arm64: dts: ti: k3-am62d2-evm: Fix regulator properties
    
    commit 0103435072bf5c54bb43d1a9376d08396c825827 upstream.
    
    Fix missing supply for regulators TLV7103318QDSERQ1 and TPS22918DBVR.
    Correct padconfig and gpio for TLV7103318QDSERQ1.
    
    Reference Docs
    Datasheet - https://www.ti.com/lit/ug/sprujd4/sprujd4.pdf
    Schematics - https://www.ti.com/lit/zip/sprcal5
    
    Fixes: 1544bca2f188e ("arm64: dts: ti: Add support for AM62D2-EVM")
    Cc: stable@vger.kernel.org
    Signed-off-by: Paresh Bhagat <p-bhagat@ti.com>
    Reviewed-by: Shree Ramamoorthy <s-ramamoorthy@ti.com>
    Link: https://patch.msgid.link/20251028210153.420473-1-p-bhagat@ti.com
    Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator [+ + +]
Author: Siddharth Vadapalli <s-vadapalli@ti.com>
Date:   Wed Nov 19 21:31:05 2025 +0530

    arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator
    
    commit 51f89c488f2ecc020f82bfedd77482584ce8027a upstream.
    
    The SoC pin Y1 is incorrectly defined in the WKUP Pinmux device-tree node
    (pinctrl@4301c000) leading to the following silent failure:
    
        pinctrl-single 4301c000.pinctrl: mux offset out of range: 0x1dc (0x178)
    
    According to the datasheet for the J721E SoC [0], the pin Y1 belongs to the
    MAIN Pinmux device-tree node (pinctrl@11c000). This is confirmed by the
    address of the pinmux register for it on page 142 of the datasheet which is
    0x00011C1DC.
    
    Hence fix it.
    
    [0]: https://www.ti.com/lit/ds/symlink/tda4vm.pdf
    
    Fixes: 97b67cc102dc ("arm64: dts: ti: k3-j721e-sk: Add DT nodes for power regulators")
    Cc: stable@vger.kernel.org
    Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
    Reviewed-by: Yemike Abhilash Chandra <y-abhilashchandra@ti.com>
    Link: https://patch.msgid.link/20251119160148.2752616-1-s-vadapalli@ti.com
    Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ASoC: codecs: Fix error handling in pm4125 audio codec driver [+ + +]
Author: Ma Ke <make24@iscas.ac.cn>
Date:   Sun Nov 16 11:37:16 2025 +0800

    ASoC: codecs: Fix error handling in pm4125 audio codec driver
    
    commit 2196e8172bee2002e9baaa0d02b2f9f2dd213949 upstream.
    
    pm4125_bind() acquires references through pm4125_sdw_device_get() but
    fails to release them in error paths and during normal unbind
    operations. This could result in reference count leaks, preventing
    proper cleanup and potentially causing resource exhaustion over
    multiple bind/unbind cycles.
    
    Calling path: pm4125_sdw_device_get() -> bus_find_device_by_of_node()
    -> bus_find_device() -> get_device.
    
    Found by code review.
    
    Cc: stable@vger.kernel.org
    Fixes: 8ad529484937 ("ASoC: codecs: add new pm4125 audio codec driver")
    Signed-off-by: Ma Ke <make24@iscas.ac.cn>
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Link: https://patch.msgid.link/20251116033716.29369-1-make24@iscas.ac.cn
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: codecs: lpass-tx-macro: fix SM6115 support [+ + +]
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date:   Fri Oct 31 12:06:58 2025 +0000

    ASoC: codecs: lpass-tx-macro: fix SM6115 support
    
    commit 7c63b5a8ed972a2c8c03d984f6a43349007cea93 upstream.
    
    SM6115 does have soundwire controller in tx. For some reason
    we ended up with this incorrect patch.
    
    Fix this by adding the flag to reflect this in SoC data.
    
    Fixes: 510c46884299 ("ASoC: codecs: lpass-tx-macro: Add SM6115 support")
    Cc: Stable@vger.kernel.org
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    Link: https://patch.msgid.link/20251031120703.590201-2-srinivas.kandagatla@oss.qualcomm.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: codecs: pm4125: Fix potential conflict when probing two devices [+ + +]
Author: Krzysztof Kozlowski <krzk@kernel.org>
Date:   Thu Oct 23 11:02:50 2025 +0200

    ASoC: codecs: pm4125: Fix potential conflict when probing two devices
    
    commit fd94857a934cbe613353810a024c84d54826ead3 upstream.
    
    Qualcomm PM4125 codec is always a single device on the board, however
    nothing stops board designers to have two of them, thus same device
    driver could probe twice.
    
    Device driver is not ready for that case, because it allocates
    statically 'struct regmap_irq_chip' as non-const and stores during
    component bind in 'irq_drv_data' member a pointer to per-probe state
    container ('struct pm4125_priv').
    
    Second component bind would overwrite the 'irq_drv_data' from previous
    device probe, so interrupts would be executed in wrong context.
    
    The fix makes use of currently unused 'struct pm4125_priv' member
    'pm4125_regmap_irq_chip', but renames it to a shorter name.
    
    Fixes: 8ad529484937 ("ASoC: codecs: add new pm4125 audio codec driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Link: https://patch.msgid.link/20251023-asoc-regmap-irq-chip-v1-1-17ad32680913@linaro.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: codecs: pm4125: Remove irq_chip on component unbind [+ + +]
Author: Krzysztof Kozlowski <krzk@kernel.org>
Date:   Thu Oct 23 11:02:51 2025 +0200

    ASoC: codecs: pm4125: Remove irq_chip on component unbind
    
    commit e65b871c9b5af9265aefc5b8cd34993586d93aab upstream.
    
    Component bind uses devm_regmap_add_irq_chip() to add IRQ chip, so it
    will be removed only during driver unbind, not component unbind.
    A component unbind-bind cycle for the same Linux device lifetime would
    result in two chips added.  Fix this by manually removing the IRQ chip
    during component unbind.
    
    Fixes: 8ad529484937 ("ASoC: codecs: add new pm4125 audio codec driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Link: https://patch.msgid.link/20251023-asoc-regmap-irq-chip-v1-2-17ad32680913@linaro.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver [+ + +]
Author: Ma Ke <make24@iscas.ac.cn>
Date:   Sun Nov 16 14:16:23 2025 +0800

    ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver
    
    commit 578ccfe344c5f421c2c6343b872995b397ffd3ff upstream.
    
    In wcd937x_bind(), the driver calls of_sdw_find_device_by_node() to
    obtain references to RX and TX SoundWire devices, which increment the
    device reference counts. However, the corresponding put_device() are
    missing in both the error paths and the normal unbind path in
    wcd937x_unbind().
    
    Add proper error handling with put_device() calls in all error paths
    of wcd937x_bind() and ensure devices are released in wcd937x_unbind().
    
    Found by code review.
    
    Cc: stable@vger.kernel.org
    Fixes: 772ed12bd04e ("ASoC: codecs: wcdxxxx: use of_sdw_find_device_by_node helper")
    Signed-off-by: Ma Ke <make24@iscas.ac.cn>
    Reviewed-by: David Heidelberg <david@ixit.cz>
    Link: https://patch.msgid.link/20251116061623.11830-1-make24@iscas.ac.cn
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: codecs: wcd939x: fix regmap leak on probe failure [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Thu Nov 27 14:50:57 2025 +0100

    ASoC: codecs: wcd939x: fix regmap leak on probe failure
    
    commit 86dc090f737953f16f8dc60c546ae7854690d4f6 upstream.
    
    The soundwire regmap that may be allocated during probe is not freed on
    late probe failures.
    
    Add the missing error handling.
    
    Fixes: be2af391cea0 ("ASoC: codecs: Add WCD939x Soundwire devices driver")
    Cc: stable@vger.kernel.org      # 6.9
    Cc: Neil Armstrong <neil.armstrong@linaro.org>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Link: https://patch.msgid.link/20251127135057.2216-1-johan@kernel.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: cs35l41: Always return 0 when a subsystem ID is found [+ + +]
Author: Eric Naim <dnaim@cachyos.org>
Date:   Sun Dec 7 03:38:12 2025 +0800

    ASoC: cs35l41: Always return 0 when a subsystem ID is found
    
    commit b0ff70e9d4fe46cece25eb97b9b9b0166624af95 upstream.
    
    When trying to get the system name in the _HID path, after successfully
    retrieving the subsystem ID the return value isn't set to 0 but instead
    still kept at -ENODATA, leading to a false negative:
    
    [   12.382507] cs35l41 spi-VLV1776:00: Subsystem ID: VLV1776
    [   12.382521] cs35l41 spi-VLV1776:00: probe with driver cs35l41 failed with error -61
    
    Always return 0 when a subsystem ID is found to mitigate these false
    negatives.
    
    Link: https://github.com/CachyOS/CachyOS-Handheld/issues/83
    Fixes: 46c8b4d2a693 ("ASoC: cs35l41: Fallback to reading Subsystem ID property if not ACPI")
    Cc: stable@vger.kernel.org # 6.18
    Signed-off-by: Eric Naim <dnaim@cachyos.org>
    Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
    Link: https://patch.msgid.link/20251206193813.56955-1-dnaim@cachyos.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: qcom: q6adm: the the copp device only during last instance [+ + +]
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date:   Thu Oct 23 11:24:26 2025 +0100

    ASoC: qcom: q6adm: the the copp device only during last instance
    
    commit 74cc4f3ea4e99262ba0d619c6a4ee33e2cd47f65 upstream.
    
    A matching Common object post processing instance is normally resused
    across multiple streams. However currently we close this on DSP
    even though there is a refcount on this copp object, this can result in
    below error.
    
    q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0
    qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2
    q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2]
    q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: Found Matching Copp 0x0
    qcom-q6adm aprsvc:service:4:8: cmd = 0x10325 return error = 0x2
    q6routing ab00000.remoteproc:glink-edge:apr:service@8:routing: DSP returned error[2]
    qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2
    qcom-q6adm aprsvc:service:4:8: DSP returned error[2]
    qcom-q6adm aprsvc:service:4:8: Failed to close copp -22
    qcom-q6adm aprsvc:service:4:8: cmd = 0x10327 return error = 0x2
    qcom-q6adm aprsvc:service:4:8: DSP returned error[2]
    qcom-q6adm aprsvc:service:4:8: Failed to close copp -22
    
    Fix this by addressing moving the adm_close to copp_kref destructor
    callback.
    
    Fixes: 7b20b2be51e1 ("ASoC: qdsp6: q6adm: Add q6adm driver")
    Cc: Stable@vger.kernel.org
    Reported-by: Martino Facchin <m.facchin@arduino.cc>
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # RB5, RB3
    Link: https://patch.msgid.link/20251023102444.88158-3-srinivas.kandagatla@oss.qualcomm.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr [+ + +]
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date:   Thu Oct 23 11:24:25 2025 +0100

    ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr
    
    commit 950a4e5788fc7dc6e8e93614a7d4d0449c39fb8d upstream.
    
    Driver does not expect the appl_ptr to move backward and requires
    explict sync. Make sure that the userspace does not do appl_ptr rewinds
    by specifying the correct flags in pcm_info.
    
    Without this patch, the result could be a forever loop as current logic assumes
    that appl_ptr can only move forward.
    
    Fixes: 3d4a4411aa8b ("ASoC: q6apm-dai: schedule all available frames to avoid dsp under-runs")
    Cc: Stable@vger.kernel.org
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # RB5, RB3
    Link: https://patch.msgid.link/20251023102444.88158-2-srinivas.kandagatla@oss.qualcomm.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: qcom: q6asm-dai: perform correct state check before closing [+ + +]
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date:   Thu Oct 23 11:24:28 2025 +0100

    ASoC: qcom: q6asm-dai: perform correct state check before closing
    
    commit bfbb12dfa144d45575bcfe139a71360b3ce80237 upstream.
    
    Do not stop a q6asm stream if its not started, this can result in
    unnecessary dsp command which will timeout anyway something like below:
    
    q6asm-dai ab00000.remoteproc:glink-edge:apr:service@7:dais: CMD 10bcd timeout
    
    Fix this by correctly checking the state.
    
    Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver")
    Cc: Stable@vger.kernel.org
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # RB5, RB3
    Link: https://patch.msgid.link/20251023102444.88158-5-srinivas.kandagatla@oss.qualcomm.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. [+ + +]
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date:   Thu Oct 23 11:24:27 2025 +0100

    ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.
    
    commit 81c53b52de21b8d5a3de55ebd06b6bf188bf7efd upstream.
    
    DSP expects the periods to be aligned to fragment sizes, currently
    setting up to hw constriants on periods bytes is not going to work
    correctly as we can endup with periods sizes aligned to 32 bytes however
    not aligned to fragment size.
    
    Update the constriants to use fragment size, and also set at step of
    10ms for period size to accommodate DSP requirements of 10ms latency.
    
    Fixes: 2a9e92d371db ("ASoC: qdsp6: q6asm: Add q6asm dai driver")
    Cc: Stable@vger.kernel.org
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # RB5, RB3
    Link: https://patch.msgid.link/20251023102444.88158-4-srinivas.kandagatla@oss.qualcomm.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime [+ + +]
Author: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Date:   Wed Oct 22 15:33:46 2025 +0100

    ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime
    
    commit bcba17279327c6e85dee6a97014dc642e2dc93cc upstream.
    
    For some reason we endedup allocating sdw_stream_runtime for every cpu dai,
    this has two issues.
    1. we never set snd_soc_dai_set_stream for non soundwire dai, which
       means there is no way that we can free this, resulting in memory leak
    2. startup and shutdown callbacks can be called without
       hw_params callback called. This combination results in memory leak
    because machine driver sruntime array pointer is only set in hw_params
    callback.
    
    Fix this by
     1. adding a helper function to get sdw_runtime for substream
    which can be used by shutdown callback to get hold of sruntime to free.
     2. only allocate sdw_runtime for soundwire dais.
    
    Fixes: d32bac9cb09c ("ASoC: qcom: Add helper for allocating Soundwire stream runtime")
    Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Cc: Stable@vger.kernel.org
    Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
    Tested-by: Steev Klimaszewski <threeway@gmail.com> # Thinkpad X13s
    Link: https://patch.msgid.link/20251022143349.1081513-2-srinivas.kandagatla@oss.qualcomm.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode [+ + +]
Author: Biju Das <biju.das.jz@bp.renesas.com>
Date:   Fri Nov 14 07:37:05 2025 +0000

    ASoC: renesas: rz-ssi: Fix channel swap issue in full duplex mode
    
    commit 52a525011cb8e293799a085436f026f2958403f9 upstream.
    
    The full duplex audio starts with half duplex mode and then switch to
    full duplex mode (another FIFO reset) when both playback/capture
    streams available leading to random audio left/right channel swap
    issue. Fix this channel swap issue by detecting the full duplex
    condition by populating struct dup variable in startup() callback
    and synchronize starting both the play and capture at the same time
    in rz_ssi_start().
    
    Cc: stable@kernel.org
    Fixes: 4f8cd05a4305 ("ASoC: sh: rz-ssi: Add full duplex support")
    Co-developed-by: Tony Tang <tony.tang.ks@renesas.com>
    Signed-off-by: Tony Tang <tony.tang.ks@renesas.com>
    Reviewed-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
    Link: https://patch.msgid.link/20251114073709.4376-2-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width [+ + +]
Author: Biju Das <biju.das.jz@bp.renesas.com>
Date:   Fri Nov 14 07:37:06 2025 +0000

    ASoC: renesas: rz-ssi: Fix rz_ssi_priv::hw_params_cache::sample_width
    
    commit 2bae7beda19f3b2dc6ab2062c94df19c27923712 upstream.
    
    The strm->sample_width is not filled during rz_ssi_dai_hw_params(). This
    wrong value is used for caching sample_width in struct hw_params_cache.
    Fix this issue by replacing 'strm->sample_width'->'params_width(params)'
    in rz_ssi_dai_hw_params(). After this drop the variable sample_width
    from struct rz_ssi_stream as it is unused.
    
    Cc: stable@kernel.org
    Fixes: 4f8cd05a4305 ("ASoC: sh: rz-ssi: Add full duplex support")
    Reviewed-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
    Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
    Link: https://patch.msgid.link/20251114073709.4376-3-biju.das.jz@bp.renesas.com
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: stm32: sai: fix clk prepare imbalance on probe failure [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Nov 24 11:49:06 2025 +0100

    ASoC: stm32: sai: fix clk prepare imbalance on probe failure
    
    commit 312ec2f0d9d1a5656f76d770bbf1d967e9289aa7 upstream.
    
    Make sure to unprepare the parent clock also on probe failures (e.g.
    probe deferral).
    
    Fixes: a14bf98c045b ("ASoC: stm32: sai: fix possible circular locking")
    Cc: stable@vger.kernel.org      # 5.5
    Cc: Olivier Moysan <olivier.moysan@st.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: olivier moysan <olivier.moysan@foss.st.com>
    Link: https://patch.msgid.link/20251124104908.15754-3-johan@kernel.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: stm32: sai: fix device leak on probe [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Nov 24 11:49:05 2025 +0100

    ASoC: stm32: sai: fix device leak on probe
    
    commit e26ff429eaf10c4ef1bc3dabd9bf27eb54b7e1f4 upstream.
    
    Make sure to drop the reference taken when looking up the sync provider
    device and its driver data during DAI probe on probe failures and on
    unbind.
    
    Note that holding a reference to a device does not prevent its driver
    data from going away so there is no point in keeping the reference.
    
    Fixes: 7dd0d835582f ("ASoC: stm32: sai: simplify sync modes management")
    Fixes: 1c3816a19487 ("ASoC: stm32: sai: add missing put_device()")
    Cc: stable@vger.kernel.org      # 4.16: 1c3816a19487
    Cc: olivier moysan <olivier.moysan@st.com>
    Cc: Wen Yang <yellowriver2010@hotmail.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: olivier moysan <olivier.moysan@foss.st.com>
    Link: https://patch.msgid.link/20251124104908.15754-2-johan@kernel.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ASoC: stm32: sai: fix OF node leak on probe [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Nov 24 11:49:07 2025 +0100

    ASoC: stm32: sai: fix OF node leak on probe
    
    commit 23261f0de09427367e99f39f588e31e2856a690e upstream.
    
    The reference taken to the sync provider OF node when probing the
    platform device is currently only dropped if the set_sync() callback
    fails during DAI probe.
    
    Make sure to drop the reference on platform probe failures (e.g. probe
    deferral) and on driver unbind.
    
    This also avoids a potential use-after-free in case the DAI is ever
    reprobed without first rebinding the platform driver.
    
    Fixes: 5914d285f6b7 ("ASoC: stm32: sai: Add synchronization support")
    Fixes: d4180b4c02e7 ("ASoC: stm32: sai: fix set_sync service")
    Cc: Olivier Moysan <olivier.moysan@st.com>
    Cc: stable@vger.kernel.org      # 4.16: d4180b4c02e7
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: olivier moysan <olivier.moysan@foss.st.com>
    Link: https://patch.msgid.link/20251124104908.15754-4-johan@kernel.org
    Signed-off-by: Mark Brown <broonie@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
blk-mq: skip CPU offline notify on unmapped hctx [+ + +]
Author: Cong Zhang <cong.zhang@oss.qualcomm.com>
Date:   Tue Dec 30 17:17:05 2025 +0800

    blk-mq: skip CPU offline notify on unmapped hctx
    
    [ Upstream commit 10845a105bbcb030647a729f1716c2309da71d33 ]
    
    If an hctx has no software ctx mapped, blk_mq_map_swqueue() never
    allocates tags and leaves hctx->tags NULL. The CPU hotplug offline
    notifier can still run for that hctx, return early since hctx cannot
    hold any requests.
    
    Signed-off-by: Cong Zhang <cong.zhang@oss.qualcomm.com>
    Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline")
    Reviewed-by: Ming Lei <ming.lei@redhat.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs [+ + +]
Author: Damien Le Moal <dlemoal@kernel.org>
Date:   Thu Dec 4 19:59:52 2025 +0900

    block: Clear BLK_ZONE_WPLUG_PLUGGED when aborting plugged BIOs
    
    commit 552c1149af7ac0cffab6fccd13feeaf816dd1f53 upstream.
    
    Commit fe0418eb9bd6 ("block: Prevent potential deadlocks in zone write
    plug error recovery") added a WARN check in disk_put_zone_wplug() to
    verify that when the last reference to a zone write plug is dropped,
    this zone write plug does not have the BLK_ZONE_WPLUG_PLUGGED flag set,
    that is, that it is not plugged.
    
    However, the function disk_zone_wplug_abort(), which is called for zone
    reset and zone finish operations, does not clear this flag after
    emptying a zone write plug BIO list. This can result in the
    disk_put_zone_wplug() warning to trigger if the user (erroneously as
    that is bad pratcice) issues zone reset or zone finish operations while
    the target zone still has plugged BIOs.
    
    Modify disk_put_zone_wplug() to clear the BLK_ZONE_WPLUG_PLUGGED flag.
    And while at it, also add a lockdep annotation to ensure that this
    function is called with the zone write plug spinlock held.
    
    Fixes: fe0418eb9bd6 ("block: Prevent potential deadlocks in zone write plug error recovery")
    Cc: stable@vger.kernel.org
    Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Niklas Cassel <cassel@kernel.org>
    Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio() [+ + +]
Author: Damien Le Moal <dlemoal@kernel.org>
Date:   Thu Nov 13 22:40:26 2025 +0900

    block: fix NULL pointer dereference in blk_zone_reset_all_bio_endio()
    
    commit c2b8d20628ca789640f64074a642f9440eefc623 upstream.
    
    For zoned block devices that do not need zone write plugs (e.g. most
    device mapper devices that support zones), the disk hash table of zone
    write plugs is NULL. For such devices, blk_zone_reset_all_bio_endio()
    should not attempt to scan this has table as that causes a NULL pointer
    dereference.
    
    Fix this by checking that the disk does have zone write plugs using the
    atomic counter. This is equivalent to checking for a non-NULL hash table
    but has the advantage to also speed up the execution of
    blk_zone_reset_all_bio_endio() for devices that do use zone write plugs
    but do not have any plug in the hash table (e.g. a disk with only full
    zones).
    
    Fixes: efae226c2ef1 ("block: handle zone management operations completions")
    Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
    Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

block: handle zone management operations completions [+ + +]
Author: Damien Le Moal <dlemoal@kernel.org>
Date:   Wed Nov 5 06:22:35 2025 +0900

    block: handle zone management operations completions
    
    commit efae226c2ef19528ffd81d29ba0eecf1b0896ca2 upstream.
    
    The functions blk_zone_wplug_handle_reset_or_finish() and
    blk_zone_wplug_handle_reset_all() both modify the zone write pointer
    offset of zone write plugs that are the target of a reset, reset all or
    finish zone management operation. However, these functions do this
    modification before the BIO is executed. So if the zone operation fails,
    the modified zone write pointer offsets become invalid.
    
    Avoid this by modifying the zone write pointer offset of a zone write
    plug that is the target of a zone management operation when the
    operation completes. To do so, modify blk_zone_bio_endio() to call the
    new function blk_zone_mgmt_bio_endio() which in turn calls the functions
    blk_zone_reset_all_bio_endio(), blk_zone_reset_bio_endio() or
    blk_zone_finish_bio_endio() depending on the operation of the completed
    BIO, to modify a zone write plug write pointer offset accordingly.
    These functions are called only if the BIO execution was successful.
    
    Fixes: dd291d77cc90 ("block: Introduce zone write plugging")
    Cc: stable@vger.kernel.org
    Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
    Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
    Reviewed-by: Hannes Reinecke <hare@suse.de>
    Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Bluetooth: btusb: revert use of devm_kzalloc in btusb [+ + +]
Author: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Date:   Wed Dec 10 11:02:28 2025 -0500

    Bluetooth: btusb: revert use of devm_kzalloc in btusb
    
    [ Upstream commit 252714f1e8bdd542025b16321c790458014d6880 ]
    
    This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in
    btusb.c file").
    
    In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This
    ties the lifetime of all the btusb data to the binding of a driver to
    one interface, INTF. In a driver that binds to other interfaces, ISOC
    and DIAG, this is an accident waiting to happen.
    
    The issue is revealed in btusb_disconnect(), where calling
    usb_driver_release_interface(&btusb_driver, data->intf) will have devm
    free the data that is also being used by the other interfaces of the
    driver that may not be released yet.
    
    To fix this, revert the use of devm and go back to freeing memory
    explicitly.
    
    Fixes: 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file")
    Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

Bluetooth: MGMT: report BIS capability flags in supported settings [+ + +]
Author: Pauli Virtanen <pav@iki.fi>
Date:   Thu Dec 4 22:40:20 2025 +0200

    Bluetooth: MGMT: report BIS capability flags in supported settings
    
    [ Upstream commit 348240e5fa901d3d4ba8dffa0e2ba9fc7aba93ab ]
    
    MGMT_SETTING_ISO_BROADCASTER and MGMT_SETTING_ISO_RECEIVER flags are
    missing from supported_settings although they are in current_settings.
    
    Report them also in supported_settings to be consistent.
    
    Fixes: ae7533613133 ("Bluetooth: Check for ISO support in controller")
    Signed-off-by: Pauli Virtanen <pav@iki.fi>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
bng_en: update module description [+ + +]
Author: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
Date:   Wed Dec 17 02:47:48 2025 -0800

    bng_en: update module description
    
    [ Upstream commit d5dc28305143f126dc3d8da21e1ad75865b194e2 ]
    
    The Broadcom BCM57708/800G NIC family is branded as ThorUltra.
    Update the driver description accordingly.
    
    Fixes: 74715c4ab0fa0 ("bng_en: Add PCI interface")
    Signed-off-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
    Reviewed-by: Vikas Gupta <vikas.gupta@broadcom.com>
    Reviewed-by: Bhargava Chenna Marreddy <bhargava.marreddy@broadcom.com>
    Link: https://patch.msgid.link/20251217104748.3004706-1-rajashekar.hudumula@broadcom.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
clk: qcom: Fix dependencies of QCS_{DISP,GPU,VIDEO}CC_615 [+ + +]
Author: Nathan Chancellor <nathan@kernel.org>
Date:   Tue Sep 30 11:56:09 2025 -0700

    clk: qcom: Fix dependencies of QCS_{DISP,GPU,VIDEO}CC_615
    
    commit 7ec1ba01ae37897f0ecf6ab0c980378cb8a2f388 upstream.
    
    It is possible to select CONFIG_QCS_{DISP,GPU,VIDEO}CC_615 when
    targeting ARCH=arm, causing a Kconfig warning when selecting
    CONFIG_QCS_GCC_615 without its dependencies, CONFIG_ARM64 or
    CONFIG_COMPILE_TEST.
    
      WARNING: unmet direct dependencies detected for QCS_GCC_615
        Depends on [n]: COMMON_CLK [=y] && COMMON_CLK_QCOM [=m] && (ARM64 || COMPILE_TEST [=n])
        Selected by [m]:
        - QCS_DISPCC_615 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
        - QCS_GPUCC_615 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
        - QCS_VIDEOCC_615 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
    
    Add the same dependency to these configurations to clear up the
    warnings.
    
    Cc: stable@vger.kernel.org
    Fixes: 9b47105f5434 ("clk: qcom: dispcc-qcs615: Add QCS615 display clock controller driver")
    Fixes: f4b5b40805ab ("clk: qcom: gpucc-qcs615: Add QCS615 graphics clock controller driver")
    Fixes: f6a8abe0cc16 ("clk: qcom: videocc-qcs615: Add QCS615 video clock controller driver")
    Signed-off-by: Nathan Chancellor <nathan@kernel.org>
    Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Link: https://lore.kernel.org/r/20250930-clk-qcom-kconfig-fixes-arm-v1-2-15ae1ae9ec9f@kernel.org
    Signed-off-by: Bjorn Andersson <andersson@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

clk: qcom: Fix SM_VIDEOCC_6350 dependencies [+ + +]
Author: Nathan Chancellor <nathan@kernel.org>
Date:   Tue Sep 30 11:56:08 2025 -0700

    clk: qcom: Fix SM_VIDEOCC_6350 dependencies
    
    commit f0691a3f7558d33b5b4a900e8312613fbe4afb9d upstream.
    
    It is possible to select CONFIG_SM_GCC_6350 when targeting ARCH=arm,
    causing a Kconfig warning when selecting CONFIG_SM_GCC_6350 without
    its dependencies, CONFIG_ARM64 or CONFIG_COMPILE_TEST.
    
      WARNING: unmet direct dependencies detected for SM_GCC_6350
        Depends on [n]: COMMON_CLK [=y] && COMMON_CLK_QCOM [=m] && (ARM64 || COMPILE_TEST [=n])
        Selected by [m]:
        - SM_VIDEOCC_6350 [=m] && COMMON_CLK [=y] && COMMON_CLK_QCOM [=m]
    
    Add the same dependency to clear up the warning.
    
    Cc: stable@vger.kernel.org
    Fixes: 720b1e8f2004 ("clk: qcom: Add video clock controller driver for SM6350")
    Signed-off-by: Nathan Chancellor <nathan@kernel.org>
    Reviewed-by: Imran Shaik <imran.shaik@oss.qualcomm.com>
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Link: https://lore.kernel.org/r/20250930-clk-qcom-kconfig-fixes-arm-v1-1-15ae1ae9ec9f@kernel.org
    Signed-off-by: Bjorn Andersson <andersson@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

clk: qcom: mmcc-sdm660: Add missing MDSS reset [+ + +]
Author: Alexey Minnekhanov <alexeymin@postmarketos.org>
Date:   Sun Nov 16 04:12:34 2025 +0300

    clk: qcom: mmcc-sdm660: Add missing MDSS reset
    
    commit 0a0ea5541d30c0fbb3dac975bd1983f299cd6948 upstream.
    
    Add offset for display subsystem reset in multimedia clock controller
    block, which is necessary to reset display when there is some
    configuration in display controller left by previous stock (Android)
    bootloader to provide continuous splash functionaluty.
    
    Before 6.17 power domains were turned off for long enough to clear
    registers, now this is not the case and a proper reset is needed to
    have functioning display.
    
    Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state")
    Cc: stable@vger.kernel.org # 6.17
    Signed-off-by: Alexey Minnekhanov <alexeymin@postmarketos.org>
    Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com>
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Link: https://lore.kernel.org/r/20251116-sdm660-mdss-reset-v2-2-6219bec0a97f@postmarketos.org
    Signed-off-by: Bjorn Andersson <andersson@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

clk: samsung: exynos-clkout: Assign .num before accessing .hws [+ + +]
Author: Nathan Chancellor <nathan@kernel.org>
Date:   Mon Nov 24 12:11:06 2025 -0700

    clk: samsung: exynos-clkout: Assign .num before accessing .hws
    
    commit cf33f0b7df13685234ccea7be7bfe316b60db4db upstream.
    
    Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
    __counted_by") annotated the hws member of 'struct clk_hw_onecell_data'
    with __counted_by, which informs the bounds sanitizer (UBSAN_BOUNDS)
    about the number of elements in .hws[], so that it can warn when .hws[]
    is accessed out of bounds. As noted in that change, the __counted_by
    member must be initialized with the number of elements before the first
    array access happens, otherwise there will be a warning from each access
    prior to the initialization because the number of elements is zero. This
    occurs in exynos_clkout_probe() due to .num being assigned after .hws[]
    has been accessed:
    
      UBSAN: array-index-out-of-bounds in drivers/clk/samsung/clk-exynos-clkout.c:178:18
      index 0 is out of range for type 'clk_hw *[*]'
    
    Move the .num initialization to before the first access of .hws[],
    clearing up the warning.
    
    Cc: stable@vger.kernel.org
    Fixes: f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by")
    Reported-by: Jochen Sprickerhof <jochen@sprickerhof.de>
    Closes: https://lore.kernel.org/aSIYDN5eyKFKoXKL@eldamar.lan/
    Tested-by: Jochen Sprickerhof <jochen@sprickerhof.de>
    Signed-off-by: Nathan Chancellor <nathan@kernel.org>
    Reviewed-by: Kees Cook <kees@kernel.org>
    Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
    Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
    Signed-off-by: Stephen Boyd <sboyd@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
compiler_types.h: add "auto" as a macro for "__auto_type" [+ + +]
Author: H. Peter Anvin <hpa@zytor.com>
Date:   Fri Jul 18 11:35:00 2025 -0700

    compiler_types.h: add "auto" as a macro for "__auto_type"
    
    commit 2fb6915fa22dc5524d704afba58a13305dd9f533 upstream.
    
    "auto" was defined as a keyword back in the K&R days, but as a storage
    type specifier.  No one ever used it, since it was and is the default
    storage type for local variables.
    
    C++11 recycled the keyword to allow a type to be declared based on the
    type of an initializer.  This was finally adopted into standard C in
    C23.
    
    gcc and clang provide the "__auto_type" alias keyword as an extension
    for pre-C23, however, there is no reason to pollute the bulk of the
    source base with this temporary keyword; instead define "auto" as a
    macro unless the compiler is running in C23+ mode.
    
    This macro is added in <linux/compiler_types.h> because that header is
    included in some of the tools headers, wheres <linux/compiler.h> is
    not as it has a bunch of very kernel-specific things in it.
    
    [ Cc: stable to reduce potential backporting burden. ]
    
    Signed-off-by: H. Peter Anvin (Intel) <hpa@zytor.com>
    Acked-by: Miguel Ojeda <ojeda@kernel.org>
    Cc: <stable@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
cpuset: fix warning when disabling remote partition [+ + +]
Author: Chen Ridong <chenridong@huawei.com>
Date:   Thu Dec 18 01:59:50 2025 +0000

    cpuset: fix warning when disabling remote partition
    
    [ Upstream commit aa7d3a56a20f07978d9f401e13637a6479b13bd0 ]
    
    A warning was triggered as follows:
    
    WARNING: kernel/cgroup/cpuset.c:1651 at remote_partition_disable+0xf7/0x110
    RIP: 0010:remote_partition_disable+0xf7/0x110
    RSP: 0018:ffffc90001947d88 EFLAGS: 00000206
    RAX: 0000000000007fff RBX: ffff888103b6e000 RCX: 0000000000006f40
    RDX: 0000000000006f00 RSI: ffffc90001947da8 RDI: ffff888103b6e000
    RBP: ffff888103b6e000 R08: 0000000000000000 R09: 0000000000000000
    R10: 0000000000000001 R11: ffff88810b2e2728 R12: ffffc90001947da8
    R13: 0000000000000000 R14: ffffc90001947da8 R15: ffff8881081f1c00
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f55c8bbe0b2 CR3: 000000010b14c000 CR4: 00000000000006f0
    Call Trace:
     <TASK>
     update_prstate+0x2d3/0x580
     cpuset_partition_write+0x94/0xf0
     kernfs_fop_write_iter+0x147/0x200
     vfs_write+0x35d/0x500
     ksys_write+0x66/0xe0
     do_syscall_64+0x6b/0x390
     entry_SYSCALL_64_after_hwframe+0x4b/0x53
    RIP: 0033:0x7f55c8cd4887
    
    Reproduction steps (on a 16-CPU machine):
    
            # cd /sys/fs/cgroup/
            # mkdir A1
            # echo +cpuset > A1/cgroup.subtree_control
            # echo "0-14" > A1/cpuset.cpus.exclusive
            # mkdir A1/A2
            # echo "0-14" > A1/A2/cpuset.cpus.exclusive
            # echo "root" > A1/A2/cpuset.cpus.partition
            # echo 0 > /sys/devices/system/cpu/cpu15/online
            # echo member > A1/A2/cpuset.cpus.partition
    
    When CPU 15 is offlined, subpartitions_cpus gets cleared because no CPUs
    remain available for the top_cpuset, forcing partitions to share CPUs with
    the top_cpuset. In this scenario, disabling the remote partition triggers
    a warning stating that effective_xcpus is not a subset of
    subpartitions_cpus. Partitions should be invalidated in this case to
    inform users that the partition is now invalid(cpus are shared with
    top_cpuset).
    
    To fix this issue:
    1. Only emit the warning only if subpartitions_cpus is not empty and the
       effective_xcpus is not a subset of subpartitions_cpus.
    2. During the CPU hotplug process, invalidate partitions if
       subpartitions_cpus is empty.
    
    Fixes: f62a5d39368e ("cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition")
    Signed-off-by: Chen Ridong <chenridong@huawei.com>
    Reviewed-by: Waiman Long <longman@redhat.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
crypto: seqiv - Do not use req->iv after crypto_aead_encrypt [+ + +]
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Wed Dec 17 14:15:41 2025 +0800

    crypto: seqiv - Do not use req->iv after crypto_aead_encrypt
    
    [ Upstream commit 50fdb78b7c0bcc550910ef69c0984e751cac72fa ]
    
    As soon as crypto_aead_encrypt is called, the underlying request
    may be freed by an asynchronous completion.  Thus dereferencing
    req->iv after it returns is invalid.
    
    Instead of checking req->iv against info, create a new variable
    unaligned_info and use it for that purpose instead.
    
    Fixes: 0a270321dbf9 ("[CRYPTO] seqiv: Add Sequence Number IV Generator")
    Reported-by: Xiumei Mu <xmu@redhat.com>
    Reported-by: Xin Long <lucien.xin@gmail.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
dm pcache: fix cache info indexing [+ + +]
Author: Li Chen <chenl311@chinatelecom.cn>
Date:   Fri Dec 5 05:46:19 2025 +0000

    dm pcache: fix cache info indexing
    
    commit ee7633178321f5d983db3adfdea9322456cfdaaa upstream.
    
    The on-media cache_info index used sizeof(struct) instead of the
    4K metadata stride, so gc_percent updates from dmsetup message
    were written between slots and lost after reboot. Use
    PCACHE_CACHE_INFO_SIZE in get_cache_info_addr() and align
    info_index with the slot returned by pcache_meta_find_latest().
    
    Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
    Signed-off-by: Dongsheng Yang <dongsheng.yang@linux.dev>
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Reviewed-by: Zheng Gu <cengku@gmail.com>
    Cc: stable@vger.kernel.org      # 6.18
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

dm pcache: fix segment info indexing [+ + +]
Author: Li Chen <chenl311@chinatelecom.cn>
Date:   Fri Dec 5 05:46:20 2025 +0000

    dm pcache: fix segment info indexing
    
    commit 13ea55ea20176736516b20b9ea2d8cf97dbe74f5 upstream.
    
    Segment info indexing also used sizeof(struct) instead of the
    4K metadata stride, so info_index could point between slots and
    subsequent writes would advance incorrectly. Derive info_index
    from the pointer returned by the segment meta search using
    PCACHE_SEG_INFO_SIZE and advance to the next slot for future
    updates.
    
    Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
    Signed-off-by: Dongsheng Yang <dongsheng.yang@linux.dev>
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Reviewed-by: Zheng Gu <cengku@gmail.com>
    Cc: stable@vger.kernel.org      # 6.18
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
dm-bufio: align write boundary on physical block size [+ + +]
Author: Mikulas Patocka <mpatocka@redhat.com>
Date:   Mon Oct 20 14:48:13 2025 +0200

    dm-bufio: align write boundary on physical block size
    
    commit d0ac06ae53be0cdb61f5fe6b62d25d3317c51657 upstream.
    
    There may be devices with physical block size larger than 4k.
    
    If dm-bufio sends I/O that is not aligned on physical block size,
    performance is degraded.
    
    The 4k minimum alignment limit is there because some SSDs report logical
    and physical block size 512 despite having 4k internally - so dm-bufio
    shouldn't send I/Os not aligned on 4k boundary, because they perform
    badly (the SSD does read-modify-write for them).
    
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Reported-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
dm-ebs: Mark full buffer dirty even on partial write [+ + +]
Author: Uladzislau Rezki (Sony) <urezki@gmail.com>
Date:   Mon Nov 17 11:59:45 2025 +0100

    dm-ebs: Mark full buffer dirty even on partial write
    
    commit 7fa3e7d114abc9cc71cc35d768e116641074ddb4 upstream.
    
    When performing a read-modify-write(RMW) operation, any modification
    to a buffered block must cause the entire buffer to be marked dirty.
    
    Marking only a subrange as dirty is incorrect because the underlying
    device block size(ubs) defines the minimum read/write granularity. A
    lower device can perform I/O only on regions which are fully aligned
    and sized to ubs.
    
    This change ensures that write-back operations always occur in full
    ubs-sized chunks, matching the intended emulation semantics of the
    EBS target.
    
    As for user space visible impact, submitting sub-ubs and misaligned
    I/O for devices which are tuned to ubs sizes only, will reject such
    requests, therefore it can lead to losing data. Example:
    
    1) Create a 8K nvme device in qemu by adding
    
    -device nvme,drive=drv0,serial=foo,logical_block_size=8192,physical_block_size=8192
    
    2) Setup dm-ebs to emulate 512B to 8K mapping
    
    urezki@pc638:~/bin$ cat dmsetup.sh
    
    lower=/dev/nvme0n1
    len=$(blockdev --getsz "$lower")
    
    echo "0 $len ebs $lower 0 1 16" | dmsetup create nvme-8k
    urezki@pc638:~/bin$
    
    offset 0, ebs=1 and ubs=16(in sectors).
    
    3) Create an ext4 filesystem(default 4K block size)
    
    urezki@pc638:~/bin$ sudo mkfs.ext4 -F /dev/dm-0
    mke2fs 1.47.0 (5-Feb-2023)
    Discarding device blocks: done
    Creating filesystem with 2072576 4k blocks and 518144 inodes
    Filesystem UUID: bd0b6ca6-0506-4e31-86da-8d22c9d50b63
    Superblock backups stored on blocks:
            32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632
    
    Allocating group tables: done
    Writing inode tables: done
    Creating journal (16384 blocks): done
    Writing superblocks and filesystem accounting information: mkfs.ext4: Input/output error while writing out and closing file system
    urezki@pc638:~/bin$ dmesg
    
    <snip>
    [ 1618.875449] buffer_io_error: 1028 callbacks suppressed
    [ 1618.875456] Buffer I/O error on dev dm-0, logical block 0, lost async page write
    [ 1618.875527] Buffer I/O error on dev dm-0, logical block 1, lost async page write
    [ 1618.875602] Buffer I/O error on dev dm-0, logical block 2, lost async page write
    [ 1618.875620] Buffer I/O error on dev dm-0, logical block 3, lost async page write
    [ 1618.875639] Buffer I/O error on dev dm-0, logical block 4, lost async page write
    [ 1618.894316] Buffer I/O error on dev dm-0, logical block 5, lost async page write
    [ 1618.894358] Buffer I/O error on dev dm-0, logical block 6, lost async page write
    [ 1618.894380] Buffer I/O error on dev dm-0, logical block 7, lost async page write
    [ 1618.894405] Buffer I/O error on dev dm-0, logical block 8, lost async page write
    [ 1618.894427] Buffer I/O error on dev dm-0, logical block 9, lost async page write
    <snip>
    
    Many I/O errors because the lower 8K device rejects sub-ubs/misaligned
    requests.
    
    with a patch:
    
    urezki@pc638:~/bin$ sudo mkfs.ext4 -F /dev/dm-0
    mke2fs 1.47.0 (5-Feb-2023)
    Discarding device blocks: done
    Creating filesystem with 2072576 4k blocks and 518144 inodes
    Filesystem UUID: 9b54f44f-ef55-4bd4-9e40-c8b775a616ac
    Superblock backups stored on blocks:
            32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632
    
    Allocating group tables: done
    Writing inode tables: done
    Creating journal (16384 blocks): done
    Writing superblocks and filesystem accounting information: done
    
    urezki@pc638:~/bin$ sudo mount /dev/dm-0 /mnt/
    urezki@pc638:~/bin$ ls -al /mnt/
    total 24
    drwxr-xr-x  3 root root  4096 Oct 17 15:13 .
    drwxr-xr-x 19 root root  4096 Jul 10 19:42 ..
    drwx------  2 root root 16384 Oct 17 15:13 lost+found
    urezki@pc638:~/bin$
    
    After this change: mkfs completes; mount succeeds.
    
    Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
    Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amd: Fix unbind/rebind for VCN 4.0.5 [+ + +]
Author: Mario Limonciello (AMD) <superm1@kernel.org>
Date:   Mon Dec 8 22:46:46 2025 -0600

    drm/amd: Fix unbind/rebind for VCN 4.0.5
    
    commit 93a01629c8bfd30906c76921ec986802d76920c6 upstream.
    
    Unbinding amdgpu has no problems, but binding it again leads to an
    error of sysfs file already existing.  This is because it wasn't
    actually cleaned up on unbind.  Add the missing cleanup step.
    
    Fixes: 547aad32edac ("drm/amdgpu: add VCN4 ip block support")
    Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit d717e62e9b6ccff0e3cec78a58dfbd00858448b3)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling [+ + +]
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Nov 13 15:55:19 2025 -0500

    drm/amdgpu/gmc11: add amdgpu_vm_handle_fault() handling
    
    commit 3f2289b56cd98f5741056bdb6e521324eff07ce5 upstream.
    
    We need to call amdgpu_vm_handle_fault() on page fault
    on all gfx9 and newer parts to properly update the
    page tables, not just for recoverable page faults.
    
    Cc: stable@vger.kernel.org
    Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling [+ + +]
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Thu Nov 13 15:57:43 2025 -0500

    drm/amdgpu/gmc12: add amdgpu_vm_handle_fault() handling
    
    commit ff28ff98db6a8eeb469e02fb8bd1647b353232a9 upstream.
    
    We need to call amdgpu_vm_handle_fault() on page fault
    on all gfx9 and newer parts to properly update the
    page tables, not just for recoverable page faults.
    
    Cc: stable@vger.kernel.org
    Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdgpu/sdma6: Update SDMA 6.0.3 FW version to include UMQ protected-fence fix [+ + +]
Author: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Date:   Tue Nov 25 21:20:45 2025 +0530

    drm/amdgpu/sdma6: Update SDMA 6.0.3 FW version to include UMQ protected-fence fix
    
    commit c8e7e3c2215e286ebfe66fe828ed426546c519e6 upstream.
    
    On GFX11.0.3, earlier SDMA firmware versions issue the
    PROTECTED_FENCE write from the user VMID (e.g. VMID 8) instead of
    VMID 0. This causes a GPU VM protection fault when SDMA tries to
    write the secure fence location, as seen in the UMQ SDMA test
    (cs-sdma-with-IP-DMA-UMQ)
    
    Fixes the below GPU page fault:
    [  514.037189] amdgpu 0000:0b:00.0: amdgpu: [gfxhub] page fault (src_id:0 ring:40 vmid:8 pasid:32770)
    [  514.037199] amdgpu 0000:0b:00.0: amdgpu:  Process  pid 0 thread  pid 0
    [  514.037205] amdgpu 0000:0b:00.0: amdgpu:   in page starting at address 0x00007fff00409000 from client 10
    [  514.037212] amdgpu 0000:0b:00.0: amdgpu: GCVM_L2_PROTECTION_FAULT_STATUS:0x00841A51
    [  514.037217] amdgpu 0000:0b:00.0: amdgpu:      Faulty UTCL2 client ID: SDMA0 (0xd)
    [  514.037223] amdgpu 0000:0b:00.0: amdgpu:      MORE_FAULTS: 0x1
    [  514.037227] amdgpu 0000:0b:00.0: amdgpu:      WALKER_ERROR: 0x0
    [  514.037232] amdgpu 0000:0b:00.0: amdgpu:      PERMISSION_FAULTS: 0x5
    [  514.037236] amdgpu 0000:0b:00.0: amdgpu:      MAPPING_ERROR: 0x0
    [  514.037241] amdgpu 0000:0b:00.0: amdgpu:      RW: 0x1
    
    v2: Updated commit message
    v3: s/gfx11.0.3/sdma 6.0.3/ in patch title (Alex)
    
    Cc: Alex Deucher <alexander.deucher@amd.com>
    Cc: Christian König <christian.koenig@amd.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma [+ + +]
Author: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Date:   Tue Nov 25 10:48:39 2025 +0100

    drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma
    
    commit 4fa944255be521b1bbd9780383f77206303a3a5c upstream.
    
    Users of ttm entities need to hold the gtt_window_lock before using them
    to guarantee proper ordering of jobs.
    
    Cc: stable@vger.kernel.org
    Fixes: cb5cc4f573e1 ("drm/amdgpu: improve debug VRAM access performance using sdma")
    Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/amdgpu: don't attach the tlb fence for SI [+ + +]
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Dec 2 14:24:03 2025 -0500

    drm/amdgpu: don't attach the tlb fence for SI
    
    commit eb296c09805ee37dd4ea520a7fb3ec157c31090f upstream.
    
    SI hardware doesn't support pasids, user mode queues, or
    KIQ/MES so there is no need for this.  Doing so results in
    a segfault as these callbacks are non-existent for SI.
    
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4744
    Fixes: f3854e04b708 ("drm/amdgpu: attach tlb fence to the PTs update")
    Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit 820b3d376e8a102c6aeab737ec6edebbbb710e04)
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/amdgpu: Forward VMID reservation errors [+ + +]
Author: Natalie Vock <natalie.vock@gmx.de>
Date:   Mon Dec 1 12:52:38 2025 -0500

    drm/amdgpu: Forward VMID reservation errors
    
    commit 8defb4f081a5feccc3ea8372d0c7af3522124e1f upstream.
    
    Otherwise userspace may be fooled into believing it has a reserved VMID
    when in reality it doesn't, ultimately leading to GPU hangs when SPM is
    used.
    
    Fixes: 80e709ee6ecc ("drm/amdgpu: add option params to enforce process isolation between graphics and compute")
    Cc: stable@vger.kernel.org
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Natalie Vock <natalie.vock@gmx.de>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/amdkfd: bump minimum vgpr size for gfx1151 [+ + +]
Author: Jonathan Kim <jonathan.kim@amd.com>
Date:   Fri Dec 5 14:41:08 2025 -0500

    drm/amdkfd: bump minimum vgpr size for gfx1151
    
    commit cf326449637a566ba98fb82c47d46cd479608c88 upstream.
    
    GFX1151 has 1.5x the number of available physical VGPRs per SIMD.
    Bump total memory availability for acquire checks on queue creation.
    
    Signed-off-by: Jonathan Kim <jonathan.kim@amd.com>
    Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit b42f3bf9536c9b710fd1d4deb7d1b0dc819dc72d)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace [+ + +]
Author: Mario Limonciello <mario.limonciello@amd.com>
Date:   Fri Dec 5 12:41:58 2025 -0600

    drm/amdkfd: Export the cwsr_size and ctl_stack_size to userspace
    
    commit 8fc2796dea6f1210e1a01573961d5836a7ce531e upstream.
    
    This is important for userspace to avoid hardcoding VGPR size.
    
    Reviewed-by: Kent Russell <kent.russell@amd.com>
    Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit 71776e0965f9f730af19c5f548827f2a7c91f5a8)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/amdkfd: Trap handler support for expert scheduling mode [+ + +]
Author: Jay Cornwall <jay.cornwall@amd.com>
Date:   Fri Nov 14 14:32:42 2025 -0600

    drm/amdkfd: Trap handler support for expert scheduling mode
    
    commit b7851f8c66191cd23a0a08bd484465ad74bbbb7d upstream.
    
    The trap may be entered with dependency checking disabled.
    Wait for dependency counters and save/restore scheduling mode.
    
    v2:
    
    Use ttmp1 instead of ttmp11. ttmp11 is not zero-initialized.
    While the trap handler does zero this field before use, a user-mode
    second-level trap handler could not rely on this being zero when
    using an older kernel mode driver.
    
    v3:
    
    Use ttmp11 primarily but copy to ttmp1 before jumping to the
    second level trap handler. ttmp1 is inspectable by a debugger.
    Unexpected bits in the unused space may regress existing software.
    
    Signed-off-by: Jay Cornwall <jay.cornwall@amd.com>
    Reviewed-by: Lancelot Six <lancelot.six@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    (cherry picked from commit 423888879412e94725ca2bdccd89414887d98e31)
    Cc: stable@vger.kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/bridge: ti-sn65dsi83: ignore PLL_UNLOCK errors [+ + +]
Author: Luca Ceresoli <luca.ceresoli@bootlin.com>
Date:   Thu Nov 27 09:42:40 2025 +0100

    drm/bridge: ti-sn65dsi83: ignore PLL_UNLOCK errors
    
    commit 35e282c1868de3c9d15f9a8812cbb2e7da06b0c1 upstream.
    
    On hardware based on Toradex Verdin AM62 the recovery mechanism added by
    commit ad5c6ecef27e ("drm: bridge: ti-sn65dsi83: Add error recovery
    mechanism") has been reported [0] to make the display turn on and off and
    and the kernel logging "Unexpected link status 0x01".
    
    According to the report, the error recovery mechanism is triggered by the
    PLL_UNLOCK error going active. Analysis suggested the board is unable to
    provide the correct DSI clock neede by the SN65DSI84, to which the TI
    SN65DSI84 reacts by raising the PLL_UNLOCK, while the display still works
    apparently without issues.
    
    On other hardware, where all the clocks are within the components
    specifications, the PLL_UNLOCK bit does not trigger while the display is in
    normal use. It can trigger for e.g. electromagnetic interference, which is
    a transient event and exactly the reason why the error recovery mechanism
    has been implemented.
    
    Idelly the PLL_UNLOCK bit could be ignored when working out of
    specification, but this requires to detect in software whether it triggers
    because the device is working out of specification but visually correctly
    for the user or for good reasons (e.g. EMI, or even because working out of
    specifications but compromising the visual output).
    
    The ongoing analysis as of this writing [1][2] has not yet found a way for
    the driver to discriminate among the two cases. So as a temporary measure
    mask the PLL_UNLOCK error bit unconditionally.
    
    [0] https://lore.kernel.org/r/bhkn6hley4xrol5o3ytn343h4unkwsr26p6s6ltcwexnrsjsdx@mgkdf6ztow42
    [1] https://lore.kernel.org/all/b71e941c-fc8a-4ac1-9407-0fe7df73b412@gmail.com/
    [2] https://lore.kernel.org/all/20251125103900.31750-1-francesco@dolcini.it/
    
    Fixes: ad5c6ecef27e ("drm: bridge: ti-sn65dsi83: Add error recovery mechanism")
    Closes: https://lore.kernel.org/r/bhkn6hley4xrol5o3ytn343h4unkwsr26p6s6ltcwexnrsjsdx@mgkdf6ztow42
    Cc: stable@vger.kernel.org # 6.15+
    Reported-by: João Paulo Gonçalves <joao.goncalves@toradex.com>
    Tested-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
    Co-developed-by: Hervé Codina <herve.codina@bootlin.com>
    Signed-off-by: Hervé Codina <herve.codina@bootlin.com>
    Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
    Link: https://patch.msgid.link/20251127-drm-ti-sn65dsi83-ignore-pll-unlock-v1-1-8a03fdf562e9@bootlin.com
    Signed-off-by: Maxime Ripard <mripard@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/buddy: Optimize free block management with RB tree [+ + +]
Author: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Date:   Mon Oct 6 15:21:22 2025 +0530

    drm/buddy: Optimize free block management with RB tree
    
    commit c178e534fff1d5a74da80ea03b20e2b948a00113 upstream.
    
    Replace the freelist (O(n)) used for free block management with a
    red-black tree, providing more efficient O(log n) search, insert,
    and delete operations. This improves scalability and performance
    when managing large numbers of free blocks per order (e.g., hundreds
    or thousands).
    
    In the VK-CTS memory stress subtest, the buddy manager merges
    fragmented memory and inserts freed blocks into the freelist. Since
    freelist insertion is O(n), this becomes a bottleneck as fragmentation
    increases. Benchmarking shows list_insert_sorted() consumes ~52.69% CPU
    with the freelist, compared to just 0.03% with the RB tree
    (rbtree_insert.isra.0), despite performing the same sorted insert.
    
    This also improves performance in heavily fragmented workloads,
    such as games or graphics tests that stress memory.
    
    As the buddy allocator evolves with new features such as clear-page
    tracking, the resulting fragmentation and complexity have grown.
    These RB-tree based design changes are introduced to address that
    growth and ensure the allocator continues to perform efficiently
    under fragmented conditions.
    
    The RB tree implementation with separate clear/dirty trees provides:
    - O(n log n) aggregate complexity for all operations instead of O(n^2)
    - Elimination of soft lockups and system instability
    - Improved code maintainability and clarity
    - Better scalability for large memory systems
    - Predictable performance under fragmentation
    
    v3(Matthew):
      - Remove RB_EMPTY_NODE check in force_merge function.
      - Rename rb for loop macros to have less generic names and move to
        .c file.
      - Make the rb node rb and link field as union.
    
    v4(Jani Nikula):
      - The kernel-doc comment should be "/**"
      - Move all the rbtree macros to rbtree.h and add parens to ensure
        correct precedence.
    
    v5:
      - Remove the inline in a .c file (Jani Nikula).
    
    v6(Peter Zijlstra):
      - Add rb_add() function replacing the existing rbtree_insert() code.
    
    v7:
      - A full walk iteration in rbtree is slower than the list (Peter Zijlstra).
      - The existing rbtree_postorder_for_each_entry_safe macro should be used
        in scenarios where traversal order is not a critical factor (Christian).
    
    v8(Matthew):
      - Remove the rbtree_is_empty() check in this patch as well.
    
    Cc: stable@vger.kernel.org
    Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality")
    Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
    Reviewed-by: Matthew Auld <matthew.auld@intel.com>
    Link: https://lore.kernel.org/r/20251006095124.1663-1-Arunpravin.PaneerSelvam@amd.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/buddy: Separate clear and dirty free block trees [+ + +]
Author: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Date:   Mon Oct 6 15:21:23 2025 +0530

    drm/buddy: Separate clear and dirty free block trees
    
    commit d4cd665c98c144dd6ad5d66d30396e13d23118c9 upstream.
    
    Maintain two separate RB trees per order - one for clear (zeroed) blocks
    and another for dirty (uncleared) blocks. This separation improves
    code clarity and makes it more obvious which tree is being searched
    during allocation. It also improves scalability and efficiency when
    searching for a specific type of block, avoiding unnecessary checks
    and making the allocator more predictable under fragmentation.
    
    The changes have been validated using the existing drm_buddy_test
    KUnit test cases, along with selected graphics workloads,
    to ensure correctness and avoid regressions.
    
    v2: Missed adding the suggested-by tag. Added it in v2.
    
    v3(Matthew):
      - Remove the double underscores from the internal functions.
      - Rename the internal functions to have less generic names.
      - Fix the error handling code.
      - Pass tree argument for the tree macro.
      - Use the existing dirty/free bit instead of new tree field.
      - Make free_trees[] instead of clear_tree and dirty_tree for
        more cleaner approach.
    
    v4:
      - A bug was reported by Intel CI and it is fixed by
        Matthew Auld.
      - Replace the get_root function with
        &mm->free_trees[tree][order] (Matthew)
      - Remove the unnecessary rbtree_is_empty() check (Matthew)
      - Remove the unnecessary get_tree_for_flags() function.
      - Rename get_tree_for_block() name with get_block_tree() for more
        clarity.
    
    v5(Jani Nikula):
      - Don't use static inline in .c files.
      - enum free_tree and enumerator names are quite generic for a header
        and usage and the whole enum should be an implementation detail.
    
    v6:
      - Rewrite the __force_merge() function using the rb_last() and rb_prev().
    
    v7(Matthew):
      - Replace the open-coded tree iteration for loops with the
        for_each_free_tree() macro throughout the code.
      - Fixed out_free_roots to prevent double decrement of i,
        addressing potential crash.
      - Replaced enum drm_buddy_free_tree with unsigned int
        in for_each_free_tree loops.
    
    Cc: stable@vger.kernel.org
    Fixes: a68c7eaa7a8f ("drm/amdgpu: Enable clear page functionality")
    Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
    Suggested-by: Matthew Auld <matthew.auld@intel.com>
    Reviewed-by: Matthew Auld <matthew.auld@intel.com>
    Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4260
    Link: https://lore.kernel.org/r/20251006095124.1663-2-Arunpravin.PaneerSelvam@amd.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/displayid: add quirk to ignore DisplayID checksum errors [+ + +]
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Wed Dec 31 11:18:56 2025 -0500

    drm/displayid: add quirk to ignore DisplayID checksum errors
    
    [ Upstream commit 83cbb4d33dc22b0ca1a4e85c6e892c9b729e28d4 ]
    
    Add a mechanism for DisplayID specific quirks, and add the first quirk
    to ignore DisplayID section checksum errors.
    
    It would be quite inconvenient to pass existing EDID quirks from
    drm_edid.c for DisplayID parsing. Not all places doing DisplayID
    iteration have the quirks readily available, and would have to pass it
    in all places. Simply add a separate array of DisplayID specific EDID
    quirks. We do end up checking it every time we iterate DisplayID blocks,
    but hopefully the number of quirks remains small.
    
    There are a few laptop models with DisplayID checksum failures, leading
    to higher refresh rates only present in the DisplayID blocks being
    ignored. Add a quirk for the panel in the machines.
    
    Reported-by: Tiago Martins Araújo <tiago.martins.araujo@gmail.com>
    Closes: https://lore.kernel.org/r/CACRbrPGvLP5LANXuFi6z0S7XMbAG4X5y2YOLBDxfOVtfGGqiKQ@mail.gmail.com
    Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14703
    Acked-by: Alex Deucher <alexander.deucher@amd.com>
    Tested-by: Tiago Martins Araújo <tiago.martins.araujo@gmail.com>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/c04d81ae648c5f21b3f5b7953f924718051f2798.1761681968.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident [+ + +]
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Wed Dec 31 11:18:55 2025 -0500

    drm/edid: add DRM_EDID_IDENT_INIT() to initialize struct drm_edid_ident
    
    [ Upstream commit 8b61583f993589a64c061aa91b44f5bd350d90a5 ]
    
    Add a convenience helper for initializing struct drm_edid_ident.
    
    Cc: Tiago Martins Araújo <tiago.martins.araujo@gmail.com>
    Acked-by: Alex Deucher <alexander.deucher@amd.com>
    Tested-by: Tiago Martins Araújo <tiago.martins.araujo@gmail.com>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/710b2ac6a211606ec1f90afa57b79e8c7375a27e.1761681968.git.jani.nikula@intel.com
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Stable-dep-of: 83cbb4d33dc2 ("drm/displayid: add quirk to ignore DisplayID checksum errors")
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/gem-shmem: Fix the MODULE_LICENSE() string [+ + +]
Author: Thomas Zimmermann <tzimmermann@suse.de>
Date:   Tue Dec 9 14:41:59 2025 +0100

    drm/gem-shmem: Fix the MODULE_LICENSE() string
    
    [ Upstream commit 3fbd97618f49e07e05aad96510e5f2ed22d68809 ]
    
    Replace the bogus "GPL v2" with "GPL" as MODULE_LICNSE() string. The
    value does not declare the module's exact license, but only lets the
    module loader test whether the module is Free Software or not.
    
    See commit bf7fbeeae6db ("module: Cure the MODULE_LICENSE "GPL" vs.
    "GPL v2" bogosity") in the details of the issue. The fix is to use
    "GPL" for all modules under any variant of the GPL.
    
    Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
    Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
    Fixes: 4b2b5e142ff4 ("drm: Move GEM memory managers into modules")
    Link: https://patch.msgid.link/20251209140141.94407-3-tzimmermann@suse.de
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg() [+ + +]
Author: Thomas Zimmermann <tzimmermann@suse.de>
Date:   Mon Sep 29 10:23:23 2025 +0200

    drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()
    
    commit be729f9de6c64240645dc80a24162ac4d3fe00a8 upstream.
    
    Remove psb_fbdev_fb_setcolreg(), which hasn't been called in almost
    a decade.
    
    Gma500 commit 4d8d096e9ae8 ("gma500: introduce the framebuffer support
    code") added the helper psb_fbdev_fb_setcolreg() for setting the fbdev
    palette via fbdev's fb_setcolreg callback. Later
    commit 3da6c2f3b730 ("drm/gma500: use DRM_FB_HELPER_DEFAULT_OPS for
    fb_ops") set several default helpers for fbdev emulation, including
    fb_setcmap.
    
    The fbdev subsystem always prefers fb_setcmap over fb_setcolreg. [1]
    Hence, the gma500 code is no longer in use and gma500 has been using
    drm_fb_helper_setcmap() for several years without issues.
    
    Fixes: 3da6c2f3b730 ("drm/gma500: use DRM_FB_HELPER_DEFAULT_OPS for fb_ops")
    Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
    Cc: Stefan Christ <contact@stefanchrist.eu>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: dri-devel@lists.freedesktop.org
    Cc: <stable@vger.kernel.org> # v4.10+
    Link: https://elixir.bootlin.com/linux/v6.16.9/source/drivers/video/fbdev/core/fbcmap.c#L246 # [1]
    Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
    Acked-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
    Link: https://lore.kernel.org/r/20250929082338.18845-1-tzimmermann@suse.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer [+ + +]
Author: Krzysztof Niemiec <krzysztof.niemiec@intel.com>
Date:   Tue Dec 16 19:09:01 2025 +0100

    drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
    
    commit 4fe2bd195435e71c117983d87f278112c5ab364c upstream.
    
    Initialize the eb.vma array with values of 0 when the eb structure is
    first set up. In particular, this sets the eb->vma[i].vma pointers to
    NULL, simplifying cleanup and getting rid of the bug described below.
    
    During the execution of eb_lookup_vmas(), the eb->vma array is
    successively filled up with struct eb_vma objects. This process includes
    calling eb_add_vma(), which might fail; however, even in the event of
    failure, eb->vma[i].vma is set for the currently processed buffer.
    
    If eb_add_vma() fails, eb_lookup_vmas() returns with an error, which
    prompts a call to eb_release_vmas() to clean up the mess. Since
    eb_lookup_vmas() might fail during processing any (possibly not first)
    buffer, eb_release_vmas() checks whether a buffer's vma is NULL to know
    at what point did the lookup function fail.
    
    In eb_lookup_vmas(), eb->vma[i].vma is set to NULL if either the helper
    function eb_lookup_vma() or eb_validate_vma() fails. eb->vma[i+1].vma is
    set to NULL in case i915_gem_object_userptr_submit_init() fails; the
    current one needs to be cleaned up by eb_release_vmas() at this point,
    so the next one is set. If eb_add_vma() fails, neither the current nor
    the next vma is set to NULL, which is a source of a NULL deref bug
    described in the issue linked in the Closes tag.
    
    When entering eb_lookup_vmas(), the vma pointers are set to the slab
    poison value, instead of NULL. This doesn't matter for the actual
    lookup, since it gets overwritten anyway, however the eb_release_vmas()
    function only recognizes NULL as the stopping value, hence the pointers
    are being set to NULL as they go in case of intermediate failure. This
    patch changes the approach to filling them all with NULL at the start
    instead, rather than handling that manually during failure.
    
    Reported-by: Gangmin Kim <km.kim1503@gmail.com>
    Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15062
    Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf")
    Cc: stable@vger.kernel.org # 5.16.x
    Signed-off-by: Krzysztof Niemiec <krzysztof.niemiec@intel.com>
    Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
    Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com>
    Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
    Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
    Link: https://lore.kernel.org/r/20251216180900.54294-2-krzysztof.niemiec@intel.com
    (cherry picked from commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd)
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/i915: Fix format string truncation warning [+ + +]
Author: Ard Biesheuvel <ardb@kernel.org>
Date:   Fri Dec 5 12:35:01 2025 +0100

    drm/i915: Fix format string truncation warning
    
    commit 1c7f9e528f8f488b060b786bfb90b40540854db3 upstream.
    
    GCC notices that the 16-byte uabi_name field could theoretically be too
    small for the formatted string if the instance number exceeds 100.
    
    So grow the field to 20 bytes.
    
    drivers/gpu/drm/i915/intel_memory_region.c: In function ‘intel_memory_region_create’:
    drivers/gpu/drm/i915/intel_memory_region.c:273:61: error: ‘%u’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 11 [-Werror=format-truncation=]
      273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
          |                                                             ^~
    drivers/gpu/drm/i915/intel_memory_region.c:273:58: note: directive argument in the range [0, 65535]
      273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
          |                                                          ^~~~~~
    drivers/gpu/drm/i915/intel_memory_region.c:273:9: note: ‘snprintf’ output between 7 and 19 bytes into a destination of size 16
      273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
          |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      274 |                  intel_memory_type_str(type), instance);
          |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    Fixes: 3b38d3515753 ("drm/i915: Add stable memory region names")
    Cc: <stable@vger.kernel.org> # v6.8+
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
    Link: https://lore.kernel.org/r/20251205113500.684286-2-ardb@kernel.org
    (cherry picked from commit 18476087f1a18dc279d200d934ad94fba1fb51d5)
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/imagination: Disallow exporting of PM/FW protected objects [+ + +]
Author: Alessio Belle <alessio.belle@imgtec.com>
Date:   Mon Dec 8 09:11:00 2025 +0000

    drm/imagination: Disallow exporting of PM/FW protected objects
    
    commit 6b991ad8dc3abfe5720fc2e9ee96be63ae43e362 upstream.
    
    These objects are meant to be used by the GPU firmware or by the PM unit
    within the GPU, in which case they may contain physical addresses.
    
    This adds a layer of protection against exposing potentially exploitable
    information outside of the driver.
    
    Fixes: ff5f643de0bf ("drm/imagination: Add GEM and VM related code")
    Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251208-no-export-pm-fw-obj-v1-1-83ab12c61693@imgtec.com
    Signed-off-by: Matt Coster <matt.coster@imgtec.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse() [+ + +]
Author: Miaoqian Lin <linmq006@gmail.com>
Date:   Wed Oct 29 15:23:06 2025 +0800

    drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()
    
    commit a846505a193d7492ad3531e33cacfca31e4bcdd1 upstream.
    
    The function mtk_dp_dt_parse() calls of_graph_get_endpoint_by_regs()
    to get the endpoint device node, but fails to call of_node_put() to release
    the reference when the function returns. This results in a device node
    reference leak.
    
    Fix this by adding the missing of_node_put() call before returning from
    the function.
    
    Found via static analysis and code review.
    
    Fixes: f70ac097a2cf ("drm/mediatek: Add MT8195 Embedded DisplayPort driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
    Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com>
    Reviewed-by: CK Hu <ck.hu@mediatek.com>
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20251029072307.10955-1-linmq006@gmail.com/
    Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/mediatek: Fix probe device leaks [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Tue Sep 23 17:23:38 2025 +0200

    drm/mediatek: Fix probe device leaks
    
    commit 2a2a04be8e869a19c9f950b89b1e05832a0f7ec7 upstream.
    
    Make sure to drop the reference taken to each component device during
    probe on probe failure (e.g. probe deferral) and on driver unbind.
    
    Fixes: 6ea6f8276725 ("drm/mediatek: Use correct device pointer to get CMDQ client register")
    Cc: stable@vger.kernel.org      # 5.12
    Cc: Chun-Kuang Hu <chunkuang.hu@kernel.org>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-4-johan@kernel.org/
    Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/mediatek: Fix probe memory leak [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Tue Sep 23 17:23:37 2025 +0200

    drm/mediatek: Fix probe memory leak
    
    commit 5e49200593f331cd0629b5376fab9192f698e8ef upstream.
    
    The Mediatek DRM driver allocates private data for components without a
    platform driver but as the lifetime is tied to each component device,
    the memory is never freed.
    
    Tie the allocation lifetime to the DRM platform device so that the
    memory is released on probe failure (e.g. probe deferral) and when the
    driver is unbound.
    
    Fixes: c0d36de868a6 ("drm/mediatek: Move clk info from struct mtk_ddp_comp to sub driver private data")
    Cc: stable@vger.kernel.org      # 5.12
    Cc: CK Hu <ck.hu@mediatek.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-3-johan@kernel.org/
    Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/mediatek: Fix probe resource leaks [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Tue Sep 23 17:23:36 2025 +0200

    drm/mediatek: Fix probe resource leaks
    
    commit 07c7c640a8eb9e196f357d15d88a59602a947197 upstream.
    
    Make sure to unmap and release the component iomap and clock on probe
    failure (e.g. probe deferral) and on driver unbind.
    
    Note that unlike of_iomap(), devm_of_iomap() also checks whether the
    region is already mapped.
    
    Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
    Cc: stable@vger.kernel.org      # 4.7
    Cc: CK Hu <ck.hu@mediatek.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-2-johan@kernel.org/
    Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/mediatek: mtk_hdmi: Fix probe device leaks [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Tue Sep 23 17:23:39 2025 +0200

    drm/mediatek: mtk_hdmi: Fix probe device leaks
    
    commit 9545bae5c8acd5a47af7add606718d94578bd838 upstream.
    
    Make sure to drop the references to the DDC adapter and CEC device
    taken during probe on probe failure (e.g. probe deferral) and on driver
    unbind.
    
    Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
    Cc: stable@vger.kernel.org      # 4.8
    Cc: Jie Qiu <jie.qiu@mediatek.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-5-johan@kernel.org/
    Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/mediatek: ovl_adaptor: Fix probe device leaks [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Tue Sep 23 17:23:40 2025 +0200

    drm/mediatek: ovl_adaptor: Fix probe device leaks
    
    commit e0f44f74ed6313e50b38eb39a2c7f210ae208db2 upstream.
    
    Make sure to drop the references taken to the component devices by
    of_find_device_by_node() during probe on probe failure (e.g. probe
    deferral) and on driver unbind.
    
    Fixes: 453c3364632a ("drm/mediatek: Add ovl_adaptor support for MT8195")
    Cc: stable@vger.kernel.org      # 6.4
    Cc: Nancy.Lin <nancy.lin@mediatek.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Link: https://patchwork.kernel.org/project/dri-devel/patch/20250923152340.18234-6-johan@kernel.org/
    Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/mgag200: Fix big-endian support [+ + +]
Author: René Rebe <rene@exactco.de>
Date:   Mon Dec 8 14:18:27 2025 +0100

    drm/mgag200: Fix big-endian support
    
    commit 6cb31fba137d45e682ce455b8ea364f44d5d4f98 upstream.
    
    Unlike the original, deleted Matrox mga driver, the new mgag200 driver
    has the XRGB frame-buffer byte swapped on big-endian "RISC"
    systems. Fix by enabling byte swapping "PowerPC" OPMODE for any
    __BIG_ENDIAN config.
    
    Fixes: 414c45310625 ("mgag200: initial g200se driver (v2)")
    Signed-off-by: René Rebe <rene@exactco.de>
    Cc: stable@kernel.org
    Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
    Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
    Link: https://patch.msgid.link/20251208.141827.965103015954471168.rene@exactco.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers [+ + +]
Author: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Date:   Tue Nov 18 14:20:28 2025 +0530

    drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers
    
    commit 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 upstream.
    
    REG_A6XX_GMU_AO_AHB_FENCE_CTRL register falls under GMU's register
    range. So, use gmu_write() routines to write to this register.
    
    Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state")
    Cc: stable@vger.kernel.org
    Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
    Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
    Patchwork: https://patchwork.freedesktop.org/patch/688993/
    Message-ID: <20251118-kaana-gpu-support-v4-1-86eeb8e93fb6@oss.qualcomm.com>
    Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/msm/dpu: Add missing NULL pointer check for pingpong interface [+ + +]
Author: Nikolay Kuratov <kniv@yandex-team.ru>
Date:   Thu Dec 11 12:36:30 2025 +0300

    drm/msm/dpu: Add missing NULL pointer check for pingpong interface
    
    commit 88733a0b64872357e5ecd82b7488121503cb9cc6 upstream.
    
    It is checked almost always in dpu_encoder_phys_wb_setup_ctl(), but in a
    single place the check is missing.
    Also use convenient locals instead of phys_enc->* where available.
    
    Cc: stable@vger.kernel.org
    Fixes: d7d0e73f7de33 ("drm/msm/dpu: introduce the dpu_encoder_phys_* for writeback")
    Signed-off-by: Nikolay Kuratov <kniv@yandex-team.ru>
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Patchwork: https://patchwork.freedesktop.org/patch/693860/
    Link: https://lore.kernel.org/r/20251211093630.171014-1-kniv@yandex-team.ru
    Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/msm: add PERFCTR_CNTL to ifpc_reglist [+ + +]
Author: Anna Maniscalco <anna.maniscalco2000@gmail.com>
Date:   Thu Nov 27 19:22:35 2025 +0100

    drm/msm: add PERFCTR_CNTL to ifpc_reglist
    
    commit 6c6915bfea212d32844b2b7f22bc1aa3669eabc4 upstream.
    
    Previously this register would become 0 after IFPC took place which
    broke all usages of counters.
    
    Fixes: a6a0157cc68e ("drm/msm/a6xx: Enable IFPC on Adreno X1-85")
    Cc: stable@vger.kernel.org
    Signed-off-by: Anna Maniscalco <anna.maniscalco2000@gmail.com>
    Reviewed-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
    Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
    Patchwork: https://patchwork.freedesktop.org/patch/690960/
    Message-ID: <20251127-ifpc_counters-v3-1-fac0a126bc88@gmail.com>
    Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb [+ + +]
Author: Lyude Paul <lyude@redhat.com>
Date:   Thu Dec 11 14:02:54 2025 -0500

    drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb
    
    commit 560271e10b2c86e95ea35afa9e79822e4847f07a upstream.
    
    Since we recently started warning about uses of this function after the
    atomic check phase completes, we've started getting warnings about this in
    nouveau. It appears a misplaced drm_atomic_get_crtc_state() call has been
    hiding in our .prepare_fb callback for a while.
    
    So, fix this by adding a new nv50_head_atom_get_new() function and use that
    in our .prepare_fb callback instead.
    
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files")
    Cc: <stable@vger.kernel.org> # v4.18+
    Link: https://patch.msgid.link/20251211190256.396742-1-lyude@redhat.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/nouveau/gsp: Allocate fwsec-sb at boot [+ + +]
Author: Lyude Paul <lyude@redhat.com>
Date:   Tue Dec 2 12:59:12 2025 -0500

    drm/nouveau/gsp: Allocate fwsec-sb at boot
    
    commit da67179e5538b473a47c87e87cb35b1a7551ad9b upstream.
    
    At the moment - the memory allocation for fwsec-sb is created as-needed and
    is released after being used. Typically this is at some point well after
    driver load, which can cause runtime suspend/resume to initially work on
    driver load but then later fail on a machine that has been running for long
    enough with sufficiently high enough memory pressure:
    
      kworker/7:1: page allocation failure: order:5, mode:0xcc0(GFP_KERNEL),
      nodemask=(null),cpuset=/,mems_allowed=0
      CPU: 7 UID: 0 PID: 875159 Comm: kworker/7:1 Not tainted
      6.17.8-300.fc43.x86_64 #1 PREEMPT(lazy)
      Hardware name: SLIMBOOK Executive/Executive, BIOS N.1.10GRU06 02/02/2024
      Workqueue: pm pm_runtime_work
      Call Trace:
       <TASK>
       dump_stack_lvl+0x5d/0x80
       warn_alloc+0x163/0x190
       ? __alloc_pages_direct_compact+0x1b3/0x220
       __alloc_pages_slowpath.constprop.0+0x57a/0xb10
       __alloc_frozen_pages_noprof+0x334/0x350
       __alloc_pages_noprof+0xe/0x20
       __dma_direct_alloc_pages.isra.0+0x1eb/0x330
       dma_direct_alloc_pages+0x3c/0x190
       dma_alloc_pages+0x29/0x130
       nvkm_firmware_ctor+0x1ae/0x280 [nouveau]
       nvkm_falcon_fw_ctor+0x3e/0x60 [nouveau]
       nvkm_gsp_fwsec+0x10e/0x2c0 [nouveau]
       ? sysvec_apic_timer_interrupt+0xe/0x90
       nvkm_gsp_fwsec_sb+0x27/0x70 [nouveau]
       tu102_gsp_fini+0x65/0x110 [nouveau]
       ? ktime_get+0x3c/0xf0
       nvkm_subdev_fini+0x67/0xc0 [nouveau]
       nvkm_device_fini+0x94/0x140 [nouveau]
       nvkm_udevice_fini+0x50/0x70 [nouveau]
       nvkm_object_fini+0xb1/0x140 [nouveau]
       nvkm_object_fini+0x70/0x140 [nouveau]
       ? __pfx_pci_pm_runtime_suspend+0x10/0x10
       nouveau_do_suspend+0xe4/0x170 [nouveau]
       nouveau_pmops_runtime_suspend+0x3e/0xb0 [nouveau]
       pci_pm_runtime_suspend+0x67/0x1a0
       ? __pfx_pci_pm_runtime_suspend+0x10/0x10
       __rpm_callback+0x45/0x1f0
       ? __pfx_pci_pm_runtime_suspend+0x10/0x10
       rpm_callback+0x6d/0x80
       rpm_suspend+0xe5/0x5e0
       ? finish_task_switch.isra.0+0x99/0x2c0
       pm_runtime_work+0x98/0xb0
       process_one_work+0x18f/0x350
       worker_thread+0x25a/0x3a0
       ? __pfx_worker_thread+0x10/0x10
       kthread+0xf9/0x240
       ? __pfx_kthread+0x10/0x10
       ? __pfx_kthread+0x10/0x10
       ret_from_fork+0xf1/0x110
       ? __pfx_kthread+0x10/0x10
       ret_from_fork_asm+0x1a/0x30
       </TASK>
    
    The reason this happens is because the fwsec-sb firmware image only
    supports being booted from a contiguous coherent sysmem allocation. If a
    system runs into enough memory fragmentation from memory pressure, such as
    what can happen on systems with low amounts of memory, this can lead to a
    situation where it later becomes impossible to find space for a large
    enough contiguous allocation to hold fwsec-sb. This causes us to fail to
    boot the firmware image, causing the GPU to fail booting and causing the
    driver to fail.
    
    Since this firmware can't use non-contiguous allocations, the best solution
    to avoid this issue is to simply allocate the memory for fwsec-sb during
    initial driver-load, and reuse the memory allocation when fwsec-sb needs to
    be used. We then release the memory allocations on driver unload.
    
    Signed-off-by: Lyude Paul <lyude@redhat.com>
    Fixes: 594766ca3e53 ("drm/nouveau/gsp: move booter handling to GPU-specific code")
    Cc: <stable@vger.kernel.org> # v6.16+
    Reviewed-by: Timur Tabi <ttabi@nvidia.com>
    Link: https://patch.msgid.link/20251202175918.63533-1-lyude@redhat.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use [+ + +]
Author: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Date:   Fri Dec 19 12:32:59 2025 +0100

    drm/pagemap, drm/xe: Ensure that the devmem allocation is idle before use
    
    commit 754c23238438600e9236719f7e67aff2c4d02093 upstream.
    
    In situations where no system memory is migrated to devmem, and in
    upcoming patches where another GPU is performing the migration to
    the newly allocated devmem buffer, there is nothing to ensure any
    ongoing clear to the devmem allocation or async eviction from the
    devmem allocation is complete.
    
    Address that by passing a struct dma_fence down to the copy
    functions, and ensure it is waited for before migration is marked
    complete.
    
    v3:
    - New patch.
    v4:
    - Update the logic used for determining when to wait for the
      pre_migrate_fence.
    - Update the logic used for determining when to warn for the
      pre_migrate_fence since the scheduler fences apparently
      can signal out-of-order.
    v5:
    - Fix a UAF (CI)
    - Remove references to source P2P migration (Himal)
    - Put the pre_migrate_fence after migration.
    v6:
    - Pipeline the pre_migrate_fence dependency (Matt Brost)
    
    Fixes: c5b3eb5a906c ("drm/xe: Add GPUSVM device memory copy vfunc functions")
    Cc: Matthew Brost <matthew.brost@intel.com>
    Cc: <stable@vger.kernel.org> # v6.15+
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Reviewed-by: Matthew Brost <matthew.brost@intel.com>
    Acked-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> # For merging through drm-xe.
    Link: https://patch.msgid.link/20251219113320.183860-4-thomas.hellstrom@linux.intel.com
    (cherry picked from commit 16b5ad31952476fb925c401897fc171cd37f536b)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/rockchip: Set VOP for the DRM DMA device [+ + +]
Author: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Date:   Wed Oct 22 19:19:48 2025 +0300

    drm/rockchip: Set VOP for the DRM DMA device
    
    commit 7d7bb790aced3b1b8550b74e02fdfc001d044bee upstream.
    
    Use VOP for DMA operations performed by DRM core. Rockchip DRM driver
    is backed by a virtual device that isn't IOMMU-capable, while VOP is the
    actual display controller device backed by IOMMU. Fixes "swiotlb buffer
    is full" warning messages originated from GEM prime code paths.
    
    Note, that backporting is non-trivial as this depends on
    commit 143ec8d3f9396 ("drm/prime: Support dedicated DMA device for dma-buf
    imports"), which landed in v6.16 and commit 421be3ee36a4 ("drm/rockchip:
    Refactor IOMMU initialisation"), which landed in v5.19.
    
    Reported-by: Daniel Stone <daniels@collabora.com>
    Fixes: 2048e3286f34 ("drm: rockchip: Add basic drm driver")
    Cc: stable@vger.kernel.org # v6.16+
    Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
    Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
    Tested-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Link: https://lore.kernel.org/r/20251022161948.199731-1-dmitry.osipenko@collabora.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/rockchip: vop2: Use OVL_LAYER_SEL configuration instead of use win_mask calculate used layers [+ + +]
Author: Andy Yan <andy.yan@rock-chips.com>
Date:   Wed Nov 12 16:50:23 2025 +0800

    drm/rockchip: vop2: Use OVL_LAYER_SEL configuration instead of use win_mask calculate used layers
    
    commit d3fe9aa495854f8d88c69c41a4b31e69424656ad upstream.
    
    When there are multiple Video Ports, and only one of them is working
    (for example, VP1 is working while VP0 is not), in this case, the
    win_mask of VP0 is 0. However, we have already set the port mux for VP0
    according to vp0->nlayers, and at the same time, in the OVL_LAYER_SEL
    register, there are windows will also be assigned to layers which will
    map to the inactive VPs. In this situation, vp0->win_mask is zero as it
    now working, it is more reliable to calculate the used layers based on
    the configuration of the OVL_LAYER_SEL register.
    
    Note: as the configuration of OVL_LAYER_SEL is take effect when the
    vsync is come, so we use the value backup in vop2->old_layer_sel instead
    of read OVL_LAYER_SEL directly.
    
    Fixes: 3e89a8c68354 ("drm/rockchip: vop2: Fix the update of LAYER/PORT select registers when there are multi display output on rk3588/rk3568")
    Cc: stable@vger.kernel.org
    Reported-by: Diederik de Haas <diederik@cknow-tech.com>
    Closes: https://bugs.kde.org/show_bug.cgi?id=511274
    Signed-off-by: Andy Yan <andy.yan@rock-chips.com>
    Tested-by: Dang Huynh <dang.huynh@mainlining.org>
    Tested-by: Diederik de Haas <diederik@cknow-tech.com>
    Signed-off-by: Heiko Stuebner <heiko@sntech.de>
    Link: https://lore.kernel.org/r/20251112085024.2480111-1-andyshrk@163.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/tilcdc: Fix removal actions in case of failed probe [+ + +]
Author: Kory Maincent (TI.com) <kory.maincent@bootlin.com>
Date:   Tue Nov 25 10:05:44 2025 +0100

    drm/tilcdc: Fix removal actions in case of failed probe
    
    commit a585c7ef9cabda58088916baedc6573e9a5cd2a7 upstream.
    
    The drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers
    should only be called when the device has been successfully registered.
    Currently, these functions are called unconditionally in tilcdc_fini(),
    which causes warnings during probe deferral scenarios.
    
    [    7.972317] WARNING: CPU: 0 PID: 23 at drivers/gpu/drm/drm_atomic_state_helper.c:175 drm_atomic_helper_crtc_duplicate_state+0x60/0x68
    ...
    [    8.005820]  drm_atomic_helper_crtc_duplicate_state from drm_atomic_get_crtc_state+0x68/0x108
    [    8.005858]  drm_atomic_get_crtc_state from drm_atomic_helper_disable_all+0x90/0x1c8
    [    8.005885]  drm_atomic_helper_disable_all from drm_atomic_helper_shutdown+0x90/0x144
    [    8.005911]  drm_atomic_helper_shutdown from tilcdc_fini+0x68/0xf8 [tilcdc]
    [    8.005957]  tilcdc_fini [tilcdc] from tilcdc_pdev_probe+0xb0/0x6d4 [tilcdc]
    
    Fix this by rewriting the failed probe cleanup path using the standard
    goto error handling pattern, which ensures that cleanup functions are
    only called on successfully initialized resources. Additionally, remove
    the now-unnecessary is_registered flag.
    
    Cc: stable@vger.kernel.org
    Fixes: 3c4babae3c4a ("drm: Call drm_atomic_helper_shutdown() at shutdown/remove time for misc drivers")
    Signed-off-by: Kory Maincent (TI.com) <kory.maincent@bootlin.com>
    Reviewed-by: Douglas Anderson <dianders@chromium.org>
    Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
    Signed-off-by: Douglas Anderson <dianders@chromium.org>
    Link: https://patch.msgid.link/20251125090546.137193-1-kory.maincent@bootlin.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/ttm: Avoid NULL pointer deref for evicted BOs [+ + +]
Author: Simon Richter <Simon.Richter@hogyros.de>
Date:   Tue Oct 14 01:11:33 2025 +0900

    drm/ttm: Avoid NULL pointer deref for evicted BOs
    
    commit 491adc6a0f9903c32b05f284df1148de39e8e644 upstream.
    
    It is possible for a BO to exist that is not currently associated with a
    resource, e.g. because it has been evicted.
    
    When devcoredump tries to read the contents of all BOs for dumping, we need
    to expect this as well -- in this case, ENODATA is recorded instead of the
    buffer contents.
    
    Fixes: 7d08df5d0bd3 ("drm/ttm: Add ttm_bo_access")
    Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2")
    Cc: stable <stable@kernel.org>
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6271
    Signed-off-by: Simon Richter <Simon.Richter@hogyros.de>
    Reviewed-by: Matthew Brost <matthew.brost@intel.com>
    Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Matthew Brost <matthew.brost@intel.com>
    Link: https://patch.msgid.link/20251013161241.709916-1-Simon.Richter@hogyros.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table [+ + +]
Author: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Date:   Tue Dec 9 21:49:20 2025 +0100

    drm/xe/bo: Don't include the CCS metadata in the dma-buf sg-table
    
    commit 449bcd5d45eb4ce26740f11f8601082fe734bed2 upstream.
    
    Some Xe bos are allocated with extra backing-store for the CCS
    metadata. It's never been the intention to share the CCS metadata
    when exporting such bos as dma-buf. Don't include it in the
    dma-buf sg-table.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
    Cc: Matthew Brost <matthew.brost@intel.com>
    Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
    Cc: <stable@vger.kernel.org> # v6.8+
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Reviewed-by: Matthew Brost <matthew.brost@intel.com>
    Reviewed-by: Karol Wachowski <karol.wachowski@linux.intel.com>
    Link: https://patch.msgid.link/20251209204920.224374-1-thomas.hellstrom@linux.intel.com
    (cherry picked from commit a4ebfb9d95d78a12512b435a698ee6886d712571)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/xe/eustall: Disallow 0 EU stall property values [+ + +]
Author: Ashutosh Dixit <ashutosh.dixit@intel.com>
Date:   Thu Dec 11 22:18:50 2025 -0800

    drm/xe/eustall: Disallow 0 EU stall property values
    
    commit 3767ca4166ad42fa9e34269efeaf9f15995cd92d upstream.
    
    An EU stall property value of 0 is invalid and will cause a NPD.
    
    Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6453
    Fixes: 1537ec85ebd7 ("drm/xe/uapi: Introduce API for EU stall sampling")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
    Reviewed-by: Harish Chegondi <harish.chegondi@intel.com>
    Link: https://patch.msgid.link/20251212061850.1565459-4-ashutosh.dixit@intel.com
    (cherry picked from commit 5bf763e908bf795da4ad538d21c1ec41f8021f76)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/xe/guc: READ/WRITE_ONCE g2h_fence->done [+ + +]
Author: Jonathan Cavitt <jonathan.cavitt@intel.com>
Date:   Mon Dec 22 20:19:59 2025 +0000

    drm/xe/guc: READ/WRITE_ONCE g2h_fence->done
    
    [ Upstream commit bed2a6bd20681aacfb063015c1edfab6f58a333e ]
    
    Use READ_ONCE and WRITE_ONCE when operating on g2h_fence->done
    to prevent the compiler from ignoring important modifications
    to its value.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Suggested-by: Matthew Brost <matthew.brost@intel.com>
    Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
    Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
    Reviewed-by: Matthew Brost <matthew.brost@intel.com>
    Link: https://patch.msgid.link/20251222201957.63245-5-jonathan.cavitt@intel.com
    Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
    (cherry picked from commit b5179dbd1c14743ae80f0aaa28eaaf35c361608f)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
drm/xe/oa: Disallow 0 OA property values [+ + +]
Author: Ashutosh Dixit <ashutosh.dixit@intel.com>
Date:   Thu Dec 11 22:18:49 2025 -0800

    drm/xe/oa: Disallow 0 OA property values
    
    commit 3595114bc31d1eb5e1996164c901485c1ffac6f7 upstream.
    
    An OA property value of 0 is invalid and will cause a NPD.
    
    Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6452
    Fixes: cc4e6994d5a2 ("drm/xe/oa: Move functions up so they can be reused for config ioctl")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
    Reviewed-by: Harish Chegondi <harish.chegondi@intel.com>
    Link: https://patch.msgid.link/20251212061850.1565459-3-ashutosh.dixit@intel.com
    (cherry picked from commit 7a100e6ddcc47c1f6ba7a19402de86ce24790621)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() [+ + +]
Author: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
Date:   Tue Nov 18 17:19:00 2025 +0530

    drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl()
    
    commit dcb171931954c51a1a7250d558f02b8f36570783 upstream.
    
    In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping
    metrics_lock. Since this lock protects the lifetime of oa_config, an
    attacker could guess the id and call xe_oa_remove_config_ioctl() with
    perfect timing, freeing oa_config before we dereference it, leading to
    a potential use-after-free.
    
    Fix this by caching the id in a local variable while holding the lock.
    
    v2: (Matt A)
    - Dropped mutex_unlock(&oa->metrics_lock) ordering change from
      xe_oa_remove_config_ioctl()
    
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6614
    Fixes: cdf02fe1a94a7 ("drm/xe/oa/uapi: Add/remove OA config perf ops")
    Cc: <stable@vger.kernel.org> # v6.11+
    Suggested-by: Matthew Auld <matthew.auld@intel.com>
    Signed-off-by: Sanjay Yadav <sanjay.kumar.yadav@intel.com>
    Reviewed-by: Matthew Auld <matthew.auld@intel.com>
    Signed-off-by: Matthew Auld <matthew.auld@intel.com>
    Link: https://patch.msgid.link/20251118114859.3379952-2-sanjay.kumar.yadav@intel.com
    (cherry picked from commit 28aeaed130e8e587fd1b73b6d66ca41ccc5a1a31)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/xe/svm: Fix a debug printout [+ + +]
Author: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Date:   Fri Dec 19 12:32:57 2025 +0100

    drm/xe/svm: Fix a debug printout
    
    commit d2d7f5636f0d752a1e0e7eadbbc1839c29177bba upstream.
    
    Avoid spamming the log with drm_info(). Use drm_dbg() instead.
    
    Fixes: cc795e041034 ("drm/xe/svm: Make xe_svm_range_needs_migrate_to_vram() public")
    Cc: Matthew Brost <matthew.brost@intel.com>
    Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
    Cc: <stable@vger.kernel.org> # v6.17+
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
    Link: https://patch.msgid.link/20251219113320.183860-2-thomas.hellstrom@linux.intel.com
    (cherry picked from commit 72aee5f70ba47b939345a0d3414b51b0639c5b88)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm/xe: Adjust long-running workload timeslices to reasonable values [+ + +]
Author: Matthew Brost <matthew.brost@intel.com>
Date:   Fri Dec 12 10:28:41 2025 -0800

    drm/xe: Adjust long-running workload timeslices to reasonable values
    
    commit 6f0f404bd289d79a260b634c5b3f4d330b13472c upstream.
    
    A 10ms timeslice for long-running workloads is far too long and causes
    significant jitter in benchmarks when the system is shared. Adjust the
    value to 5ms for preempt-fencing VMs, as the resume step there is quite
    costly as memory is moved around, and set it to zero for pagefault VMs,
    since switching back to pagefault mode after dma-fence mode is
    relatively fast.
    
    Also change min_run_period_ms to 'unsiged int' type rather than 's64' as
    only positive values make sense.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Matthew Brost <matthew.brost@intel.com>
    Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Link: https://patch.msgid.link/20251212182847.1683222-2-matthew.brost@intel.com
    (cherry picked from commit 33a5abd9a68394aa67f9618b20eee65ee8702ff4)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/xe: Drop preempt-fences when destroying imported dma-bufs. [+ + +]
Author: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Date:   Wed Dec 17 10:34:41 2025 +0100

    drm/xe: Drop preempt-fences when destroying imported dma-bufs.
    
    commit fe3ccd24138fd391ae8e32289d492c85f67770fc upstream.
    
    When imported dma-bufs are destroyed, TTM is not fully
    individualizing the dma-resv, but it *is* copying the fences that
    need to be waited for before declaring idle. So in the case where
    the bo->resv != bo->_resv we can still drop the preempt-fences, but
    make sure we do that on bo->_resv which contains the fence-pointer
    copy.
    
    In the case where the copying fails, bo->_resv will typically not
    contain any fences pointers at all, so there will be nothing to
    drop. In that case, TTM would have ensured all fences that would
    have been copied are signaled, including any remaining preempt
    fences.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Fixes: fa0af721bd1f ("drm/ttm: test private resv obj on release/destroy")
    Cc: Matthew Brost <matthew.brost@intel.com>
    Cc: <stable@vger.kernel.org> # v6.16+
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Tested-by: Matthew Brost <matthew.brost@intel.com>
    Reviewed-by: Matthew Brost <matthew.brost@intel.com>
    Link: https://patch.msgid.link/20251217093441.5073-1-thomas.hellstrom@linux.intel.com
    (cherry picked from commit 425fe550fb513b567bd6d01f397d274092a9c274)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/xe: Use usleep_range for accurate long-running workload timeslicing [+ + +]
Author: Matthew Brost <matthew.brost@intel.com>
Date:   Fri Dec 12 10:28:42 2025 -0800

    drm/xe: Use usleep_range for accurate long-running workload timeslicing
    
    commit 80f9c601d9c4d26f00356c0a9c461650e7089273 upstream.
    
    msleep is not very accurate in terms of how long it actually sleeps,
    whereas usleep_range is precise. Replace the timeslice sleep for
    long-running workloads with the more accurate usleep_range to avoid
    jitter if the sleep period is less than 20ms.
    
    Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Matthew Brost <matthew.brost@intel.com>
    Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Link: https://patch.msgid.link/20251212182847.1683222-3-matthew.brost@intel.com
    (cherry picked from commit ca415c4d4c17ad676a2c8981e1fcc432221dce79)
    Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
drm: Fix object leak in DRM_IOCTL_GEM_CHANGE_HANDLE [+ + +]
Author: Karol Wachowski <karol.wachowski@linux.intel.com>
Date:   Fri Dec 12 14:41:33 2025 +0100

    drm: Fix object leak in DRM_IOCTL_GEM_CHANGE_HANDLE
    
    commit 630efee9493cf64ff7b9a1652978807fef385fdd upstream.
    
    Add missing drm_gem_object_put() call when drm_gem_object_lookup()
    successfully returns an object. This fixes a GEM object reference
    leak that can prevent driver modules from unloading when using
    prime buffers.
    
    Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle")
    Cc: <stable@vger.kernel.org> # v6.18+
    Signed-off-by: Karol Wachowski <karol.wachowski@linux.intel.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Link: https://lore.kernel.org/r/20251212134133.475218-1-karol.wachowski@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm: nova: depend on CONFIG_64BIT [+ + +]
Author: Danilo Krummrich <dakr@kernel.org>
Date:   Tue Oct 28 12:00:52 2025 +0100

    drm: nova: depend on CONFIG_64BIT
    
    commit ba1b40ed0e34bab597fd90d4c4e9f7397f878c8f upstream.
    
    nova-core already depends on CONFIG_64BIT, hence also depend on
    CONFIG_64BIT for nova-drm.
    
    Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
    Reviewed-by: John Hubbard <jhubbard@nvidia.com>
    Link: https://patch.msgid.link/20251028110058.340320-1-dakr@kernel.org
    Signed-off-by: Danilo Krummrich <dakr@kernel.org>
    Cc: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
e1000: fix OOB in e1000_tbi_should_accept() [+ + +]
Author: Guangshuo Li <lgs201920130244@gmail.com>
Date:   Mon Dec 1 11:40:58 2025 +0800

    e1000: fix OOB in e1000_tbi_should_accept()
    
    commit 9c72a5182ed92904d01057f208c390a303f00a0f upstream.
    
    In e1000_tbi_should_accept() we read the last byte of the frame via
    'data[length - 1]' to evaluate the TBI workaround. If the descriptor-
    reported length is zero or larger than the actual RX buffer size, this
    read goes out of bounds and can hit unrelated slab objects. The issue
    is observed from the NAPI receive path (e1000_clean_rx_irq):
    
    ==================================================================
    BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790
    Read of size 1 at addr ffff888014114e54 by task sshd/363
    
    CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
    Call Trace:
     <IRQ>
     dump_stack_lvl+0x5a/0x74
     print_address_description+0x7b/0x440
     print_report+0x101/0x200
     kasan_report+0xc1/0xf0
     e1000_tbi_should_accept+0x610/0x790
     e1000_clean_rx_irq+0xa8c/0x1110
     e1000_clean+0xde2/0x3c10
     __napi_poll+0x98/0x380
     net_rx_action+0x491/0xa20
     __do_softirq+0x2c9/0x61d
     do_softirq+0xd1/0x120
     </IRQ>
     <TASK>
     __local_bh_enable_ip+0xfe/0x130
     ip_finish_output2+0x7d5/0xb00
     __ip_queue_xmit+0xe24/0x1ab0
     __tcp_transmit_skb+0x1bcb/0x3340
     tcp_write_xmit+0x175d/0x6bd0
     __tcp_push_pending_frames+0x7b/0x280
     tcp_sendmsg_locked+0x2e4f/0x32d0
     tcp_sendmsg+0x24/0x40
     sock_write_iter+0x322/0x430
     vfs_write+0x56c/0xa60
     ksys_write+0xd1/0x190
     do_syscall_64+0x43/0x90
     entry_SYSCALL_64_after_hwframe+0x44/0xae
    RIP: 0033:0x7f511b476b10
    Code: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24
    RSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
    RAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10
    RDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003
    RBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00
    R10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000
    R13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003
     </TASK>
    Allocated by task 1:
     __kasan_krealloc+0x131/0x1c0
     krealloc+0x90/0xc0
     add_sysfs_param+0xcb/0x8a0
     kernel_add_sysfs_param+0x81/0xd4
     param_sysfs_builtin+0x138/0x1a6
     param_sysfs_init+0x57/0x5b
     do_one_initcall+0x104/0x250
     do_initcall_level+0x102/0x132
     do_initcalls+0x46/0x74
     kernel_init_freeable+0x28f/0x393
     kernel_init+0x14/0x1a0
     ret_from_fork+0x22/0x30
    The buggy address belongs to the object at ffff888014114000
     which belongs to the cache kmalloc-2k of size 2048
    The buggy address is located 1620 bytes to the right of
     2048-byte region [ffff888014114000, ffff888014114800]
    The buggy address belongs to the physical page:
    page:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110
    head:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0
    flags: 0x100000000010200(slab|head|node=0|zone=1)
    raw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000
    raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected
    ==================================================================
    
    This happens because the TBI check unconditionally dereferences the last
    byte without validating the reported length first:
    
            u8 last_byte = *(data + length - 1);
    
    Fix by rejecting the frame early if the length is zero, or if it exceeds
    adapter->rx_buffer_len. This preserves the TBI workaround semantics for
    valid frames and prevents touching memory beyond the RX buffer.
    
    Fixes: 2037110c96d5 ("e1000: move tbi workaround code into helper function")
    Cc: stable@vger.kernel.org
    Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
erofs: fix unexpected EIO under memory pressure [+ + +]
Author: Junbeom Yeom <junbeom.yeom@samsung.com>
Date:   Fri Dec 19 21:40:31 2025 +0900

    erofs: fix unexpected EIO under memory pressure
    
    commit 4012d78562193ef5eb613bad4b0c0fa187637cfe upstream.
    
    erofs readahead could fail with ENOMEM under the memory pressure because
    it tries to alloc_page with GFP_NOWAIT | GFP_NORETRY, while GFP_KERNEL
    for a regular read. And if readahead fails (with non-uptodate folios),
    the original request will then fall back to synchronous read, and
    `.read_folio()` should return appropriate errnos.
    
    However, in scenarios where readahead and read operations compete,
    read operation could return an unintended EIO because of an incorrect
    error propagation.
    
    To resolve this, this patch modifies the behavior so that, when the
    PCL is for read(which means pcl.besteffort is true), it attempts actual
    decompression instead of propagating the privios error except initial EIO.
    
    - Page size: 4K
    - The original size of FileA: 16K
    - Compress-ratio per PCL: 50% (Uncompressed 8K -> Compressed 4K)
    [page0, page1] [page2, page3]
    [PCL0]---------[PCL1]
    
    - functions declaration:
      . pread(fd, buf, count, offset)
      . readahead(fd, offset, count)
    - Thread A tries to read the last 4K
    - Thread B tries to do readahead 8K from 4K
    - RA, besteffort == false
    - R, besteffort == true
    
            <process A>                   <process B>
    
    pread(FileA, buf, 4K, 12K)
      do readahead(page3) // failed with ENOMEM
      wait_lock(page3)
        if (!uptodate(page3))
          goto do_read
                                   readahead(FileA, 4K, 8K)
                                   // Here create PCL-chain like below:
                                   // [null, page1] [page2, null]
                                   //   [PCL0:RA]-----[PCL1:RA]
    ...
      do read(page3)        // found [PCL1:RA] and add page3 into it,
                            // and then, change PCL1 from RA to R
    ...
                                   // Now, PCL-chain is as below:
                                   // [null, page1] [page2, page3]
                                   //   [PCL0:RA]-----[PCL1:R]
    
                                     // try to decompress PCL-chain...
                                     z_erofs_decompress_queue
                                       err = 0;
    
                                       // failed with ENOMEM, so page 1
                                       // only for RA will not be uptodated.
                                       // it's okay.
                                       err = decompress([PCL0:RA], err)
    
                                       // However, ENOMEM propagated to next
                                       // PCL, even though PCL is not only
                                       // for RA but also for R. As a result,
                                       // it just failed with ENOMEM without
                                       // trying any decompression, so page2
                                       // and page3 will not be uptodated.
                    ** BUG HERE ** --> err = decompress([PCL1:R], err)
    
                                       return err as ENOMEM
    ...
        wait_lock(page3)
          if (!uptodate(page3))
            return EIO      <-- Return an unexpected EIO!
    ...
    
    Fixes: 2349d2fa02db ("erofs: sunset unneeded NOFAILs")
    Cc: stable@vger.kernel.org
    Reviewed-by: Jaewook Kim <jw5454.kim@samsung.com>
    Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
    Signed-off-by: Junbeom Yeom <junbeom.yeom@samsung.com>
    Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
    Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
    Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
    Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
erspan: Initialize options_len before referencing options. [+ + +]
Author: Frode Nordahl <fnordahl@ubuntu.com>
Date:   Sat Dec 13 10:13:36 2025 +0000

    erspan: Initialize options_len before referencing options.
    
    commit 35ddf66c65eff93fff91406756ba273600bf61a3 upstream.
    
    The struct ip_tunnel_info has a flexible array member named
    options that is protected by a counted_by(options_len)
    attribute.
    
    The compiler will use this information to enforce runtime bounds
    checking deployed by FORTIFY_SOURCE string helpers.
    
    As laid out in the GCC documentation, the counter must be
    initialized before the first reference to the flexible array
    member.
    
    After scanning through the files that use struct ip_tunnel_info
    and also refer to options or options_len, it appears the normal
    case is to use the ip_tunnel_info_opts_set() helper.
    
    Said helper would initialize options_len properly before copying
    data into options, however in the GRE ERSPAN code a partial
    update is done, preventing the use of the helper function.
    
    Before this change the handling of ERSPAN traffic in GRE tunnels
    would cause a kernel panic when the kernel is compiled with
    GCC 15+ and having FORTIFY_SOURCE configured:
    
    memcpy: detected buffer overflow: 4 byte write of buffer size 0
    
    Call Trace:
     <IRQ>
     __fortify_panic+0xd/0xf
     erspan_rcv.cold+0x68/0x83
     ? ip_route_input_slow+0x816/0x9d0
     gre_rcv+0x1b2/0x1c0
     gre_rcv+0x8e/0x100
     ? raw_v4_input+0x2a0/0x2b0
     ip_protocol_deliver_rcu+0x1ea/0x210
     ip_local_deliver_finish+0x86/0x110
     ip_local_deliver+0x65/0x110
     ? ip_rcv_finish_core+0xd6/0x360
     ip_rcv+0x186/0x1a0
    
    Cc: stable@vger.kernel.org
    Link: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-counted_005fby-variable-attribute
    Reported-at: https://launchpad.net/bugs/2129580
    Fixes: bb5e62f2d547 ("net: Add options as a flexible array to struct ip_tunnel_info")
    Signed-off-by: Frode Nordahl <fnordahl@ubuntu.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20251213101338.4693-1-fnordahl@ubuntu.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
fbdev: gbefb: fix to use physical address instead of dma address [+ + +]
Author: Rene Rebe <rene@exactco.de>
Date:   Fri Nov 14 16:00:42 2025 +0100

    fbdev: gbefb: fix to use physical address instead of dma address
    
    commit e3f44742bbb10537fe53d83d20dea2a7c167674d upstream.
    
    While debuggigng why X would not start on mips64 Sgi/O2 I found the
    phys adress being off. Turns out the gbefb passed the internal
    dma_addr as phys. May be broken pre git history. Fix by converting
    dma_to_phys.
    
    Signed-off-by: René Rebe <rene@exactco.de>
    Cc: <stable@vger.kernel.org> # v4.0+
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing [+ + +]
Author: Thorsten Blum <thorsten.blum@linux.dev>
Date:   Tue Dec 2 19:15:32 2025 +0100

    fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing
    
    commit 0155e868cbc111846cc2809c1546ea53810a56ae upstream.
    
    The variables were never clamped because the return value of clamp_val()
    was not used. Fix this by assigning the clamped values, and use clamp()
    instead of clamp_val().
    
    Cc: stable@vger.kernel.org
    Fixes: 3f16ff608a75 ("[ARM] pxafb: cleanup of the timing checking code")
    Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fbdev: tcx.c fix mem_map to correct smem_start offset [+ + +]
Author: René Rebe <rene@exactco.de>
Date:   Thu Nov 20 14:24:00 2025 +0100

    fbdev: tcx.c fix mem_map to correct smem_start offset
    
    commit 35fa2b4bf96415b88d7edaa5cf8af5185d9ce76e upstream.
    
    403ae52ac047 ("sparc: fix drivers/video/tcx.c warning") changed the
    physbase initializing breaking the user-space mmap, e.g. for Xorg
    entirely.
    
    Fix fbdev mmap table so the sbus mmap helper work correctly, and
    not try to map vastly (physbase) offset memory.
    
    Fixes: 403ae52ac047 ("sparc: fix drivers/video/tcx.c warning")
    Cc: <stable@vger.kernel.org>
    Signed-off-by: René Rebe <rene@exactco.de>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
fgraph: Check ftrace_pids_enabled on registration for early filtering [+ + +]
Author: Shengming Hu <hu.shengming@zte.com.cn>
Date:   Wed Nov 26 17:33:31 2025 +0800

    fgraph: Check ftrace_pids_enabled on registration for early filtering
    
    commit 1650a1b6cb1ae6cb99bb4fce21b30ebdf9fc238e upstream.
    
    When registering ftrace_graph, check if ftrace_pids_enabled is active.
    If enabled, assign entryfunc to fgraph_pid_func to ensure filtering
    is performed before executing the saved original entry function.
    
    Cc: stable@vger.kernel.org
    Cc: <wang.yaxin@zte.com.cn>
    Cc: <mhiramat@kernel.org>
    Cc: <mark.rutland@arm.com>
    Cc: <mathieu.desnoyers@efficios.com>
    Cc: <zhang.run@zte.com.cn>
    Cc: <yang.yang29@zte.com.cn>
    Link: https://patch.msgid.link/20251126173331679XGVF98NLhyLJRdtNkVZ6w@zte.com.cn
    Fixes: df3ec5da6a1e7 ("function_graph: Add pid tracing back to function graph tracer")
    Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fgraph: Initialize ftrace_ops->private for function graph ops [+ + +]
Author: Shengming Hu <hu.shengming@zte.com.cn>
Date:   Wed Nov 26 17:29:26 2025 +0800

    fgraph: Initialize ftrace_ops->private for function graph ops
    
    commit b5d6d3f73d0bac4a7e3a061372f6da166fc6ee5c upstream.
    
    The ftrace_pids_enabled(op) check relies on op->private being properly
    initialized, but fgraph_ops's underlying ftrace_ops->private was left
    uninitialized. This caused ftrace_pids_enabled() to always return false,
    effectively disabling PID filtering for function graph tracing.
    
    Fix this by copying src_ops->private to dst_ops->private in
    fgraph_init_ops(), ensuring PID filter state is correctly propagated.
    
    Cc: stable@vger.kernel.org
    Cc: <wang.yaxin@zte.com.cn>
    Cc: <mhiramat@kernel.org>
    Cc: <mark.rutland@arm.com>
    Cc: <mathieu.desnoyers@efficios.com>
    Cc: <zhang.run@zte.com.cn>
    Cc: <yang.yang29@zte.com.cn>
    Fixes: c132be2c4fcc1 ("function_graph: Have the instances use their own ftrace_ops for filtering")
    Link: https://patch.msgid.link/20251126172926004y3hC8QyU4WFOjBkU_UxLC@zte.com.cn
    Signed-off-by: Shengming Hu <hu.shengming@zte.com.cn>
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
firewire: nosy: Fix dma_free_coherent() size [+ + +]
Author: Thomas Fourier <fourier.thomas@gmail.com>
Date:   Tue Dec 16 17:54:18 2025 +0100

    firewire: nosy: Fix dma_free_coherent() size
    
    [ Upstream commit c48c0fd0e19684b6ecdb4108a429e3a4e73f5e21 ]
    
    It looks like the buffer allocated and mapped in add_card() is done
    with size RCV_BUFFER_SIZE which is 16 KB and 4KB.
    
    Fixes: 286468210d83 ("firewire: new driver: nosy - IEEE 1394 traffic sniffer")
    Co-developed-by: Thomas Fourier <fourier.thomas@gmail.com>
    Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
    Co-developed-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    Link: https://lore.kernel.org/r/20251216165420.38355-2-fourier.thomas@gmail.com
    Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
firmware: stratix10-svc: Add mutex in stratix10 memory management [+ + +]
Author: Mahesh Rao <mahesh.rao@altera.com>
Date:   Mon Oct 27 22:54:40 2025 +0800

    firmware: stratix10-svc: Add mutex in stratix10 memory management
    
    commit 85f96cbbbc67b59652b2c1ec394b8ddc0ddf1b0b upstream.
    
    Add mutex lock to stratix10_svc_allocate_memory and
    stratix10_svc_free_memory for thread safety. This prevents race
    conditions and ensures proper synchronization during memory operations.
    This is required for parallel communication with the Stratix10 service
    channel.
    
    Fixes: 7ca5ce896524f ("firmware: add Intel Stratix10 service layer driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Mahesh Rao <mahesh.rao@altera.com>
    Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
    Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
fjes: Add missing iounmap in fjes_hw_init() [+ + +]
Author: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Date:   Thu Dec 11 15:37:56 2025 +0800

    fjes: Add missing iounmap in fjes_hw_init()
    
    commit 15ef641a0c6728d25a400df73922e80ab2cf029c upstream.
    
    In error paths, add fjes_hw_iounmap() to release the
    resource acquired by fjes_hw_iomap(). Add a goto label
    to do so.
    
    Fixes: 8cdc3f6c5d22 ("fjes: Hardware initialization routine")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
    Signed-off-by: Simon Horman <horms@kernel.org>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20251211073756.101824-1-lihaoxiang@isrc.iscas.ac.cn
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
genalloc.h: fix htmldocs warning [+ + +]
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Thu Nov 27 10:39:24 2025 -0800

    genalloc.h: fix htmldocs warning
    
    [ Upstream commit 5393802c94e0ab1295c04c94c57bcb00222d4674 ]
    
    WARNING: include/linux/genalloc.h:52 function parameter 'start_addr' not described in 'genpool_algo_t'
    
    Fixes: 52fbf1134d47 ("lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk")
    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Closes: https://lkml.kernel.org/r/20251127130624.563597e3@canb.auug.org.au
    Acked-by: Randy Dunlap <rdunlap@infradead.org>
    Tested-by: Randy Dunlap <rdunlap@infradead.org>
    Cc: Alexey Skidanov <alexey.skidanov@intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
gve: defer interrupt enabling until NAPI registration [+ + +]
Author: Ankit Garg <nktgrg@google.com>
Date:   Fri Dec 19 10:29:45 2025 +0000

    gve: defer interrupt enabling until NAPI registration
    
    commit 3d970eda003441f66551a91fda16478ac0711617 upstream.
    
    Currently, interrupts are automatically enabled immediately upon
    request. This allows interrupt to fire before the associated NAPI
    context is fully initialized and cause failures like below:
    
    [    0.946369] Call Trace:
    [    0.946369]  <IRQ>
    [    0.946369]  __napi_poll+0x2a/0x1e0
    [    0.946369]  net_rx_action+0x2f9/0x3f0
    [    0.946369]  handle_softirqs+0xd6/0x2c0
    [    0.946369]  ? handle_edge_irq+0xc1/0x1b0
    [    0.946369]  __irq_exit_rcu+0xc3/0xe0
    [    0.946369]  common_interrupt+0x81/0xa0
    [    0.946369]  </IRQ>
    [    0.946369]  <TASK>
    [    0.946369]  asm_common_interrupt+0x22/0x40
    [    0.946369] RIP: 0010:pv_native_safe_halt+0xb/0x10
    
    Use the `IRQF_NO_AUTOEN` flag when requesting interrupts to prevent auto
    enablement and explicitly enable the interrupt in NAPI initialization
    path (and disable it during NAPI teardown).
    
    This ensures that interrupt lifecycle is strictly coupled with
    readiness of NAPI context.
    
    Cc: stable@vger.kernel.org
    Fixes: 1dfc2e46117e ("gve: Refactor napi add and remove functions")
    Signed-off-by: Ankit Garg <nktgrg@google.com>
    Reviewed-by: Jordan Rhee <jordanrhee@google.com>
    Reviewed-by: Joshua Washington <joshwash@google.com>
    Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com>
    Link: https://patch.msgid.link/20251219102945.2193617-1-hramamurthy@google.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
HID: logitech-dj: Remove duplicate error logging [+ + +]
Author: Hans de Goede <johannes.goede@oss.qualcomm.com>
Date:   Sat Nov 8 22:03:18 2025 +0100

    HID: logitech-dj: Remove duplicate error logging
    
    commit ca389a55d8b2d86a817433bf82e0602b68c4d541 upstream.
    
    logi_dj_recv_query_paired_devices() and logi_dj_recv_switch_to_dj_mode()
    both have 2 callers which all log an error if the function fails. Move
    the error logging to inside these 2 functions to remove the duplicated
    error logging in the callers.
    
    While at it also move the logi_dj_recv_send_report() call error handling
    in logi_dj_recv_switch_to_dj_mode() to directly after the call. That call
    only fails if the report cannot be found and in that case it does nothing,
    so the msleep() is not necessary on failures.
    
    Fixes: 6f20d3261265 ("HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()")
    Cc: stable@vger.kernel.org
    Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops [+ + +]
Author: Raghavendra Rao Ananta <rananta@google.com>
Date:   Fri Oct 31 17:06:03 2025 +0000

    hisi_acc_vfio_pci: Add .match_token_uuid callback in hisi_acc_vfio_pci_migrn_ops
    
    commit 0ed3a30fd996cb0cac872432cf25185fda7e5316 upstream.
    
    The commit, <86624ba3b522> ("vfio/pci: Do vf_token checks for
    VFIO_DEVICE_BIND_IOMMUFD") accidentally ignored including the
    .match_token_uuid callback in the hisi_acc_vfio_pci_migrn_ops struct.
    Introduce the missed callback here.
    
    Fixes: 86624ba3b522 ("vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD")
    Cc: stable@vger.kernel.org
    Suggested-by: Longfang Liu <liulongfang@huawei.com>
    Signed-off-by: Raghavendra Rao Ananta <rananta@google.com>
    Reviewed-by: Longfang Liu <liulongfang@huawei.com>
    Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
    Link: https://lore.kernel.org/r/20251031170603.2260022-3-rananta@google.com
    Signed-off-by: Alex Williamson <alex@shazbot.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
hwmon: (dell-smm) Fix off-by-one error in dell_smm_is_visible() [+ + +]
Author: Armin Wolf <W_Armin@gmx.de>
Date:   Wed Dec 3 21:21:09 2025 +0100

    hwmon: (dell-smm) Fix off-by-one error in dell_smm_is_visible()
    
    commit fae00a7186cecf90a57757a63b97a0cbcf384fe9 upstream.
    
    The documentation states that on machines supporting only global
    fan mode control, the pwmX_enable attributes should only be created
    for the first fan channel (pwm1_enable, aka channel 0).
    
    Fix the off-by-one error caused by the fact that fan channels have
    a zero-based index.
    
    Cc: stable@vger.kernel.org
    Fixes: 1c1658058c99 ("hwmon: (dell-smm) Add support for automatic fan mode")
    Signed-off-by: Armin Wolf <W_Armin@gmx.de>
    Link: https://lore.kernel.org/r/20251203202109.331528-1-W_Armin@gmx.de
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
i40e: fix scheduling in set_rx_mode [+ + +]
Author: Przemyslaw Korba <przemyslaw.korba@intel.com>
Date:   Thu Nov 20 13:07:28 2025 +0100

    i40e: fix scheduling in set_rx_mode
    
    [ Upstream commit be43abc5514167cc129a8d8e9727b89b8e1d9719 ]
    
    Add service task schedule to set_rx_mode.
    In some cases there are error messages printed out in PTP application
    (ptp4l):
    
    ptp4l[13848.762]: port 1 (ens2f3np3): received SYNC without timestamp
    ptp4l[13848.825]: port 1 (ens2f3np3): received SYNC without timestamp
    ptp4l[13848.887]: port 1 (ens2f3np3): received SYNC without timestamp
    
    This happens when service task would not run immediately after
    set_rx_mode, and we need it for setup tasks. This service task checks, if
    PTP RX packets are hung in firmware, and propagate correct settings such
    as multicast address for IEEE 1588 Precision Time Protocol.
    RX timestamping depends on some of these filters set. Bug happens only
    with high PTP packets frequency incoming, and not every run since
    sometimes service task is being ran from a different place immediately
    after starting ptp4l.
    
    Fixes: 0e4425ed641f ("i40e: fix: do not sleep in netdev_ops")
    Reviewed-by: Grzegorz Nitka <grzegorz.nitka@intel.com>
    Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Signed-off-by: Przemyslaw Korba <przemyslaw.korba@intel.com>
    Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

i40e: validate ring_len parameter against hardware-specific values [+ + +]
Author: Gregory Herrero <gregory.herrero@oracle.com>
Date:   Fri Dec 12 22:06:43 2025 +0100

    i40e: validate ring_len parameter against hardware-specific values
    
    [ Upstream commit 69942834215323cd9131db557091b4dec43f19c5 ]
    
    The maximum number of descriptors supported by the hardware is
    hardware-dependent and can be retrieved using
    i40e_get_max_num_descriptors(). Move this function to a shared header
    and use it when checking for valid ring_len parameter rather than using
    hardcoded value.
    
    By fixing an over-acceptance issue, behavior change could be seen where
    ring_len could now be rejected while configuring rx and tx queues if its
    size is larger than the hardware-dependent maximum number of
    descriptors.
    
    Fixes: 55d225670def ("i40e: add validation for ring_len param")
    Signed-off-by: Gregory Herrero <gregory.herrero@oracle.com>
    Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
iavf: fix off-by-one issues in iavf_config_rss_reg() [+ + +]
Author: Kohei Enju <enjuk@amazon.com>
Date:   Sun Oct 26 01:58:50 2025 +0900

    iavf: fix off-by-one issues in iavf_config_rss_reg()
    
    [ Upstream commit 6daa2893f323981c7894c68440823326e93a7d61 ]
    
    There are off-by-one bugs when configuring RSS hash key and lookup
    table, causing out-of-bounds reads to memory [1] and out-of-bounds
    writes to device registers.
    
    Before commit 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS"),
    the loop upper bounds were:
        i <= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX
    which is safe since the value is the last valid index.
    
    That commit changed the bounds to:
        i <= adapter->rss_{key,lut}_size / 4
    where `rss_{key,lut}_size / 4` is the number of dwords, so the last
    valid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `<=`
    accesses one element past the end.
    
    Fix the issues by using `<` instead of `<=`, ensuring we do not exceed
    the bounds.
    
    [1] KASAN splat about rss_key_size off-by-one
      BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800
      Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63
    
      CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
      Workqueue: iavf iavf_watchdog_task
      Call Trace:
       <TASK>
       dump_stack_lvl+0x6f/0xb0
       print_report+0x170/0x4f3
       kasan_report+0xe1/0x1a0
       iavf_config_rss+0x619/0x800
       iavf_watchdog_task+0x2be7/0x3230
       process_one_work+0x7fd/0x1420
       worker_thread+0x4d1/0xd40
       kthread+0x344/0x660
       ret_from_fork+0x249/0x320
       ret_from_fork_asm+0x1a/0x30
       </TASK>
    
      Allocated by task 63:
       kasan_save_stack+0x30/0x50
       kasan_save_track+0x14/0x30
       __kasan_kmalloc+0x7f/0x90
       __kmalloc_noprof+0x246/0x6f0
       iavf_watchdog_task+0x28fc/0x3230
       process_one_work+0x7fd/0x1420
       worker_thread+0x4d1/0xd40
       kthread+0x344/0x660
       ret_from_fork+0x249/0x320
       ret_from_fork_asm+0x1a/0x30
    
      The buggy address belongs to the object at ffff888102c50100
       which belongs to the cache kmalloc-64 of size 64
      The buggy address is located 0 bytes to the right of
       allocated 52-byte region [ffff888102c50100, ffff888102c50134)
    
      The buggy address belongs to the physical page:
      page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50
      flags: 0x200000000000000(node=0|zone=2)
      page_type: f5(slab)
      raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000
      raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000
      page dumped because: kasan: bad access detected
    
      Memory state around the buggy address:
       ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
       ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
      >ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc
                                           ^
       ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
       ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
    
    Fixes: 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS")
    Signed-off-by: Kohei Enju <enjuk@amazon.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
    Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path [+ + +]
Author: Li Zhijian <lizhijian@fujitsu.com>
Date:   Fri Dec 26 17:41:12 2025 +0800

    IB/rxe: Fix missing umem_odp->umem_mutex unlock on error path
    
    [ Upstream commit 3c68cf68233e556e0102f45b69f7448908dc1f44 ]
    
    rxe_odp_map_range_and_lock() must release umem_odp->umem_mutex when an
    error occurs, including cases where rxe_check_pagefault() fails.
    
    Fixes: 2fae67ab63db ("RDMA/rxe: Add support for Send/Recv/Write/Read with ODP")
    Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
    Link: https://patch.msgid.link/20251226094112.3042583-1-lizhijian@fujitsu.com
    Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
idpf: fix LAN memory regions command on some NVMs [+ + +]
Author: Larysa Zaremba <larysa.zaremba@intel.com>
Date:   Tue Oct 7 13:46:22 2025 +0200

    idpf: fix LAN memory regions command on some NVMs
    
    [ Upstream commit 4af1f9a47291f7d446398065e0d6eb4943f7e184 ]
    
    IPU SDK versions 1.9 through 2.0.5 require send buffer to contain a single
    empty memory region. Set number of regions to 1 and use appropriate send
    buffer size to satisfy this requirement.
    
    Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions")
    Suggested-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
    Tested-by: Krishneil Singh <krishneil.k.singh@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

idpf: reduce mbx_task schedule delay to 300us [+ + +]
Author: Brian Vazquez <brianvv@google.com>
Date:   Mon Nov 10 20:58:37 2025 +0000

    idpf: reduce mbx_task schedule delay to 300us
    
    [ Upstream commit b3d6bbae1d6d5638a4ab702ab195476787cde857 ]
    
    During the IDPF init phase, the mailbox runs in poll mode until it is
    configured to properly handle interrupts. The previous delay of 300ms is
    excessively long for the mailbox polling mechanism, which causes a slow
    initialization of ~2s:
    
    echo 0000:06:12.4 > /sys/bus/pci/drivers/idpf/bind
    
    [   52.444239] idpf 0000:06:12.4: enabling device (0000 -> 0002)
    [   52.485005] idpf 0000:06:12.4: Device HW Reset initiated
    [   54.177181] idpf 0000:06:12.4: PTP init failed, err=-EOPNOTSUPP
    [   54.206177] idpf 0000:06:12.4: Minimum RX descriptor support not provided, using the default
    [   54.206182] idpf 0000:06:12.4: Minimum TX descriptor support not provided, using the default
    
    Changing the delay to 300us avoids the delays during the initial mailbox
    transactions, making the init phase much faster:
    
    [   83.342590] idpf 0000:06:12.4: enabling device (0000 -> 0002)
    [   83.384402] idpf 0000:06:12.4: Device HW Reset initiated
    [   83.518323] idpf 0000:06:12.4: PTP init failed, err=-EOPNOTSUPP
    [   83.547430] idpf 0000:06:12.4: Minimum RX descriptor support not provided, using the default
    [   83.547435] idpf 0000:06:12.4: Minimum TX descriptor support not provided, using the default
    
    Fixes: 4930fbf419a7 ("idpf: add core init and interrupt request")
    Signed-off-by: Brian Vazquez <brianvv@google.com>
    Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
    Tested-by: Samuel Salin <Samuel.salin@intel.com>
    Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
idr: fix idr_alloc() returning an ID out of range [+ + +]
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Fri Nov 28 16:18:32 2025 +0000

    idr: fix idr_alloc() returning an ID out of range
    
    commit c6e8e595a0798ad67da0f7bebaf69c31ef70dfff upstream.
    
    If you use an IDR with a non-zero base, and specify a range that lies
    entirely below the base, 'max - base' becomes very large and
    idr_get_free() can return an ID that lies outside of the requested range.
    
    Link: https://lkml.kernel.org/r/20251128161853.3200058-1-willy@infradead.org
    Fixes: 6ce711f27500 ("idr: Make 1-based IDRs more efficient")
    Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
    Reported-by: Jan Sokolowski <jan.sokolowski@intel.com>
    Reported-by: Koen Koning <koen.koning@intel.com>
    Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
    Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6449
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/amd: Fix pci_segment memleak in alloc_pci_segment() [+ + +]
Author: Jinhui Guo <guojinhui.liam@bytedance.com>
Date:   Tue Oct 28 00:50:17 2025 +0800

    iommu/amd: Fix pci_segment memleak in alloc_pci_segment()
    
    commit 75ba146c2674ba49ed8a222c67f9abfb4a4f2a4f upstream.
    
    Fix a memory leak of struct amd_iommu_pci_segment in alloc_pci_segment()
    when system memory (or contiguous memory) is insufficient.
    
    Fixes: 04230c119930 ("iommu/amd: Introduce per PCI segment device table")
    Fixes: eda797a27795 ("iommu/amd: Introduce per PCI segment rlookup table")
    Fixes: 99fc4ac3d297 ("iommu/amd: Introduce per PCI segment alias_table")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga() [+ + +]
Author: Jinhui Guo <guojinhui.liam@bytedance.com>
Date:   Thu Nov 20 23:47:25 2025 +0800

    iommu/amd: Propagate the error code returned by __modify_irte_ga() in modify_irte_ga()
    
    commit 2381a1b40be4b286062fb3cf67dd7f005692aa2a upstream.
    
    The return type of __modify_irte_ga() is int, but modify_irte_ga()
    treats it as a bool. Casting the int to bool discards the error code.
    
    To fix the issue, change the type of ret to int in modify_irte_ga().
    
    Fixes: 57cdb720eaa5 ("iommu/amd: Do not flush IRTE when only updating isRun and destination fields")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
    Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/apple-dart: fix device leak on of_xlate() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:05 2025 +0200

    iommu/apple-dart: fix device leak on of_xlate()
    
    commit a6eaa872c52a181ae9a290fd4e40c9df91166d7a upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during of_xlate().
    
    Fixes: 46d1fb072e76 ("iommu/dart: Add DART iommu driver")
    Cc: stable@vger.kernel.org      # 5.15
    Cc: Sven Peter <sven@kernel.org>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/exynos: fix device leak on of_xlate() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:07 2025 +0200

    iommu/exynos: fix device leak on of_xlate()
    
    commit 05913cc43cb122f9afecdbe775115c058b906e1b upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during of_xlate().
    
    Note that commit 1a26044954a6 ("iommu/exynos: add missing put_device()
    call in exynos_iommu_of_xlate()") fixed the leak in a couple of error
    paths, but the reference is still leaking on success.
    
    Fixes: aa759fd376fb ("iommu/exynos: Add callback for initializing devices from device tree")
    Cc: stable@vger.kernel.org      # 4.2: 1a26044954a6
    Cc: Yu Kuai <yukuai3@huawei.com>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/ipmmu-vmsa: fix device leak on of_xlate() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:08 2025 +0200

    iommu/ipmmu-vmsa: fix device leak on of_xlate()
    
    commit 80aa518452c4aceb9459f9a8e3184db657d1b441 upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during of_xlate().
    
    Fixes: 7b2d59611fef ("iommu/ipmmu-vmsa: Replace local utlb code with fwspec ids")
    Cc: stable@vger.kernel.org      # 4.14
    Cc: Magnus Damm <damm+renesas@opensource.se>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/mediatek-v1: fix device leak on probe_device() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:12 2025 +0200

    iommu/mediatek-v1: fix device leak on probe_device()
    
    commit c77ad28bfee0df9cbc719eb5adc9864462cfb65b upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during probe_device().
    
    Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")
    Cc: stable@vger.kernel.org      # 4.8
    Cc: Honghui Zhang <honghui.zhang@mediatek.com>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Reviewed-by: Yong Wu <yong.wu@mediatek.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iommu/mediatek-v1: fix device leaks on probe() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:13 2025 +0200

    iommu/mediatek-v1: fix device leaks on probe()
    
    commit 46207625c9f33da0e43bb4ae1e91f0791b6ed633 upstream.
    
    Make sure to drop the references taken to the larb devices during
    probe on probe failure (e.g. probe deferral) and on driver unbind.
    
    Fixes: b17336c55d89 ("iommu/mediatek: add support for mtk iommu generation one HW")
    Cc: stable@vger.kernel.org      # 4.8
    Cc: Honghui Zhang <honghui.zhang@mediatek.com>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/mediatek: fix device leak on of_xlate() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:09 2025 +0200

    iommu/mediatek: fix device leak on of_xlate()
    
    commit b3f1ee18280363ef17f82b564fc379ceba9ec86f upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during of_xlate().
    
    Fixes: 0df4fabe208d ("iommu/mediatek: Add mt8173 IOMMU driver")
    Cc: stable@vger.kernel.org      # 4.6
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Reviewed-by: Yong Wu <yong.wu@mediatek.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/omap: fix device leaks on probe_device() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:15 2025 +0200

    iommu/omap: fix device leaks on probe_device()
    
    commit b5870691065e6bbe6ba0650c0412636c6a239c5a upstream.
    
    Make sure to drop the references taken to the iommu platform devices
    when looking up their driver data during probe_device().
    
    Note that the arch data device pointer added by commit 604629bcb505
    ("iommu/omap: add support for late attachment of iommu devices") has
    never been used. Remove it to underline that the references are not
    needed.
    
    Fixes: 9d5018deec86 ("iommu/omap: Add support to program multiple iommus")
    Fixes: 7d6827748d54 ("iommu/omap: Fix iommu archdata name for DT-based devices")
    Cc: stable@vger.kernel.org      # 3.18
    Cc: Suman Anna <s-anna@ti.com>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/qcom: fix device leak on of_xlate() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:06 2025 +0200

    iommu/qcom: fix device leak on of_xlate()
    
    commit 6a3908ce56e6879920b44ef136252b2f0c954194 upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during of_xlate().
    
    Note that commit e2eae09939a8 ("iommu/qcom: add missing put_device()
    call in qcom_iommu_of_xlate()") fixed the leak in a couple of error
    paths, but the reference is still leaking on success and late failures.
    
    Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu")
    Cc: stable@vger.kernel.org      # 4.14: e2eae09939a8
    Cc: Rob Clark <robin.clark@oss.qualcomm.com>
    Cc: Yu Kuai <yukuai3@huawei.com>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/sun50i: fix device leak on of_xlate() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:17 2025 +0200

    iommu/sun50i: fix device leak on of_xlate()
    
    commit f916109bf53864605d10bf6f4215afa023a80406 upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during of_xlate().
    
    Fixes: 4100b8c229b3 ("iommu: Add Allwinner H6 IOMMU driver")
    Cc: stable@vger.kernel.org      # 5.8
    Cc: Maxime Ripard <mripard@kernel.org>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu/tegra: fix device leak on probe_device() [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Oct 20 06:53:18 2025 +0200

    iommu/tegra: fix device leak on probe_device()
    
    commit c08934a61201db8f1d1c66fcc63fb2eb526b656d upstream.
    
    Make sure to drop the reference taken to the iommu platform device when
    looking up its driver data during probe_device().
    
    Note that commit 9826e393e4a8 ("iommu/tegra-smmu: Fix missing
    put_device() call in tegra_smmu_find") fixed the leak in an error path,
    but the reference is still leaking on success.
    
    Fixes: 891846516317 ("memory: Add NVIDIA Tegra memory controller support")
    Cc: stable@vger.kernel.org      # 3.19: 9826e393e4a8
    Cc: Miaoqian Lin <linmq006@gmail.com>
    Acked-by: Robin Murphy <robin.murphy@arm.com>
    Acked-by: Thierry Reding <treding@nvidia.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
iommu: disable SVA when CONFIG_X86 is set [+ + +]
Author: Lu Baolu <baolu.lu@linux.intel.com>
Date:   Wed Oct 22 16:26:27 2025 +0800

    iommu: disable SVA when CONFIG_X86 is set
    
    commit 72f98ef9a4be30d2a60136dd6faee376f780d06c upstream.
    
    Patch series "Fix stale IOTLB entries for kernel address space", v7.
    
    This proposes a fix for a security vulnerability related to IOMMU Shared
    Virtual Addressing (SVA).  In an SVA context, an IOMMU can cache kernel
    page table entries.  When a kernel page table page is freed and
    reallocated for another purpose, the IOMMU might still hold stale,
    incorrect entries.  This can be exploited to cause a use-after-free or
    write-after-free condition, potentially leading to privilege escalation or
    data corruption.
    
    This solution introduces a deferred freeing mechanism for kernel page
    table pages, which provides a safe window to notify the IOMMU to
    invalidate its caches before the page is reused.
    
    
    This patch (of 8):
    
    In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware
    shares and walks the CPU's page tables.  The x86 architecture maps the
    kernel's virtual address space into the upper portion of every process's
    page table.  Consequently, in an SVA context, the IOMMU hardware can walk
    and cache kernel page table entries.
    
    The Linux kernel currently lacks a notification mechanism for kernel page
    table changes, specifically when page table pages are freed and reused.
    The IOMMU driver is only notified of changes to user virtual address
    mappings.  This can cause the IOMMU's internal caches to retain stale
    entries for kernel VA.
    
    Use-After-Free (UAF) and Write-After-Free (WAF) conditions arise when
    kernel page table pages are freed and later reallocated.  The IOMMU could
    misinterpret the new data as valid page table entries.  The IOMMU might
    then walk into attacker-controlled memory, leading to arbitrary physical
    memory DMA access or privilege escalation.  This is also a
    Write-After-Free issue, as the IOMMU will potentially continue to write
    Accessed and Dirty bits to the freed memory while attempting to walk the
    stale page tables.
    
    Currently, SVA contexts are unprivileged and cannot access kernel
    mappings.  However, the IOMMU will still walk kernel-only page tables all
    the way down to the leaf entries, where it realizes the mapping is for the
    kernel and errors out.  This means the IOMMU still caches these
    intermediate page table entries, making the described vulnerability a real
    concern.
    
    Disable SVA on x86 architecture until the IOMMU can receive notification
    to flush the paging cache before freeing the CPU kernel page table pages.
    
    Link: https://lkml.kernel.org/r/20251022082635.2462433-1-baolu.lu@linux.intel.com
    Link: https://lkml.kernel.org/r/20251022082635.2462433-2-baolu.lu@linux.intel.com
    Fixes: 26b25a2b98e4 ("iommu: Bind process address spaces to devices")
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
    Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
    Cc: Alistair Popple <apopple@nvidia.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Betkov <bp@alien8.de>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: David Hildenbrand <david@redhat.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Jann Horn <jannh@google.com>
    Cc: Jean-Philippe Brucker <jean-philippe@linaro.org>
    Cc: Joerg Roedel <joro@8bytes.org>
    Cc: Kevin Tian <kevin.tian@intel.com>
    Cc: Liam Howlett <liam.howlett@oracle.com>
    Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
    Cc: Michal Hocko <mhocko@kernel.org>
    Cc: Mike Rapoport <rppt@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Robin Murohy <robin.murphy@arm.com>
    Cc: Thomas Gleinxer <tglx@linutronix.de>
    Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
    Cc: Vasant Hegde <vasant.hegde@amd.com>
    Cc: Vinicius Costa Gomes <vinicius.gomes@intel.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: Will Deacon <will@kernel.org>
    Cc: Yi Lai <yi1.lai@intel.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ip6_gre: make ip6gre_header() robust [+ + +]
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Dec 11 17:35:50 2025 +0000

    ip6_gre: make ip6gre_header() robust
    
    [ Upstream commit db5b4e39c4e63700c68a7e65fc4e1f1375273476 ]
    
    Over the years, syzbot found many ways to crash the kernel
    in ip6gre_header() [1].
    
    This involves team or bonding drivers ability to dynamically
    change their dev->needed_headroom and/or dev->hard_header_len
    
    In this particular crash mld_newpack() allocated an skb
    with a too small reserve/headroom, and by the time mld_sendpack()
    was called, syzbot managed to attach an ip6gre device.
    
    [1]
    skbuff: skb_under_panic: text:ffffffff8a1d69a8 len:136 put:40 head:ffff888059bc7000 data:ffff888059bc6fe8 tail:0x70 end:0x6c0 dev:team0
    ------------[ cut here ]------------
     kernel BUG at net/core/skbuff.c:213 !
     <TASK>
      skb_under_panic net/core/skbuff.c:223 [inline]
      skb_push+0xc3/0xe0 net/core/skbuff.c:2641
      ip6gre_header+0xc8/0x790 net/ipv6/ip6_gre.c:1371
      dev_hard_header include/linux/netdevice.h:3436 [inline]
      neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618
      neigh_output include/net/neighbour.h:556 [inline]
      ip6_finish_output2+0xfb3/0x1480 net/ipv6/ip6_output.c:136
     __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
      ip6_finish_output+0x234/0x7d0 net/ipv6/ip6_output.c:220
      NF_HOOK_COND include/linux/netfilter.h:307 [inline]
      ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
      NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318
      mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855
      mld_send_cr net/ipv6/mcast.c:2154 [inline]
      mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
    
    Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
    Reported-by: syzbot+43a2ebcf2a64b1102d64@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/netdev/693b002c.a70a0220.33cd7b.0033.GAE@google.com/T/#u
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Link: https://patch.msgid.link/20251211173550.2032674-1-edumazet@google.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ipv4: Fix reference count leak when using error routes with nexthop objects [+ + +]
Author: Ido Schimmel <idosch@nvidia.com>
Date:   Sun Dec 21 16:48:28 2025 +0200

    ipv4: Fix reference count leak when using error routes with nexthop objects
    
    [ Upstream commit ac782f4e3bfcde145b8a7f8af31d9422d94d172a ]
    
    When a nexthop object is deleted, it is marked as dead and then
    fib_table_flush() is called to flush all the routes that are using the
    dead nexthop.
    
    The current logic in fib_table_flush() is to only flush error routes
    (e.g., blackhole) when it is called as part of network namespace
    dismantle (i.e., with flush_all=true). Therefore, error routes are not
    flushed when their nexthop object is deleted:
    
     # ip link add name dummy1 up type dummy
     # ip nexthop add id 1 dev dummy1
     # ip route add 198.51.100.1/32 nhid 1
     # ip route add blackhole 198.51.100.2/32 nhid 1
     # ip nexthop del id 1
     # ip route show
     blackhole 198.51.100.2 nhid 1 dev dummy1
    
    As such, they keep holding a reference on the nexthop object which in
    turn holds a reference on the nexthop device, resulting in a reference
    count leak:
    
     # ip link del dev dummy1
     [   70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2
    
    Fix by flushing error routes when their nexthop is marked as dead.
    
    IPv6 does not suffer from this problem.
    
    Fixes: 493ced1ac47c ("ipv4: Allow routes to use nexthop objects")
    Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Closes: https://lore.kernel.org/netdev/d943f806-4da6-4970-ac28-b9373b0e63ac@I-love.SAKURA.ne.jp/
    Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
    Signed-off-by: Ido Schimmel <idosch@nvidia.com>
    Reviewed-by: David Ahern <dsahern@kernel.org>
    Link: https://patch.msgid.link/20251221144829.197694-1-idosch@nvidia.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() [+ + +]
Author: Will Rosenberg <whrosenb@asu.edu>
Date:   Fri Dec 19 10:36:37 2025 -0700

    ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
    
    [ Upstream commit 58fc7342b529803d3c221101102fe913df7adb83 ]
    
    There exists a kernel oops caused by a BUG_ON(nhead < 0) at
    net/core/skbuff.c:2232 in pskb_expand_head().
    This bug is triggered as part of the calipso_skbuff_setattr()
    routine when skb_cow() is passed headroom > INT_MAX
    (i.e. (int)(skb_headroom(skb) + len_delta) < 0).
    
    The root cause of the bug is due to an implicit integer cast in
    __skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure
    that delta = headroom - skb_headroom(skb) is never negative, otherwise
    we will trigger a BUG_ON in pskb_expand_head(). However, if
    headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta
    becomes negative, and pskb_expand_head() is passed a negative value for
    nhead.
    
    Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing
    "negative" headroom sizes to skb_cow() within calipso_skbuff_setattr()
    by only using skb_cow() to grow headroom.
    
    PoC:
            Using `netlabelctl` tool:
    
            netlabelctl map del default
            netlabelctl calipso add pass doi:7
            netlabelctl map add default address:0::1/128 protocol:calipso,7
    
            Then run the following PoC:
    
            int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
    
            // setup msghdr
            int cmsg_size = 2;
            int cmsg_len = 0x60;
            struct msghdr msg;
            struct sockaddr_in6 dest_addr;
            struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1,
                            sizeof(struct cmsghdr) + cmsg_len);
            msg.msg_name = &dest_addr;
            msg.msg_namelen = sizeof(dest_addr);
            msg.msg_iov = NULL;
            msg.msg_iovlen = 0;
            msg.msg_control = cmsg;
            msg.msg_controllen = cmsg_len;
            msg.msg_flags = 0;
    
            // setup sockaddr
            dest_addr.sin6_family = AF_INET6;
            dest_addr.sin6_port = htons(31337);
            dest_addr.sin6_flowinfo = htonl(31337);
            dest_addr.sin6_addr = in6addr_loopback;
            dest_addr.sin6_scope_id = 31337;
    
            // setup cmsghdr
            cmsg->cmsg_len = cmsg_len;
            cmsg->cmsg_level = IPPROTO_IPV6;
            cmsg->cmsg_type = IPV6_HOPOPTS;
            char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
            hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80
    
            sendmsg(fd, &msg, 0);
    
    Fixes: 2917f57b6bc1 ("calipso: Allow the lsm to label the skbuff directly.")
    Suggested-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Will Rosenberg <whrosenb@asu.edu>
    Acked-by: Paul Moore <paul@paul-moore.com>
    Link: https://patch.msgid.link/20251219173637.797418-1-whrosenb@asu.edu
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT [+ + +]
Author: Jiayuan Chen <jiayuan.chen@linux.dev>
Date:   Tue Dec 23 13:14:12 2025 +0800

    ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
    
    [ Upstream commit 1adaea51c61b52e24e7ab38f7d3eba023b2d050d ]
    
    On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the
    current task can be preempted. Another task running on the same CPU
    may then execute rt6_make_pcpu_route() and successfully install a
    pcpu_rt entry. When the first task resumes execution, its cmpxchg()
    in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer
    NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding
    mdelay() after rt6_get_pcpu_route().
    
    Using preempt_disable/enable is not appropriate here because
    ip6_rt_pcpu_alloc() may sleep.
    
    Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT:
    free our allocation and return the existing pcpu_rt installed by
    another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT
    kernels where such races should not occur.
    
    Link: https://syzkaller.appspot.com/bug?extid=9b35e9bc0951140d13e6
    Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.")
    Reported-by: syzbot+9b35e9bc0951140d13e6@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/6918cd88.050a0220.1c914e.0045.GAE@google.com/T/
    Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
    Link: https://patch.msgid.link/20251223051413.124687-1-jiayuan.chen@linux.dev
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
kasan: refactor pcpu kasan vmalloc unpoison [+ + +]
Author: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Date:   Thu Dec 4 19:00:04 2025 +0000

    kasan: refactor pcpu kasan vmalloc unpoison
    
    commit 6f13db031e27e88213381039032a9cc061578ea6 upstream.
    
    A KASAN tag mismatch, possibly causing a kernel panic, can be observed
    on systems with a tag-based KASAN enabled and with multiple NUMA nodes.
    It was reported on arm64 and reproduced on x86. It can be explained in
    the following points:
    
    1. There can be more than one virtual memory chunk.
    2. Chunk's base address has a tag.
    3. The base address points at the first chunk and thus inherits
       the tag of the first chunk.
    4. The subsequent chunks will be accessed with the tag from the
       first chunk.
    5. Thus, the subsequent chunks need to have their tag set to
       match that of the first chunk.
    
    Refactor code by reusing __kasan_unpoison_vmalloc in a new helper in
    preparation for the actual fix.
    
    Link: https://lkml.kernel.org/r/eb61d93b907e262eefcaa130261a08bcb6c5ce51.1764874575.git.m.wieczorretman@pm.me
    Fixes: 1d96320f8d53 ("kasan, vmalloc: add vmalloc tagging for SW_TAGS")
    Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
    Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
    Cc: Danilo Krummrich <dakr@kernel.org>
    Cc: Dmitriy Vyukov <dvyukov@google.com>
    Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
    Cc: Kees Cook <kees@kernel.org>
    Cc: Marco Elver <elver@google.com>
    Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
    Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Cc: <stable@vger.kernel.org>    [6.1+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

kasan: unpoison vms[area] addresses with a common tag [+ + +]
Author: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Date:   Thu Dec 4 19:00:11 2025 +0000

    kasan: unpoison vms[area] addresses with a common tag
    
    commit 6a0e5b333842cf65d6f4e4f0a2a4386504802515 upstream.
    
    A KASAN tag mismatch, possibly causing a kernel panic, can be observed on
    systems with a tag-based KASAN enabled and with multiple NUMA nodes.  It
    was reported on arm64 and reproduced on x86.  It can be explained in the
    following points:
    
    1. There can be more than one virtual memory chunk.
    2. Chunk's base address has a tag.
    3. The base address points at the first chunk and thus inherits
       the tag of the first chunk.
    4. The subsequent chunks will be accessed with the tag from the
       first chunk.
    5. Thus, the subsequent chunks need to have their tag set to
       match that of the first chunk.
    
    Use the new vmalloc flag that disables random tag assignment in
    __kasan_unpoison_vmalloc() - pass the same random tag to all the
    vm_structs by tagging the pointers before they go inside
    __kasan_unpoison_vmalloc().  Assigning a common tag resolves the pcpu
    chunk address mismatch.
    
    [akpm@linux-foundation.org: use WARN_ON_ONCE(), per Andrey]
      Link: https://lkml.kernel.org/r/CA+fCnZeuGdKSEm11oGT6FS71_vGq1vjq-xY36kxVdFvwmag2ZQ@mail.gmail.com
    [maciej.wieczor-retman@intel.com: remove unneeded pr_warn()]
      Link: https://lkml.kernel.org/r/919897daaaa3c982a27762a2ee038769ad033991.1764945396.git.m.wieczorretman@pm.me
    Link: https://lkml.kernel.org/r/873821114a9f722ffb5d6702b94782e902883fdf.1764874575.git.m.wieczorretman@pm.me
    Fixes: 1d96320f8d53 ("kasan, vmalloc: add vmalloc tagging for SW_TAGS")
    Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
    Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
    Cc: Danilo Krummrich <dakr@kernel.org>
    Cc: Dmitriy Vyukov <dvyukov@google.com>
    Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
    Cc: Kees Cook <kees@kernel.org>
    Cc: Marco Elver <elver@google.com>
    Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
    Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Cc: <stable@vger.kernel.org>    [6.1+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
kbuild: fix compilation of dtb specified on command-line without make rule [+ + +]
Author: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Date:   Wed Nov 26 11:00:16 2025 +0100

    kbuild: fix compilation of dtb specified on command-line without make rule
    
    [ Upstream commit b08fc4d0ec2466558f6d5511434efdfabbddf2a6 ]
    
    Since commit e7e2941300d2 ("kbuild: split device tree build rules into
    scripts/Makefile.dtbs"), it is no longer possible to compile a device tree
    blob that is not specified in a make rule
    like:
        dtb-$(CONFIG_FOO) += foo.dtb
    
    Before the mentioned commit, one could copy a dts file to e.g.
    arch/arm64/boot/dts/ (or a new subdirectory) and then convert it to a dtb
    file using:
        make ARCH=arm64 foo.dtb
    
    In this scenario, both 'dtb-y' and 'dtb-' are empty, and the inclusion of
    scripts/Makefile.dtbs relies on 'targets' to contain the MAKECMDGOALS. The
    value of 'targets', however, is only final later in the code.
    
    Move the conditional include of scripts/Makefile.dtbs down to where the
    value of 'targets' is final. Since Makefile.dtbs updates 'always-y' which is
    used as a prerequisite in the build rule, the build rule also needs to move
    down.
    
    Fixes: e7e2941300d2 ("kbuild: split device tree build rules into scripts/Makefile.dtbs")
    Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
    Reviewed-by: Nathan Chancellor <nathan@kernel.org>
    Tested-by: Nathan Chancellor <nathan@kernel.org>
    Acked-by: Rob Herring (Arm) <robh@kernel.org>
    Link: https://patch.msgid.link/20251126100017.1162330-1-thomas.de_schampheleire@nokia.com
    Signed-off-by: Nicolas Schier <nsc@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
kernel/kexec: change the prototype of kimage_map_segment() [+ + +]
Author: Pingfan Liu <piliu@redhat.com>
Date:   Tue Dec 16 09:48:51 2025 +0800

    kernel/kexec: change the prototype of kimage_map_segment()
    
    commit fe55ea85939efcbf0e6baa234f0d70acb79e7b58 upstream.
    
    The kexec segment index will be required to extract the corresponding
    information for that segment in kimage_map_segment().  Additionally,
    kexec_segment already holds the kexec relocation destination address and
    size.  Therefore, the prototype of kimage_map_segment() can be changed.
    
    Link: https://lkml.kernel.org/r/20251216014852.8737-1-piliu@redhat.com
    Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation")
    Signed-off-by: Pingfan Liu <piliu@redhat.com>
    Acked-by: Baoquan He <bhe@redhat.com>
    Cc: Mimi Zohar <zohar@linux.ibm.com>
    Cc: Roberto Sassu <roberto.sassu@huawei.com>
    Cc: Alexander Graf <graf@amazon.com>
    Cc: Steven Chen <chenste@linux.microsoft.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

kernel/kexec: fix IMA when allocation happens in CMA area [+ + +]
Author: Pingfan Liu <piliu@redhat.com>
Date:   Tue Dec 16 09:48:52 2025 +0800

    kernel/kexec: fix IMA when allocation happens in CMA area
    
    commit a3785ae5d334bb71d47a593d54c686a03fb9d136 upstream.
    
    *** Bug description ***
    
    When I tested kexec with the latest kernel, I ran into the following warning:
    
    [   40.712410] ------------[ cut here ]------------
    [   40.712576] WARNING: CPU: 2 PID: 1562 at kernel/kexec_core.c:1001 kimage_map_segment+0x144/0x198
    [...]
    [   40.816047] Call trace:
    [   40.818498]  kimage_map_segment+0x144/0x198 (P)
    [   40.823221]  ima_kexec_post_load+0x58/0xc0
    [   40.827246]  __do_sys_kexec_file_load+0x29c/0x368
    [...]
    [   40.855423] ---[ end trace 0000000000000000 ]---
    
    *** How to reproduce ***
    
    This bug is only triggered when the kexec target address is allocated in
    the CMA area. If no CMA area is reserved in the kernel, use the "cma="
    option in the kernel command line to reserve one.
    
    *** Root cause ***
    The commit 07d24902977e ("kexec: enable CMA based contiguous
    allocation") allocates the kexec target address directly on the CMA area
    to avoid copying during the jump. In this case, there is no IND_SOURCE
    for the kexec segment.  But the current implementation of
    kimage_map_segment() assumes that IND_SOURCE pages exist and map them
    into a contiguous virtual address by vmap().
    
    *** Solution ***
    If IMA segment is allocated in the CMA area, use its page_address()
    directly.
    
    Link: https://lkml.kernel.org/r/20251216014852.8737-2-piliu@redhat.com
    Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation")
    Signed-off-by: Pingfan Liu <piliu@redhat.com>
    Acked-by: Baoquan He <bhe@redhat.com>
    Cc: Alexander Graf <graf@amazon.com>
    Cc: Steven Chen <chenste@linux.microsoft.com>
    Cc: Mimi Zohar <zohar@linux.ibm.com>
    Cc: Roberto Sassu <roberto.sassu@huawei.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ksmbd: Fix memory leak in get_file_all_info() [+ + +]
Author: Zilin Guan <zilin@seu.edu.cn>
Date:   Wed Dec 24 14:20:16 2025 +0000

    ksmbd: Fix memory leak in get_file_all_info()
    
    [ Upstream commit 0c56693b06a68476ba113db6347e7897475f9e4c ]
    
    In get_file_all_info(), if vfs_getattr() fails, the function returns
    immediately without freeing the allocated filename, leading to a memory
    leak.
    
    Fix this by freeing the filename before returning in this error case.
    
    Fixes: 5614c8c487f6a ("ksmbd: replace generic_fillattr with vfs_getattr")
    Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
    Acked-by: Namjae Jeon <linkinjeon@kernel.org>
    Signed-off-by: Steve French <stfrench@microsoft.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
kunit: Enforce task execution in {soft,hard}irq contexts [+ + +]
Author: David Gow <davidgow@google.com>
Date:   Fri Dec 19 16:52:58 2025 +0800

    kunit: Enforce task execution in {soft,hard}irq contexts
    
    [ Upstream commit c31f4aa8fed048fa70e742c4bb49bb48dc489ab3 ]
    
    The kunit_run_irq_test() helper allows a function to be run in hardirq
    and softirq contexts (in addition to the task context). It does this by
    running the user-provided function concurrently in the three contexts,
    until either a timeout has expired or a number of iterations have
    completed in the normal task context.
    
    However, on setups where the initialisation of the hardirq and softirq
    contexts (or, indeed, the scheduling of those tasks) is significantly
    slower than the function execution, it's possible for that number of
    iterations to be exceeded before any runs in irq contexts actually
    occur. This occurs with the polyval.test_polyval_preparekey_in_irqs
    test, which runs 20000 iterations of the relatively fast preparekey
    function, and therefore fails often under many UML, 32-bit arm, m68k and
    other environments.
    
    Instead, ensure that the max_iterations limit counts executions in all
    three contexts, and requires at least one of each. This will cause the
    test to continue iterating until at least the irq contexts have been
    tested, or the 1s wall-clock limit has been exceeded. This causes the
    test to pass in all of my environments.
    
    In so doing, we also update the task counters to atomic ints, to better
    match both the 'int' max_iterations input, and to ensure they are
    correctly updated across contexts.
    
    Finally, we also fix a few potential assertion messages to be
    less-specific to the original crypto usecases.
    
    Fixes: 950a81224e8b ("lib/crypto: tests: Add hash-test-template.h and gen-hash-testvecs.py")
    Signed-off-by: David Gow <davidgow@google.com>
    Link: https://lore.kernel.org/r/20251219085259.1163048-1-davidgow@google.com
    Signed-off-by: Eric Biggers <ebiggers@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
KVM: s390: Fix gmap_helper_zap_one_page() again [+ + +]
Author: Claudio Imbrenda <imbrenda@linux.ibm.com>
Date:   Tue Dec 30 22:16:26 2025 -0500

    KVM: s390: Fix gmap_helper_zap_one_page() again
    
    [ Upstream commit 2f393c228cc519ddf19b8c6c05bf15723241aa96 ]
    
    A few checks were missing in gmap_helper_zap_one_page(), which can lead
    to memory corruption in the guest under specific circumstances.
    
    Add the missing checks.
    
    Fixes: 5deafa27d9ae ("KVM: s390: Fix to clear PTE when discarding a swapped page")
    Cc: stable@vger.kernel.org
    Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
    Tested-by: Marc Hartmayer <mhartmay@linux.ibm.com>
    Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
    Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
    Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
    [ adapted ptep_zap_softleaf_entry() and softleaf_from_pte() calls to ptep_zap_swap_entry() and pte_to_swp_entry() ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
leds: leds-cros_ec: Skip LEDs without color components [+ + +]
Author: Thomas Weißschuh <linux@weissschuh.net>
Date:   Tue Oct 28 16:31:03 2025 +0100

    leds: leds-cros_ec: Skip LEDs without color components
    
    commit 4dbf066d965cd3299fb396f1375d10423c9c625c upstream.
    
    A user reports that on their Lenovo Corsola Magneton with EC firmware
    steelix-15194.270.0 the driver probe fails with EINVAL. It turns out
    that the power LED does not contain any color components as indicated
    by the following "ectool led power query" output:
    
    Brightness range for LED 1:
            red     : 0x0
            green   : 0x0
            blue    : 0x0
            yellow  : 0x0
            white   : 0x0
            amber   : 0x0
    
    The LED also does not react to commands sent manually through ectool and
    is generally non-functional.
    
    Instead of failing the probe for all LEDs managed by the EC when one
    without color components is encountered, silently skip those.
    
    Cc: stable@vger.kernel.org
    Fixes: 8d6ce6f3ec9d ("leds: Add ChromeOS EC driver")
    Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
    Link: https://patch.msgid.link/20251028-cros_ec-leds-no-colors-v1-1-ebe13a02022a@weissschuh.net
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

leds: leds-lp50xx: Allow LED 0 to be added to module bank [+ + +]
Author: Christian Hitz <christian.hitz@bbv.ch>
Date:   Wed Oct 8 14:32:21 2025 +0200

    leds: leds-lp50xx: Allow LED 0 to be added to module bank
    
    commit 26fe74d598c32e7bc6f150edfc4aa43e1bee55db upstream.
    
    led_banks contains LED module number(s) that should be grouped into the
    module bank. led_banks is 0-initialized.
    By checking the led_banks entries for 0, un-set entries are detected.
    But a 0-entry also indicates that LED module 0 should be grouped into the
    module bank.
    
    By only iterating over the available entries no check for unused entries
    is required and LED module 0 can be added to bank.
    
    Cc: stable@vger.kernel.org
    Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
    Signed-off-by: Christian Hitz <christian.hitz@bbv.ch>
    Reviewed-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
    Link: https://patch.msgid.link/20251008123222.1117331-1-christian@klarinett.li
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

leds: leds-lp50xx: Enable chip before any communication [+ + +]
Author: Christian Hitz <christian.hitz@bbv.ch>
Date:   Tue Oct 28 16:51:40 2025 +0100

    leds: leds-lp50xx: Enable chip before any communication
    
    commit 434959618c47efe9e5f2e20f4a850caac4f6b823 upstream.
    
    If a GPIO is used to control the chip's enable pin, it needs to be pulled
    high before any i2c communication is attempted.
    
    Currently, the enable GPIO handling is not correct.
    
    Assume the enable GPIO is low when the probe function is entered. In this
    case the device is in SHUTDOWN mode and does not react to i2c commands.
    
    During probe the following sequence happens:
     1. The call to lp50xx_reset() on line 548 has no effect as i2c is not
        possible yet.
     2. Then - on line 552 - lp50xx_enable_disable() is called. As
        "priv->enable_gpio“ has not yet been initialized, setting the GPIO has
        no effect. Also the i2c enable command is not executed as the device
        is still in SHUTDOWN.
     3. On line 556 the call to lp50xx_probe_dt() finally parses the rest of
        the DT and the configured priv->enable_gpio is set up.
    
    As a result the device is still in SHUTDOWN mode and not ready for
    operation.
    
    Split lp50xx_enable_disable() into distinct enable and disable functions
    to enforce correct ordering between enable_gpio manipulations and i2c
    commands.
    Read enable_gpio configuration from DT before attempting to manipulate
    enable_gpio.
    Add delays to observe correct wait timing after manipulating enable_gpio
    and before any i2c communication.
    
    Cc: stable@vger.kernel.org
    Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
    Signed-off-by: Christian Hitz <christian.hitz@bbv.ch>
    Link: https://patch.msgid.link/20251028155141.1603193-1-christian@klarinett.li
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs [+ + +]
Author: Christian Hitz <christian.hitz@bbv.ch>
Date:   Wed Oct 22 08:33:04 2025 +0200

    leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs
    
    commit 5246e3673eeeccb4f5bf4f42375dd495d465ac15 upstream.
    
    LP5009 supports 9 LED outputs that are grouped into 3 modules.
    
    Cc: stable@vger.kernel.org
    Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver")
    Signed-off-by: Christian Hitz <christian.hitz@bbv.ch>
    Link: https://patch.msgid.link/20251022063305.972190-1-christian@klarinett.li
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Linux: Linux 6.18.4 [+ + +]
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Thu Jan 8 10:17:22 2026 +0100

    Linux 6.18.4
    
    Link: https://lore.kernel.org/r/20260106170547.832845344@linuxfoundation.org
    Tested-by: Brett A C Sheffield <bacs@librecast.net>
    Tested-by: Ronald Warsow <rwarsow@gmx.de>
    Tested-by: Peter Schneider <pschneider1968@googlemail.com>
    Tested-by: Shuah Khan <skhan@linuxfoundation.org>
    Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
    Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Tested-by: Christian Heusel <christian@heusel.eu>
    Tested-by: Ron Economos <re@w6rz.net>
    Tested-by: Mark Brown <broonie@kernel.org>
    Tested-by: Jeffrin Jose T <jeffrin@rajagiritech.edu.in>
    Tested-by: Salvatore Bonaccorso <carnil@debian.org>
    Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
    Tested-by: Miguel Ojeda <ojeda@kernel.org>
    Tested-by: Jon Hunter <jonathanh@nvidia.com>
    Tested-by: Hardik Garg <hargar@linux.microsoft.com>
    Tested-by: Brett Mastbergen <bmastbergen@ciq.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
lockd: fix vfs_test_lock() calls [+ + +]
Author: NeilBrown <neil@brown.name>
Date:   Sat Nov 22 12:00:36 2025 +1100

    lockd: fix vfs_test_lock() calls
    
    commit a49a2a1baa0c553c3548a1c414b6a3c005a8deba upstream.
    
    Usage of vfs_test_lock() is somewhat confused.  Documentation suggests
    it is given a "lock" but this is not the case.  It is given a struct
    file_lock which contains some details of the sort of lock it should be
    looking for.
    
    In particular passing a "file_lock" containing fl_lmops or fl_ops is
    meaningless and possibly confusing.
    
    This is particularly problematic in lockd.  nlmsvc_testlock() receives
    an initialised "file_lock" from xdr-decode, including manager ops and an
    owner.  It then mistakenly passes this to vfs_test_lock() which might
    replace the owner and the ops.  This can lead to confusion when freeing
    the lock.
    
    The primary role of the 'struct file_lock' passed to vfs_test_lock() is
    to report a conflicting lock that was found, so it makes more sense for
    nlmsvc_testlock() to pass "conflock", which it uses for returning the
    conflicting lock.
    
    With this change, freeing of the lock is not confused and code in
    __nlm4svc_proc_test() and __nlmsvc_proc_test() can be simplified.
    
    Documentation for vfs_test_lock() is improved to reflect its real
    purpose, and a WARN_ON_ONCE() is added to avoid a similar problem in the
    future.
    
    Reported-by: Olga Kornievskaia <okorniev@redhat.com>
    Closes: https://lore.kernel.org/all/20251021130506.45065-1-okorniev@redhat.com
    Signed-off-by: NeilBrown <neil@brown.name>
    Fixes: 20fa19027286 ("nfs: add export operations")
    Cc: stable@vger.kernel.org
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
LoongArch: Add new PCI ID for pci_fixup_vgadev() [+ + +]
Author: Huacai Chen <chenhuacai@kernel.org>
Date:   Sat Dec 6 10:39:49 2025 +0800

    LoongArch: Add new PCI ID for pci_fixup_vgadev()
    
    commit bf3fa8f232a1eec8d7b88dcd9e925e60f04f018d upstream.
    
    Loongson-2K3000 has a new PCI ID (0x7a46) for its display controller,
    Add it for pci_fixup_vgadev() since we prefer a discrete graphics card
    as default boot device if present.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Tianrui Zhao <zhaotianrui@loongson.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: BPF: Adjust the jump offset of tail calls [+ + +]
Author: Chenghao Duan <duanchenghao@kylinos.cn>
Date:   Wed Dec 31 15:19:21 2025 +0800

    LoongArch: BPF: Adjust the jump offset of tail calls
    
    commit 61319d15a56093358c6822d30659fe2941f589f1 upstream.
    
    Call the next bpf prog and skip the first instruction of TCC
    initialization.
    
    A total of 7 instructions are skipped:
    'move t0, ra'                   1 inst
    'move_imm + jirl'               5 inst
    'addid REG_TCC, zero, 0'        1 inst
    
    Relevant test cases: the tailcalls test item in selftests/bpf.
    
    Cc: stable@vger.kernel.org
    Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace")
    Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: BPF: Enable trampoline-based tracing for module functions [+ + +]
Author: Chenghao Duan <duanchenghao@kylinos.cn>
Date:   Wed Dec 31 15:19:21 2025 +0800

    LoongArch: BPF: Enable trampoline-based tracing for module functions
    
    commit 26138762d9a27a7f1c33f467c4123c600f64a36e upstream.
    
    Remove the previous restrictions that blocked the tracing of kernel
    module functions. Fix the issue that previously caused kernel lockups
    when attempting to trace module functions.
    
    Before entering the trampoline code, the return address register ra
    shall store the address of the next assembly instruction after the
    'bl trampoline' instruction, which is the traced function address, and
    the register t0 shall store the parent function return address. Refine
    the trampoline return logic to ensure that register data remains correct
    when returning to both the traced function and the parent function.
    
    Before this patch was applied, the module_attach test in selftests/bpf
    encountered a deadlock issue. This was caused by an incorrect jump
    address after the trampoline execution, which resulted in an infinite
    loop within the module function.
    
    Cc: stable@vger.kernel.org
    Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace")
    Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: BPF: Enhance the bpf_arch_text_poke() function [+ + +]
Author: Chenghao Duan <duanchenghao@kylinos.cn>
Date:   Tue Jan 6 10:55:02 2026 +0800

    LoongArch: BPF: Enhance the bpf_arch_text_poke() function
    
    commit 73721d8676771c6c7b06d4e636cc053fc76afefd upstream.
    
    Enhance the bpf_arch_text_poke() function to enable accurate location
    of BPF program entry points.
    
    When modifying the entry point of a BPF program, skip the "move t0, ra"
    instruction to ensure the correct logic and copy of the jump address.
    
    Cc: stable@vger.kernel.org
    Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace")
    Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: BPF: Save return address register ra to t0 before trampoline [+ + +]
Author: Chenghao Duan <duanchenghao@kylinos.cn>
Date:   Wed Dec 31 15:19:20 2025 +0800

    LoongArch: BPF: Save return address register ra to t0 before trampoline
    
    commit d314e1f48260cef3f869e3edc02a02c8a48b08e1 upstream.
    
    Modify the build_prologue() function to ensure the return address
    register ra is saved to t0 before entering trampoline operations.
    This change ensures the accurate return address handling when a BPF
    program calls another BPF program, preventing errors in the BPF-to-BPF
    call chain.
    
    Cc: stable@vger.kernel.org
    Fixes: 677e6123e3d2 ("LoongArch: BPF: Disable trampoline for kernel module function trace")
    Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: BPF: Sign extend kfunc call arguments [+ + +]
Author: Hengqi Chen <hengqi.chen@gmail.com>
Date:   Wed Dec 31 15:19:20 2025 +0800

    LoongArch: BPF: Sign extend kfunc call arguments
    
    commit 3f5a238f24d7b75f9efe324d3539ad388f58536e upstream.
    
    The kfunc calls are native calls so they should follow LoongArch calling
    conventions. Sign extend its arguments properly to avoid kernel panic.
    This is done by adding a new emit_abi_ext() helper. The emit_abi_ext()
    helper performs extension in place meaning a value already store in the
    target register (Note: this is different from the existing sign_extend()
    helper and thus we can't reuse it).
    
    Cc: stable@vger.kernel.org
    Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support")
    Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: BPF: Zero-extend bpf_tail_call() index [+ + +]
Author: Hengqi Chen <hengqi.chen@gmail.com>
Date:   Wed Dec 31 15:19:20 2025 +0800

    LoongArch: BPF: Zero-extend bpf_tail_call() index
    
    commit eb71f5c433e1c6dff089b315881dec40a88a7baf upstream.
    
    The bpf_tail_call() index should be treated as a u32 value. Let's
    zero-extend it to avoid calling wrong BPF progs. See similar fixes
    for x86 [1]) and arm64 ([2]) for more details.
    
      [1]: https://github.com/torvalds/linux/commit/90caccdd8cc0215705f18b92771b449b01e2474a
      [2]: https://github.com/torvalds/linux/commit/16338a9b3ac30740d49f5dfed81bac0ffa53b9c7
    
    Cc: stable@vger.kernel.org
    Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support")
    Signed-off-by: Hengqi Chen <hengqi.chen@gmail.com>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: Correct the calculation logic of thread_count [+ + +]
Author: Qiang Ma <maqianga@uniontech.com>
Date:   Sat Dec 6 10:39:49 2025 +0800

    LoongArch: Correct the calculation logic of thread_count
    
    commit 1de0ae21f136efa6c5d8a4d3e07b7d1ca39c750f upstream.
    
    For thread_count, the current calculation method has a maximum of 255,
    which may not be sufficient in the future. Therefore, we are correcting
    it now.
    
    Reference: SMBIOS Specification, 7.5 Processor Information (Type 4)[1]
    
    [1]: https://www.dmtf.org/sites/default/files/standards/documents/DSP0134_3.9.0.pdf
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Qiang Ma <maqianga@uniontech.com>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: Fix arch_dup_task_struct() for CONFIG_RANDSTRUCT [+ + +]
Author: Huacai Chen <chenhuacai@kernel.org>
Date:   Sat Dec 6 10:39:48 2025 +0800

    LoongArch: Fix arch_dup_task_struct() for CONFIG_RANDSTRUCT
    
    commit a91b446e359aa96cc2655318789fd37441337415 upstream.
    
    Now the optimized version of arch_dup_task_struct() for LoongArch
    assumes 'thread' is the last member of 'task_struct'. But this is
    not true if CONFIG_RANDSTRUCT is enabled after Linux-6.16.
    
    So fix the arch_dup_task_struct() function for CONFIG_RANDSTRUCT by
    copying the whole 'task_struct'.
    
    Cc: stable@vger.kernel.org   # 6.16+
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: Fix build errors for CONFIG_RANDSTRUCT [+ + +]
Author: Huacai Chen <chenhuacai@kernel.org>
Date:   Sat Dec 6 10:39:40 2025 +0800

    LoongArch: Fix build errors for CONFIG_RANDSTRUCT
    
    commit 3c250aecef62da81deb38ac6738ac0a88d91f1fc upstream.
    
    When CONFIG_RANDSTRUCT enabled, members of task_struct are randomized.
    There is a chance that TASK_STACK_CANARY be out of 12bit immediate's
    range and causes build errors. TASK_STACK_CANARY is naturally aligned,
    so fix it by replacing ld.d/st.d with ldptr.d/stptr.d which have 14bit
    immediates.
    
    Cc: stable@vger.kernel.org
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/oe-kbuild-all/202511240656.0NaPcJs1-lkp@intel.com/
    Suggested-by: Rui Wang <wangrui@loongson.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: Refactor register restoration in ftrace_common_return [+ + +]
Author: Chenghao Duan <duanchenghao@kylinos.cn>
Date:   Wed Dec 31 15:19:20 2025 +0800

    LoongArch: Refactor register restoration in ftrace_common_return
    
    commit 45cb47c628dfbd1994c619f3eac271a780602826 upstream.
    
    Refactor the register restoration sequence in the ftrace_common_return
    function to clearly distinguish between the logic of normal returns and
    direct call returns in function tracing scenarios. The logic is as
    follows:
    
    1. In the case of a normal return, the execution flow returns to the
    traced function, and ftrace must ensure that the register data is
    consistent with the state when the function was entered.
    
    ra = parent return address; t0 = traced function return address.
    
    2. In the case of a direct call return, the execution flow jumps to the
    custom trampoline function, and ftrace must ensure that the register
    data is consistent with the state when ftrace was entered.
    
    ra = traced function return address; t0 = parent return address.
    
    Cc: stable@vger.kernel.org
    Fixes: 9cdc3b6a299c ("LoongArch: ftrace: Add direct call support")
    Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: Use __pmd()/__pte() for swap entry conversions [+ + +]
Author: WangYuli <wangyuli@aosc.io>
Date:   Sat Dec 6 10:39:48 2025 +0800

    LoongArch: Use __pmd()/__pte() for swap entry conversions
    
    commit 4a71df151e703b5e7e85b33369cee59ef2665e61 upstream.
    
    The __pmd() and __pte() helper macros provide the correct initialization
    syntax and abstraction for the pmd_t and pte_t types.
    
    Use __pmd() to fix follow warning about __swp_entry_to_pmd() with gcc-15
    under specific configs [1] :
    
      In file included from ./include/linux/pgtable.h:6,
                       from ./include/linux/mm.h:31,
                       from ./include/linux/pagemap.h:8,
                       from arch/loongarch/mm/init.c:14:
      ./include/linux/swapops.h: In function ‘swp_entry_to_pmd’:
      ./arch/loongarch/include/asm/pgtable.h:302:34: error: missing braces around initializer [-Werror=missing-braces]
        302 | #define __swp_entry_to_pmd(x)   ((pmd_t) { (x).val | _PAGE_HUGE })
            |                                  ^
      ./include/linux/swapops.h:559:16: note: in expansion of macro ‘__swp_entry_to_pmd’
        559 |         return __swp_entry_to_pmd(arch_entry);
            |                ^~~~~~~~~~~~~~~~~~
      cc1: all warnings being treated as errors
    
    Also update __swp_entry_to_pte() to use __pte() for consistency.
    
    [1]. https://download.01.org/0day-ci/archive/20251119/202511190316.luI90kAo-lkp@intel.com/config
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Yuli Wang <wangyl5933@chinaunicom.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

LoongArch: Use unsigned long for _end and _text [+ + +]
Author: Tiezhu Yang <yangtiezhu@loongson.cn>
Date:   Sat Dec 6 10:39:48 2025 +0800

    LoongArch: Use unsigned long for _end and _text
    
    commit a258a3cb1895e3acf5f2fe245d17426e894bc935 upstream.
    
    It is better to use unsigned long rather than long for _end and _text to
    calculate the kernel length.
    
    Cc: stable@vger.kernel.org # v6.3+
    Fixes: e5f02b51fa0c ("LoongArch: Add support for kernel address space layout randomization (KASLR)")
    Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mcb: Add missing modpost build support [+ + +]
Author: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Date:   Tue Dec 2 09:42:00 2025 +0100

    mcb: Add missing modpost build support
    
    [ Upstream commit 1f4ea4838b13c3b2278436a8dcb148e3c23f4b64 ]
    
    mcb bus is not prepared to autoload client drivers with the data defined on
    the drivers' MODULE_DEVICE_TABLE. modpost cannot access to mcb_table_id
    inside MODULE_DEVICE_TABLE so the data declared inside is ignored.
    
    Add modpost build support for accessing to the mcb_table_id coded on device
    drivers' MODULE_DEVICE_TABLE.
    
    Fixes: 3764e82e5150 ("drivers: Introduce MEN Chameleon Bus")
    Reviewed-by: Jorge Sanjuan Garcia <dev-jorge.sanjuangarcia@duagon.com>
    Signed-off-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
    Acked-by: Nathan Chancellor <nathan@kernel.org>
    Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
    Link: https://patch.msgid.link/20251202084200.10410-1-dev-josejavier.rodriguez@duagon.com
    Signed-off-by: Nicolas Schier <nsc@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() [+ + +]
Author: Tuo Li <islituo@gmail.com>
Date:   Thu Dec 25 21:03:26 2025 +0800

    md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()
    
    [ Upstream commit 7ad6ef91d8745d04aff9cce7bdbc6320d8e05fe9 ]
    
    The variable mddev->private is first assigned to conf and then checked:
    
      conf = mddev->private;
      if (!conf) ...
    
    If conf is NULL, then mddev->private is also NULL. In this case,
    null-pointer dereferences can occur when calling raid5_quiesce():
    
      raid5_quiesce(mddev, true);
      raid5_quiesce(mddev, false);
    
    since mddev->private is assigned to conf again in raid5_quiesce(), and conf
    is dereferenced in several places, for example:
    
      conf->quiesce = 0;
      wake_up(&conf->wait_for_quiescent);
    
    To fix this issue, the function should unlock mddev and return before
    invoking raid5_quiesce() when conf is NULL, following the existing pattern
    in raid5_change_consistency_policy().
    
    Fixes: fa1944bbe622 ("md/raid5: Wait sync io to finish before changing group cnt")
    Signed-off-by: Tuo Li <islituo@gmail.com>
    Reviewed-by: Xiao Ni <xni@redhat.com>
    Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
    Link: https://lore.kernel.org/linux-raid/20251225130326.67780-1-islituo@gmail.com
    Signed-off-by: Yu Kuai <yukuai@fnnas.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
md: Fix static checker warning in analyze_sbs [+ + +]
Author: Li Nan <linan122@huawei.com>
Date:   Mon Dec 15 20:44:12 2025 +0800

    md: Fix static checker warning in analyze_sbs
    
    [ Upstream commit 00f6c1b4d15d35fadb7f34768a1831c81aaa8936 ]
    
    The following warn is reported:
    
     drivers/md/md.c:3912 analyze_sbs()
     warn: iterator 'i' not incremented
    
    Fixes: d8730f0cf4ef ("md: Remove deprecated CONFIG_MD_MULTIPATH")
    Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
    Closes: https://lore.kernel.org/linux-raid/7e2e95ce-3740-09d8-a561-af6bfb767f18@huaweicloud.com/T/#t
    Signed-off-by: Li Nan <linan122@huawei.com>
    Link: https://lore.kernel.org/linux-raid/20251215124412.4015572-1-linan666@huaweicloud.com
    Signed-off-by: Yu Kuai <yukuai@fnnas.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() [+ + +]
Author: Ivan Abramov <i.abramov@mt-integration.ru>
Date:   Wed Sep 3 02:23:31 2025 +0300

    media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()
    
    commit 8163419e3e05d71dcfa8fb49c8fdf8d76908fe51 upstream.
    
    It's possible for cp_read() and hdmi_read() to return -EIO. Those
    values are further used as indexes for accessing arrays.
    
    Fix that by checking return values where it's needed.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: a89bcd4c6c20 ("[media] adv7842: add new video decoder driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: amphion: Cancel message work before releasing the VPU core [+ + +]
Author: Ming Qian <ming.qian@oss.nxp.com>
Date:   Tue Sep 16 14:10:07 2025 +0800

    media: amphion: Cancel message work before releasing the VPU core
    
    commit ae246b0032146e352c4c06a7bf03cd3d5bcb2ecd upstream.
    
    To avoid accessing the VPU register after release of the VPU core,
    cancel the message work and destroy the workqueue that handles the
    VPU message before release of the VPU core.
    
    Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
    Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: amphion: Remove vpu_vb_is_codecconfig [+ + +]
Author: Ming Qian <ming.qian@oss.nxp.com>
Date:   Tue Sep 16 14:08:53 2025 +0800

    media: amphion: Remove vpu_vb_is_codecconfig
    
    commit 634c2cd17bd021487c57b95973bddb14be8002ff upstream.
    
    Currently the function vpu_vb_is_codecconfig() always returns 0.
    Delete it and its related code.
    
    Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
    Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: cec: Fix debugfs leak on bus_register() failure [+ + +]
Author: Haotian Zhang <vulab@iscas.ac.cn>
Date:   Mon Sep 29 19:12:29 2025 +0800

    media: cec: Fix debugfs leak on bus_register() failure
    
    commit c43bcd2b2aa3c2ca9d2433c3990ecbc2c47d10eb upstream.
    
    In cec_devnode_init(), the debugfs directory created with
    debugfs_create_dir() is not removed if bus_register() fails.
    This leaves a stale "cec" entry in debugfs and prevents
    proper module reloading.
    
    Fix this by removing the debugfs directory in the error path.
    
    Fixes: a56960e8b406 ("[media] cec: add HDMI CEC framework (core)")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe [+ + +]
Author: Duoming Zhou <duoming@zju.edu.cn>
Date:   Tue Sep 2 09:53:37 2025 +0800

    media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe
    
    commit 8f34f24355a607b98ecd9924837aab13c676eeca upstream.
    
    The delayed_work delayed_work_enable_hotplug is initialized with
    INIT_DELAYED_WORK() in adv76xx_probe(), but it is never scheduled
    anywhere in the probe function.
    
    Calling cancel_delayed_work() on a work that has never been
    scheduled is redundant and unnecessary, as there is no pending
    work to cancel.
    
    Remove the redundant cancel_delayed_work() from error handling
    path and adjust the goto label accordingly to simplify the code
    and avoid potential confusion.
    
    Fixes: 54450f591c99 ("[media] adv7604: driver for the Analog Devices ADV7604 video decoder")
    Cc: stable@vger.kernel.org
    Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: i2c: adv7842: Remove redundant cancel_delayed_work in probe [+ + +]
Author: Duoming Zhou <duoming@zju.edu.cn>
Date:   Tue Sep 2 09:10:31 2025 +0800

    media: i2c: adv7842: Remove redundant cancel_delayed_work in probe
    
    commit e66a5cc606c58e72f18f9cdd868a3672e918f9f8 upstream.
    
    The delayed_work delayed_work_enable_hotplug is initialized with
    INIT_DELAYED_WORK() in adv7842_probe(), but it is never scheduled
    anywhere in the probe function.
    
    Calling cancel_delayed_work() on a work that has never been
    scheduled is redundant and unnecessary, as there is no pending
    work to cancel.
    
    Remove the redundant cancel_delayed_work() from error handling
    path and adjust the goto label accordingly to simplify the code
    and avoid potential confusion.
    
    Fixes: a89bcd4c6c20 ("[media] adv7842: add new video decoder driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio [+ + +]
Author: Dave Stevenson <dave.stevenson@raspberrypi.com>
Date:   Fri Oct 17 13:43:49 2025 +0530

    media: i2c: imx219: Fix 1920x1080 mode to use 1:1 pixel aspect ratio
    
    commit 9ef6e4db152c34580cc52792f32485c193945395 upstream.
    
    Commit 0af46fbc333d ("media: i2c: imx219: Calculate crop rectangle
    dynamically") meant that the 1920x1080 mode switched from using no
    binning to using vertical binning but no horizontal binning, which
    resulted in stretched pixels.
    
    Until proper controls are available to independently select horizontal
    and vertical binning, restore the original 1:1 pixel aspect ratio by
    forcing binning to be uniform in both directions.
    
    Cc: stable@vger.kernel.org
    Fixes: 0af46fbc333d ("media: i2c: imx219: Calculate crop rectangle dynamically")
    Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
    [Add comment & reword commit message]
    Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
    Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
    Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: iris: Refine internal buffer reconfiguration logic for resolution change [+ + +]
Author: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Date:   Wed Nov 5 11:17:37 2025 +0530

    media: iris: Refine internal buffer reconfiguration logic for resolution change
    
    commit aec75e355c633e4b0967c99580bd8ef93e0cdc98 upstream.
    
    Improve the condition used to determine when input internal buffers need
    to be reconfigured during streamon on the capture port. Previously, the
    check relied on the INPUT_PAUSE sub-state, which was also being set
    during seek operations. This led to input buffers being queued multiple
    times to the firmware, causing session errors due to duplicate buffer
    submissions.
    
    This change introduces a more accurate check using the FIRST_IPSC and
    DRC sub-states to ensure that input buffer reconfiguration is triggered
    only during resolution change scenarios, such as streamoff/on on the
    capture port. This avoids duplicate buffer queuing during seek
    operations.
    
    Fixes: c1f8b2cc72ec ("media: iris: handle streamoff/on from client in dynamic resolution change")
    Cc: stable@vger.kernel.org
    Reported-by: Val Packett <val@packett.cool>
    Closes: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/4700
    Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
    Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
    Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init() [+ + +]
Author: Haoxiang Li <haoxiang_li2024@163.com>
Date:   Mon Sep 15 20:09:38 2025 +0800

    media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()
    
    commit cdd0f118ef87db8a664fb5ea366fd1766d2df1cd upstream.
    
    vpu_get_plat_device() increases the reference count of the returned
    platform device. However, when devm_kzalloc() fails, the reference
    is not released, causing a reference leak.
    
    Fix this by calling put_device() on fw_pdev->dev before returning
    on the error path.
    
    Fixes: e25a89f743b1 ("media: mtk-vcodec: potential dereference of null pointer")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Reviewed-by: Tzung-Bi Shih <tzungbi@kernel.org>
    Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: mediatek: vcodec: Use spinlock for context list protection lock [+ + +]
Author: Chen-Yu Tsai <wenst@chromium.org>
Date:   Wed Aug 20 15:54:05 2025 +0800

    media: mediatek: vcodec: Use spinlock for context list protection lock
    
    commit a5844227e0f030d2af2d85d4aed10c5eca6ca176 upstream.
    
    Previously a mutex was added to protect the encoder and decoder context
    lists from unexpected changes originating from the SCP IP block, causing
    the context pointer to go invalid, resulting in a NULL pointer
    dereference in the IPI handler.
    
    Turns out on the MT8173, the VPU IPI handler is called from hard IRQ
    context. This causes a big warning from the scheduler. This was first
    reported downstream on the ChromeOS kernels, but is also reproducible
    on mainline using Fluster with the FFmpeg v4l2m2m decoders. Even though
    the actual capture format is not supported, the affected code paths
    are triggered.
    
    Since this lock just protects the context list and operations on it are
    very fast, it should be OK to switch to a spinlock.
    
    Fixes: 6467cda18c9f ("media: mediatek: vcodec: adding lock to protect decoder context list")
    Fixes: afaaf3a0f647 ("media: mediatek: vcodec: adding lock to protect encoder context list")
    Cc: Yunfei Dong <yunfei.dong@mediatek.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
    Reviewed-by: Fei Shao <fshao@chromium.org>
    Reviewed-by: Tomasz Figa <tfiga@chromium.org>
    Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread() [+ + +]
Author: Ivan Abramov <i.abramov@mt-integration.ru>
Date:   Wed Sep 3 02:28:14 2025 +0300

    media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()
    
    commit d2bceb2e20e783d57e739c71e4e50b4b9f4a3953 upstream.
    
    It's possible for max1 to remain -1 if msp_read() always fail. This
    variable is further used as index for accessing arrays.
    
    Fix that by checking max1 prior to array accesses.
    
    It seems that restart is the preferable action in case of out-of-bounds
    value.
    
    Found by Linux Verification Center (linuxtesting.org) with SVACE.
    
    Fixes: 8a4b275f9c19 ("V4L/DVB (3427): audmode and rxsubchans fixes (VIDIOC_G/S_TUNER)")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: platform: mtk-mdp3: fix device leaks at probe [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Wed Sep 24 16:39:19 2025 +0200

    media: platform: mtk-mdp3: fix device leaks at probe
    
    commit 8f6f3aa21517ef34d50808af0c572e69580dca20 upstream.
    
    Make sure to drop the references taken when looking up the subsys
    devices during probe on probe failure (e.g. probe deferral) and on
    driver unbind.
    
    Similarly, drop the SCP device reference after retrieving its platform
    data during probe to avoid leaking it.
    
    Note that holding a reference to a device does not prevent its driver
    data from going away.
    
    Fixes: 61890ccaefaf ("media: platform: mtk-mdp3: add MediaTek MDP3 driver")
    Cc: stable@vger.kernel.org      # 6.1
    Cc: Moudy Ho <moudy.ho@mediatek.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
    Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: rc: st_rc: Fix reset control resource leak [+ + +]
Author: Haotian Zhang <vulab@iscas.ac.cn>
Date:   Fri Oct 31 14:03:32 2025 +0800

    media: rc: st_rc: Fix reset control resource leak
    
    commit 1240abf4b71f632f0117b056e22488e4d9808938 upstream.
    
    The driver calls reset_control_get_optional_exclusive() but never calls
    reset_control_put() in error paths or in the remove function. This causes
    a resource leak when probe fails after successfully acquiring the reset
    control, or when the driver is unloaded.
    
    Switch to devm_reset_control_get_optional_exclusive() to automatically
    manage the reset control resource.
    
    Fixes: a4b80242d046 ("media: st-rc: explicitly request exclusive reset control")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
    Reviewed-by: Patrice Chotard <patrice.chotard@foss.st.com>
    Signed-off-by: Sean Young <sean@mess.org>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled [+ + +]
Author: Miaoqian Lin <linmq006@gmail.com>
Date:   Wed Sep 3 21:37:29 2025 +0800

    media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled
    
    commit 445e1658894fd74eab7e53071fa16233887574ed upstream.
    
    The function calls of_parse_phandle() which returns
    a device node with an incremented reference count. When the bonded device
    is not available, the function
    returns NULL without releasing the reference, causing a reference leak.
    
    Add of_node_put(np) to release the device node reference.
    The of_node_put function handles NULL pointers.
    
    Found through static analysis by reviewing the doc of of_parse_phandle()
    and cross-checking its usage patterns across the codebase.
    
    Fixes: 7625ee981af1 ("[media] media: platform: rcar_drif: Add DRIF support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
    Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Reviewed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: samsung: exynos4-is: fix potential ABBA deadlock on init [+ + +]
Author: Marek Szyprowski <m.szyprowski@samsung.com>
Date:   Tue Oct 14 12:46:43 2025 +0200

    media: samsung: exynos4-is: fix potential ABBA deadlock on init
    
    commit 17dc8ccd6dd5ffe30aa9b0d36e2af1389344ce2b upstream.
    
    v4l2_device_register_subdev_nodes() must called without taking
    media_dev->graph_mutex to avoid potential AB-BA deadlock on further
    subdevice driver initialization.
    
    Fixes: fa91f1056f17 ("[media] exynos4-is: Add support for asynchronous subdevices registration")
    Cc: stable@vger.kernel.org
    Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Acked-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: TDA1997x: Remove redundant cancel_delayed_work in probe [+ + +]
Author: Duoming Zhou <duoming@zju.edu.cn>
Date:   Mon Sep 1 21:26:17 2025 +0800

    media: TDA1997x: Remove redundant cancel_delayed_work in probe
    
    commit 29de195ca39fc2ac0af6fd45522994df9f431f80 upstream.
    
    The delayed_work delayed_work_enable_hpd is initialized with
    INIT_DELAYED_WORK(), but it is never scheduled in tda1997x_probe().
    
    Calling cancel_delayed_work() on a work that has never been
    scheduled is redundant and unnecessary, as there is no pending
    work to cancel.
    
    Remove the redundant cancel_delayed_work() from error handling
    path in tda1997x_probe() to avoid potential confusion.
    
    Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: verisilicon: Fix CPU stalls on G2 bus error [+ + +]
Author: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Date:   Mon Sep 22 14:43:38 2025 -0400

    media: verisilicon: Fix CPU stalls on G2 bus error
    
    commit 19c286b755072a22a063052f530a6b1fac8a1f63 upstream.
    
    In some seek stress tests, we are getting IRQ from the G2 decoder where
    the dec_bus_int and the dec_e bits are high, meaning the decoder is
    still running despite the error.
    
    Fix this by reworking the IRQ handler to only finish the job once we
    have reached completion and move the software reset to when our software
    watchdog triggers.
    
    This way, we let the hardware continue on errors when it did not self
    reset and in worse case scenario the hardware timeout will
    automatically stop it. The actual error will be fixed in a follow up
    patch.
    
    Fixes: 3385c514ecc5a ("media: hantro: Convert imx8m_vpu_g2_irq to helper")
    Cc: stable@vger.kernel.org
    Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
    Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: verisilicon: Protect G2 HEVC decoder against invalid DPB index [+ + +]
Author: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Date:   Mon Sep 22 14:43:39 2025 -0400

    media: verisilicon: Protect G2 HEVC decoder against invalid DPB index
    
    commit 47825b1646a6a9eca0f90baa3d4f98947c2add96 upstream.
    
    Fix the Hantro G2 HEVC decoder so that we use DPB index 0 whenever a
    ninvalid index is received from user space. This protects the hardware
    from doing faulty memory access which then leads to bus errors.
    
    To be noted that when a reference is missing, userspace such as GStreamer
    passes an invalid DPB index of 255. This issue was found by seeking to a
    CRA picture using GStreamer. The framework is currently missing the code
    to skip over RASL pictures placed after the CRA. This situation can also
    occur while doing live streaming over lossy transport.
    
    Fixes: cb5dd5a0fa518 ("media: hantro: Introduce G2/HEVC decoder")
    Cc: stable@vger.kernel.org
    Reviewed-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
    Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: videobuf2: Fix device reference leak in vb2_dc_alloc error path [+ + +]
Author: Haotian Zhang <vulab@iscas.ac.cn>
Date:   Tue Oct 28 14:44:43 2025 +0800

    media: videobuf2: Fix device reference leak in vb2_dc_alloc error path
    
    commit 94de23a9aa487d7c1372efb161721d7949a177ae upstream.
    
    In vb2_dc_alloc(), get_device() is called to increment the device
    reference count. However, if subsequent DMA allocation fails
    (vb2_dc_alloc_coherent or vb2_dc_alloc_non_coherent returns error),
    the function returns without calling put_device(), causing a device
    reference leak.
    
    Add put_device() call in the error path before kfree() to properly
    release the device reference acquired earlier.
    
    Fixes: de27891f675e ("media: videobuf2: handle non-contiguous DMA allocations")
    Cc: stable@vger.kernel.org
    Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
    Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: vpif_capture: fix section mismatch [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Oct 17 07:33:20 2025 +0200

    media: vpif_capture: fix section mismatch
    
    commit 0ef841113724166c3c484d0e9ae6db1eb5634fde upstream.
    
    Platform drivers can be probed after their init sections have been
    discarded (e.g. on probe deferral or manual rebind through sysfs) so the
    probe function must not live in init.
    
    Note that commit ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section
    mismatch warning") incorrectly suppressed the modpost warning.
    
    Fixes: ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section mismatch warning")
    Fixes: 6ffefff5a9e7 ("V4L/DVB (12906c): V4L : vpif capture driver for DM6467")
    Cc: stable@vger.kernel.org      # 2.6.32
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

media: vpif_display: fix section mismatch [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Fri Oct 17 07:33:21 2025 +0200

    media: vpif_display: fix section mismatch
    
    commit 59ca64bf98e4209df8ace8057d31ae3c80f948cd upstream.
    
    Platform drivers can be probed after their init sections have been
    discarded (e.g. on probe deferral or manual rebind through sysfs) so the
    probe function must not live in init.
    
    Note that commit ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section
    mismatch warning") incorrectly suppressed the modpost warning.
    
    Fixes: ffa1b391c61b ("V4L/DVB: vpif_cap/disp: Removed section mismatch warning")
    Fixes: e7332e3a552f ("V4L/DVB (12176): davinci/vpif_display: Add VPIF display driver")
    Cc: stable@vger.kernel.org      # 2.6.32
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup [+ + +]
Author: Johan Hovold <johan@kernel.org>
Date:   Thu Sep 25 17:02:19 2025 +0200

    mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup
    
    commit ccb7cd3218e48665f3c7e19eede0da5f069c323d upstream.
    
    Make sure to drop the reference taken to the sysmgr platform device when
    retrieving its driver data.
    
    Note that holding a reference to a device does not prevent its driver
    data from going away.
    
    Fixes: f36e789a1f8d ("mfd: altera-sysmgr: Add SOCFPGA System Manager")
    Cc: stable@vger.kernel.org      # 5.2
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mfd: max77620: Fix potential IRQ chip conflict when probing two devices [+ + +]
Author: Krzysztof Kozlowski <krzk@kernel.org>
Date:   Thu Oct 23 12:19:40 2025 +0200

    mfd: max77620: Fix potential IRQ chip conflict when probing two devices
    
    commit 2bac49bad1f3553cc3b3bfb22cc194e9bd9e8427 upstream.
    
    MAX77620 is most likely always a single device on the board, however
    nothing stops board designers to have two of them, thus same device
    driver could probe twice. Or user could manually try to probing second
    time.
    
    Device driver is not ready for that case, because it allocates
    statically 'struct regmap_irq_chip' as non-const and stores during
    probe in 'irq_drv_data' member a pointer to per-probe state
    container ('struct max77620_chip').  devm_regmap_add_irq_chip() does not
    make a copy of 'struct regmap_irq_chip' but store the pointer.
    
    Second probe - either successful or failure - would overwrite the
    'irq_drv_data' from previous device probe, so interrupts would be
    executed in a wrong context.
    
    Cc: stable@vger.kernel.org
    Fixes: 3df140d11c6d ("mfd: max77620: Mask/unmask interrupt before/after servicing it")
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Link: https://patch.msgid.link/20251023101939.67991-2-krzysztof.kozlowski@linaro.org
    Signed-off-by: Lee Jones <lee@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm, swap: do not perform synchronous discard during allocation [+ + +]
Author: Kairui Song <kasong@tencent.com>
Date:   Fri Oct 24 02:34:11 2025 +0800

    mm, swap: do not perform synchronous discard during allocation
    
    commit 9fb749cd15078c7bdc46e5d45c37493f83323e33 upstream.
    
    Patch series "mm, swap: misc cleanup and bugfix", v2.
    
    A few cleanups and a bugfix that are either suitable after the swap table
    phase I or found during code review.
    
    Patch 1 is a bugfix and needs to be included in the stable branch, the
    rest have no behavioral change.
    
    
    This patch (of 5):
    
    Since commit 1b7e90020eb77 ("mm, swap: use percpu cluster as allocation
    fast path"), swap allocation is protected by a local lock, which means we
    can't do any sleeping calls during allocation.
    
    However, the discard routine is not taken well care of.  When the swap
    allocator failed to find any usable cluster, it would look at the pending
    discard cluster and try to issue some blocking discards.  It may not
    necessarily sleep, but the cond_resched at the bio layer indicates this is
    wrong when combined with a local lock.  And the bio GFP flag used for
    discard bio is also wrong (not atomic).
    
    It's arguable whether this synchronous discard is helpful at all.  In most
    cases, the async discard is good enough.  And the swap allocator is doing
    very differently at organizing the clusters since the recent change, so it
    is very rare to see discard clusters piling up.
    
    So far, no issues have been observed or reported with typical SSD setups
    under months of high pressure.  This issue was found during my code
    review.  But by hacking the kernel a bit: adding a mdelay(500) in the
    async discard path, this issue will be observable with WARNING triggered
    by the wrong GFP and cond_resched in the bio layer for debug builds.
    
    So now let's apply a hotfix for this issue: remove the synchronous discard
    in the swap allocation path.  And when order 0 is failing with all cluster
    list drained on all swap devices, try to do a discard following the swap
    device priority list.  If any discards released some cluster, try the
    allocation again.  This way, we can still avoid OOM due to swap failure if
    the hardware is very slow and memory pressure is extremely high.
    
    This may cause more fragmentation issues if the discarding hardware is
    really slow.  Ideally, we want to discard pending clusters before
    continuing to iterate the fragment cluster lists.  This can be implemented
    in a cleaner way if we clean up the device list iteration part first.
    
    Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-0-a709469052e7@tencent.com
    Link: https://lkml.kernel.org/r/20251024-swap-clean-after-swap-table-p1-v2-1-c5b0e1092927@tencent.com
    Fixes: 1b7e90020eb7 ("mm, swap: use percpu cluster as allocation fast path")
    Signed-off-by: Kairui Song <kasong@tencent.com>
    Acked-by: Nhat Pham <nphamcs@gmail.com>
    Acked-by: Chris Li <chrisl@kernel.org>
    Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
    Cc: Baoquan He <bhe@redhat.com>
    Cc: Barry Song <baohua@kernel.org>
    Cc: David Hildenbrand <david@redhat.com>
    Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
    Cc: Kemeng Shi <shikemeng@huaweicloud.com>
    Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/damon/tests/core-kunit: fix memory leak in damon_test_set_filters_default_reject() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:19:55 2025 -0700

    mm/damon/tests/core-kunit: fix memory leak in damon_test_set_filters_default_reject()
    
    commit b5ab490d85b772bc99d2648182a282f39f08feb6 upstream.
    
    Patch series "mm/damon/tests: fix memory bugs in kunit tests".
    
    DAMON kunit tests were initially written assuming those will be run on
    environments that are well controlled and therefore tolerant to transient
    test failures and bugs in the test code itself.  The user-mode linux based
    manual run of the tests is one example of such an environment.  And the
    test code was written for adding more test coverage as fast as possible,
    over making those safe and reliable.
    
    As a result, the tests resulted in having a number of bugs including real
    memory leaks, theoretical unhandled memory allocation failures, and unused
    memory allocations.  The allocation failures that are not handled well are
    unlikely in the real world, since those allocations are too small to fail.
    But in theory, it can happen and cause inappropriate memory access.
    
    It is arguable if bugs in test code can really harm users.  But, anyway
    bugs are bugs that need to be fixed.  Fix the bugs one by one.  Also Cc
    stable@ for the fixes of memory leak and unhandled memory allocation
    failures.  The unused memory allocations are only a matter of memory
    efficiency, so not Cc-ing stable@.
    
    The first patch fixes memory leaks in the test code for the DAMON core
    layer.
    
    Following fifteen, three, and one patches respectively fix unhandled
    memory allocation failures in the test code for DAMON core layer, virtual
    address space DAMON operation set, and DAMON sysfs interface, one by one
    per test function.
    
    Final two patches remove memory allocations that are correctly deallocated
    at the end, but not really being used by any code.
    
    
    This patch (of 22):
    
    Kunit test function for damos_set_filters_default_reject() allocates two
    'struct damos_filter' objects and not deallocates those, so that the
    memory for the two objects are leaked for every time the test runs.  Fix
    this by deallocating those objects at the end of the test code.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-1-sj@kernel.org
    Link: https://lkml.kernel.org/r/20251101182021.74868-2-sj@kernel.org
    Fixes: 094fb14913c7 ("mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject()")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.16+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:07 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()
    
    commit 28ab2265e9422ccd81e4beafc0ace90f78de04c4 upstream.
    
    damon_test_new_filter() is assuming all dynamic memory allocation in it
    will succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-14-sj@kernel.org
    Fixes: 2a158e956b98 ("mm/damon/core-test: add a test for damos_new_filter()")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.6+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:06 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()
    
    commit 915a2453d824a9b6bf724e3f970d86ae1d092a61 upstream.
    
    damon_test_set_attrs() is assuming all dynamic memory allocation in it
    will succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-13-sj@kernel.org
    Fixes: aa13779be6b7 ("mm/damon/core-test: add a test for damon_set_attrs()")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.5+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failure on damos_test_commit_filter() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:08 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failure on damos_test_commit_filter()
    
    commit 3e5c4a1a1737bd79abaaa184233d0f815e62273b upstream.
    
    damon_test_commit_filter() is assuming all dynamic memory allocation in it
    will succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-15-sj@kernel.org
    Fixes: f6a4a150f1ec ("mm/damon/tests/core-kunit: add damos_commit_filter test")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.18+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:03 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration()
    
    commit 4f835f4e8c863985f15abd69db033c2f66546094 upstream.
    
    damon_test_ops_registration() is assuming all dynamic memory allocation in
    it will succeed.  Those are indeed likely in the real use cases since
    those allocations are too small to fail, but theoretically those could
    fail.  In the case, inappropriate memory access can happen.  Fix it by
    appropriately cleanup pre-allocated memory and skip the execution of the
    remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-10-sj@kernel.org
    Fixes: 4f540f5ab4f2 ("mm/damon/core-test: add a kunit test case for ops registration")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.19+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:04 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()
    
    commit 74d5969995d129fd59dd93b9c7daa6669cb6810f upstream.
    
    damon_test_set_regions() is assuming all dynamic memory allocation in it
    will succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-11-sj@kernel.org
    Fixes: 62f409560eb2 ("mm/damon/core-test: test damon_set_regions")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.1+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:05 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result()
    
    commit 8cf298c01b7fdb08eef5b6b26d0fe98d48134d72 upstream.
    
    damon_test_update_monitoring_result() is assuming all dynamic memory
    allocation in it will succeed.  Those are indeed likely in the real use
    cases since those allocations are too small to fail, but theoretically
    those could fail.  In the case, inappropriate memory access can happen.
    Fix it by appropriately cleanup pre-allocated memory and skip the
    execution of the remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-12-sj@kernel.org
    Fixes: f4c978b6594b ("mm/damon/core-test: add a test for damon_update_monitoring_results()")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.3+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:00 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()
    
    commit 3d443dd29a1db7efa587a4bb0c06a497e13ca9e4 upstream.
    
    damon_test_merge_two() is assuming all dynamic memory allocation in it
    will succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-7-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures on damon_test_set_filters_default_reject() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:10 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures on damon_test_set_filters_default_reject()
    
    commit 84be856cc87317bc60ff54bd7c8f8a5aa8f0e2c8 upstream.
    
    damon_test_set_filters_default_reject() is assuming all dynamic memory
    allocation in it will succeed.  Those are indeed likely in the real use
    cases since those allocations are too small to fail, but theoretically
    those could fail.  In the case, inappropriate memory access can happen.
    Fix it by appropriately cleanup pre-allocated memory and skip the
    execution of the remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-17-sj@kernel.org
    Fixes: 094fb14913c7 ("mm/damon/tests/core-kunit: add a test for damos_set_filters_default_reject()")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.16+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:19:59 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()
    
    commit 5e80d73f22043c59c8ad36452a3253937ed77955 upstream.
    
    damon_test_split_at() is assuming all dynamic memory allocation in it will
    succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-6-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Mon Jan 5 17:42:49 2026 -0800

    mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()
    
    damon_test_split_regions_of() is assuming all dynamic memory allocation in
    it will succeed.  Those are indeed likely in the real use cases since
    those allocations are too small to fail, but theoretically those could
    fail.  In the case, inappropriate memory access can happen.  Fix it by
    appropriately cleanup pre-allocated memory and skip the execution of the
    remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-9-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    (cherry picked from commit eded254cb69044bd4abde87394ea44909708d7c0)
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:09 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out()
    
    commit d14d5671e7c9cc788c5a1edfa94e6f9064275905 upstream.
    
    damon_test_filter_out() is assuming all dynamic memory allocation in it
    will succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-16-sj@kernel.org
    Fixes: 26713c890875 ("mm/damon/core-test: add a unit test for __damos_filter_out()")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.6+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:01 2025 -0700

    mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()
    
    commit 0998d2757218771c59d5ca59ccf13d1542a38f17 upstream.
    
    damon_test_merge_regions_of() is assuming all dynamic memory allocation in
    it will succeed.  Those are indeed likely in the real use cases since
    those allocations are too small to fail, but theoretically those could
    fail.  In the case, inappropriate memory access can happen.  Fix it by
    appropriately cleanup pre-allocated memory and skip the execution of the
    remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-8-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:19:56 2025 -0700

    mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()
    
    commit e16fdd4f754048d6e23c56bd8d920b71e41e3777 upstream.
    
    damon_test_regions() is assuming all dynamic memory allocation in it will
    succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-3-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:19:58 2025 -0700

    mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()
    
    commit f79f2fc44ebd0ed655239046be3e80e8804b5545 upstream.
    
    damon_test_aggregate() is assuming all dynamic memory allocation in it
    will succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-5-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/core-kunit: handle memory failure from damon_test_target() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:19:57 2025 -0700

    mm/damon/tests/core-kunit: handle memory failure from damon_test_target()
    
    commit fafe953de2c661907c94055a2497c6b8dbfd26f3 upstream.
    
    damon_test_target() is assuming all dynamic memory allocation in it will
    succeed.  Those are indeed likely in the real use cases since those
    allocations are too small to fail, but theoretically those could fail.  In
    the case, inappropriate memory access can happen.  Fix it by appropriately
    cleanup pre-allocated memory and skip the execution of the remaining tests
    in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-4-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:14 2025 -0700

    mm/damon/tests/sysfs-kunit: handle alloc failures on damon_sysfs_test_add_targets()
    
    commit 7d808bf13943f4c6a6142400bffe14267f6dc997 upstream.
    
    damon_sysfs_test_add_targets() is assuming all dynamic memory allocation
    in it will succeed.  Those are indeed likely in the real use cases since
    those allocations are too small to fail, but theoretically those could
    fail.  In the case, inappropriate memory access can happen.  Fix it by
    appropriately cleanup pre-allocated memory and skip the execution of the
    remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-21-sj@kernel.org
    Fixes: b8ee5575f763 ("mm/damon/sysfs-test: add a unit test for damon_sysfs_set_targets()")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [6.7+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:12 2025 -0700

    mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()
    
    commit 7890e5b5bb6e386155c6e755fe70e0cdcc77f18e upstream.
    
    damon_test_split_evenly_fail() is assuming all dynamic memory allocation
    in it will succeed.  Those are indeed likely in the real use cases since
    those allocations are too small to fail, but theoretically those could
    fail.  In the case, inappropriate memory access can happen.  Fix it by
    appropriately cleanup pre-allocated memory and skip the execution of the
    remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-19-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:11 2025 -0700

    mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()
    
    commit 2b22d0fcc6320ba29b2122434c1d2f0785fb0a25 upstream.
    
    damon_do_test_apply_three_regions() is assuming all dynamic memory
    allocation in it will succeed.  Those are indeed likely in the real use
    cases since those allocations are too small to fail, but theoretically
    those could fail.  In the case, inappropriate memory access can happen.
    Fix it by appropriately cleanup pre-allocated memory and skip the
    execution of the remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-18-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ() [+ + +]
Author: SeongJae Park <sj@kernel.org>
Date:   Sat Nov 1 11:20:13 2025 -0700

    mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()
    
    commit 0a63a0e7570b9b2631dfb8d836dc572709dce39e upstream.
    
    damon_test_split_evenly_succ() is assuming all dynamic memory allocation
    in it will succeed.  Those are indeed likely in the real use cases since
    those allocations are too small to fail, but theoretically those could
    fail.  In the case, inappropriate memory access can happen.  Fix it by
    appropriately cleanup pre-allocated memory and skip the execution of the
    remaining tests in the failure cases.
    
    Link: https://lkml.kernel.org/r/20251101182021.74868-20-sj@kernel.org
    Fixes: 17ccae8bb5c9 ("mm/damon: add kunit tests")
    Signed-off-by: SeongJae Park <sj@kernel.org>
    Cc: Brendan Higgins <brendan.higgins@linux.dev>
    Cc: David Gow <davidgow@google.com>
    Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
    Cc: <stable@vger.kernel.org>    [5.15+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/huge_memory: merge uniform_split_supported() and non_uniform_split_supported() [+ + +]
Author: Wei Yang <richard.weiyang@gmail.com>
Date:   Mon Dec 29 21:48:31 2025 -0500

    mm/huge_memory: merge uniform_split_supported() and non_uniform_split_supported()
    
    [ Upstream commit 8a0e4bdddd1c998b894d879a1d22f1e745606215 ]
    
    uniform_split_supported() and non_uniform_split_supported() share
    significantly similar logic.
    
    The only functional difference is that uniform_split_supported() includes
    an additional check on the requested @new_order.
    
    The reason for this check comes from the following two aspects:
    
      * some file system or swap cache just supports order-0 folio
      * the behavioral difference between uniform/non-uniform split
    
    The behavioral difference between uniform split and non-uniform:
    
      * uniform split splits folio directly to @new_order
      * non-uniform split creates after-split folios with orders from
        folio_order(folio) - 1 to new_order.
    
    This means for non-uniform split or !new_order split we should check the
    file system and swap cache respectively.
    
    This commit unifies the logic and merge the two functions into a single
    combined helper, removing redundant code and simplifying the split
    support checking mechanism.
    
    Link: https://lkml.kernel.org/r/20251106034155.21398-3-richard.weiyang@gmail.com
    Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages")
    Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
    Reviewed-by: Zi Yan <ziy@nvidia.com>
    Cc: Zi Yan <ziy@nvidia.com>
    Cc: "David Hildenbrand (Red Hat)" <david@kernel.org>
    Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
    Cc: Barry Song <baohua@kernel.org>
    Cc: Dev Jain <dev.jain@arm.com>
    Cc: Lance Yang <lance.yang@linux.dev>
    Cc: Liam Howlett <liam.howlett@oracle.com>
    Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Cc: Nico Pache <npache@redhat.com>
    Cc: Ryan Roberts <ryan.roberts@arm.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [ split_type => uniform_split and replaced SPLIT_TYPE_NON_UNIFORM checks ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN [+ + +]
Author: Jiayuan Chen <jiayuan.chen@linux.dev>
Date:   Thu Dec 4 18:59:55 2025 +0000

    mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN
    
    commit 007f5da43b3d0ecff972e2616062b8da1f862f5e upstream.
    
    Patch series "kasan: vmalloc: Fixes for the percpu allocator and
    vrealloc", v3.
    
    Patches fix two issues related to KASAN and vmalloc.
    
    The first one, a KASAN tag mismatch, possibly resulting in a kernel panic,
    can be observed on systems with a tag-based KASAN enabled and with
    multiple NUMA nodes.  Initially it was only noticed on x86 [1] but later a
    similar issue was also reported on arm64 [2].
    
    Specifically the problem is related to how vm_structs interact with
    pcpu_chunks - both when they are allocated, assigned and when pcpu_chunk
    addresses are derived.
    
    When vm_structs are allocated they are unpoisoned, each with a different
    random tag, if vmalloc support is enabled along the KASAN mode.  Later
    when first pcpu chunk is allocated it gets its 'base_addr' field set to
    the first allocated vm_struct.  With that it inherits that vm_struct's
    tag.
    
    When pcpu_chunk addresses are later derived (by pcpu_chunk_addr(), for
    example in pcpu_alloc_noprof()) the base_addr field is used and offsets
    are added to it.  If the initial conditions are satisfied then some of the
    offsets will point into memory allocated with a different vm_struct.  So
    while the lower bits will get accurately derived the tag bits in the top
    of the pointer won't match the shadow memory contents.
    
    The solution (proposed at v2 of the x86 KASAN series [3]) is to unpoison
    the vm_structs with the same tag when allocating them for the per cpu
    allocator (in pcpu_get_vm_areas()).
    
    The second one reported by syzkaller [4] is related to vrealloc and
    happens because of random tag generation when unpoisoning memory without
    allocating new pages.  This breaks shadow memory tracking and needs to
    reuse the existing tag instead of generating a new one.  At the same time
    an inconsistency in used flags is corrected.
    
    
    This patch (of 3):
    
    Syzkaller reported a memory out-of-bounds bug [4].  This patch fixes two
    issues:
    
    1. In vrealloc the KASAN_VMALLOC_VM_ALLOC flag is missing when
       unpoisoning the extended region. This flag is required to correctly
       associate the allocation with KASAN's vmalloc tracking.
    
       Note: In contrast, vzalloc (via __vmalloc_node_range_noprof)
       explicitly sets KASAN_VMALLOC_VM_ALLOC and calls
       kasan_unpoison_vmalloc() with it.  vrealloc must behave consistently --
       especially when reusing existing vmalloc regions -- to ensure KASAN can
       track allocations correctly.
    
    2. When vrealloc reuses an existing vmalloc region (without allocating
       new pages) KASAN generates a new tag, which breaks tag-based memory
       access tracking.
    
    Introduce KASAN_VMALLOC_KEEP_TAG, a new KASAN flag that allows reusing the
    tag already attached to the pointer, ensuring consistent tag behavior
    during reallocation.
    
    Pass KASAN_VMALLOC_KEEP_TAG and KASAN_VMALLOC_VM_ALLOC to the
    kasan_unpoison_vmalloc inside vrealloc_node_align_noprof().
    
    Link: https://lkml.kernel.org/r/cover.1765978969.git.m.wieczorretman@pm.me
    Link: https://lkml.kernel.org/r/38dece0a4074c43e48150d1e242f8242c73bf1a5.1764874575.git.m.wieczorretman@pm.me
    Link: https://lore.kernel.org/all/e7e04692866d02e6d3b32bb43b998e5d17092ba4.1738686764.git.maciej.wieczor-retman@intel.com/ [1]
    Link: https://lore.kernel.org/all/aMUrW1Znp1GEj7St@MiWiFi-R3L-srv/ [2]
    Link: https://lore.kernel.org/all/CAPAsAGxDRv_uFeMYu9TwhBVWHCCtkSxoWY4xmFB_vowMbi8raw@mail.gmail.com/ [3]
    Link: https://syzkaller.appspot.com/bug?extid=997752115a851cb0cf36 [4]
    Fixes: a0309faf1cb0 ("mm: vmalloc: support more granular vrealloc() sizing")
    Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
    Co-developed-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
    Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
    Reported-by: syzbot+997752115a851cb0cf36@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/68e243a2.050a0220.1696c6.007d.GAE@google.com/T/
    Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
    Cc: Danilo Krummrich <dakr@kernel.org>
    Cc: Dmitriy Vyukov <dvyukov@google.com>
    Cc: Kees Cook <kees@kernel.org>
    Cc: Marco Elver <elver@google.com>
    Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
    Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/page_alloc: change all pageblocks migrate type on coalescing [+ + +]
Author: Alexander Gordeev <agordeev@linux.ibm.com>
Date:   Fri Dec 12 16:14:57 2025 +0100

    mm/page_alloc: change all pageblocks migrate type on coalescing
    
    commit 7838a4eb8a1d23160bd3f588ea7f2b8f7c00c55b upstream.
    
    When a page is freed it coalesces with a buddy into a higher order page
    while possible.  When the buddy page migrate type differs, it is expected
    to be updated to match the one of the page being freed.
    
    However, only the first pageblock of the buddy page is updated, while the
    rest of the pageblocks are left unchanged.
    
    That causes warnings in later expand() and other code paths (like below),
    since an inconsistency between migration type of the list containing the
    page and the page-owned pageblocks migration types is introduced.
    
    [  308.986589] ------------[ cut here ]------------
    [  308.987227] page type is 0, passed migratetype is 1 (nr=256)
    [  308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270
    [  308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E)
    [  308.987439] Unloaded tainted modules: hmac_s390(E):2
    [  308.987650] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G            E       6.18.0-gcc-bpf-debug #431 PREEMPT
    [  308.987657] Tainted: [E]=UNSIGNED_MODULE
    [  308.987661] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0)
    [  308.987666] Krnl PSW : 0404f00180000000 00000349976fa600 (expand+0x240/0x270)
    [  308.987676]            R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
    [  308.987682] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88
    [  308.987688]            0000000000000005 0000034980000005 000002be803ac000 0000023efe6c8300
    [  308.987692]            0000000000000008 0000034998d57290 000002be00000100 0000023e00000008
    [  308.987696]            0000000000000000 0000000000000000 00000349976fa5fc 000002c99b1eb6f0
    [  308.987708] Krnl Code: 00000349976fa5f0: c020008a02f2        larl    %r2,000003499883abd4
                              00000349976fa5f6: c0e5ffe3f4b5        brasl   %r14,0000034997378f60
                             #00000349976fa5fc: af000000            mc      0,0
                             >00000349976fa600: a7f4ff4c            brc     15,00000349976fa498
                              00000349976fa604: b9040026            lgr     %r2,%r6
                              00000349976fa608: c0300088317f        larl    %r3,0000034998800906
                              00000349976fa60e: c0e5fffdb6e1        brasl   %r14,00000349976b13d0
                              00000349976fa614: af000000            mc      0,0
    [  308.987734] Call Trace:
    [  308.987738]  [<00000349976fa600>] expand+0x240/0x270
    [  308.987744] ([<00000349976fa5fc>] expand+0x23c/0x270)
    [  308.987749]  [<00000349976ff95e>] rmqueue_bulk+0x71e/0x940
    [  308.987754]  [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0
    [  308.987759]  [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40
    [  308.987763]  [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0
    [  308.987768]  [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400
    [  308.987774]  [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220
    [  308.987781]  [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0
    [  308.987786]  [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0
    [  308.987791]  [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240
    [  308.987799]  [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210
    [  308.987804]  [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500
    [  308.987809]  [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0
    [  308.987813]  [<000003499734d70e>] do_exception+0x1de/0x540
    [  308.987822]  [<0000034998387390>] __do_pgm_check+0x130/0x220
    [  308.987830]  [<000003499839a934>] pgm_check_handler+0x114/0x160
    [  308.987838] 3 locks held by mempig_verify/5224:
    [  308.987842]  #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0
    [  308.987859]  #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40
    [  308.987871]  #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940
    [  308.987886] Last Breaking-Event-Address:
    [  308.987890]  [<0000034997379096>] __warn_printk+0x136/0x140
    [  308.987897] irq event stamp: 52330356
    [  308.987901] hardirqs last  enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220
    [  308.987907] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0
    [  308.987913] softirqs last  enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530
    [  308.987922] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140
    [  308.987929] ---[ end trace 0000000000000000 ]---
    [  308.987936] ------------[ cut here ]------------
    [  308.987940] page type is 0, passed migratetype is 1 (nr=256)
    [  308.987951] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:860 __del_page_from_free_list+0x1be/0x1e0
    [  308.987960] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E)
    [  308.988070] Unloaded tainted modules: hmac_s390(E):2
    [  308.988087] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G        W   E       6.18.0-gcc-bpf-debug #431 PREEMPT
    [  308.988095] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE
    [  308.988100] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0)
    [  308.988105] Krnl PSW : 0404f00180000000 00000349976f9e32 (__del_page_from_free_list+0x1c2/0x1e0)
    [  308.988118]            R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3
    [  308.988127] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88
    [  308.988133]            0000000000000005 0000034980000005 0000034998d57290 0000023efe6c8300
    [  308.988139]            0000000000000001 0000000000000008 000002be00000100 000002be803ac000
    [  308.988144]            0000000000000000 0000000000000001 00000349976f9e2e 000002c99b1eb728
    [  308.988153] Krnl Code: 00000349976f9e22: c020008a06d9        larl    %r2,000003499883abd4
                              00000349976f9e28: c0e5ffe3f89c        brasl   %r14,0000034997378f60
                             #00000349976f9e2e: af000000            mc      0,0
                             >00000349976f9e32: a7f4ff4e            brc     15,00000349976f9cce
                              00000349976f9e36: b904002b            lgr     %r2,%r11
                              00000349976f9e3a: c030008a06e7        larl    %r3,000003499883ac08
                              00000349976f9e40: c0e5fffdbac8        brasl   %r14,00000349976b13d0
                              00000349976f9e46: af000000            mc      0,0
    [  308.988184] Call Trace:
    [  308.988188]  [<00000349976f9e32>] __del_page_from_free_list+0x1c2/0x1e0
    [  308.988195] ([<00000349976f9e2e>] __del_page_from_free_list+0x1be/0x1e0)
    [  308.988202]  [<00000349976ff946>] rmqueue_bulk+0x706/0x940
    [  308.988208]  [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0
    [  308.988214]  [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40
    [  308.988221]  [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0
    [  308.988227]  [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400
    [  308.988233]  [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220
    [  308.988240]  [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0
    [  308.988247]  [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0
    [  308.988253]  [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240
    [  308.988260]  [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210
    [  308.988267]  [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500
    [  308.988273]  [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0
    [  308.988279]  [<000003499734d70e>] do_exception+0x1de/0x540
    [  308.988286]  [<0000034998387390>] __do_pgm_check+0x130/0x220
    [  308.988293]  [<000003499839a934>] pgm_check_handler+0x114/0x160
    [  308.988300] 3 locks held by mempig_verify/5224:
    [  308.988305]  #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0
    [  308.988322]  #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40
    [  308.988334]  #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940
    [  308.988346] Last Breaking-Event-Address:
    [  308.988350]  [<0000034997379096>] __warn_printk+0x136/0x140
    [  308.988356] irq event stamp: 52330356
    [  308.988360] hardirqs last  enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220
    [  308.988366] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0
    [  308.988373] softirqs last  enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530
    [  308.988380] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140
    [  308.988388] ---[ end trace 0000000000000000 ]---
    
    Link: https://lkml.kernel.org/r/20251215081002.3353900A9c-agordeev@linux.ibm.com
    Link: https://lkml.kernel.org/r/20251212151457.3898073Add-agordeev@linux.ibm.com
    Fixes: e6cf9e1c4cde ("mm: page_alloc: fix up block types when merging compatible blocks")
    Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
    Reported-by: Marc Hartmayer <mhartmay@linux.ibm.com>
    Closes: https://lore.kernel.org/linux-mm/87wmalyktd.fsf@linux.ibm.com/
    Acked-by: Vlastimil Babka <vbabka@suse.cz>
    Acked-by: Johannes Weiner <hannes@cmpxchg.org>
    Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
    Cc: Marc Hartmayer <mhartmay@linux.ibm.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm/page_owner: fix memory leak in page_owner_stack_fops->release() [+ + +]
Author: Ran Xiaokai <ran.xiaokai@zte.com.cn>
Date:   Fri Dec 19 07:42:32 2025 +0000

    mm/page_owner: fix memory leak in page_owner_stack_fops->release()
    
    commit a76a5ae2c6c645005672c2caf2d49361c6f2500f upstream.
    
    The page_owner_stack_fops->open() callback invokes seq_open_private(),
    therefore its corresponding ->release() callback must call
    seq_release_private().  Otherwise it will cause a memory leak of struct
    stack_print_ctx.
    
    Link: https://lkml.kernel.org/r/20251219074232.136482-1-ranxiaokai627@163.com
    Fixes: 765973a09803 ("mm,page_owner: display all stacks and their count")
    Signed-off-by: Ran Xiaokai <ran.xiaokai@zte.com.cn>
    Acked-by: Michal Hocko <mhocko@suse.com>
    Acked-by: Vlastimil Babka <vbabka@suse.cz>
    Cc: Andrey Konovalov <andreyknvl@gmail.com>
    Cc: Brendan Jackman <jackmanb@google.com>
    Cc: Johannes Weiner <hannes@cmpxchg.org>
    Cc: Marco Elver <elver@google.com>
    Cc: Suren Baghdasaryan <surenb@google.com>
    Cc: Zi Yan <ziy@nvidia.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mm: consider non-anon swap cache folios in folio_expected_ref_count() [+ + +]
Author: Bijan Tabatabai <bijan311@gmail.com>
Date:   Tue Dec 16 14:07:27 2025 -0600

    mm: consider non-anon swap cache folios in folio_expected_ref_count()
    
    commit f183663901f21fe0fba8bd31ae894bc529709ee0 upstream.
    
    Currently, folio_expected_ref_count() only adds references for the swap
    cache if the folio is anonymous.  However, according to the comment above
    the definition of PG_swapcache in enum pageflags, shmem folios can also
    have PG_swapcache set.  This patch makes sure references for the swap
    cache are added if folio_test_swapcache(folio) is true.
    
    This issue was found when trying to hot-unplug memory in a QEMU/KVM
    virtual machine.  When initiating hot-unplug when most of the guest memory
    is allocated, hot-unplug hangs partway through removal due to migration
    failures.  The following message would be printed several times, and would
    be printed again about every five seconds:
    
    [   49.641309] migrating pfn b12f25 failed ret:7
    [   49.641310] page: refcount:2 mapcount:0 mapping:0000000033bd8fe2 index:0x7f404d925 pfn:0xb12f25
    [   49.641311] aops:swap_aops
    [   49.641313] flags: 0x300000000030508(uptodate|active|owner_priv_1|reclaim|swapbacked|node=0|zone=3)
    [   49.641314] raw: 0300000000030508 ffffed312c4bc908 ffffed312c4bc9c8 0000000000000000
    [   49.641315] raw: 00000007f404d925 00000000000c823b 00000002ffffffff 0000000000000000
    [   49.641315] page dumped because: migration failure
    
    When debugging this, I found that these migration failures were due to
    __migrate_folio() returning -EAGAIN for a small set of folios because the
    expected reference count it calculates via folio_expected_ref_count() is
    one less than the actual reference count of the folios.  Furthermore, all
    of the affected folios were not anonymous, but had the PG_swapcache flag
    set, inspiring this patch.  After applying this patch, the memory
    hot-unplug behaves as expected.
    
    I tested this on a machine running Ubuntu 24.04 with kernel version
    6.8.0-90-generic and 64GB of memory.  The guest VM is managed by libvirt
    and runs Ubuntu 24.04 with kernel version 6.18 (though the head of the
    mm-unstable branch as a Dec 16, 2025 was also tested and behaves the same)
    and 48GB of memory.  The libvirt XML definition for the VM can be found at
    [1].  CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE is set in the guest
    kernel so the hot-pluggable memory is automatically onlined.
    
    Below are the steps to reproduce this behavior:
    
    1) Define and start and virtual machine
      host$ virsh -c qemu:///system define ./test_vm.xml # test_vm.xml from [1]
      host$ virsh -c qemu:///system start test_vm
    
    2) Setup swap in the guest
      guest$ sudo fallocate -l 32G /swapfile
      guest$ sudo chmod 0600 /swapfile
      guest$ sudo mkswap /swapfile
      guest$ sudo swapon /swapfile
    
    3) Use alloc_data [2] to allocate most of the remaining guest memory
      guest$ ./alloc_data 45
    
    4) In a separate guest terminal, monitor the amount of used memory
      guest$ watch -n1 free -h
    
    5) When alloc_data has finished allocating, initiate the memory
    hot-unplug using the provided xml file [3]
      host$ virsh -c qemu:///system detach-device test_vm ./remove.xml --live
    
    After initiating the memory hot-unplug, you should see the amount of
    available memory in the guest decrease, and the amount of used swap data
    increase.  If everything works as expected, when all of the memory is
    unplugged, there should be around 8.5-9GB of data in swap.  If the
    unplugging is unsuccessful, the amount of used swap data will settle below
    that.  If that happens, you should be able to see log messages in dmesg
    similar to the one posted above.
    
    Link: https://lkml.kernel.org/r/20251216200727.2360228-1-bijan311@gmail.com
    Link: https://github.com/BijanT/linux_patch_files/blob/main/test_vm.xml [1]
    Link: https://github.com/BijanT/linux_patch_files/blob/main/alloc_data.c [2]
    Link: https://github.com/BijanT/linux_patch_files/blob/main/remove.xml [3]
    Fixes: 86ebd50224c0 ("mm: add folio_expected_ref_count() for reference count calculation")
    Signed-off-by: Bijan Tabatabai <bijan311@gmail.com>
    Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
    Acked-by: Zi Yan <ziy@nvidia.com>
    Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
    Cc: Liam Howlett <liam.howlett@oracle.com>
    Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Mike Rapoport <rppt@kernel.org>
    Cc: Shivank Garg <shivankg@amd.com>
    Cc: Suren Baghdasaryan <surenb@google.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: Kairui Song <ryncsn@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mptcp: fallback earlier on simult connection [+ + +]
Author: Paolo Abeni <pabeni@redhat.com>
Date:   Fri Dec 12 13:54:03 2025 +0100

    mptcp: fallback earlier on simult connection
    
    commit 71154bbe49423128c1c8577b6576de1ed6836830 upstream.
    
    Syzkaller reports a simult-connect race leading to inconsistent fallback
    status:
    
      WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515 subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1515
      Modules linked in:
      CPU: 3 UID: 0 PID: 33 Comm: ksoftirqd/3 Not tainted syzkaller #0 PREEMPT(full)
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
      RIP: 0010:subflow_data_ready+0x40b/0x7c0 net/mptcp/subflow.c:1515
      Code: 89 ee e8 78 61 3c f6 40 84 ed 75 21 e8 8e 66 3c f6 44 89 fe bf 07 00 00 00 e8 c1 61 3c f6 41 83 ff 07 74 09 e8 76 66 3c f6 90 <0f> 0b 90 e8 6d 66 3c f6 48 89 df e8 e5 ad ff ff 31 ff 89 c5 89 c6
      RSP: 0018:ffffc900006cf338 EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff888031acd100 RCX: ffffffff8b7f2abf
      RDX: ffff88801e6ea440 RSI: ffffffff8b7f2aca RDI: 0000000000000005
      RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000007
      R10: 0000000000000004 R11: 0000000000002c10 R12: ffff88802ba69900
      R13: 1ffff920000d9e67 R14: ffff888046f81800 R15: 0000000000000004
      FS:  0000000000000000(0000) GS:ffff8880d69bc000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000560fc0ca1670 CR3: 0000000032c3a000 CR4: 0000000000352ef0
      Call Trace:
       <TASK>
       tcp_data_queue+0x13b0/0x4f90 net/ipv4/tcp_input.c:5197
       tcp_rcv_state_process+0xfdf/0x4ec0 net/ipv4/tcp_input.c:6922
       tcp_v6_do_rcv+0x492/0x1740 net/ipv6/tcp_ipv6.c:1672
       tcp_v6_rcv+0x2976/0x41e0 net/ipv6/tcp_ipv6.c:1918
       ip6_protocol_deliver_rcu+0x188/0x1520 net/ipv6/ip6_input.c:438
       ip6_input_finish+0x1e4/0x4b0 net/ipv6/ip6_input.c:489
       NF_HOOK include/linux/netfilter.h:318 [inline]
       NF_HOOK include/linux/netfilter.h:312 [inline]
       ip6_input+0x105/0x2f0 net/ipv6/ip6_input.c:500
       dst_input include/net/dst.h:471 [inline]
       ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
       NF_HOOK include/linux/netfilter.h:318 [inline]
       NF_HOOK include/linux/netfilter.h:312 [inline]
       ipv6_rcv+0x264/0x650 net/ipv6/ip6_input.c:311
       __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5979
       __netif_receive_skb+0x1d/0x160 net/core/dev.c:6092
       process_backlog+0x442/0x15e0 net/core/dev.c:6444
       __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7494
       napi_poll net/core/dev.c:7557 [inline]
       net_rx_action+0xa9f/0xfe0 net/core/dev.c:7684
       handle_softirqs+0x216/0x8e0 kernel/softirq.c:579
       run_ksoftirqd kernel/softirq.c:968 [inline]
       run_ksoftirqd+0x3a/0x60 kernel/softirq.c:960
       smpboot_thread_fn+0x3f7/0xae0 kernel/smpboot.c:160
       kthread+0x3c2/0x780 kernel/kthread.c:463
       ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
       </TASK>
    
    The TCP subflow can process the simult-connect syn-ack packet after
    transitioning to TCP_FIN1 state, bypassing the MPTCP fallback check,
    as the sk_state_change() callback is not invoked for * -> FIN_WAIT1
    transitions.
    
    That will move the msk socket to an inconsistent status and the next
    incoming data will hit the reported splat.
    
    Close the race moving the simult-fallback check at the earliest possible
    stage - that is at syn-ack generation time.
    
    About the fixes tags: [2] was supposed to also fix this issue introduced
    by [3]. [1] is required as a dependence: it was not explicitly marked as
    a fix, but it is one and it has already been backported before [3]. In
    other words, this commit should be backported up to [3], including [2]
    and [1] if that's not already there.
    
    Fixes: 23e89e8ee7be ("tcp: Don't drop SYN+ACK for simultaneous connect().") [1]
    Fixes: 4fd19a307016 ("mptcp: fix inconsistent state on fastopen race") [2]
    Fixes: 1e777f39b4d7 ("mptcp: add MSG_FASTOPEN sendmsg flag support") [3]
    Cc: stable@vger.kernel.org
    Reported-by: syzbot+0ff6b771b4f7a5bce83b@syzkaller.appspotmail.com
    Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/586
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20251212-net-mptcp-subflow_data_ready-warn-v1-1-d1f9fd1c36c8@kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions [+ + +]
Author: Christian Marangi <ansuelsmth@gmail.com>
Date:   Sun Nov 9 12:52:44 2025 +0100

    mtd: mtdpart: ignore error -ENOENT from parsers on subpartitions
    
    commit 64ef5f454e167bb66cf70104f033c3d71e6ef9c0 upstream.
    
    Commit 5c2f7727d437 ("mtd: mtdpart: check for subpartitions parsing
    result") introduced some kind of regression with parser on subpartitions
    where if a parser emits an error then the entire parsing process from the
    upper parser fails and partitions are deleted.
    
    Not checking for error in subpartitions was originally intended as
    special parser can emit error also in the case of the partition not
    correctly init (for example a wiped partition) or special case where the
    partition should be skipped due to some ENV variables externally
    provided (from bootloader for example)
    
    One example case is the TRX partition where, in the context of a wiped
    partition, returns a -ENOENT as the trx_magic is not found in the
    expected TRX header (as the partition is wiped)
    
    To better handle this and still keep some kind of error tracking (for
    example to catch -ENOMEM errors or -EINVAL errors), permit parser on
    subpartition to emit -ENOENT error, print a debug log and skip them
    accordingly.
    
    This results in giving better tracking of the status of the parser
    (instead of returning just 0, dropping any kind of signal that there is
    something wrong with the parser) and to some degree restore the original
    logic of the subpartitions parse.
    
    (worth to notice that some special partition might have all the special
    header present for the parser and declare 0 partition in it, this is why
    it would be wrong to simply return 0 in the case of a special partition
    that is NOT init for the scanning parser)
    
    Cc: stable@vger.kernel.org
    Fixes: 5c2f7727d437 ("mtd: mtdpart: check for subpartitions parsing result")
    Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips [+ + +]
Author: Miquel Raynal <miquel.raynal@bootlin.com>
Date:   Wed Nov 5 18:27:04 2025 +0100

    mtd: spi-nor: winbond: Add support for W25H01NWxxAM chips
    
    commit 1df1fdbc7e63350b2962dc7d87ded124ee26f3ad upstream.
    
    These chips must be described as none of the block protection
    information are discoverable. This chip supports 4 bits plus the
    top/bottom addressing capability to identify the protected blocks.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Reviewed-by: Michael Walle <mwalle@kernel.org>
    Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips [+ + +]
Author: Miquel Raynal <miquel.raynal@bootlin.com>
Date:   Wed Nov 5 18:27:05 2025 +0100

    mtd: spi-nor: winbond: Add support for W25H02NWxxAM chips
    
    commit 604cf6a40157abba4677dea9834de8df9047d798 upstream.
    
    These chips must be described as none of the block protection
    information are discoverable. This chip supports 4 bits plus the
    top/bottom addressing capability to identify the protected blocks.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Reviewed-by: Michael Walle <mwalle@kernel.org>
    Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips [+ + +]
Author: Miquel Raynal <miquel.raynal@bootlin.com>
Date:   Wed Nov 5 18:27:03 2025 +0100

    mtd: spi-nor: winbond: Add support for W25H512NWxxAM chips
    
    commit f21d2c7d37553b24825918f2f61df123e182b712 upstream.
    
    These chips must be described as none of the block protection
    information are discoverable. This chip supports 4 bits plus the
    top/bottom addressing capability to identify the protected blocks.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Reviewed-by: Michael Walle <mwalle@kernel.org>
    Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips [+ + +]
Author: Miquel Raynal <miquel.raynal@bootlin.com>
Date:   Wed Nov 5 18:27:01 2025 +0100

    mtd: spi-nor: winbond: Add support for W25Q01NWxxIM chips
    
    commit a607e676c8b9258eabc3fc88f45bcd70ea178b41 upstream.
    
    These chips must be described as none of the block protection
    information are discoverable. This chip supports 4 bits plus the
    top/bottom addressing capability to identify the protected blocks.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Reviewed-by: Michael Walle <mwalle@kernel.org>
    Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips [+ + +]
Author: Miquel Raynal <miquel.raynal@bootlin.com>
Date:   Wed Nov 5 18:27:00 2025 +0100

    mtd: spi-nor: winbond: Add support for W25Q01NWxxIQ chips
    
    commit aee8c4d9d48d661624d72de670ebe5c6b5687842 upstream.
    
    This chip must be described as none of the block protection information
    are discoverable. This chip supports 4 bits plus the top/bottom
    addressing capability to identify the protected blocks.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Reviewed-by: Michael Walle <mwalle@kernel.org>
    Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips [+ + +]
Author: Miquel Raynal <miquel.raynal@bootlin.com>
Date:   Wed Nov 5 18:27:02 2025 +0100

    mtd: spi-nor: winbond: Add support for W25Q02NWxxIM chips
    
    commit 71c239348d9fbdb1f0d6f36013f1697cc06c3e9c upstream.
    
    These chips must be described as none of the block protection
    information are discoverable. This chip supports 4 bits plus the
    top/bottom addressing capability to identify the protected blocks.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Reviewed-by: Michael Walle <mwalle@kernel.org>
    Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
net: airoha: Move net_devs registration in a dedicated routine [+ + +]
Author: Lorenzo Bianconi <lorenzo@kernel.org>
Date:   Sun Dec 14 10:30:07 2025 +0100

    net: airoha: Move net_devs registration in a dedicated routine
    
    [ Upstream commit 5e7365b5a1ac8f517a7a84442289d7de242deb76 ]
    
    Since airoha_probe() is not executed under rtnl lock, there is small race
    where a given device is configured by user-space while the remaining ones
    are not completely loaded from the dts yet. This condition will allow a
    hw device misconfiguration since there are some conditions (e.g. GDM2 check
    in airoha_dev_init()) that require all device are properly loaded from the
    device tree. Fix the issue moving net_devices registration at the end of
    the airoha_probe routine.
    
    Fixes: 9cd451d414f6e ("net: airoha: Add loopback support for GDM2")
    Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20251214-airoha-fix-dev-registration-v1-1-860e027ad4c6@kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct [+ + +]
Author: Bagas Sanjaya <bagasdotme@gmail.com>
Date:   Thu Dec 18 11:29:37 2025 +0700

    net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
    
    [ Upstream commit f79f9b7ace1713e4b83888c385f5f55519dfb687 ]
    
    Sphinx reports kernel-doc warning:
    
    WARNING: ./net/bridge/br_private.h:267 struct member 'tunnel_hash' not described in 'net_bridge_vlan_group'
    
    Fix it by describing @tunnel_hash member.
    
    Fixes: efa5356b0d9753 ("bridge: per vlan dst_metadata netlink support")
    Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
    Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Link: https://patch.msgid.link/20251218042936.24175-2-bagasdotme@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dsa: b53: skip multicast entries for fdb_dump() [+ + +]
Author: Jonas Gorski <jonas.gorski@gmail.com>
Date:   Wed Dec 17 21:57:56 2025 +0100

    net: dsa: b53: skip multicast entries for fdb_dump()
    
    [ Upstream commit d42bce414d1c5c0b536758466a1f63ac358e613c ]
    
    port_fdb_dump() is supposed to only add fdb entries, but we iterate over
    the full ARL table, which also includes multicast entries.
    
    So check if the entry is a multicast entry before passing it on to the
    callback().
    
    Additionally, the port of those entries is a bitmask, not a port number,
    so any included entries would have even be for the wrong port.
    
    Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations")
    Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
    Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Link: https://patch.msgid.link/20251217205756.172123-1-jonas.gorski@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dsa: fix missing put_device() in dsa_tree_find_first_conduit() [+ + +]
Author: Vladimir Oltean <vladimir.oltean@nxp.com>
Date:   Mon Dec 15 17:02:36 2025 +0200

    net: dsa: fix missing put_device() in dsa_tree_find_first_conduit()
    
    [ Upstream commit a9f96dc59b4a50ffbf86158f315e115969172d48 ]
    
    of_find_net_device_by_node() searches net devices by their /sys/class/net/,
    entry. It is documented in its kernel-doc that:
    
     * If successful, returns a pointer to the net_device with the embedded
     * struct device refcount incremented by one, or NULL on failure. The
     * refcount must be dropped when done with the net_device.
    
    We are missing a put_device(&conduit->dev) which we could place at the
    end of dsa_tree_find_first_conduit(). But to explain why calling
    put_device() right away is safe is the same as to explain why the chosen
    solution is different.
    
    The code is very poorly split: dsa_tree_find_first_conduit() was first
    introduced in commit 95f510d0b792 ("net: dsa: allow the DSA master to be
    seen and changed through rtnetlink") but was first used several commits
    later, in commit acc43b7bf52a ("net: dsa: allow masters to join a LAG").
    
    Assume there is a switch with 2 CPU ports and 2 conduits, eno2 and eno3.
    When we create a LAG (bonding or team device) and place eno2 and eno3
    beneath it, we create a 3rd conduit (the LAG device itself), but this is
    slightly different than the first two.
    
    Namely, the cpu_dp->conduit pointer of the CPU ports does not change,
    and remains pointing towards the physical Ethernet controllers which are
    now LAG ports. Only 2 things change:
    - the LAG device has a dev->dsa_ptr which marks it as a DSA conduit
    - dsa_port_to_conduit(user port) finds the LAG and not the physical
      conduit, because of the dp->cpu_port_in_lag bit being set.
    
    When the LAG device is destroyed, dsa_tree_migrate_ports_from_lag_conduit()
    is called and this is where dsa_tree_find_first_conduit() kicks in.
    
    This is the logical mistake and the reason why introducing code in one
    patch and using it from another is bad practice. I didn't realize that I
    don't have to call of_find_net_device_by_node() again; the cpu_dp->conduit
    association was never undone, and is still available for direct (re)use.
    There's only one concern - maybe the conduit disappeared in the
    meantime, but the netdev_hold() call we made during dsa_port_parse_cpu()
    (see previous change) ensures that this was not the case.
    
    Therefore, fixing the code means reimplementing it in the simplest way.
    
    I am blaming the time of use, since this is what "git blame" would show
    if we were to monitor for the conduit's kobject's refcount remaining
    elevated instead of being freed.
    
    Tested on the NXP LS1028A, using the steps from
    Documentation/networking/dsa/configuration.rst section "Affinity of user
    ports to CPU ports", followed by (extra prints added by me):
    
    $ ip link del bond0
    mscc_felix 0000:00:00.5 swp3: Link is Down
    bond0 (unregistering): (slave eno2): Releasing backup interface
    fsl_enetc 0000:00:00.2 eno2: Link is Down
    mscc_felix 0000:00:00.5 swp0: bond0 disappeared, migrating to eno2
    mscc_felix 0000:00:00.5 swp1: bond0 disappeared, migrating to eno2
    mscc_felix 0000:00:00.5 swp2: bond0 disappeared, migrating to eno2
    mscc_felix 0000:00:00.5 swp3: bond0 disappeared, migrating to eno2
    
    Fixes: acc43b7bf52a ("net: dsa: allow masters to join a LAG")
    Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Link: https://patch.msgid.link/20251215150236.3931670-2-vladimir.oltean@nxp.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: dsa: properly keep track of conduit reference [+ + +]
Author: Vladimir Oltean <vladimir.oltean@nxp.com>
Date:   Mon Dec 15 17:02:35 2025 +0200

    net: dsa: properly keep track of conduit reference
    
    [ Upstream commit 06e219f6a706c367c93051f408ac61417643d2f9 ]
    
    Problem description
    -------------------
    
    DSA has a mumbo-jumbo of reference handling of the conduit net device
    and its kobject which, sadly, is just wrong and doesn't make sense.
    
    There are two distinct problems.
    
    1. The OF path, which uses of_find_net_device_by_node(), never releases
       the elevated refcount on the conduit's kobject. Nominally, the OF and
       non-OF paths should result in objects having identical reference
       counts taken, and it is already suspicious that
       dsa_dev_to_net_device() has a put_device() call which is missing in
       dsa_port_parse_of(), but we can actually even verify that an issue
       exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command
       "before" and "after" applying this patch:
    
    (unbind the conduit driver for net device eno2)
    echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind
    
    we see these lines in the output diff which appear only with the patch
    applied:
    
    kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)
    kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)
    
    2. After we find the conduit interface one way (OF) or another (non-OF),
       it can get unregistered at any time, and DSA remains with a long-lived,
       but in this case stale, cpu_dp->conduit pointer. Holding the net
       device's underlying kobject isn't actually of much help, it just
       prevents it from being freed (but we never need that kobject
       directly). What helps us to prevent the net device from being
       unregistered is the parallel netdev reference mechanism (dev_hold()
       and dev_put()).
    
    Actually we actually use that netdev tracker mechanism implicitly on
    user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with
    the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link().
    But time still passes at DSA switch probe time between the initial
    of_find_net_device_by_node() code and the user port creation time, time
    during which the conduit could unregister itself and DSA wouldn't know
    about it.
    
    So we have to run of_find_net_device_by_node() under rtnl_lock() to
    prevent that from happening, and release the lock only with the netdev
    tracker having acquired the reference.
    
    Do we need to keep the reference until dsa_unregister_switch() /
    dsa_switch_shutdown()?
    1: Maybe yes. A switch device will still be registered even if all user
       ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not
       make user port errors fatal"), and the cpu_dp->conduit pointers
       remain valid.  I haven't audited all call paths to see whether they
       will actually use the conduit in lack of any user port, but if they
       do, it seems safer to not rely on user ports for that reference.
    2. Definitely yes. We support changing the conduit which a user port is
       associated to, and we can get into a situation where we've moved all
       user ports away from a conduit, thus no longer hold any reference to
       it via the net device tracker. But we shouldn't let it go nonetheless
       - see the next change in relation to dsa_tree_find_first_conduit()
       and LAG conduits which disappear.
       We have to be prepared to return to the physical conduit, so the CPU
       port must explicitly keep another reference to it. This is also to
       say: the user ports and their CPU ports may not always keep a
       reference to the same conduit net device, and both are needed.
    
    As for the conduit's kobject for the /sys/class/net/ entry, we don't
    care about it, we can release it as soon as we hold the net device
    object itself.
    
    History and blame attribution
    -----------------------------
    
    The code has been refactored so many times, it is very difficult to
    follow and properly attribute a blame, but I'll try to make a short
    history which I hope to be correct.
    
    We have two distinct probing paths:
    - one for OF, introduced in 2016 in commit 83c0afaec7b7 ("net: dsa: Add
      new binding implementation")
    - one for non-OF, introduced in 2017 in commit 71e0bbde0d88 ("net: dsa:
      Add support for platform data")
    
    These are both complete rewrites of the original probing paths (which
    used struct dsa_switch_driver and other weird stuff, instead of regular
    devices on their respective buses for register access, like MDIO, SPI,
    I2C etc):
    - one for OF, introduced in 2013 in commit 5e95329b701c ("dsa: add
      device tree bindings to register DSA switches")
    - one for non-OF, introduced in 2008 in commit 91da11f870f0 ("net:
      Distributed Switch Architecture protocol support")
    
    except for tiny bits and pieces like dsa_dev_to_net_device() which were
    seemingly carried over since the original commit, and used to this day.
    
    The point is that the original probing paths received a fix in 2015 in
    the form of commit 679fb46c5785 ("net: dsa: Add missing master netdev
    dev_put() calls"), but the fix never made it into the "new" (dsa2)
    probing paths that can still be traced to today, and the fixed probing
    path was later deleted in 2019 in commit 93e86b3bc842 ("net: dsa: Remove
    legacy probing support").
    
    That is to say, the new probing paths were never quite correct in this
    area.
    
    The existence of the legacy probing support which was deleted in 2019
    explains why dsa_dev_to_net_device() returns a conduit with elevated
    refcount (because it was supposed to be released during
    dsa_remove_dst()). After the removal of the legacy code, the only user
    of dsa_dev_to_net_device() calls dev_put(conduit) immediately after this
    function returns. This pattern makes no sense today, and can only be
    interpreted historically to understand why dev_hold() was there in the
    first place.
    
    Change details
    --------------
    
    Today we have a better netdev tracking infrastructure which we should
    use. Logically netdev_hold() belongs in common code
    (dsa_port_parse_cpu(), where dp->conduit is assigned), but there is a
    tradeoff to be made with the rtnl_lock() section which would become a
    bit too long if we did that - dsa_port_parse_cpu() also calls
    request_module(). So we duplicate a bit of logic in order for the
    callers of dsa_port_parse_cpu() to be the ones responsible of holding
    the conduit reference and releasing it on error. This shortens the
    rtnl_lock() section significantly.
    
    In the dsa_switch_probe() error path, dsa_switch_release_ports() will be
    called in a number of situations, one being where dsa_port_parse_cpu()
    maybe didn't get the chance to run at all (a different port failed
    earlier, etc). So we have to test for the conduit being NULL prior to
    calling netdev_put().
    
    There have still been so many transformations to the code since the
    blamed commits (rename master -> conduit, commit 0650bf52b31f ("net:
    dsa: be compatible with masters which unregister on shutdown")), that it
    only makes sense to fix the code using the best methods available today
    and see how it can be backported to stable later. I suspect the fix
    cannot even be backported to kernels which lack dsa_switch_shutdown(),
    and I suspect this is also maybe why the long-lived conduit reference
    didn't make it into the new DSA probing paths at the time (problems
    during shutdown).
    
    Because dsa_dev_to_net_device() has a single call site and has to be
    changed anyway, the logic was just absorbed into the non-OF
    dsa_port_parse().
    
    Tested on the ocelot/felix switch and on dsa_loop, both on the NXP
    LS1028A with CONFIG_DEBUG_KOBJECT_RELEASE=y.
    
    Reported-by: Ma Ke <make24@iscas.ac.cn>
    Closes: https://lore.kernel.org/netdev/20251214131204.4684-1-make24@iscas.ac.cn/
    Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation")
    Fixes: 71e0bbde0d88 ("net: dsa: Add support for platform data")
    Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com>
    Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
    Link: https://patch.msgid.link/20251215150236.3931670-1-vladimir.oltean@nxp.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: fib: restore ECMP balance from loopback [+ + +]
Author: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Date:   Sun Dec 21 19:26:38 2025 +0000

    net: fib: restore ECMP balance from loopback
    
    [ Upstream commit 6e17474aa9fe15015c9921a5081c7ca71783aac6 ]
    
    Preference of nexthop with source address broke ECMP for packets with
    source addresses which are not in the broadcast domain, but rather added
    to loopback/dummy interfaces. Original behaviour was to balance over
    nexthops while now it uses the latest nexthop from the group. To fix the
    issue introduce next hop scoring system where next hops with source
    address equal to requested will always have higher priority.
    
    For the case with 198.51.100.1/32 assigned to dummy0 and routed using
    192.0.2.0/24 and 203.0.113.0/24 networks:
    
    2: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
        link/ether d6:54:8a:ff:78:f5 brd ff:ff:ff:ff:ff:ff
        inet 198.51.100.1/32 scope global dummy0
           valid_lft forever preferred_lft forever
    7: veth1@if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
        link/ether 06:ed:98:87:6d:8a brd ff:ff:ff:ff:ff:ff link-netnsid 0
        inet 192.0.2.2/24 scope global veth1
           valid_lft forever preferred_lft forever
        inet6 fe80::4ed:98ff:fe87:6d8a/64 scope link proto kernel_ll
           valid_lft forever preferred_lft forever
    9: veth3@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
        link/ether ae:75:23:38:a0:d2 brd ff:ff:ff:ff:ff:ff link-netnsid 0
        inet 203.0.113.2/24 scope global veth3
           valid_lft forever preferred_lft forever
        inet6 fe80::ac75:23ff:fe38:a0d2/64 scope link proto kernel_ll
           valid_lft forever preferred_lft forever
    
    ~ ip ro list:
    default
            nexthop via 192.0.2.1 dev veth1 weight 1
            nexthop via 203.0.113.1 dev veth3 weight 1
    192.0.2.0/24 dev veth1 proto kernel scope link src 192.0.2.2
    203.0.113.0/24 dev veth3 proto kernel scope link src 203.0.113.2
    
    before:
       for i in {1..255} ; do ip ro get 10.0.0.$i; done | grep veth | awk ' {print $(NF-2)}' | sort | uniq -c:
        255 veth3
    
    after:
       for i in {1..255} ; do ip ro get 10.0.0.$i; done | grep veth | awk ' {print $(NF-2)}' | sort | uniq -c:
        122 veth1
        133 veth3
    
    Fixes: 32607a332cfe ("ipv4: prefer multipath nexthop that matches source address")
    Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
    Reviewed-by: Ido Schimmel <idosch@nvidia.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/20251221192639.3911901-1-vadim.fedorenko@linux.dev
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() [+ + +]
Author: Xiaolei Wang <xiaolei.wang@windriver.com>
Date:   Mon Dec 22 09:56:24 2025 +0800

    net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
    
    commit 99537d5c476cada9cf75aef9fa75579a31faadb9 upstream.
    
    In the non-RT kernel, local_bh_disable() merely disables preemption,
    whereas it maps to an actual spin lock in the RT kernel. Consequently,
    when attempting to refill RX buffers via netdev_alloc_skb() in
    macb_mac_link_up(), a deadlock scenario arises as follows:
    
       WARNING: possible circular locking dependency detected
       6.18.0-08691-g2061f18ad76e #39 Not tainted
       ------------------------------------------------------
       kworker/0:0/8 is trying to acquire lock:
       ffff00080369bbe0 (&bp->lock){+.+.}-{3:3}, at: macb_start_xmit+0x808/0xb7c
    
       but task is already holding lock:
       ffff000803698e58 (&queue->tx_ptr_lock){+...}-{3:3}, at: macb_start_xmit
       +0x148/0xb7c
    
       which lock already depends on the new lock.
    
       the existing dependency chain (in reverse order) is:
    
       -> #3 (&queue->tx_ptr_lock){+...}-{3:3}:
              rt_spin_lock+0x50/0x1f0
              macb_start_xmit+0x148/0xb7c
              dev_hard_start_xmit+0x94/0x284
              sch_direct_xmit+0x8c/0x37c
              __dev_queue_xmit+0x708/0x1120
              neigh_resolve_output+0x148/0x28c
              ip6_finish_output2+0x2c0/0xb2c
              __ip6_finish_output+0x114/0x308
              ip6_output+0xc4/0x4a4
              mld_sendpack+0x220/0x68c
              mld_ifc_work+0x2a8/0x4f4
              process_one_work+0x20c/0x5f8
              worker_thread+0x1b0/0x35c
              kthread+0x144/0x200
              ret_from_fork+0x10/0x20
    
       -> #2 (_xmit_ETHER#2){+...}-{3:3}:
              rt_spin_lock+0x50/0x1f0
              sch_direct_xmit+0x11c/0x37c
              __dev_queue_xmit+0x708/0x1120
              neigh_resolve_output+0x148/0x28c
              ip6_finish_output2+0x2c0/0xb2c
              __ip6_finish_output+0x114/0x308
              ip6_output+0xc4/0x4a4
              mld_sendpack+0x220/0x68c
              mld_ifc_work+0x2a8/0x4f4
              process_one_work+0x20c/0x5f8
              worker_thread+0x1b0/0x35c
              kthread+0x144/0x200
              ret_from_fork+0x10/0x20
    
       -> #1 ((softirq_ctrl.lock)){+.+.}-{3:3}:
              lock_release+0x250/0x348
              __local_bh_enable_ip+0x7c/0x240
              __netdev_alloc_skb+0x1b4/0x1d8
              gem_rx_refill+0xdc/0x240
              gem_init_rings+0xb4/0x108
              macb_mac_link_up+0x9c/0x2b4
              phylink_resolve+0x170/0x614
              process_one_work+0x20c/0x5f8
              worker_thread+0x1b0/0x35c
              kthread+0x144/0x200
              ret_from_fork+0x10/0x20
    
       -> #0 (&bp->lock){+.+.}-{3:3}:
              __lock_acquire+0x15a8/0x2084
              lock_acquire+0x1cc/0x350
              rt_spin_lock+0x50/0x1f0
              macb_start_xmit+0x808/0xb7c
              dev_hard_start_xmit+0x94/0x284
              sch_direct_xmit+0x8c/0x37c
              __dev_queue_xmit+0x708/0x1120
              neigh_resolve_output+0x148/0x28c
              ip6_finish_output2+0x2c0/0xb2c
              __ip6_finish_output+0x114/0x308
              ip6_output+0xc4/0x4a4
              mld_sendpack+0x220/0x68c
              mld_ifc_work+0x2a8/0x4f4
              process_one_work+0x20c/0x5f8
              worker_thread+0x1b0/0x35c
              kthread+0x144/0x200
              ret_from_fork+0x10/0x20
    
       other info that might help us debug this:
    
       Chain exists of:
         &bp->lock --> _xmit_ETHER#2 --> &queue->tx_ptr_lock
    
        Possible unsafe locking scenario:
    
              CPU0                    CPU1
              ----                    ----
         lock(&queue->tx_ptr_lock);
                                      lock(_xmit_ETHER#2);
                                      lock(&queue->tx_ptr_lock);
         lock(&bp->lock);
    
        *** DEADLOCK ***
    
       Call trace:
        show_stack+0x18/0x24 (C)
        dump_stack_lvl+0xa0/0xf0
        dump_stack+0x18/0x24
        print_circular_bug+0x28c/0x370
        check_noncircular+0x198/0x1ac
        __lock_acquire+0x15a8/0x2084
        lock_acquire+0x1cc/0x350
        rt_spin_lock+0x50/0x1f0
        macb_start_xmit+0x808/0xb7c
        dev_hard_start_xmit+0x94/0x284
        sch_direct_xmit+0x8c/0x37c
        __dev_queue_xmit+0x708/0x1120
        neigh_resolve_output+0x148/0x28c
        ip6_finish_output2+0x2c0/0xb2c
        __ip6_finish_output+0x114/0x308
        ip6_output+0xc4/0x4a4
        mld_sendpack+0x220/0x68c
        mld_ifc_work+0x2a8/0x4f4
        process_one_work+0x20c/0x5f8
        worker_thread+0x1b0/0x35c
        kthread+0x144/0x200
        ret_from_fork+0x10/0x20
    
    Notably, invoking the mog_init_rings() callback upon link establishment
    is unnecessary. Instead, we can exclusively call mog_init_rings() within
    the ndo_open() callback. This adjustment resolves the deadlock issue.
    Furthermore, since MACB_CAPS_MACB_IS_EMAC cases do not use mog_init_rings()
    when opening the network interface via at91ether_open(), moving
    mog_init_rings() to macb_open() also eliminates the MACB_CAPS_MACB_IS_EMAC
    check.
    
    Fixes: 633e98a711ac ("net: macb: use resolved link config in mac_link_up()")
    Cc: stable@vger.kernel.org
    Suggested-by: Kevin Hao <kexin.hao@windriver.com>
    Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
    Link: https://patch.msgid.link/20251222015624.1994551-1-xiaolei.wang@windriver.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: mdio: aspeed: add dummy read to avoid read-after-write issue [+ + +]
Author: Jacky Chou <jacky_chou@aspeedtech.com>
Date:   Thu Dec 11 14:24:58 2025 +0800

    net: mdio: aspeed: add dummy read to avoid read-after-write issue
    
    [ Upstream commit d1a1a4bade4b20c0858d0b2f81d2611de055f675 ]
    
    The Aspeed MDIO controller may return incorrect data when a read operation
    follows immediately after a write. Due to a controller bug, the subsequent
    read can latch stale data, causing the polling logic to terminate earlier
    than expected.
    
    To work around this hardware issue, insert a dummy read after each write
    operation. This ensures that the next actual read returns the correct
    data and prevents premature polling exit.
    
    This workaround has been verified to stabilize MDIO transactions on
    affected Aspeed platforms.
    
    Fixes: f160e99462c6 ("net: phy: Add mdio-aspeed")
    Signed-off-by: Jacky Chou <jacky_chou@aspeedtech.com>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Link: https://patch.msgid.link/20251211-aspeed_mdio_add_dummy_read-v3-1-382868869004@aspeedtech.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: mdio: rtl9300: use scoped for loops [+ + +]
Author: Rosen Penev <rosenp@gmail.com>
Date:   Wed Dec 17 13:01:53 2025 -0800

    net: mdio: rtl9300: use scoped for loops
    
    [ Upstream commit a4f800c4487dc5d6fcc28da89c7cc3c187ccc731 ]
    
    Currently in the return path, fwnode_handle_put calls are missing. Just use
    _scoped to avoid the issue.
    
    Fixes: 24e31e474769 ("net: mdio: Add RTL9300 MDIO driver")
    Signed-off-by: Rosen Penev <rosenp@gmail.com>
    Link: https://patch.msgid.link/20251217210153.14641-1-rosenp@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write [+ + +]
Author: Deepanshu Kartikey <kartikey406@gmail.com>
Date:   Thu Dec 18 06:53:54 2025 +0530

    net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
    
    commit 1ab526d97a57e44d26fadcc0e9adeb9c0c0182f5 upstream.
    
    A deadlock can occur between nfc_unregister_device() and rfkill_fop_write()
    due to lock ordering inversion between device_lock and rfkill_global_mutex.
    
    The problematic lock order is:
    
    Thread A (rfkill_fop_write):
      rfkill_fop_write()
        mutex_lock(&rfkill_global_mutex)
          rfkill_set_block()
            nfc_rfkill_set_block()
              nfc_dev_down()
                device_lock(&dev->dev)    <- waits for device_lock
    
    Thread B (nfc_unregister_device):
      nfc_unregister_device()
        device_lock(&dev->dev)
          rfkill_unregister()
            mutex_lock(&rfkill_global_mutex)  <- waits for rfkill_global_mutex
    
    This creates a classic ABBA deadlock scenario.
    
    Fix this by moving rfkill_unregister() and rfkill_destroy() outside the
    device_lock critical section. Store the rfkill pointer in a local variable
    before releasing the lock, then call rfkill_unregister() after releasing
    device_lock.
    
    This change is safe because rfkill_fop_write() holds rfkill_global_mutex
    while calling the rfkill callbacks, and rfkill_unregister() also acquires
    rfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will
    wait for any ongoing callback to complete before proceeding, and
    device_del() is only called after rfkill_unregister() returns, preventing
    any use-after-free.
    
    The similar lock ordering in nfc_register_device() (device_lock ->
    rfkill_global_mutex via rfkill_register) is safe because during
    registration the device is not yet in rfkill_list, so no concurrent
    rfkill operations can occur on this device.
    
    Fixes: 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device")
    Cc: stable@vger.kernel.org
    Reported-by: syzbot+4ef89409a235d804c6c2@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=4ef89409a235d804c6c2
    Link: https://lore.kernel.org/all/20251217054908.178907-1-kartikey406@gmail.com/T/ [v1]
    Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
    Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
    Link: https://patch.msgid.link/20251218012355.279940-1-kartikey406@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: openvswitch: Avoid needlessly taking the RTNL on vport destroy [+ + +]
Author: Toke Høiland-Jørgensen <toke@redhat.com>
Date:   Thu Dec 11 12:50:05 2025 +0100

    net: openvswitch: Avoid needlessly taking the RTNL on vport destroy
    
    [ Upstream commit 5498227676303e3ffa9a3a46214af96bc3e81314 ]
    
    The openvswitch teardown code will immediately call
    ovs_netdev_detach_dev() in response to a NETDEV_UNREGISTER notification.
    It will then start the dp_notify_work workqueue, which will later end up
    calling the vport destroy() callback. This callback takes the RTNL to do
    another ovs_netdev_detach_port(), which in this case is unnecessary.
    This causes extra pressure on the RTNL, in some cases leading to
    "unregister_netdevice: waiting for XX to become free" warnings on
    teardown.
    
    We can straight-forwardly avoid the extra RTNL lock acquisition by
    checking the device flags before taking the lock, and skip the locking
    altogether if the IFF_OVS_DATAPATH flag has already been unset.
    
    Fixes: b07c26511e94 ("openvswitch: fix vport-netdev unregister")
    Tested-by: Adrian Moreno <amorenoz@redhat.com>
    Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Acked-by: Eelco Chaudron <echaudro@redhat.com>
    Acked-by: Aaron Conole <aconole@redhat.com>
    Link: https://patch.msgid.link/20251211115006.228876-1-toke@redhat.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration [+ + +]
Author: Miaoqian Lin <linmq006@gmail.com>
Date:   Thu Dec 11 12:13:13 2025 +0400

    net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration
    
    commit 1e5a541420b8c6d87d88eb50b6b978cdeafee1c9 upstream.
    
    When nvmem_cell_read() fails in mt798x_phy_calibration(), the function
    returns without calling nvmem_cell_put(), leaking the cell reference.
    
    Move nvmem_cell_put() right after nvmem_cell_read() to ensure the cell
    reference is always released regardless of the read result.
    
    Found via static analysis and code review.
    
    Fixes: 98c485eaf509 ("net: phy: add driver for MediaTek SoC built-in GE PHYs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
    Reviewed-by: Daniel Golle <daniel@makrotopia.org>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Link: https://patch.msgid.link/20251211081313.2368460-1-linmq006@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: rose: fix invalid array index in rose_kill_by_device() [+ + +]
Author: Pwnverse <stanksal@purdue.edu>
Date:   Mon Dec 22 21:22:27 2025 +0000

    net: rose: fix invalid array index in rose_kill_by_device()
    
    [ Upstream commit 6595beb40fb0ec47223d3f6058ee40354694c8e4 ]
    
    rose_kill_by_device() collects sockets into a local array[] and then
    iterates over them to disconnect sockets bound to a device being brought
    down.
    
    The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
    ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
    ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
    an invalid socket pointer dereference and also leaks references taken
    via sock_hold().
    
    Fix the index to use i.
    
    Fixes: 64b8bc7d5f143 ("net/rose: fix races in rose_kill_by_device()")
    Co-developed-by: Fatma Alwasmi <falwasmi@purdue.edu>
    Signed-off-by: Fatma Alwasmi <falwasmi@purdue.edu>
    Signed-off-by: Pwnverse <stanksal@purdue.edu>
    Link: https://patch.msgid.link/20251222212227.4116041-1-ritviktanksalkar@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: stmmac: fix the crash issue for zero copy XDP_TX action [+ + +]
Author: Wei Fang <wei.fang@nxp.com>
Date:   Thu Dec 4 15:13:32 2025 +0800

    net: stmmac: fix the crash issue for zero copy XDP_TX action
    
    [ Upstream commit a48e232210009be50591fdea8ba7c07b0f566a13 ]
    
    There is a crash issue when running zero copy XDP_TX action, the crash
    log is shown below.
    
    [  216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000
    [  216.187524] Internal error: Oops: 0000000096000144 [#1]  SMP
    [  216.301694] Call trace:
    [  216.304130]  dcache_clean_poc+0x20/0x38 (P)
    [  216.308308]  __dma_sync_single_for_device+0x1bc/0x1e0
    [  216.313351]  stmmac_xdp_xmit_xdpf+0x354/0x400
    [  216.317701]  __stmmac_xdp_run_prog+0x164/0x368
    [  216.322139]  stmmac_napi_poll_rxtx+0xba8/0xf00
    [  216.326576]  __napi_poll+0x40/0x218
    [  216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt
    
    For XDP_TX action, the xdp_buff is converted to xdp_frame by
    xdp_convert_buff_to_frame(). The memory type of the resulting xdp_frame
    depends on the memory type of the xdp_buff. For page pool based xdp_buff
    it produces xdp_frame with memory type MEM_TYPE_PAGE_POOL. For zero copy
    XSK pool based xdp_buff it produces xdp_frame with memory type
    MEM_TYPE_PAGE_ORDER0. However, stmmac_xdp_xmit_back() does not check the
    memory type and always uses the page pool type, this leads to invalid
    mappings and causes the crash. Therefore, check the xdp_buff memory type
    in stmmac_xdp_xmit_back() to fix this issue.
    
    Fixes: bba2556efad6 ("net: stmmac: Enable RX via AF_XDP zero-copy")
    Signed-off-by: Wei Fang <wei.fang@nxp.com>
    Reviewed-by: Hariprasad Kelam <hkelam@marvell.com>
    Link: https://patch.msgid.link/20251204071332.1907111-1-wei.fang@nxp.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: usb: asix: validate PHY address before use [+ + +]
Author: Deepanshu Kartikey <kartikey406@gmail.com>
Date:   Thu Dec 18 06:41:56 2025 +0530

    net: usb: asix: validate PHY address before use
    
    [ Upstream commit a1e077a3f76eea0dc671ed6792e7d543946227e8 ]
    
    The ASIX driver reads the PHY address from the USB device via
    asix_read_phy_addr(). A malicious or faulty device can return an
    invalid address (>= PHY_MAX_ADDR), which causes a warning in
    mdiobus_get_phy():
    
      addr 207 out of range
      WARNING: drivers/net/phy/mdio_bus.c:76
    
    Validate the PHY address in asix_read_phy_addr() and remove the
    now-redundant check in ax88172a.c.
    
    Reported-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=3d43c9066a5b54902232
    Tested-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com
    Fixes: 7e88b11a862a ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return")
    Link: https://lore.kernel.org/all/20251217085057.270704-1-kartikey406@gmail.com/T/ [v1]
    Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Link: https://patch.msgid.link/20251218011156.276824-1-kartikey406@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: usb: rtl8150: fix memory leak on usb_submit_urb() failure [+ + +]
Author: Deepakkumar Karn <dkarn@redhat.com>
Date:   Tue Dec 16 20:43:05 2025 +0530

    net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
    
    [ Upstream commit 12cab1191d9890097171156d06bfa8d31f1e39c8 ]
    
    In async_set_registers(), when usb_submit_urb() fails, the allocated
      async_req structure and URB are not freed, causing a memory leak.
    
      The completion callback async_set_reg_cb() is responsible for freeing
      these allocations, but it is only called after the URB is successfully
      submitted and completes (successfully or with error). If submission
      fails, the callback never runs and the memory is leaked.
    
      Fix this by freeing both the URB and the request structure in the error
      path when usb_submit_urb() fails.
    
    Reported-by: syzbot+8dd915c7cb0490fc8c52@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=8dd915c7cb0490fc8c52
    Fixes: 4d12997a9bb3 ("drivers: net: usb: rtl8150: concurrent URB bugfix")
    Signed-off-by: Deepakkumar Karn <dkarn@redhat.com>
    Link: https://patch.msgid.link/20251216151304.59865-2-dkarn@redhat.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

net: usb: sr9700: fix incorrect command used to write single register [+ + +]
Author: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Date:   Sun Dec 21 00:24:00 2025 -0800

    net: usb: sr9700: fix incorrect command used to write single register
    
    commit fa0b198be1c6775bc7804731a43be5d899d19e7a upstream.
    
    This fixes the device failing to initialize with "error reading MAC
    address" for me, probably because the incorrect write of NCR_RST to
    SR_NCR is not actually resetting the device.
    
    Fixes: c9b37458e95629b1d1171457afdcc1bf1eb7881d ("USB2NET : SR9700 : One chip USB 1.1 USB2NET SR9700Device Driver Support")
    Cc: stable@vger.kernel.org
    Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
    Link: https://patch.msgid.link/20251221082400.50688-1-enelsonmoore@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: wangxun: move PHYLINK dependency [+ + +]
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Tue Dec 16 22:35:42 2025 +0100

    net: wangxun: move PHYLINK dependency
    
    [ Upstream commit b94f11af9d9201426f4d6c8a753493fd58d6ac16 ]
    
    The LIBWX library code is what calls into phylink, so any user of
    it has to select CONFIG_PHYLINK at the moment, with NGBEVF missing this:
    
    x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_nway_reset':
    wx_ethtool.c:(.text+0x613): undefined reference to `phylink_ethtool_nway_reset'
    x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_get_link_ksettings':
    wx_ethtool.c:(.text+0x62b): undefined reference to `phylink_ethtool_ksettings_get'
    x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_set_link_ksettings':
    wx_ethtool.c:(.text+0x643): undefined reference to `phylink_ethtool_ksettings_set'
    x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_get_pauseparam':
    wx_ethtool.c:(.text+0x65b): undefined reference to `phylink_ethtool_get_pauseparam'
    x86_64-linux-ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_set_pauseparam':
    wx_ethtool.c:(.text+0x677): undefined reference to `phylink_ethtool_set_pauseparam'
    
    Add the 'select PHYLINK' line in the libwx option directly so this will
    always be enabled for all current and future wangxun drivers, and remove
    the now duplicate lines.
    
    Fixes: a0008a3658a3 ("net: wangxun: add ngbevf build")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
    Link: https://patch.msgid.link/20251216213547.115026-1-arnd@kernel.org
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
nfsd: Drop the client reference in client_states_open() [+ + +]
Author: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Date:   Sat Dec 6 15:38:42 2025 +0800

    nfsd: Drop the client reference in client_states_open()
    
    commit 1f941b2c23fd34c6f3b76d36f9d0a2528fa92b8f upstream.
    
    In error path, call drop_client() to drop the reference
    obtained by get_nfsdfs_clp().
    
    Fixes: 78599c42ae3c ("nfsd4: add file to display list of client's opens")
    Cc: stable@vger.kernel.org
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() [+ + +]
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Mon Dec 1 17:09:55 2025 -0500

    nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg()
    
    commit 8072e34e1387d03102b788677d491e2bcceef6f5 upstream.
    
    nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites
    fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file. However, if
    the client already has a SHARE_ACCESS_READ open from a previous OPEN
    operation, this action overwrites the existing pointer without
    releasing its reference, orphaning the previous reference.
    
    Additionally, the function originally stored the same nfsd_file
    pointer in both fp->fi_fds[O_RDONLY] and fp->fi_rdeleg_file with
    only a single reference. When put_deleg_file() runs, it clears
    fi_rdeleg_file and calls nfs4_file_put_access() to release the file.
    
    However, nfs4_file_put_access() only releases fi_fds[O_RDONLY] when
    the fi_access[O_RDONLY] counter drops to zero. If another READ open
    exists on the file, the counter remains elevated and the nfsd_file
    reference from the delegation is never released. This potentially
    causes open conflicts on that file.
    
    Then, on server shutdown, these leaks cause __nfsd_file_cache_purge()
    to encounter files with an elevated reference count that cannot be
    cleaned up, ultimately triggering a BUG() in kmem_cache_destroy()
    because there are still nfsd_file objects allocated in that cache.
    
    Fixes: e7a8ebc305f2 ("NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE")
    Cc: stable@vger.kernel.org
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
NFSD: Make FILE_SYNC WRITEs comply with spec [+ + +]
Author: Chuck Lever <chuck.lever@oracle.com>
Date:   Tue Nov 11 09:59:30 2025 -0500

    NFSD: Make FILE_SYNC WRITEs comply with spec
    
    commit e3e8e176ca4876e6212582022ad80835dddc9de4 upstream.
    
    Mike noted that when NFSD responds to an NFS_FILE_SYNC WRITE, it
    does not also persist file time stamps. To wit, Section 18.32.3
    of RFC 8881 mandates:
    
    > The client specifies with the stable parameter the method of how
    > the data is to be processed by the server. If stable is
    > FILE_SYNC4, the server MUST commit the data written plus all file
    > system metadata to stable storage before returning results. This
    > corresponds to the NFSv2 protocol semantics. Any other behavior
    > constitutes a protocol violation. If stable is DATA_SYNC4, then
    > the server MUST commit all of the data to stable storage and
    > enough of the metadata to retrieve the data before returning.
    
    Commit 3f3503adb332 ("NFSD: Use vfs_iocb_iter_write()") replaced:
    
    -               flags |= RWF_SYNC;
    
    with:
    
    +               kiocb.ki_flags |= IOCB_DSYNC;
    
    which appears to be correct given:
    
            if (flags & RWF_SYNC)
                    kiocb_flags |= IOCB_DSYNC;
    
    in kiocb_set_rw_flags(). However the author of that commit did not
    appreciate that the previous line in kiocb_set_rw_flags() results
    in IOCB_SYNC also being set:
    
            kiocb_flags |= (__force int) (flags & RWF_SUPPORTED);
    
    RWF_SUPPORTED contains RWF_SYNC, and RWF_SYNC is the same bit as
    IOCB_SYNC. Reviewers at the time did not catch the omission.
    
    Reported-by: Mike Snitzer <snitzer@kernel.org>
    Closes: https://lore.kernel.org/linux-nfs/20251018005431.3403-1-cel@kernel.org/T/#t
    Fixes: 3f3503adb332 ("NFSD: Use vfs_iocb_iter_write()")
    Cc: stable@vger.kernel.org
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Reviewed-by: NeilBrown <neil@brown.name>
    Reviewed-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
nfsd: use ATTR_DELEG in nfsd4_finalize_deleg_timestamps() [+ + +]
Author: Jeff Layton <jlayton@kernel.org>
Date:   Wed Dec 3 10:52:15 2025 -0500

    nfsd: use ATTR_DELEG in nfsd4_finalize_deleg_timestamps()
    
    commit 8f9e967830ff32ab7756f530a36adf74a9f12b76 upstream.
    
    When finalizing timestamps that have never been updated and preparing to
    release the delegation lease, the notify_change() call can trigger a
    delegation break, and fail to update the timestamps. When this happens,
    there will be messages like this in dmesg:
    
        [ 2709.375785] Unable to update timestamps on inode 00:39:263: -11
    
    Since this code is going to release the lease just after updating the
    timestamps, breaking the delegation is undesirable. Fix this by setting
    ATTR_DELEG in ia_valid, in order to avoid the delegation break.
    
    Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation")
    Cc: stable@vger.kernel.org
    Signed-off-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
ntfs: Do not overwrite uptodate pages [+ + +]
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Fri Jul 18 20:53:58 2025 +0100

    ntfs: Do not overwrite uptodate pages
    
    commit 68f6bd128e75a032432eda9d16676ed2969a1096 upstream.
    
    When reading a compressed file, we may read several pages in addition to
    the one requested.  The current code will overwrite pages in the page
    cache with the data from disc which can definitely result in changes
    that have been made being lost.
    
    For example if we have four consecutie pages ABCD in the file compressed
    into a single extent, on first access, we'll bring in ABCD.  Then we
    write to page B.  Memory pressure results in the eviction of ACD.
    When we attempt to write to page C, we will overwrite the data in page
    B with the data currently on disk.
    
    I haven't investigated the decompression code to check whether it's
    OK to overwrite a clean page or whether it might be possible to see
    corrupt data.  Out of an abundance of caution, decline to overwrite
    uptodate pages, not just dirty pages.
    
    Fixes: 4342306f0f0d (fs/ntfs3: Add file operations and implementation)
    Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
nvmet: pci-epf: move DMA initialization to EPC init callback [+ + +]
Author: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Date:   Tue Sep 9 13:21:22 2025 +0200

    nvmet: pci-epf: move DMA initialization to EPC init callback
    
    commit 511b3b644e28d9b66e32515a74c57ff599e89035 upstream.
    
    For DMA initialization to work across all EPC drivers, the DMA
    initialization has to be done in the .init() callback.
    
    This is because not all EPC drivers will have a refclock (which is often
    needed to access registers of a DMA controller embedded in a PCIe
    controller) at the time the .bind() callback is called.
    
    However, all EPC drivers are guaranteed to have a refclock by the time
    the .init() callback is called.
    
    Thus, move the DMA initialization to the .init() callback.
    
    This change was already done for other EPF drivers in
    commit 60bd3e039aa2 ("PCI: endpoint: pci-epf-{mhi/test}: Move DMA
    initialization to EPC init callback").
    
    Cc: stable@vger.kernel.org
    Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver")
    Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
    Signed-off-by: Niklas Cassel <cassel@kernel.org>
    Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
    Signed-off-by: Keith Busch <kbusch@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" [+ + +]
Author: Anshumali Gaur <agaur@marvell.com>
Date:   Fri Dec 19 11:52:26 2025 +0530

    octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
    
    [ Upstream commit 85f4b0c650d9f9db10bda8d3acfa1af83bf78cf7 ]
    
    This patch ensures that the RX ring size (rx_pending) is not
    set below the permitted length. This avoids UBSAN
    shift-out-of-bounds errors when users passes small or zero
    ring sizes via ethtool -G.
    
    Fixes: d45d8979840d ("octeontx2-pf: Add basic ethtool support")
    Signed-off-by: Anshumali Gaur <agaur@marvell.com>
    Link: https://patch.msgid.link/20251219062226.524844-1-agaur@marvell.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
parisc: entry.S: fix space adjustment on interruption for 64-bit userspace [+ + +]
Author: Sven Schnelle <svens@stackframe.org>
Date:   Thu Oct 30 08:56:05 2025 +0100

    parisc: entry.S: fix space adjustment on interruption for 64-bit userspace
    
    commit 1aa4524c0c1b54842c4c0a370171d11b12d0709b upstream.
    
    In wide mode, the IASQ contain the upper part of the GVA
    during interruption. This needs to be reversed before
    the space is used - otherwise it contains parts of IAOQ.
    See Page 2-13 "Processing Resources / Interruption Instruction
    Address Queues" in the Parisc 2.0 Architecture Manual page 2-13
    for an explanation.
    
    The IAOQ/IASQ space_adjust was skipped for other interruptions
    than itlb misses. However, the code in handle_interruption()
    checks whether iasq[0] contains a valid space. Due to the not
    masked out bits this match failed and the process was killed.
    
    Also add space_adjust for IAOQ1/IASQ1 so ptregs contains sane values.
    
    Signed-off-by: Sven Schnelle <svens@stackframe.org>
    Cc: stable@vger.kernel.org # v6.0+
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parisc: entry: set W bit for !compat tasks in syscall_restore_rfi() [+ + +]
Author: Sven Schnelle <svens@stackframe.org>
Date:   Wed Oct 15 23:21:41 2025 +0200

    parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()
    
    commit 5fb1d3ce3e74a4530042795e1e065422295f1371 upstream.
    
    When the kernel leaves to userspace via syscall_restore_rfi(), the
    W bit is not set in the new PSW. This doesn't cause any problems
    because there's no 64 bit userspace for parisc. Simple static binaries
    are usually loaded at addresses way below the 32 bit limit so the W bit
    doesn't matter.
    
    Fix this by setting the W bit when TIF_32BIT is not set.
    
    Signed-off-by: Sven Schnelle <svens@stackframe.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths [+ + +]
Author: Lukas Wunner <lukas@wunner.de>
Date:   Wed Nov 19 09:50:01 2025 +0100

    PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths
    
    commit 894f475f88e06c0f352c829849560790dbdedbe5 upstream.
    
    When a PCI device is suspended, it is normally the PCI core's job to save
    Config Space and put the device into a low power state.  However drivers
    are allowed to assume these responsibilities.  When they do, the PCI core
    can tell by looking at the state_saved flag in struct pci_dev:  The flag
    is cleared before commencing the suspend sequence and it is set when
    pci_save_state() is called.  If the PCI core finds the flag set late in
    the suspend sequence, it refrains from calling pci_save_state() itself.
    
    But there are two corner cases where the PCI core neglects to clear the
    flag before commencing the suspend sequence:
    
    * If a driver has legacy PCI PM callbacks, pci_legacy_suspend() neglects
      to clear the flag.  The (stale) flag is subsequently queried by
      pci_legacy_suspend() itself and pci_legacy_suspend_late().
    
    * If a device has no driver or its driver has no PCI PM callbacks,
      pci_pm_freeze() neglects to clear the flag.  The (stale) flag is
      subsequently queried by pci_pm_freeze_noirq().
    
    The flag may be set prior to suspend if the device went through error
    recovery:  Drivers commonly invoke pci_restore_state() + pci_save_state()
    to restore Config Space after reset.
    
    The flag may also be set if drivers call pci_save_state() on probe to
    allow for recovery from subsequent errors.
    
    The result is that pci_legacy_suspend_late() and pci_pm_freeze_noirq()
    don't call pci_save_state() and so the state that will be restored on
    resume is the one recorded on last error recovery or on probe, not the one
    that the device had on suspend.  If the two states happen to be identical,
    there's no problem.
    
    Reinstate clearing the flag in pci_legacy_suspend() and pci_pm_freeze().
    The two functions used to do that until commit 4b77b0a2ba27 ("PCI: Clear
    saved_state after the state has been restored") deemed it unnecessary
    because it assumed that it's sufficient to clear the flag on resume in
    pci_restore_state().  The commit seemingly did not take into account that
    pci_save_state() and pci_restore_state() are not only used by power
    management code, but also for error recovery.
    
    Devices without driver or whose driver has no PCI PM callbacks may be in
    runtime suspend when pci_pm_freeze() is called.  Their state has already
    been saved, so don't clear the flag to skip a pointless pci_save_state()
    in pci_pm_freeze_noirq().
    
    None of the drivers with legacy PCI PM callbacks seem to use runtime PM,
    so clear the flag unconditionally in their case.
    
    Fixes: 4b77b0a2ba27 ("PCI: Clear saved_state after the state has been restored")
    Signed-off-by: Lukas Wunner <lukas@wunner.de>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
    Cc: stable@vger.kernel.org # v2.6.32+
    Link: https://patch.msgid.link/094f2aad64418710daf0940112abe5a0afdc6bce.1763483367.git.lukas@wunner.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
PCI: brcmstb: Fix disabling L0s capability [+ + +]
Author: Jim Quinlan <james.quinlan@broadcom.com>
Date:   Fri Oct 3 13:04:36 2025 -0400

    PCI: brcmstb: Fix disabling L0s capability
    
    commit 9583f9d22991d2cfb5cc59a2552040c4ae98d998 upstream.
    
    caab002d5069 ("PCI: brcmstb: Disable L0s component of ASPM if requested")
    set PCI_EXP_LNKCAP_ASPM_L1 and (optionally) PCI_EXP_LNKCAP_ASPM_L0S in
    PCI_EXP_LNKCAP (aka PCIE_RC_CFG_PRIV1_LINK_CAPABILITY in brcmstb).
    
    But instead of using PCI_EXP_LNKCAP_ASPM_L1 and PCI_EXP_LNKCAP_ASPM_L0S
    directly, it used PCIE_LINK_STATE_L1 and PCIE_LINK_STATE_L0S, which are
    Linux-created values that only coincidentally matched the PCIe spec.
    b478e162f227 ("PCI/ASPM: Consolidate link state defines") later changed
    them so they no longer matched the PCIe spec, so the bits ended up in the
    wrong place in PCI_EXP_LNKCAP.
    
    Use PCI_EXP_LNKCAP_ASPM_L0S to clear L0s support when there's an
    'aspm-no-l0s' property.  Rely on brcmstb hardware to advertise L0s and/or
    L1 support otherwise.
    
    Fixes: caab002d5069 ("PCI: brcmstb: Disable L0s component of ASPM if requested")
    Reported-by: Bjorn Helgaas <bhelgaas@google.com>
    Closes: https://lore.kernel.org/linux-pci/20250925194424.GA2197200@bhelgaas
    Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com>
    [mani: reworded subject and description, added closes tag and CCed stable]
    Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
    [bhelgaas: commit log]
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/20251003170436.1446030-1-james.quinlan@broadcom.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

PCI: meson: Fix parsing the DBI register region [+ + +]
Author: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Date:   Sat Nov 1 09:59:42 2025 +0530

    PCI: meson: Fix parsing the DBI register region
    
    commit eff0306b109f2d611e44f0155b0324f6cfec3ef4 upstream.
    
    First of all, the driver was parsing the 'dbi' register region as 'elbi'.
    This was due to DT mistakenly passing 'dbi' as 'elbi'. Since the DT is
    now fixed to supply 'dbi' region, this driver can rely on the DWC core
    driver to parse and map it.
    
    However, to support the old DTs, if the 'elbi' region is found in DT, parse
    and map the region as both 'dw_pcie::elbi_base' as 'dw_pcie::dbi_base'.
    This will allow the driver to work with both broken and fixed DTs.
    
    Also, skip parsing the 'elbi' region in DWC core if 'pci->elbi_base' was
    already populated.
    
    Fixes: 9c0ef6d34fdb ("PCI: amlogic: Add the Amlogic Meson PCIe controller driver")
    Fixes: c96992a24bec ("PCI: dwc: Add support for ELBI resource mapping")
    Reported-by: Linnaea Lavia <linnaea-von-lavia@live.com>
    Closes: https://lore.kernel.org/linux-pci/DM4PR05MB102707B8CDF84D776C39F22F2C7F0A@DM4PR05MB10270.namprd05.prod.outlook.com/
    Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
    Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
    Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on Bananapi-M2S
    Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
    Cc: stable@vger.kernel.org # 6.2
    Link: https://patch.msgid.link/20251101-pci-meson-fix-v1-3-c50dcc56ed6a@oss.qualcomm.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error [+ + +]
Author: Sandipan Das <sandipan.das@amd.com>
Date:   Tue Dec 9 13:56:38 2025 +0530

    perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
    
    commit 01439286514ce9d13b8123f8ec3717d7135ff1d6 upstream.
    
    If amd_uncore_event_init() fails, return an error irrespective of the
    pmu_version. Setting hwc->config should be safe even if there is an
    error so use this opportunity to simplify the code.
    
    Closes: https://lore.kernel.org/all/aTaI0ci3vZ44lmBn@stanley.mountain/
    
    Fixes: d6389d3ccc13 ("perf/x86/amd/uncore: Refactor uncore management")
    Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
    Signed-off-by: Sandipan Das <sandipan.das@amd.com>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: stable@vger.kernel.org
    Link: https://patch.msgid.link/076935e23a70335d33bd6e23308b75ae0ad35ba2.1765268667.git.sandipan.das@amd.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names [+ + +]
Author: Shravan Kumar Ramani <shravankr@nvidia.com>
Date:   Thu Dec 18 12:18:13 2025 +0000

    platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names
    
    [ Upstream commit f13bce715d1600698310a4a7832f6a52499d5395 ]
    
    Some event names have trailing whitespaces at the end which causes programming
    of counters using the name for these specific events to fail and hence need to
    be removed.
    
    Fixes: 423c3361855c ("platform/mellanox: mlxbf-pmc: Add support for BlueField-3")
    Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com>
    Reviewed-by: David Thompson <davthompson@nvidia.com>
    Link: https://patch.msgid.link/065cbae0717dcc1169681c4dbb1a6e050b8574b3.1766059953.git.shravankr@nvidia.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe [+ + +]
Author: Alok Tiwari <alok.a.tiwari@oracle.com>
Date:   Wed Dec 24 01:51:09 2025 -0800

    platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
    
    [ Upstream commit 66e245db16f0175af656cd812b6dc1a5e1f7b80a ]
    
    The PMT feature probe creates a child device with device_create().
    If device creation fail, the code pass priv->dev (which is an ERR_PTR)
    to dev_err_probe(), which is not a valid device pointer.
    
    This patch change the dev_err_probe() call to use the parent auxiliary
    device (&auxdev->dev) and update the error message to reference the
    parent device name. It ensure correct error reporting and avoid
    passing an invalid device pointer.
    
    Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver")
    Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
    Link: https://patch.msgid.link/20251224095133.115678-1-alok.a.tiwari@oracle.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
platform/x86/intel/pmt: Fix kobject memory leak on init failure [+ + +]
Author: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Date:   Tue Dec 23 14:10:41 2025 +0530

    platform/x86/intel/pmt: Fix kobject memory leak on init failure
    
    [ Upstream commit 00c22b1e84288bf0e17ab1e7e59d75237cf0d0dc ]
    
    When kobject_init_and_add() fails in pmt_features_discovery(), the
    function returns without calling kobject_put(). This violates the
    kobject API contract where kobject_put() must be called even on
    initialization failure to properly release allocated resources.
    
    Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver")
    Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
    Link: https://patch.msgid.link/20251223084041.3832933-1-kaushlendra.kumar@intel.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
platform/x86: alienware-wmi-wmax: Add AWCC support for Alienware x16 [+ + +]
Author: Kurt Borja <kuurtb@gmail.com>
Date:   Fri Dec 5 13:50:11 2025 -0500

    platform/x86: alienware-wmi-wmax: Add AWCC support for Alienware x16
    
    commit a584644a490d276907e56817694859eaac2a4199 upstream.
    
    Add AWCC support for Alienware x16 laptops.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Kurt Borja <kuurtb@gmail.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Link: https://patch.msgid.link/20251205-area-51-v1-2-d2cb13530851@gmail.com
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora [+ + +]
Author: Kurt Borja <kuurtb@gmail.com>
Date:   Fri Dec 5 13:50:12 2025 -0500

    platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora
    
    commit 7f3c2499da24551968640528fee9aed3bb4f0c3f upstream.
    
    Add AWCC support for Alienware 16X Aurora laptops.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Kurt Borja <kuurtb@gmail.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Link: https://patch.msgid.link/20251205-area-51-v1-3-d2cb13530851@gmail.com
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

platform/x86: alienware-wmi-wmax: Add support for new Area-51 laptops [+ + +]
Author: Kurt Borja <kuurtb@gmail.com>
Date:   Fri Dec 5 13:50:10 2025 -0500

    platform/x86: alienware-wmi-wmax: Add support for new Area-51 laptops
    
    commit 433f7744cb302ac22800dc0cd50494319ce64ba0 upstream.
    
    Add AWCC support for new Alienware Area-51 laptops.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Kurt Borja <kuurtb@gmail.com>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Link: https://patch.msgid.link/20251205-area-51-v1-1-d2cb13530851@gmail.com
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing [+ + +]
Author: Junrui Luo <moonafterrain@outlook.com>
Date:   Fri Dec 26 19:42:05 2025 +0800

    platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
    
    [ Upstream commit e44c42c830b7ab36e3a3a86321c619f24def5206 ]
    
    The hp_populate_*_elements_from_package() functions in the hp-bioscfg
    driver contain out-of-bounds array access vulnerabilities.
    
    These functions parse ACPI packages into internal data structures using
    a for loop with index variable 'elem' that iterates through
    enum_obj/integer_obj/order_obj/password_obj/string_obj arrays.
    
    When processing multi-element fields like PREREQUISITES and
    ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array
    elements using expressions like 'enum_obj[elem + reqs]' and
    'enum_obj[elem + pos_values]' within nested loops.
    
    The bug is that the bounds check only validated elem, but did not consider
    the additional offset when accessing elem + reqs or elem + pos_values.
    
    The fix changes the bounds check to validate the actual accessed index.
    
    Reported-by: Yuhao Jiang <danisjiang@gmail.com>
    Reported-by: Junrui Luo <moonafterrain@outlook.com>
    Fixes: e6c7b3e15559 ("platform/x86: hp-bioscfg: string-attributes")
    Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
    Link: https://patch.msgid.link/SYBPR01MB788173D7DD4EA2CB6383683DAFB0A@SYBPR01MB7881.ausprd01.prod.outlook.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic [+ + +]
Author: Junrui Luo <moonafterrain@outlook.com>
Date:   Fri Dec 19 16:30:29 2025 +0800

    platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
    
    [ Upstream commit 15dd100349b8526cbdf2de0ce3e72e700eb6c208 ]
    
    The ibm_rtl_init() function searches for the signature but has a pointer
    arithmetic error. The loop counter suggests searching at 4-byte intervals
    but the implementation only advances by 1 byte per iteration.
    
    Fix by properly advancing the pointer by sizeof(unsigned int) bytes
    each iteration.
    
    Reported-by: Yuhao Jiang <danisjiang@gmail.com>
    Reported-by: Junrui Luo <moonafterrain@outlook.com>
    Fixes: 35f0ce032b0f ("IBM Real-Time "SMI Free" mode driver -v7")
    Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
    Link: https://patch.msgid.link/SYBPR01MB78812D887A92DE3802D0D06EAFA9A@SYBPR01MB7881.ausprd01.prod.outlook.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

platform/x86: msi-laptop: add missing sysfs_remove_group() [+ + +]
Author: Thomas Fourier <fourier.thomas@gmail.com>
Date:   Wed Dec 17 11:36:13 2025 +0100

    platform/x86: msi-laptop: add missing sysfs_remove_group()
    
    [ Upstream commit 1461209cf813b6ee6d40f29b96b544587df6d2b1 ]
    
    A sysfs group is created in msi_init() when old_ec_model is enabled, but
    never removed. Remove the msipf_old_attribute_group in that case.
    
    Fixes: 03696e51d75a ("msi-laptop: Disable brightness control for new EC")
    Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
    Link: https://patch.msgid.link/20251217103617.27668-2-fourier.thomas@gmail.com
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

platform/x86: samsung-galaxybook: Fix problematic pointer cast [+ + +]
Author: Armin Wolf <W_Armin@gmx.de>
Date:   Sun Dec 28 22:41:31 2025 +0100

    platform/x86: samsung-galaxybook: Fix problematic pointer cast
    
    commit d37cd54ebeac37a763fbf303ed25f8a6e98328ff upstream.
    
    A user reported that reading the charge threshold on his device
    results in very strange values (like 78497792) being returned.
    The reason for this seems to be the fact that the driver casts
    the int pointer to an u8 pointer, leaving the last 3 bytes of
    the destination uninitialized. Fix this by using a temporary
    variable instead.
    
    Cc: stable@vger.kernel.org
    Fixes: 56f529ce4370 ("platform/x86: samsung-galaxybook: Add samsung-galaxybook driver")
    Reported-by: Gianni Ceccarelli <dakkar@thenautilus.net>
    Closes: https://lore.kernel.org/platform-driver-x86/20251228115556.14362d66@thenautilus.net/
    Tested-by: Gianni Ceccarelli <dakkar@thenautilus.net>
    Signed-off-by: Armin Wolf <W_Armin@gmx.de>
    Link: https://patch.msgid.link/20251228214217.35972-1-W_Armin@gmx.de
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
pmdomain: imx: Fix reference count leak in imx_gpc_probe() [+ + +]
Author: Wentao Liang <vulab@iscas.ac.cn>
Date:   Thu Dec 11 04:02:52 2025 +0000

    pmdomain: imx: Fix reference count leak in imx_gpc_probe()
    
    commit 73cb5f6eafb0ac7aea8cdeb8ff12981aa741d8fb upstream.
    
    of_get_child_by_name() returns a node pointer with refcount incremented.
    Use the __free() attribute to manage the pgc_node reference, ensuring
    automatic of_node_put() cleanup when pgc_node goes out of scope.
    
    This eliminates the need for explicit error handling paths and avoids
    reference count leaks.
    
    Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver")
    Cc: stable@vger.kernel.org
    Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
    Reviewed-by: Frank Li <Frank.Li@nxp.com>
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

pmdomain: mtk-pm-domains: Fix spinlock recursion fix in probe [+ + +]
Author: Macpaul Lin <macpaul.lin@mediatek.com>
Date:   Fri Nov 28 12:17:22 2025 +0800

    pmdomain: mtk-pm-domains: Fix spinlock recursion fix in probe
    
    commit 305f254727bd379bbed0385afa0162f5bde1f51c upstream.
    
    Remove scpsys_get_legacy_regmap(), replacing its usage with
    of_find_node_with_property(). Explicitly call of_node_get(np) before each
    of_find_node_with_property() to maintain correct node reference counting.
    
    The of_find_node_with_property() function "consumes" its input by calling
    of_node_put() internally, whether or not it finds a match.  Currently,
    dev->of_node (np) is passed multiple times in sequence without incrementing
    its reference count, causing it to be decremented multiple times and
    risking early memory release.
    
    Adding of_node_get(np) before each call balances the reference count,
    preventing premature node release.
    
    Fixes: c1bac49fe91f ("pmdomains: mtk-pm-domains: Fix spinlock recursion in probe")
    Cc: stable@vger.kernel.org
    Signed-off-by: Macpaul Lin <macpaul.lin@mediatek.com>
    Tested-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
power: supply: max77705: Fix potential IRQ chip conflict when probing two devices [+ + +]
Author: Krzysztof Kozlowski <krzk@kernel.org>
Date:   Thu Oct 23 12:29:06 2025 +0200

    power: supply: max77705: Fix potential IRQ chip conflict when probing two devices
    
    commit 1cb053ea2e1dedd8f2d9653b7c3ca5b93c8c9275 upstream.
    
    MAX77705 charger is most likely always a single device on the board,
    however nothing stops board designers to have two of them, thus same
    device driver could probe twice. Or user could manually try to probing
    second time.
    
    Device driver is not ready for that case, because it allocates
    statically 'struct regmap_irq_chip' as non-const and stores during
    probe in 'irq_drv_data' member a pointer to per-probe state
    container ('struct max77705_charger_data').  devm_regmap_add_irq_chip()
    does not make a copy of 'struct regmap_irq_chip' but stores the pointer.
    
    Second probe - either successful or failure - would overwrite the
    'irq_drv_data' from previous device probe, so interrupts would be
    executed in a wrong context.
    
    Fixes: a6a494c8e3ce ("power: supply: max77705: Add charger driver for Maxim 77705")
    Cc: stable@vger.kernel.org
    Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
    Link: https://patch.msgid.link/20251023102905.71535-2-krzysztof.kozlowski@linaro.org
    Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
powercap: intel_rapl: Add support for Nova Lake processors [+ + +]
Author: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Date:   Tue Oct 28 15:48:14 2025 +0530

    powercap: intel_rapl: Add support for Nova Lake processors
    
    commit 58075aec92a8141fd7f42e1c36d1bc54552c015e upstream.
    
    Add RAPL support for Intel Nova Lake and Nova Lake L processors using
    the core defaults configuration.
    
    Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
    [ rjw: Subject and changelog edits, rebase ]
    Link: https://patch.msgid.link/20251028101814.3482508-1-kaushlendra.kumar@intel.com
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

powercap: intel_rapl: Add support for Wildcat Lake platform [+ + +]
Author: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Date:   Thu Oct 23 10:45:32 2025 -0700

    powercap: intel_rapl: Add support for Wildcat Lake platform
    
    commit 39f421f2e301f995c17c35b783e2863155b3f647 upstream.
    
    Add Wildcat Lake to the list of supported processors for RAPL.
    
    Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
    Link: https://patch.msgid.link/20251023174532.1882008-1-srinivas.pandruvada@linux.intel.com
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
powerpc, mm: Fix mprotect on book3s 32-bit [+ + +]
Author: Dave Vasilevsky <dave@vasilevsky.ca>
Date:   Sun Nov 16 01:40:46 2025 -0500

    powerpc, mm: Fix mprotect on book3s 32-bit
    
    commit 78fc63ffa7813e33681839bb33826c24195f0eb7 upstream.
    
    On 32-bit book3s with hash-MMUs, tlb_flush() was a no-op. This was
    unnoticed because all uses until recently were for unmaps, and thus
    handled by __tlb_remove_tlb_entry().
    
    After commit 4a18419f71cd ("mm/mprotect: use mmu_gather") in kernel 5.19,
    tlb_gather_mmu() started being used for mprotect as well. This caused
    mprotect to simply not work on these machines:
    
      int *ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
                      MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
      *ptr = 1; // force HPTE to be created
      mprotect(ptr, 4096, PROT_READ);
      *ptr = 2; // should segfault, but succeeds
    
    Fixed by making tlb_flush() actually flush TLB pages. This finally
    agrees with the behaviour of boot3s64's tlb_flush().
    
    Fixes: 4a18419f71cd ("mm/mprotect: use mmu_gather")
    Cc: stable@vger.kernel.org
    Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Signed-off-by: Dave Vasilevsky <dave@vasilevsky.ca>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
    Link: https://patch.msgid.link/20251116-vasi-mprotect-g3-v3-1-59a9bd33ba00@vasilevsky.ca
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
powerpc/64s/slb: Fix SLB multihit issue during SLB preload [+ + +]
Author: Donet Tom <donettom@linux.ibm.com>
Date:   Thu Oct 30 20:27:26 2025 +0530

    powerpc/64s/slb: Fix SLB multihit issue during SLB preload
    
    commit 00312419f0863964625d6dcda8183f96849412c6 upstream.
    
    On systems using the hash MMU, there is a software SLB preload cache that
    mirrors the entries loaded into the hardware SLB buffer. This preload
    cache is subject to periodic eviction — typically after every 256 context
    switches — to remove old entry.
    
    To optimize performance, the kernel skips switch_mmu_context() in
    switch_mm_irqs_off() when the prev and next mm_struct are the same.
    However, on hash MMU systems, this can lead to inconsistencies between
    the hardware SLB and the software preload cache.
    
    If an SLB entry for a process is evicted from the software cache on one
    CPU, and the same process later runs on another CPU without executing
    switch_mmu_context(), the hardware SLB may retain stale entries. If the
    kernel then attempts to reload that entry, it can trigger an SLB
    multi-hit error.
    
    The following timeline shows how stale SLB entries are created and can
    cause a multi-hit error when a process moves between CPUs without a
    MMU context switch.
    
    CPU 0                                   CPU 1
    -----                                    -----
    Process P
    exec                                    swapper/1
     load_elf_binary
      begin_new_exc
        activate_mm
         switch_mm_irqs_off
          switch_mmu_context
           switch_slb
           /*
            * This invalidates all
            * the entries in the HW
            * and setup the new HW
            * SLB entries as per the
            * preload cache.
            */
    context_switch
    sched_migrate_task migrates process P to cpu-1
    
    Process swapper/0                       context switch (to process P)
    (uses mm_struct of Process P)           switch_mm_irqs_off()
                                             switch_slb
                                               load_slb++
                                                /*
                                                * load_slb becomes 0 here
                                                * and we evict an entry from
                                                * the preload cache with
                                                * preload_age(). We still
                                                * keep HW SLB and preload
                                                * cache in sync, that is
                                                * because all HW SLB entries
                                                * anyways gets evicted in
                                                * switch_slb during SLBIA.
                                                * We then only add those
                                                * entries back in HW SLB,
                                                * which are currently
                                                * present in preload_cache
                                                * (after eviction).
                                                */
                                            load_elf_binary continues...
                                             setup_new_exec()
                                              slb_setup_new_exec()
    
                                            sched_switch event
                                            sched_migrate_task migrates
                                            process P to cpu-0
    
    context_switch from swapper/0 to Process P
     switch_mm_irqs_off()
      /*
       * Since both prev and next mm struct are same we don't call
       * switch_mmu_context(). This will cause the HW SLB and SW preload
       * cache to go out of sync in preload_new_slb_context. Because there
       * was an SLB entry which was evicted from both HW and preload cache
       * on cpu-1. Now later in preload_new_slb_context(), when we will try
       * to add the same preload entry again, we will add this to the SW
       * preload cache and then will add it to the HW SLB. Since on cpu-0
       * this entry was never invalidated, hence adding this entry to the HW
       * SLB will cause a SLB multi-hit error.
       */
    load_elf_binary continues...
     START_THREAD
      start_thread
       preload_new_slb_context
       /*
        * This tries to add a new EA to preload cache which was earlier
        * evicted from both cpu-1 HW SLB and preload cache. This caused the
        * HW SLB of cpu-0 to go out of sync with the SW preload cache. The
        * reason for this was, that when we context switched back on CPU-0,
        * we should have ideally called switch_mmu_context() which will
        * bring the HW SLB entries on CPU-0 in sync with SW preload cache
        * entries by setting up the mmu context properly. But we didn't do
        * that since the prev mm_struct running on cpu-0 was same as the
        * next mm_struct (which is true for swapper / kernel threads). So
        * now when we try to add this new entry into the HW SLB of cpu-0,
        * we hit a SLB multi-hit error.
        */
    
    WARNING: CPU: 0 PID: 1810970 at arch/powerpc/mm/book3s64/slb.c:62
    assert_slb_presence+0x2c/0x50(48 results) 02:47:29 [20157/42149]
    Modules linked in:
    CPU: 0 UID: 0 PID: 1810970 Comm: dd Not tainted 6.16.0-rc3-dirty #12
    VOLUNTARY
    Hardware name: IBM pSeries (emulated by qemu) POWER8 (architected)
    0x4d0200 0xf000004 of:SLOF,HEAD hv:linux,kvm pSeries
    NIP:  c00000000015426c LR: c0000000001543b4 CTR: 0000000000000000
    REGS: c0000000497c77e0 TRAP: 0700   Not tainted  (6.16.0-rc3-dirty)
    MSR:  8000000002823033 <SF,VEC,VSX,FP,ME,IR,DR,RI,LE>  CR: 28888482  XER: 00000000
    CFAR: c0000000001543b0 IRQMASK: 3
    <...>
    NIP [c00000000015426c] assert_slb_presence+0x2c/0x50
    LR [c0000000001543b4] slb_insert_entry+0x124/0x390
    Call Trace:
      0x7fffceb5ffff (unreliable)
      preload_new_slb_context+0x100/0x1a0
      start_thread+0x26c/0x420
      load_elf_binary+0x1b04/0x1c40
      bprm_execve+0x358/0x680
      do_execveat_common+0x1f8/0x240
      sys_execve+0x58/0x70
      system_call_exception+0x114/0x300
      system_call_common+0x160/0x2c4
    
    >From the above analysis, during early exec the hardware SLB is cleared,
    and entries from the software preload cache are reloaded into hardware
    by switch_slb. However, preload_new_slb_context and slb_setup_new_exec
    also attempt to load some of the same entries, which can trigger a
    multi-hit. In most cases, these additional preloads simply hit existing
    entries and add nothing new. Removing these functions avoids redundant
    preloads and eliminates the multi-hit issue. This patch removes these
    two functions.
    
    We tested process switching performance using the context_switch
    benchmark on POWER9/hash, and observed no regression.
    
    Without this patch: 129041 ops/sec
    With this patch:    129341 ops/sec
    
    We also measured SLB faults during boot, and the counts are essentially
    the same with and without this patch.
    
    SLB faults without this patch: 19727
    SLB faults with this patch:    19786
    
    Fixes: 5434ae74629a ("powerpc/64s/hash: Add a SLB preload cache")
    cc: stable@vger.kernel.org
    Suggested-by: Nicholas Piggin <npiggin@gmail.com>
    Signed-off-by: Donet Tom <donettom@linux.ibm.com>
    Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
    Link: https://patch.msgid.link/0ac694ae683494fe8cadbd911a1a5018d5d3c541.1761834163.git.ritesh.list@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages [+ + +]
Author: David Hildenbrand <david@kernel.org>
Date:   Tue Oct 21 12:06:06 2025 +0200

    powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
    
    commit 0da2ba35c0d532ca0fe7af698b17d74c4d084b9a upstream.
    
    Let's properly adjust BALLOON_MIGRATE like the other drivers.
    
    Note that the INFLATE/DEFLATE events are triggered from the core when
    enqueueing/dequeueing pages.
    
    This was found by code inspection.
    
    Link: https://lkml.kernel.org/r/20251021100606.148294-3-david@redhat.com
    Fixes: fe030c9b85e6 ("powerpc/pseries/cmm: Implement balloon compaction")
    Signed-off-by: David Hildenbrand <david@redhat.com>
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
    Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
    Cc: Michael Ellerman <mpe@ellerman.id.au>
    Cc: Nicholas Piggin <npiggin@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION [+ + +]
Author: David Hildenbrand <david@kernel.org>
Date:   Tue Oct 21 12:06:05 2025 +0200

    powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
    
    commit fc6bcf9ac4de76f5e7bcd020b3c0a86faff3f2d5 upstream.
    
    Patch series "powerpc/pseries/cmm: two smaller fixes".
    
    Two smaller fixes identified while doing a bigger rework.
    
    
    This patch (of 2):
    
    We always have to initialize the balloon_dev_info, even when compaction is
    not configured in: otherwise the containing list and the lock are left
    uninitialized.
    
    Likely not many such configs exist in practice, but let's CC stable to
    be sure.
    
    This was found by code inspection.
    
    Link: https://lkml.kernel.org/r/20251021100606.148294-1-david@redhat.com
    Link: https://lkml.kernel.org/r/20251021100606.148294-2-david@redhat.com
    Fixes: fe030c9b85e6 ("powerpc/pseries/cmm: Implement balloon compaction")
    Signed-off-by: David Hildenbrand <david@redhat.com>
    Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
    Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
    Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
    Cc: Michael Ellerman <mpe@ellerman.id.au>
    Cc: Nicholas Piggin <npiggin@gmail.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
powerpc/tools: drop `-o pipefail` in gcc check scripts [+ + +]
Author: Jan Stancek <jstancek@redhat.com>
Date:   Tue Sep 23 17:32:16 2025 +0200

    powerpc/tools: drop `-o pipefail` in gcc check scripts
    
    [ Upstream commit f1164534ad62f0cc247d99650b07bd59ad2a49fd ]
    
    Fixes: 0f71dcfb4aef ("powerpc/ftrace: Add support for -fpatchable-function-entry")
    Fixes: b71c9ffb1405 ("powerpc: Add arch/powerpc/tools directory")
    Reported-by: Joe Lawrence <joe.lawrence@redhat.com>
    Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
    Signed-off-by: Jan Stancek <jstancek@redhat.com>
    Fixes: 8c50b72a3b4f ("powerpc/ftrace: Add Kconfig & Make glue for mprofile-kernel")
    Fixes: abba759796f9 ("powerpc/kbuild: move -mprofile-kernel check to Kconfig")
    Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
    Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
    Reviewed-by: Josh Poimboeuf <jpoimboe@kernel.org>
    Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
    Link: https://patch.msgid.link/cc6cdd116c3ad9d990df21f13c6d8e8a83815bbd.1758641374.git.jstancek@redhat.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/bnxt_re: fix dma_free_coherent() pointer [+ + +]
Author: Thomas Fourier <fourier.thomas@gmail.com>
Date:   Tue Dec 30 09:51:21 2025 +0100

    RDMA/bnxt_re: fix dma_free_coherent() pointer
    
    [ Upstream commit fcd431a9627f272b4c0bec445eba365fe2232a94 ]
    
    The dma_alloc_coherent() allocates a dma-mapped buffer, pbl->pg_arr[i].
    The dma_free_coherent() should pass the same buffer to
    dma_free_coherent() and not page-aligned.
    
    Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
    Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
    Link: https://patch.msgid.link/20251230085121.8023-2-fourier.thomas@gmail.com
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send [+ + +]
Author: Alok Tiwari <alok.a.tiwari@oracle.com>
Date:   Fri Dec 19 01:32:57 2025 -0800

    RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send
    
    [ Upstream commit f01765a2361323e78e3d91b1cb1d5527a83c5cf7 ]
    
    The bnxt_re SEND path checks wr->send_flags to enable features such as
    IP checksum offload. However, send_flags is a bitmask and may contain
    multiple flags (e.g. IB_SEND_SIGNALED | IB_SEND_IP_CSUM), while the
    existing code uses a switch() statement that only matches when
    send_flags is exactly IB_SEND_IP_CSUM.
    
    As a result, checksum offload is not enabled when additional SEND
    flags are present.
    
    Replace the switch() with a bitmask test:
    
        if (wr->send_flags & IB_SEND_IP_CSUM)
    
    This ensures IP checksum offload is enabled correctly when multiple
    SEND flags are used.
    
    Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
    Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
    Link: https://patch.msgid.link/20251219093308.2415620-1-alok.a.tiwari@oracle.com
    Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db() [+ + +]
Author: Alok Tiwari <alok.a.tiwari@oracle.com>
Date:   Wed Dec 17 02:01:41 2025 -0800

    RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()
    
    [ Upstream commit 145a417a39d7efbc881f52e829817376972b278c ]
    
    RCFW_COMM_CONS_PCI_BAR_REGION is defined as BAR 2, so checking
    !creq_db->reg.bar_id is incorrect and always false.
    
    pci_resource_start() returns the BAR base address, and a value of 0
    indicates that the BAR is unassigned. Update the condition to test
    bar_base == 0 instead.
    
    This ensures the driver detects and logs an error for an unassigned
    RCFW communication BAR.
    
    Fixes: cee0c7bba486 ("RDMA/bnxt_re: Refactor command queue management code")
    Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
    Link: https://patch.msgid.link/20251217100158.752504-1-alok.a.tiwari@oracle.com
    Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats() [+ + +]
Author: Ding Hui <dinghui@sangfor.com.cn>
Date:   Mon Dec 8 15:21:10 2025 +0800

    RDMA/bnxt_re: Fix OOB write in bnxt_re_copy_err_stats()
    
    [ Upstream commit 9b68a1cc966bc947d00e4c0df7722d118125aa37 ]
    
    Commit ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters
    update") added three new counters and placed them after
    BNXT_RE_OUT_OF_SEQ_ERR.
    
    BNXT_RE_OUT_OF_SEQ_ERR acts as a boundary marker for allocating hardware
    statistics with different num_counters values on chip_gen_p5_p7 devices.
    
    As a result, BNXT_RE_NUM_STD_COUNTERS are used when allocating
    hw_stats, which leads to an out-of-bounds write in
    bnxt_re_copy_err_stats().
    
    The counters BNXT_RE_REQ_CQE_ERROR, BNXT_RE_RESP_CQE_ERROR, and
    BNXT_RE_RESP_REMOTE_ACCESS_ERRS are applicable to generic hardware, not
    only p5/p7 devices.
    
    Fix this by moving these counters before BNXT_RE_OUT_OF_SEQ_ERR so they
    are included in the generic counter set.
    
    Fixes: ef56081d1864 ("RDMA/bnxt_re: RoCE related hardware counters update")
    Reported-by: Yingying Zheng <zhengyingying@sangfor.com.cn>
    Signed-off-by: Ding Hui <dinghui@sangfor.com.cn>
    Link: https://patch.msgid.link/20251208072110.28874-1-dinghui@sangfor.com.cn
    Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
    Tested-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/bnxt_re: Fix to use correct page size for PDE table [+ + +]
Author: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Date:   Tue Dec 23 18:48:55 2025 +0530

    RDMA/bnxt_re: Fix to use correct page size for PDE table
    
    [ Upstream commit 3d70e0fb0f289b0c778041c5bb04d099e1aa7c1c ]
    
    In bnxt_qplib_alloc_init_hwq(), while allocating memory for PDE table
    driver incorrectly is using the "pg_size" value passed to the function.
    Fixed to use the right value 4K. Also, fixed the allocation size for
    PBL table.
    
    Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation")
    Signed-off-by: Damodharam Ammepalli <damodharam.ammepalli@broadcom.com>
    Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
    Link: https://patch.msgid.link/20251223131855.145955-1-kalesh-anakkur.purayil@broadcom.com
    Reviewed-by: Selvin Xavier <selvin.xavier@broadcom.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/cm: Fix leaking the multicast GID table reference [+ + +]
Author: Jason Gunthorpe <jgg@ziepe.ca>
Date:   Fri Nov 28 20:53:21 2025 -0400

    RDMA/cm: Fix leaking the multicast GID table reference
    
    commit 57f3cb6c84159d12ba343574df2115fb18dd83ca upstream.
    
    If the CM ID is destroyed while the CM event for multicast creating is
    still queued the cancel_work_sync() will prevent the work from running
    which also prevents destroying the ah_attr. This leaks a refcount and
    triggers a WARN:
    
       GID entry ref leak for dev syz1 index 2 ref=573
       WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 release_gid_table drivers/infiniband/core/cache.c:806 [inline]
       WARNING: CPU: 1 PID: 655 at drivers/infiniband/core/cache.c:809 gid_table_release_one+0x284/0x3cc drivers/infiniband/core/cache.c:886
    
    Destroy the ah_attr after canceling the work, it is safe to call this
    twice.
    
    Link: https://patch.msgid.link/r/0-v1-4285d070a6b2+20a-rdma_mc_gid_leak_syz_jgg@nvidia.com
    Cc: stable@vger.kernel.org
    Fixes: fe454dc31e84 ("RDMA/ucma: Fix use-after-free bug in ucma_create_uevent")
    Reported-by: syzbot+b0da83a6c0e2e2bddbd4@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/all/68232e7b.050a0220.f2294.09f6.GAE@google.com
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
RDMA/core: always drop device refcount in ib_del_sub_device_and_put() [+ + +]
Author: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Date:   Sat Dec 20 11:11:33 2025 +0900

    RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
    
    [ Upstream commit fa3c411d21ebc26ffd175c7256c37cefa35020aa ]
    
    Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add
    support to add/delete a sub IB device through netlink") grabs a reference
    using ib_device_get_by_index() before calling ib_del_sub_device_and_put(),
    we need to drop that reference before returning -EOPNOTSUPP error.
    
    Reported-by: syzbot+881d65229ca4f9ae8c84@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84
    Fixes: bca51197620a ("RDMA/core: Support IB sub device with type "SMI"")
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Link: https://patch.msgid.link/80749a85-cbe2-460c-8451-42516013f9fa@I-love.SAKURA.ne.jp
    Reviewed-by: Parav Pandit <parav@nvidia.com>
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly [+ + +]
Author: Jason Gunthorpe <jgg@ziepe.ca>
Date:   Fri Nov 28 13:37:28 2025 -0400

    RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
    
    commit a7b8e876e0ef0232b8076972c57ce9a7286b47ca upstream.
    
    The netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a
    LS_NLA_TYPE_DGID attribute, it is invalid if it does not.
    
    Use the nl parsing logic properly and call nla_parse_deprecated() to fill
    the nlattrs array and then directly index that array to get the data for
    the DGID. Just fail if it is NULL.
    
    Remove the for loop searching for the nla, and squash the validation and
    parsing into one function.
    
    Fixes an uninitialized read from the stack triggered by userspace if it
    does not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE
    query.
    
        BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]
        BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
         hex_byte_pack include/linux/hex.h:13 [inline]
         ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490
         ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509
         ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633
         pointer+0xc09/0x1bd0 lib/vsprintf.c:2542
         vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930
         vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279
         vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426
         vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465
         vprintk+0x36/0x50 kernel/printk/printk_safe.c:82
         _printk+0x17e/0x1b0 kernel/printk/printk.c:2475
         ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline]
         ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141
         rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
         rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
         rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259
         netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
         netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346
         netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896
         sock_sendmsg_nosec net/socket.c:714 [inline]
         __sock_sendmsg+0x333/0x3d0 net/socket.c:729
         ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617
         ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671
         __sys_sendmsg+0x1aa/0x300 net/socket.c:2703
         __compat_sys_sendmsg net/compat.c:346 [inline]
         __do_compat_sys_sendmsg net/compat.c:353 [inline]
         __se_compat_sys_sendmsg net/compat.c:350 [inline]
         __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350
         ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371
         do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline]
         __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306
         do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331
         do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:3
    
    Link: https://patch.msgid.link/r/0-v1-3fbaef094271+2cf-rdma_op_ip_rslv_syz_jgg@nvidia.com
    Cc: stable@vger.kernel.org
    Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload")
    Reported-by: syzbot+938fcd548c303fe33c1a@syzkaller.appspotmail.com
    Closes: https://lore.kernel.org/r/68dc3dac.a00a0220.102ee.004f.GAE@google.com
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr() [+ + +]
Author: Jang Ingyu <ingyujang25@korea.ac.kr>
Date:   Fri Dec 19 13:15:08 2025 +0900

    RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()
    
    [ Upstream commit 8aaa848eaddd9ef8680fc6aafbd3a0646da5df40 ]
    
    Fix missing comparison operator for RDMA_NETWORK_ROCE_V1 in the
    conditional statement. The constant was used directly instead of
    being compared with net_type, causing the condition to always
    evaluate to true.
    
    Fixes: 1c15b4f2a42f ("RDMA/core: Modify enum ib_gid_type and enum rdma_network_type")
    Signed-off-by: Jang Ingyu <ingyujang25@korea.ac.kr>
    Link: https://patch.msgid.link/20251219041508.1725947-1-ingyujang25@korea.ac.kr
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/efa: Remove possible negative shift [+ + +]
Author: Michael Margolin <mrgolin@amazon.com>
Date:   Wed Dec 10 17:36:56 2025 +0000

    RDMA/efa: Remove possible negative shift
    
    [ Upstream commit 85463eb6a46caf2f1e0e1a6d0731f2f3bab17780 ]
    
    The page size used for device might in some cases be smaller than
    PAGE_SIZE what results in a negative shift when calculating the number of
    host pages in PAGE_SIZE for a debug log. Remove the debug line together
    with the calculation.
    
    Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
    Link: https://patch.msgid.link/r/20251210173656.8180-1-mrgolin@amazon.com
    Reviewed-by: Tom Sela <tomsela@amazon.com>
    Reviewed-by: Yonatan Nachum <ynachum@amazon.com>
    Signed-off-by: Michael Margolin <mrgolin@amazon.com>
    Reviewed-by: Gal Pressman <gal.pressman@linux.dev>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/irdma: avoid invalid read in irdma_net_event [+ + +]
Author: Michal Schmidt <mschmidt@redhat.com>
Date:   Thu Nov 27 15:31:50 2025 +0100

    RDMA/irdma: avoid invalid read in irdma_net_event
    
    [ Upstream commit 6f05611728e9d0ab024832a4f1abb74a5f5d0bb0 ]
    
    irdma_net_event() should not dereference anything from "neigh" (alias
    "ptr") until it has checked that the event is NETEVENT_NEIGH_UPDATE.
    Other events come with different structures pointed to by "ptr" and they
    may be smaller than struct neighbour.
    
    Move the read of neigh->dev under the NETEVENT_NEIGH_UPDATE case.
    
    The bug is mostly harmless, but it triggers KASAN on debug kernels:
    
     BUG: KASAN: stack-out-of-bounds in irdma_net_event+0x32e/0x3b0 [irdma]
     Read of size 8 at addr ffffc900075e07f0 by task kworker/27:2/542554
    
     CPU: 27 PID: 542554 Comm: kworker/27:2 Kdump: loaded Not tainted 5.14.0-630.el9.x86_64+debug #1
     Hardware name: [...]
     Workqueue: events rt6_probe_deferred
     Call Trace:
      <IRQ>
      dump_stack_lvl+0x60/0xb0
      print_address_description.constprop.0+0x2c/0x3f0
      print_report+0xb4/0x270
      kasan_report+0x92/0xc0
      irdma_net_event+0x32e/0x3b0 [irdma]
      notifier_call_chain+0x9e/0x180
      atomic_notifier_call_chain+0x5c/0x110
      rt6_do_redirect+0xb91/0x1080
      tcp_v6_err+0xe9b/0x13e0
      icmpv6_notify+0x2b2/0x630
      ndisc_redirect_rcv+0x328/0x530
      icmpv6_rcv+0xc16/0x1360
      ip6_protocol_deliver_rcu+0xb84/0x12e0
      ip6_input_finish+0x117/0x240
      ip6_input+0xc4/0x370
      ipv6_rcv+0x420/0x7d0
      __netif_receive_skb_one_core+0x118/0x1b0
      process_backlog+0xd1/0x5d0
      __napi_poll.constprop.0+0xa3/0x440
      net_rx_action+0x78a/0xba0
      handle_softirqs+0x2d4/0x9c0
      do_softirq+0xad/0xe0
      </IRQ>
    
    Fixes: 915cc7ac0f8e ("RDMA/irdma: Add miscellaneous utility definitions")
    Link: https://patch.msgid.link/r/20251127143150.121099-1-mschmidt@redhat.com
    Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

RDMA/irdma: Fix irdma_alloc_ucontext_resp padding [+ + +]
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Dec 8 14:38:44 2025 +0100

    RDMA/irdma: Fix irdma_alloc_ucontext_resp padding
    
    [ Upstream commit d95e99a74eaf35c070f5939295331e5d7857c723 ]
    
    A recent commit modified struct irdma_alloc_ucontext_resp by adding a
    member with implicit padding in front of it, though this does not change
    the offset of the data members other than m68k. Reported by
    scripts/check-uapi.sh:
    
    ==== ABI differences detected in include/rdma/irdma-abi.h from 1dd7bde2e91c -> HEAD ====
        [C] 'struct irdma_alloc_ucontext_resp' changed:
          type size changed from 704 to 640 (in bits)
          1 data member deletion:
            '__u8 rsvd3[2]', at offset 640 (in bits) at irdma-abi.h:61:1
          1 data member insertion:
            '__u8 revd3[2]', at offset 592 (in bits) at irdma-abi.h:60:1
    
    Change the size back to the previous version, and remove the implicit
    padding by making it explicit and matching what x86-64 would do by placing
    max_hw_srq_quanta member into a naturally aligned location.
    
    Fixes: 563e1feb5f6e ("RDMA/irdma: Add SRQ support")
    Link: https://patch.msgid.link/r/20251208133849.315451-1-arnd@kernel.org
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Tested-by: Jacob Moroni <jmoroni@google.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/mana_ib: check cqe length for kernel CQs [+ + +]
Author: Konstantin Taranov <kotaranov@microsoft.com>
Date:   Thu Oct 23 03:03:00 2025 -0700

    RDMA/mana_ib: check cqe length for kernel CQs
    
    [ Upstream commit 887bfe5986396aca908b7afd2d214471ba7d5544 ]
    
    Check queue size during kernel CQ creation to prevent overflow of u32.
    
    Fixes: bec127e45d9f ("RDMA/mana_ib: create kernel-level CQs")
    Link: https://patch.msgid.link/r/1761213780-5457-1-git-send-email-kotaranov@linux.microsoft.com
    Signed-off-by: Konstantin Taranov <kotaranov@microsoft.com>
    Reviewed-by: Long Li <longli@microsoft.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation [+ + +]
Author: Honggang LI <honggangli@163.com>
Date:   Mon Dec 29 10:56:17 2025 +0800

    RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation
    
    [ Upstream commit 43bd09d5b750f700499ae8ec45fd41a4c48673e6 ]
    
    If device max_mr_size bits in the range [mr_page_shift+31:mr_page_shift]
    are zero, the `min3` function will set clt_path::max_pages_per_mr to
    zero.
    
    `alloc_path_reqs` will pass zero, which is invalid, as the third parameter
    to `ib_alloc_mr`.
    
    Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality")
    Signed-off-by: Honggang LI <honggangli@163.com>
    Link: https://patch.msgid.link/20251229025617.13241-1-honggangli@163.com
    Signed-off-by: Leon Romanovsky <leon@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding [+ + +]
Author: Arnd Bergmann <arnd@arndb.de>
Date:   Mon Dec 8 14:33:05 2025 +0100

    RDMA/ucma: Fix rdma_ucm_query_ib_service_resp struct padding
    
    [ Upstream commit 2dc675f614850b80deab7cf6d12902636ed8a7f4 ]
    
    On a few 32-bit architectures, the newly added ib_user_service_rec
    structure is not 64-bit aligned the way it is on most regular ones.
    
    Add explicit padding into the rdma_ucm_query_ib_service_resp and
    rdma_ucm_resolve_ib_service structures that embed it, so that the layout
    is compatible across all of them.
    
    This is an ABI change on i386, aligning it with x86_64 and the other
    64-bit architectures to avoid having to use a compat ioctl handler.
    
    Fixes: 810f874eda8e ("RDMA/ucma: Support query resolved service records")
    Link: https://patch.msgid.link/r/20251208133311.313977-1-arnd@kernel.org
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
Revert "drm/amd: Skip power ungate during suspend for VPE" [+ + +]
Author: Mario Limonciello (AMD) <superm1@kernel.org>
Date:   Sat Nov 29 19:46:31 2025 -0600

    Revert "drm/amd: Skip power ungate during suspend for VPE"
    
    commit 3925683515e93844be204381d2d5a1df5de34f31 upstream.
    
    Skipping power ungate exposed some scenarios that will fail
    like below:
    
    ```
    amdgpu: Register(0) [regVPEC_QUEUE_RESET_REQ] failed to reach value 0x00000000 != 0x00000001n
    amdgpu 0000:c1:00.0: amdgpu: VPE queue reset failed
    ...
    amdgpu: [drm] *ERROR* wait_for_completion_timeout timeout!
    ```
    
    The underlying s2idle issue that prompted this commit is going to
    be fixed in BIOS.
    This reverts commit 2a6c826cfeedd7714611ac115371a959ead55bda.
    
    Fixes: 2a6c826cfeed ("drm/amd: Skip power ungate during suspend for VPE")
    Cc: stable@vger.kernel.org
    Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
    Acked-by: Alex Deucher <alexander.deucher@amd.com>
    Reported-by: Konstantin <answer2019@yandex.ru>
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220812
    Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup" [+ + +]
Author: Charles Keepax <ckeepax@opensource.cirrus.com>
Date:   Tue Jan 6 15:53:21 2026 +0000

    Revert "gpio: swnode: don't use the swnode's name as the key for GPIO lookup"
    
    This reverts commit e5d527be7e6984882306b49c067f1fec18920735.
    
    This software node change doesn't actually fix any current issues
    with the kernel, it is an improvement to the lookup process rather
    than fixing a live bug. It also causes a couple of regressions with
    shipping laptops, which relied on the label based lookup.
    
    There is a fix for the regressions in mainline, the first 5 patches
    of [1]. However, those patches are fairly substantial changes and
    given the patch causing the regression doesn't actually fix a bug
    it seems better to just revert it in stable.
    
    CC: stable@vger.kernel.org # 6.18
    Link: https://lore.kernel.org/linux-sound/20251120-reset-gpios-swnodes-v7-0-a100493a0f4b@linaro.org/ [1]
    Closes: https://github.com/thesofproject/linux/issues/5599
    Closes: https://github.com/thesofproject/linux/issues/5603
    Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
rust: maple_tree: rcu_read_lock() in destructor to silence lockdep [+ + +]
Author: Alice Ryhl <aliceryhl@google.com>
Date:   Wed Dec 17 13:10:37 2025 +0000

    rust: maple_tree: rcu_read_lock() in destructor to silence lockdep
    
    commit 6558749ef3405c143711cbdc67ec88cbc1582d91 upstream.
    
    When running the Rust maple tree kunit tests with lockdep, you may trigger
    a warning that looks like this:
    
            lib/maple_tree.c:780 suspicious rcu_dereference_check() usage!
    
            other info that might help us debug this:
    
            rcu_scheduler_active = 2, debug_locks = 1
            no locks held by kunit_try_catch/344.
    
            stack backtrace:
            CPU: 3 UID: 0 PID: 344 Comm: kunit_try_catch Tainted: G                 N  6.19.0-rc1+ #2 NONE
            Tainted: [N]=TEST
            Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
            Call Trace:
             <TASK>
             dump_stack_lvl+0x71/0x90
             lockdep_rcu_suspicious+0x150/0x190
             mas_start+0x104/0x150
             mas_find+0x179/0x240
             _RINvNtCs5QSdWC790r4_4core3ptr13drop_in_placeINtNtCs1cdwasc6FUb_6kernel10maple_tree9MapleTreeINtNtNtBL_5alloc4kbox3BoxlNtNtB1x_9allocator7KmallocEEECsgxAQYCfdR72_25doctests_kernel_generated+0xaf/0x130
             rust_doctest_kernel_maple_tree_rs_0+0x600/0x6b0
             ? lock_release+0xeb/0x2a0
             ? kunit_try_catch_run+0x210/0x210
             kunit_try_run_case+0x74/0x160
             ? kunit_try_catch_run+0x210/0x210
             kunit_generic_run_threadfn_adapter+0x12/0x30
             kthread+0x21c/0x230
             ? __do_trace_sched_kthread_stop_ret+0x40/0x40
             ret_from_fork+0x16c/0x270
             ? __do_trace_sched_kthread_stop_ret+0x40/0x40
             ret_from_fork_asm+0x11/0x20
             </TASK>
    
    This is because the destructor of maple tree calls mas_find() without
    taking rcu_read_lock() or the spinlock.  Doing that is actually ok in this
    case since the destructor has exclusive access to the entire maple tree,
    but it triggers a lockdep warning.  To fix that, take the rcu read lock.
    
    In the future, it's possible that memory reclaim could gain a feature
    where it reallocates entries in maple trees even if no user-code is
    touching it.  If that feature is added, then this use of rcu read lock
    would become load-bearing, so I did not make it conditional on lockdep.
    
    We have to repeatedly take and release rcu because the destructor of T
    might perform operations that sleep.
    
    Link: https://lkml.kernel.org/r/20251217-maple-drop-rcu-v1-1-702af063573f@google.com
    Fixes: da939ef4c494 ("rust: maple_tree: add MapleTree")
    Signed-off-by: Alice Ryhl <aliceryhl@google.com>
    Reported-by: Andreas Hindborg <a.hindborg@kernel.org>
    Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/x/topic/x/near/564215108
    Reviewed-by: Gary Guo <gary@garyguo.net>
    Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
    Cc: Andrew Ballance <andrewjballance@gmail.com>
    Cc: Björn Roy Baron <bjorn3_gh@protonmail.com>
    Cc: Boqun Feng <boqun.feng@gmail.com>
    Cc: Danilo Krummrich <dakr@kernel.org>
    Cc: Liam Howlett <liam.howlett@oracle.com>
    Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
    Cc: Miguel Ojeda <ojeda@kernel.org>
    Cc: Trevor Gross <tmgross@umich.edu>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
samples/ftrace: Adjust LoongArch register restore order in direct calls [+ + +]
Author: Chenghao Duan <duanchenghao@kylinos.cn>
Date:   Wed Dec 31 15:19:25 2025 +0800

    samples/ftrace: Adjust LoongArch register restore order in direct calls
    
    commit bb85d206be208bbf834883e948125a35ac59993a upstream.
    
    Ensure that in the ftrace direct call logic, the CPU register state
    (with ra = parent return address) is restored to the correct state after
    the execution of the custom trampoline function and before returning to
    the traced function. Additionally, guarantee the correctness of the jump
    logic for jr t0 (traced function address).
    
    Cc: stable@vger.kernel.org
    Fixes: 9cdc3b6a299c ("LoongArch: ftrace: Add direct call support")
    Reported-by: Youling Tang <tangyouling@kylinos.cn>
    Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Chenghao Duan <duanchenghao@kylinos.cn>
    Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sched/core: Add comment explaining force-idle vruntime snapshots [+ + +]
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Mon Dec 29 14:35:37 2025 -0500

    sched/core: Add comment explaining force-idle vruntime snapshots
    
    [ Upstream commit 9359d9785d85bb53f1ff1738a59aeeec4b878906 ]
    
    I always end up having to re-read these emails every time I look at
    this code. And a future patch is going to change this story a little.
    This means it is past time to stick them in a comment so it can be
    modified and stay current.
    
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Link: https://lkml.kernel.org/r/20200506143506.GH5298@hirez.programming.kicks-ass.net
    Link: https://lkml.kernel.org/r/20200515103844.GG2978@hirez.programming.kicks-ass.net
    Link: https://patch.msgid.link/20251106111603.GB4068168@noisy.programming.kicks-ass.net
    Stable-dep-of: 79f3f9bedd14 ("sched/eevdf: Fix min_vruntime vs avg_vruntime")
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sched/eevdf: Fix min_vruntime vs avg_vruntime [+ + +]
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Mon Dec 29 14:35:38 2025 -0500

    sched/eevdf: Fix min_vruntime vs avg_vruntime
    
    [ Upstream commit 79f3f9bedd149ea438aaeb0fb6a083637affe205 ]
    
    Basically, from the constraint that the sum of lag is zero, you can
    infer that the 0-lag point is the weighted average of the individual
    vruntime, which is what we're trying to compute:
    
            \Sum w_i * v_i
      avg = --------------
               \Sum w_i
    
    Now, since vruntime takes the whole u64 (worse, it wraps), this
    multiplication term in the numerator is not something we can compute;
    instead we do the min_vruntime (v0 henceforth) thing like:
    
      v_i = (v_i - v0) + v0
    
    This does two things:
     - it keeps the key: (v_i - v0) 'small';
     - it creates a relative 0-point in the modular space.
    
    If you do that subtitution and work it all out, you end up with:
    
            \Sum w_i * (v_i - v0)
      avg = --------------------- + v0
                  \Sum w_i
    
    Since you cannot very well track a ratio like that (and not suffer
    terrible numerical problems) we simpy track the numerator and
    denominator individually and only perform the division when strictly
    needed.
    
    Notably, the numerator lives in cfs_rq->avg_vruntime and the denominator
    lives in cfs_rq->avg_load.
    
    The one extra 'funny' is that these numbers track the entities in the
    tree, and current is typically outside of the tree, so avg_vruntime()
    adds current when needed before doing the division.
    
    (vruntime_eligible() elides the division by cross-wise multiplication)
    
    Anyway, as mentioned above, we currently use the CFS era min_vruntime
    for this purpose. However, this thing can only move forward, while the
    above avg can in fact move backward (when a non-eligible task leaves,
    the average becomes smaller), this can cause trouble when through
    happenstance (or construction) these values drift far enough apart to
    wreck the game.
    
    Replace cfs_rq::min_vruntime with cfs_rq::zero_vruntime which is kept
    near/at avg_vruntime, following its motion.
    
    The down-side is that this requires computing the avg more often.
    
    Fixes: 147f3efaa241 ("sched/fair: Implement an EEVDF-like scheduling policy")
    Reported-by: Zicheng Qu <quzicheng@huawei.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Link: https://patch.msgid.link/20251106111741.GC4068168@noisy.programming.kicks-ass.net
    Cc: stable@vger.kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
sched/proxy: Yield the donor task [+ + +]
Author: Fernand Sieber <sieberf@amazon.com>
Date:   Thu Nov 6 12:40:10 2025 +0200

    sched/proxy: Yield the donor task
    
    commit 127b90315ca07ccad2618db7ba950a63e3b32d22 upstream.
    
    When executing a task in proxy context, handle yields as if they were
    requested by the donor task. This matches the traditional PI semantics
    of yield() as well.
    
    This avoids scenario like proxy task yielding, pick next task selecting the
    same previous blocked donor, running the proxy task again, etc.
    
    Reported-by: kernel test robot <oliver.sang@intel.com>
    Closes: https://lore.kernel.org/oe-lkp/202510211205.1e0f5223-lkp@intel.com
    Suggested-by: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Fernand Sieber <sieberf@amazon.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Link: https://patch.msgid.link/20251106104022.195157-1-sieberf@amazon.com
    Cc: Holger Hoffstätte <holger@applied-asynchrony.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks [+ + +]
Author: Zqiang <qiang.zhang@linux.dev>
Date:   Mon Dec 29 14:36:40 2025 -0500

    sched_ext: Fix incorrect sched_class settings for per-cpu migration tasks
    
    [ Upstream commit 1dd6c84f1c544e552848a8968599220bd464e338 ]
    
    When loading the ebpf scheduler, the tasks in the scx_tasks list will
    be traversed and invoke __setscheduler_class() to get new sched_class.
    however, this would also incorrectly set the per-cpu migration
    task's->sched_class to rt_sched_class, even after unload, the per-cpu
    migration task's->sched_class remains sched_rt_class.
    
    The log for this issue is as follows:
    
    ./scx_rustland --stats 1
    [  199.245639][  T630] sched_ext: "rustland" does not implement cgroup cpu.weight
    [  199.269213][  T630] sched_ext: BPF scheduler "rustland" enabled
    04:25:09 [INFO] RustLand scheduler attached
    
    bpftrace -e 'iter:task /strcontains(ctx->task->comm, "migration")/
    { printf("%s:%d->%pS\n", ctx->task->comm, ctx->task->pid, ctx->task->sched_class); }'
    Attaching 1 probe...
    migration/0:24->rt_sched_class+0x0/0xe0
    migration/1:27->rt_sched_class+0x0/0xe0
    migration/2:33->rt_sched_class+0x0/0xe0
    migration/3:39->rt_sched_class+0x0/0xe0
    migration/4:45->rt_sched_class+0x0/0xe0
    migration/5:52->rt_sched_class+0x0/0xe0
    migration/6:58->rt_sched_class+0x0/0xe0
    migration/7:64->rt_sched_class+0x0/0xe0
    
    sched_ext: BPF scheduler "rustland" disabled (unregistered from user space)
    EXIT: unregistered from user space
    04:25:21 [INFO] Unregister RustLand scheduler
    
    bpftrace -e 'iter:task /strcontains(ctx->task->comm, "migration")/
    { printf("%s:%d->%pS\n", ctx->task->comm, ctx->task->pid, ctx->task->sched_class); }'
    Attaching 1 probe...
    migration/0:24->rt_sched_class+0x0/0xe0
    migration/1:27->rt_sched_class+0x0/0xe0
    migration/2:33->rt_sched_class+0x0/0xe0
    migration/3:39->rt_sched_class+0x0/0xe0
    migration/4:45->rt_sched_class+0x0/0xe0
    migration/5:52->rt_sched_class+0x0/0xe0
    migration/6:58->rt_sched_class+0x0/0xe0
    migration/7:64->rt_sched_class+0x0/0xe0
    
    This commit therefore generate a new scx_setscheduler_class() and
    add check for stop_sched_class to replace __setscheduler_class().
    
    Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class")
    Cc: stable@vger.kernel.org # v6.12+
    Signed-off-by: Zqiang <qiang.zhang@linux.dev>
    Reviewed-by: Andrea Righi <arighi@nvidia.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    [ Adjust context ]
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

sched_ext: fix uninitialized ret on alloc_percpu() failure [+ + +]
Author: Liang Jie <liangjie@lixiang.com>
Date:   Tue Dec 16 17:39:55 2025 +0800

    sched_ext: fix uninitialized ret on alloc_percpu() failure
    
    [ Upstream commit b0101ccb5b4641885f30fecc352ef891ed06e083 ]
    
    Smatch reported:
    
      kernel/sched/ext.c:5332 scx_alloc_and_add_sched() warn: passing zero to 'ERR_PTR'
    
    In scx_alloc_and_add_sched(), the alloc_percpu() failure path jumps to
    err_free_gdsqs without initializing @ret. That can lead to returning
    ERR_PTR(0), which violates the ERR_PTR() convention and confuses
    callers.
    
    Set @ret to -ENOMEM before jumping to the error path when
    alloc_percpu() fails.
    
    Reported-by: kernel test robot <lkp@intel.com>
    Closes: https://lore.kernel.org/r/202512141601.yAXDAeA9-lkp@intel.com/
    Reported-by: Dan Carpenter <error27@gmail.com>
    Fixes: c201ea1578d3 ("sched_ext: Move event_stats_cpu into scx_sched")
    Signed-off-by: Liang Jie <liangjie@lixiang.com>
    Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
    Reviewed-by: Andrea Righi <arighi@nvidia.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
selftests/ftrace: traceonoff_triggers: strip off names [+ + +]
Author: Yipeng Zou <zouyipeng@huawei.com>
Date:   Fri Aug 18 09:32:26 2023 +0800

    selftests/ftrace: traceonoff_triggers: strip off names
    
    [ Upstream commit b889b4fb4cbea3ca7eb9814075d6a51936394bd9 ]
    
    The func_traceonoff_triggers.tc sometimes goes to fail
    on my board, Kunpeng-920.
    
    [root@localhost]# ./ftracetest ./test.d/ftrace/func_traceonoff_triggers.tc -l fail.log
    === Ftrace unit tests ===
    [1] ftrace - test for function traceon/off triggers     [FAIL]
    [2] (instance)  ftrace - test for function traceon/off triggers [UNSUPPORTED]
    
    I look up the log, and it shows that the md5sum is different between csum1 and csum2.
    
    ++ cnt=611
    ++ sleep .1
    +++ cnt_trace
    +++ grep -v '^#' trace
    +++ wc -l
    ++ cnt2=611
    ++ '[' 611 -ne 611 ']'
    +++ cat tracing_on
    ++ on=0
    ++ '[' 0 '!=' 0 ']'
    +++ md5sum trace
    ++ csum1='76896aa74362fff66a6a5f3cf8a8a500  trace'
    ++ sleep .1
    +++ md5sum trace
    ++ csum2='ee8625a21c058818fc26e45c1ed3f6de  trace'
    ++ '[' '76896aa74362fff66a6a5f3cf8a8a500  trace' '!=' 'ee8625a21c058818fc26e45c1ed3f6de  trace' ']'
    ++ fail 'Tracing file is still changing'
    ++ echo Tracing file is still changing
    Tracing file is still changing
    ++ exit_fail
    ++ exit 1
    
    So I directly dump the trace file before md5sum, the diff shows that:
    
    [root@localhost]# diff trace_1.log trace_2.log -y --suppress-common-lines
    dockerd-12285   [036] d.... 18385.510290: sched_stat | <...>-12285   [036] d.... 18385.510290: sched_stat
    dockerd-12285   [036] d.... 18385.510291: sched_swit | <...>-12285   [036] d.... 18385.510291: sched_swit
    <...>-740       [044] d.... 18385.602859: sched_stat | kworker/44:1-740 [044] d.... 18385.602859: sched_stat
    <...>-740       [044] d.... 18385.602860: sched_swit | kworker/44:1-740 [044] d.... 18385.602860: sched_swit
    
    And we can see that <...> filed be filled with names.
    
    We can strip off the names there to fix that.
    
    After strip off the names:
    
    kworker/u257:0-12 [019] d..2.  2528.758910: sched_stat | -12 [019] d..2.  2528.758910: sched_stat_runtime: comm=k
    kworker/u257:0-12 [019] d..2.  2528.758912: sched_swit | -12 [019] d..2.  2528.758912: sched_switch: prev_comm=kw
    <idle>-0          [000] d.s5.  2528.762318: sched_waki | -0  [000] d.s5.  2528.762318: sched_waking: comm=sshd pi
    <idle>-0          [037] dNh2.  2528.762326: sched_wake | -0  [037] dNh2.  2528.762326: sched_wakeup: comm=sshd pi
    <idle>-0          [037] d..2.  2528.762334: sched_swit | -0  [037] d..2.  2528.762334: sched_switch: prev_comm=sw
    
    Link: https://lore.kernel.org/r/20230818013226.2182299-1-zouyipeng@huawei.com
    Fixes: d87b29179aa0 ("selftests: ftrace: Use md5sum to take less time of checking logs")
    Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Yipeng Zou <zouyipeng@huawei.com>
    Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
selftests/mm: fix thread state check in uffd-unit-tests [+ + +]
Author: Wake Liu <wakel@google.com>
Date:   Wed Dec 10 17:14:08 2025 +0800

    selftests/mm: fix thread state check in uffd-unit-tests
    
    commit 632b874d59a36caf829ab5790dafb90f9b350fd6 upstream.
    
    In the thread_state_get() function, the logic to find the thread's state
    character was using `sizeof(header) - 1` to calculate the offset from the
    "State:\t" string.
    
    The `header` variable is a `const char *` pointer.  `sizeof()` on a
    pointer returns the size of the pointer itself, not the length of the
    string literal it points to.  This makes the code's behavior dependent on
    the architecture's pointer size.
    
    This bug was identified on a 32-bit ARM build (`gsi_tv_arm`) for Android,
    running on an ARMv8-based device, compiled with Clang 19.0.1.
    
    On this 32-bit architecture, `sizeof(char *)` is 4.  The expression
    `sizeof(header) - 1` resulted in an incorrect offset of 3, causing the
    test to read the wrong character from `/proc/[tid]/status` and fail.
    
    On 64-bit architectures, `sizeof(char *)` is 8, so the expression
    coincidentally evaluates to 7, which matches the length of "State:\t".
    This is why the bug likely remained hidden on 64-bit builds.
    
    To fix this and make the code portable and correct across all
    architectures, this patch replaces `sizeof(header) - 1` with
    `strlen(header)`.  The `strlen()` function correctly calculates the
    string's length, ensuring the correct offset is always used.
    
    Link: https://lkml.kernel.org/r/20251210091408.3781445-1-wakel@google.com
    Fixes: f60b6634cd88 ("mm/selftests: add a test to verify mmap_changing race with -EAGAIN")
    Signed-off-by: Wake Liu <wakel@google.com>
    Acked-by: Peter Xu <peterx@redhat.com>
    Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
    Cc: Bill Wendling <morbo@google.com>
    Cc: Justin Stitt <justinstitt@google.com>
    Cc: Liam Howlett <liam.howlett@oracle.com>
    Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Cc: Michal Hocko <mhocko@suse.com>
    Cc: Nathan Chancellor <nathan@kernel.org>
    Cc: Shuah Khan <shuah@kernel.org>
    Cc: Suren Baghdasaryan <surenb@google.com>
    Cc: Vlastimil Babka <vbabka@suse.cz>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
selftests: drv-net: psp: fix templated test names in psp_ip_ver_test_builder() [+ + +]
Author: Daniel Zahka <daniel.zahka@gmail.com>
Date:   Tue Dec 16 06:21:35 2025 -0800

    selftests: drv-net: psp: fix templated test names in psp_ip_ver_test_builder()
    
    [ Upstream commit d52668cac3f98f86aa1fb238dec1320c80fbefea ]
    
    test_case will only take on its formatted name after it is called by
    the test runner. Move the assignment to test_case.__name__ to when the
    test_case is constructed, not called.
    
    Fixes: 8f90dc6e417a ("selftests: drv-net: psp: add basic data transfer and key rotation tests")
    Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
    Link: https://patch.msgid.link/20251216-psp-test-fix-v1-1-3b5a6dde186f@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

selftests: drv-net: psp: fix test names in ipver_test_builder() [+ + +]
Author: Daniel Zahka <daniel.zahka@gmail.com>
Date:   Tue Dec 16 06:21:36 2025 -0800

    selftests: drv-net: psp: fix test names in ipver_test_builder()
    
    [ Upstream commit f0e5126f5e55d4939784ff61b0b7e9f9636d787d ]
    
    test_case will only take on the formatted name after being
    called. This does not work with the way ksft_run() currently
    works. Assign the name after the test_case is created.
    
    Fixes: 81236c74dba6 ("selftests: drv-net: psp: add test for auto-adjusting TCP MSS")
    Signed-off-by: Daniel Zahka <daniel.zahka@gmail.com>
    Link: https://patch.msgid.link/20251216-psp-test-fix-v1-2-3b5a6dde186f@gmail.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

selftests: net: fix "buffer overflow detected" for tap.c [+ + +]
Author: Alice C. Munduruca <alice.munduruca@canonical.com>
Date:   Tue Dec 16 12:06:41 2025 -0500

    selftests: net: fix "buffer overflow detected" for tap.c
    
    [ Upstream commit 472c5dd6b95c02b3e5d7395acf542150e91165e7 ]
    
    When the selftest 'tap.c' is compiled with '-D_FORTIFY_SOURCE=3',
    the strcpy() in rtattr_add_strsz() is replaced with a checked
    version which causes the test to consistently fail when compiled
    with toolchains for which this option is enabled by default.
    
     TAP version 13
     1..3
     # Starting 3 tests from 1 test cases.
     #  RUN           tap.test_packet_valid_udp_gso ...
     *** buffer overflow detected ***: terminated
     # test_packet_valid_udp_gso: Test terminated by assertion
     #          FAIL  tap.test_packet_valid_udp_gso
     not ok 1 tap.test_packet_valid_udp_gso
     #  RUN           tap.test_packet_valid_udp_csum ...
     *** buffer overflow detected ***: terminated
     # test_packet_valid_udp_csum: Test terminated by assertion
     #          FAIL  tap.test_packet_valid_udp_csum
     not ok 2 tap.test_packet_valid_udp_csum
     #  RUN           tap.test_packet_crash_tap_invalid_eth_proto ...
     *** buffer overflow detected ***: terminated
     # test_packet_crash_tap_invalid_eth_proto: Test terminated by assertion
     #          FAIL  tap.test_packet_crash_tap_invalid_eth_proto
     not ok 3 tap.test_packet_crash_tap_invalid_eth_proto
     # FAILED: 0 / 3 tests passed.
     # Totals: pass:0 fail:3 xfail:0 xpass:0 skip:0 error:0
    
    A buffer overflow is detected by the fortified glibc __strcpy_chk()
    since the __builtin_object_size() of `RTA_DATA(rta)` is incorrectly
    reported as 1, even though there is ample space in its bounding
    buffer `req`.
    
    Additionally, given that IFLA_IFNAME also expects a null-terminated
    string, callers of rtaddr_add_str{,sz}() could simply use the
    rtaddr_add_strsz() variant. (which has been renamed to remove the
    trailing `sz`) memset() has been used for this function since it
    is unchecked and thus circumvents the issue discussed in the
    previous paragraph.
    
    Fixes: 2e64fe4624d1 ("selftests: add few test cases for tap driver")
    Signed-off-by: Alice C. Munduruca <alice.munduruca@canonical.com>
    Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
    Reviewed-by: Willem de Bruijn <willemb@google.com>
    Link: https://patch.msgid.link/20251216170641.250494-1-alice.munduruca@canonical.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
smc91x: fix broken irq-context in PREEMPT_RT [+ + +]
Author: Yeoreum Yun <yeoreum.yun@arm.com>
Date:   Wed Dec 17 08:51:15 2025 +0000

    smc91x: fix broken irq-context in PREEMPT_RT
    
    [ Upstream commit 6402078bd9d1ed46e79465e1faaa42e3458f8a33 ]
    
    When smc91x.c is built with PREEMPT_RT, the following splat occurs
    in FVP_RevC:
    
    [   13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000
    [   13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106]
    [   13.062137]      preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work
    [   13.062266] C
    ** replaying previous printk message **
    [   13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)}
    [   13.062353] Hardware name:  , BIOS
    [   13.062382] Workqueue: mld mld_ifc_work
    [   13.062469] Call trace:
    [   13.062494]  show_stack+0x24/0x40 (C)
    [   13.062602]  __dump_stack+0x28/0x48
    [   13.062710]  dump_stack_lvl+0x7c/0xb0
    [   13.062818]  dump_stack+0x18/0x34
    [   13.062926]  process_scheduled_works+0x294/0x450
    [   13.063043]  worker_thread+0x260/0x3d8
    [   13.063124]  kthread+0x1c4/0x228
    [   13.063235]  ret_from_fork+0x10/0x20
    
    This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT,
    but smc_special_unlock() does not restore IRQs on PREEMPT_RT.
    The reason is that smc_special_unlock() calls spin_unlock_irqrestore(),
    and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke
    rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero.
    
    To address this issue, replace smc_special_trylock() with spin_trylock_irqsave().
    
    Fixes: 342a93247e08 ("locking/spinlock: Provide RT variant header: <linux/spinlock_rt.h>")
    Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20251217085115.1730036-1-yeoreum.yun@arm.com
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
team: fix check for port enabled in team_queue_override_port_prio_changed() [+ + +]
Author: Jiri Pirko <jiri@resnulli.us>
Date:   Fri Dec 12 11:29:53 2025 +0100

    team: fix check for port enabled in team_queue_override_port_prio_changed()
    
    [ Upstream commit 932ac51d9953eaf77a1252f79b656d4ca86163c6 ]
    
    There has been a syzkaller bug reported recently with the following
    trace:
    
    list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122)
    ------------[ cut here ]------------
    kernel BUG at lib/list_debug.c:59!
    Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
    CPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full)
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
    RIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59
    Code: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff
    RSP: 0018:ffffc9000d49f370 EFLAGS: 00010286
    RAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000
    RDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005
    RBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000
    R10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230
    R13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480
    FS:  00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0
    Call Trace:
     <TASK>
     __list_del_entry_valid include/linux/list.h:132 [inline]
     __list_del_entry include/linux/list.h:223 [inline]
     list_del_rcu include/linux/rculist.h:178 [inline]
     __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline]
     __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline]
     team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline]
     team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534
     team_option_set drivers/net/team/team_core.c:376 [inline]
     team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653
     genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115
     genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
     genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210
     netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552
     genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
     netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
     netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346
     netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896
     sock_sendmsg_nosec net/socket.c:727 [inline]
     __sock_sendmsg net/socket.c:742 [inline]
     ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630
     ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684
     __sys_sendmsg+0x16d/0x220 net/socket.c:2716
     do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
     do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
     entry_SYSCALL_64_after_hwframe+0x77/0x7f
    
    The problem is in this flow:
    1) Port is enabled, queue_id != 0, in qom_list
    2) Port gets disabled
            -> team_port_disable()
            -> team_queue_override_port_del()
            -> del (removed from list)
    3) Port is disabled, queue_id != 0, not in any list
    4) Priority changes
            -> team_queue_override_port_prio_changed()
            -> checks: port disabled && queue_id != 0
            -> calls del - hits the BUG as it is removed already
    
    To fix this, change the check in team_queue_override_port_prio_changed()
    so it returns early if port is not enabled.
    
    Reported-by: syzbot+422806e5f4cce722a71f@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=422806e5f4cce722a71f
    Fixes: 6c31ff366c11 ("team: remove synchronize_rcu() called during queue override change")
    Signed-off-by: Jiri Pirko <jiri@nvidia.com>
    Reviewed-by: Simon Horman <horms@kernel.org>
    Link: https://patch.msgid.link/20251212102953.167287-1-jiri@resnulli.us
    Signed-off-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
tools/mm/page_owner_sort: fix timestamp comparison for stable sorting [+ + +]
Author: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Date:   Tue Dec 9 10:15:52 2025 +0530

    tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
    
    commit 7013803444dd3bbbe28fd3360c084cec3057c554 upstream.
    
    The ternary operator in compare_ts() returns 1 when timestamps are equal,
    causing unstable sorting behavior. Replace with explicit three-way
    comparison that returns 0 for equal timestamps, ensuring stable qsort
    ordering and consistent output.
    
    Link: https://lkml.kernel.org/r/20251209044552.3396468-1-kaushlendra.kumar@intel.com
    Fixes: 8f9c447e2e2b ("tools/vm/page_owner_sort.c: support sorting pid and time")
    Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
    Cc: Chongxi Zhao <zhaochongxi2019@email.szu.edu.cn>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
tools/sched_ext: fix scx_show_state.py for scx_root change [+ + +]
Author: Kohei Enju <enjuk@amazon.com>
Date:   Fri Dec 26 17:46:49 2025 +0900

    tools/sched_ext: fix scx_show_state.py for scx_root change
    
    [ Upstream commit f92ff79ba2640fc482bf2bfb5b42e33957f90caf ]
    
    Commit 48e126777386 ("sched_ext: Introduce scx_sched") introduced
    scx_root and removed scx_ops, causing scx_show_state.py to fail when
    searching for the 'scx_ops' object. [1]
    
    Fix by using 'scx_root' instead, with NULL pointer handling.
    
    [1]
     # drgn -s vmlinux ./tools/sched_ext/scx_show_state.py
     Traceback (most recent call last):
       File "/root/.venv/bin/drgn", line 8, in <module>
         sys.exit(_main())
                  ~~~~~^^
       File "/root/.venv/lib64/python3.14/site-packages/drgn/cli.py", line 625, in _main
         runpy.run_path(
         ~~~~~~~~~~~~~~^
             script_path, init_globals={"prog": prog}, run_name="__main__"
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
         )
         ^
       File "<frozen runpy>", line 287, in run_path
       File "<frozen runpy>", line 98, in _run_module_code
       File "<frozen runpy>", line 88, in _run_code
       File "./tools/sched_ext/scx_show_state.py", line 30, in <module>
         ops = prog['scx_ops']
               ~~~~^^^^^^^^^^^
     _drgn.ObjectNotFoundError: could not find 'scx_ops'
    
    Fixes: 48e126777386 ("sched_ext: Introduce scx_sched")
    Signed-off-by: Kohei Enju <enjuk@amazon.com>
    Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
ublk: implement NUMA-aware memory allocation [+ + +]
Author: Ming Lei <ming.lei@redhat.com>
Date:   Sat Nov 1 21:31:17 2025 +0800

    ublk: implement NUMA-aware memory allocation
    
    [ Upstream commit 529d4d6327880e5c60f4e0def39b3faaa7954e54 ]
    
    Implement NUMA-friendly memory allocation for ublk driver to improve
    performance on multi-socket systems.
    
    This commit includes the following changes:
    
    1. Rename __queues to queues, dropping the __ prefix since the field is
       now accessed directly throughout the codebase rather than only through
       the ublk_get_queue() helper.
    
    2. Remove the queue_size field from struct ublk_device as it is no longer
       needed.
    
    3. Move queue allocation and deallocation into ublk_init_queue() and
       ublk_deinit_queue() respectively, improving encapsulation. This
       simplifies ublk_init_queues() and ublk_deinit_queues() to just
       iterate and call the per-queue functions.
    
    4. Add ublk_get_queue_numa_node() helper function to determine the
       appropriate NUMA node for a queue by finding the first CPU mapped
       to that queue via tag_set.map[HCTX_TYPE_DEFAULT].mq_map[] and
       converting it to a NUMA node using cpu_to_node(). This function is
       called internally by ublk_init_queue() to determine the allocation
       node.
    
    5. Allocate each queue structure on its local NUMA node using
       kvzalloc_node() in ublk_init_queue().
    
    6. Allocate the I/O command buffer on the same NUMA node using
       alloc_pages_node().
    
    This reduces memory access latency on multi-socket NUMA systems by
    ensuring each queue's data structures are local to the CPUs that
    access them.
    
    Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
    Signed-off-by: Ming Lei <ming.lei@redhat.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Stable-dep-of: 7fc4da6a304b ("ublk: scan partition in async way")
    Signed-off-by: Sasha Levin <sashal@kernel.org>

ublk: scan partition in async way [+ + +]
Author: Ming Lei <ming.lei@redhat.com>
Date:   Tue Dec 23 11:27:40 2025 +0800

    ublk: scan partition in async way
    
    [ Upstream commit 7fc4da6a304bdcd3de14fc946dc2c19437a9cc5a ]
    
    Implement async partition scan to avoid IO hang when reading partition
    tables. Similar to nvme_partition_scan_work(), partition scanning is
    deferred to a work queue to prevent deadlocks.
    
    When partition scan happens synchronously during add_disk(), IO errors
    can cause the partition scan to wait while holding ub->mutex, which
    can deadlock with other operations that need the mutex.
    
    Changes:
    - Add partition_scan_work to ublk_device structure
    - Implement ublk_partition_scan_work() to perform async scan
    - Always suppress sync partition scan during add_disk()
    - Schedule async work after add_disk() for trusted daemons
    - Add flush_work() in ublk_stop_dev() before grabbing ub->mutex
    
    Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
    Reported-by: Yoav Cohen <yoav@nvidia.com>
    Closes: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@DM4PR12MB6328.namprd12.prod.outlook.com/
    Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
    Signed-off-by: Ming Lei <ming.lei@redhat.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
vfio/pci: Disable qword access to the PCI ROM bar [+ + +]
Author: Kevin Tian <kevin.tian@intel.com>
Date:   Tue Jan 6 02:11:44 2026 +0000

    vfio/pci: Disable qword access to the PCI ROM bar
    
    [ Upstream commit dc85a46928c41423ad89869baf05a589e2975575 ]
    
    Commit 2b938e3db335 ("vfio/pci: Enable iowrite64 and ioread64 for vfio
    pci") enables qword access to the PCI bar resources. However certain
    devices (e.g. Intel X710) are observed with problem upon qword accesses
    to the rom bar, e.g. triggering PCI aer errors.
    
    This is triggered by Qemu which caches the rom content by simply does a
    pread() of the remaining size until it gets the full contents. The other
    bars would only perform operations at the same access width as their
    guest drivers.
    
    Instead of trying to identify all broken devices, universally disable
    qword access to the rom bar i.e. going back to the old way which worked
    reliably for years.
    
    Reported-by: Farrah Chen <farrah.chen@intel.com>
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220740
    Fixes: 2b938e3db335 ("vfio/pci: Enable iowrite64 and ioread64 for vfio pci")
    Cc: stable@vger.kernel.org
    Signed-off-by: Kevin Tian <kevin.tian@intel.com>
    Tested-by: Farrah Chen <farrah.chen@intel.com>
    Link: https://lore.kernel.org/r/20251218081650.555015-2-kevin.tian@intel.com
    Signed-off-by: Alex Williamson <alex@shazbot.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 
vfio/pds: Fix memory leak in pds_vfio_dirty_enable() [+ + +]
Author: Zilin Guan <zilin@seu.edu.cn>
Date:   Thu Dec 25 14:31:50 2025 +0000

    vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
    
    [ Upstream commit 665077d78dc7941ce6a330c02023a2b469cc8cc7 ]
    
    pds_vfio_dirty_enable() allocates memory for region_info. If
    interval_tree_iter_first() returns NULL, the function returns -EINVAL
    immediately without freeing the allocated memory, causing a memory leak.
    
    Fix this by jumping to the out_free_region_info label to ensure
    region_info is freed.
    
    Fixes: 2e7c6feb4ef52 ("vfio/pds: Add multi-region support")
    Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
    Link: https://lore.kernel.org/r/20251225143150.1117366-1-zilin@seu.edu.cn
    Signed-off-by: Alex Williamson <alex@shazbot.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
wifi: cfg80211: sme: store capped length in __cfg80211_connect_result() [+ + +]
Author: Dan Carpenter <dan.carpenter@linaro.org>
Date:   Wed Dec 3 14:14:47 2025 +0300

    wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
    
    [ Upstream commit 2b77b9551d1184cb5af8271ff350e6e2c1b3db0d ]
    
    The QGenie AI code review tool says we should store the capped length to
    wdev->u.client.ssid_len.  The AI is correct.
    
    Fixes: 62b635dcd69c ("wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()")
    Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
    Link: https://patch.msgid.link/aTAbp5RleyH_lnZE@stanley.mountain
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

wifi: iwlwifi: Fix firmware version handling [+ + +]
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date:   Fri Nov 14 00:28:52 2025 +0200

    wifi: iwlwifi: Fix firmware version handling
    
    commit ca5898222914f399797cea1aeb0ce77109ca2e62 upstream.
    
    On my system the arithmetic done on the firmware numbers
    results in a negative number, but since the types are
    unsigned it gets interpreted as a large positive number.
    
    The end result is that the firmware gets rejected and wifi
    is defunct.
    
    Switch to signed types to handle this case correctly.
    
    iwlwifi 0000:0c:00.0: Driver unable to support your firmware API. Driver supports FW core 4294967294..2, firmware is 2.
    iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-4.ucode failed with error -2
    iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-3.ucode failed with error -2
    iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-2.ucode failed with error -2
    iwlwifi 0000:0c:00.0: Direct firmware load for iwlwifi-5000-1.ucode failed with error -2
    iwlwifi 0000:0c:00.0: no suitable firmware found!
    iwlwifi 0000:0c:00.0: minimum version required: iwlwifi-5000-1
    iwlwifi 0000:0c:00.0: maximum version supported: iwlwifi-5000-5
    iwlwifi 0000:0c:00.0: check git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
    
    Cc: stable@vger.kernel.org
    Fixes: 5f708cccde9d ("wifi: iwlwifi: add a new FW file numbering scheme")
    Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
    Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220805
    Link: https://patch.msgid.link/20251113222852.15896-1-ville.syrjala@linux.intel.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: mac80211: Discard Beacon frames to non-broadcast address [+ + +]
Author: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
Date:   Mon Dec 15 17:11:34 2025 +0200

    wifi: mac80211: Discard Beacon frames to non-broadcast address
    
    commit 193d18f60588e95d62e0f82b6a53893e5f2f19f8 upstream.
    
    Beacon frames are required to be sent to the broadcast address, see IEEE
    Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the Beacon .. frame
    shall be set to the broadcast address"). A unicast Beacon frame might be
    used as a targeted attack to get one of the associated STAs to do
    something (e.g., using CSA to move it to another channel). As such, it
    is better have strict filtering for this on the received side and
    discard all Beacon frames that are sent to an unexpected address.
    
    This is even more important for cases where beacon protection is used.
    The current implementation in mac80211 is correctly discarding unicast
    Beacon frames if the Protected Frame bit in the Frame Control field is
    set to 0. However, if that bit is set to 1, the logic used for checking
    for configured BIGTK(s) does not actually work. If the driver does not
    have logic for dropping unicast Beacon frames with Protected Frame bit
    1, these frames would be accepted in mac80211 processing as valid Beacon
    frames even though they are not protected. This would allow beacon
    protection to be bypassed. While the logic for checking beacon
    protection could be extended to cover this corner case, a more generic
    check for discard all Beacon frames based on A1=unicast address covers
    this without needing additional changes.
    
    Address all these issues by dropping received Beacon frames if they are
    sent to a non-broadcast address.
    
    Cc: stable@vger.kernel.org
    Fixes: af2d14b01c32 ("mac80211: Beacon protection using the new BIGTK (STA)")
    Signed-off-by: Jouni Malinen <jouni.malinen@oss.qualcomm.com>
    Link: https://patch.msgid.link/20251215151134.104501-1-jouni.malinen@oss.qualcomm.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wifi: mac80211: do not use old MBSSID elements [+ + +]
Author: Aloka Dixit <aloka.dixit@oss.qualcomm.com>
Date:   Mon Dec 15 09:46:56 2025 -0800

    wifi: mac80211: do not use old MBSSID elements
    
    [ Upstream commit a519be2f5d958c5804f2cfd68f1f384291271fab ]
    
    When userspace brings down and deletes a non-transmitted profile,
    it is expected to send a new updated Beacon template for the
    transmitted profile of that multiple BSSID (MBSSID) group which
    does not include the removed profile in MBSSID element. This
    update comes via NL80211_CMD_SET_BEACON.
    
    Such updates work well as long as the group continues to have at
    least one non-transmitted profile as NL80211_ATTR_MBSSID_ELEMS
    is included in the new Beacon template.
    
    But when the last non-trasmitted profile is removed, it still
    gets included in Beacon templates sent to driver. This happens
    because when no MBSSID elements are sent by the userspace,
    ieee80211_assign_beacon() ends up using the element stored from
    earlier Beacon template.
    
    Do not copy old MBSSID elements, instead userspace should always
    include these when applicable.
    
    Fixes: 2b3171c6fe0a ("mac80211: MBSSID beacon handling in AP mode")
    Signed-off-by: Aloka Dixit <aloka.dixit@oss.qualcomm.com>
    Link: https://patch.msgid.link/20251215174656.2866319-2-aloka.dixit@oss.qualcomm.com
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() [+ + +]
Author: Morning Star <alexbestoso@gmail.com>
Date:   Thu Nov 27 16:37:08 2025 +0800

    wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
    
    [ Upstream commit dd39edb445f07400e748da967a07d5dca5c5f96e ]
    
    TID getting from ieee80211_get_tid() might be out of range of array size
    of sta_entry->tids[], so check TID is less than MAX_TID_COUNT. Othwerwise,
    UBSAN warn:
    
     UBSAN: array-index-out-of-bounds in drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c:514:30
     index 10 is out of range for type 'rtl_tid_data [9]'
    
    Fixes: 8ca4cdef9329 ("wifi: rtlwifi: rtl8192cu: Fix TX aggregation")
    Signed-off-by: Morning Star <alexbestoso@gmail.com>
    Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
    Link: https://patch.msgid.link/1764232628-13625-1-git-send-email-pkshih@realtek.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

wifi: rtw88: limit indirect IO under powered off for RTL8822CS [+ + +]
Author: Ping-Ke Shih <pkshih@realtek.com>
Date:   Tue Nov 25 09:38:49 2025 +0800

    wifi: rtw88: limit indirect IO under powered off for RTL8822CS
    
    [ Upstream commit f3ccdfda345ca9a624ea425840a926b8338c1e25 ]
    
    The indirect IO is necessary for RTL8822CS, but not necessary for other
    chips. Otherwiese, it throws errors and becomes unusable.
    
     rtw88_8723cs mmc1:0001:1: WOW Firmware version 11.0.0, H2C version 0
     rtw88_8723cs mmc1:0001:1: Firmware version 11.0.0, H2C version 0
     rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110
     rtw88_8723cs mmc1:0001:1: sdio write8 failed (0x1c): -110
     rtw88_8723cs mmc1:0001:1: sdio read32 failed (0xf0): -110
    
    By vendor driver, only RTL8822CS and RTL8822ES need indirect IO, but
    RTL8822ES isn't supported yet. Therefore, limit it to RTL8822CS only.
    
    Reported-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
    Closes: https://lore.kernel.org/linux-wireless/07a32e2d6c764eb1bd9415b5a921a652@realtek.com/T/#m997b4522f7209ba629561c776bfd1d13ab24c1d4
    Fixes: 58de1f91e033 ("wifi: rtw88: sdio: use indirect IO for device registers before power-on")
    Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
    Tested-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
    Link: https://patch.msgid.link/1764034729-1251-1-git-send-email-pkshih@realtek.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 
x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo [+ + +]
Author: Rong Zhang <i@rong.moe>
Date:   Tue Dec 30 02:22:21 2025 +0800

    x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo
    
    commit 150b1b97e27513535dcd3795d5ecd28e61b6cb8c upstream.
    
    Zen5 also contains family 1Ah, models 70h-7Fh, which are mistakenly missing
    from cpu_has_entrysign(). Add the missing range.
    
    Fixes: 8a9fb5129e8e ("x86/microcode/AMD: Limit Entrysign signature checking to known generations")
    Signed-off-by: Rong Zhang <i@rong.moe>
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Cc: stable@kernel.org
    Link: https://patch.msgid.link/20251229182245.152747-1-i@rong.moe
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

x86/microcode/AMD: Select which microcode patch to load [+ + +]
Author: Borislav Petkov (AMD) <bp@alien8.de>
Date:   Thu Sep 25 13:46:00 2025 +0200

    x86/microcode/AMD: Select which microcode patch to load
    
    commit 8d171045069c804e5ffaa18be590c42c6af0cf3f upstream.
    
    All microcode patches up to the proper BIOS Entrysign fix are loaded
    only after the sha256 signature carried in the driver has been verified.
    
    Microcode patches after the Entrysign fix has been applied, do not need
    that signature verification anymore.
    
    In order to not abandon machines which haven't received the BIOS update
    yet, add the capability to select which microcode patch to load.
    
    The corresponding microcode container supplied through firmware-linux
    has been modified to carry two patches per CPU type
    (family/model/stepping) so that the proper one gets selected.
    
    Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
    Tested-by: Waiman Long <longman@redhat.com>
    Link: https://patch.msgid.link/20251027133818.4363-1-bp@kernel.org
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>