6.6.85-rc2 review

This is the start of the stable review cycle for the 6.6.85 release. There are 76 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 28 Mar 2025 15:43:33 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.85-rc2.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.85-rc2

Sebastian Andrzej Siewior <[email protected]>
netfilter: nft_counter: Use u64_stats_t for statistic.

Benjamin Berg <[email protected]>
wifi: iwlwifi: mvm: ensure offloading TID queue exists

Miri Korenblit <[email protected]>
wifi: iwlwifi: support BIOS override for 5G9 in CA also in LARI version 8

Shravya KN <[email protected]>
bnxt_en: Fix receive ring space parameters when XDP is active

Josef Bacik <[email protected]>
btrfs: make sure that WRITTEN is set on all metadata blocks

Dietmar Eggemann <[email protected]>
Revert "sched/core: Reduce cost of sched_move_task when config autogroup"

Justin Klaassen <[email protected]>
arm64: dts: rockchip: fix u2phy1_host status for NanoPi R4S

Mark Rutland <[email protected]>

    KVM: arm64: Eagerly switch ZCR_EL{1,2}

Mark Rutland <[email protected]>
KVM: arm64: Mark some header functions as inline

Mark Rutland <[email protected]>
KVM: arm64: Refactor exit handlers

Mark Rutland <[email protected]>
KVM: arm64: Remove VHE host restore of CPACR_EL1.SMEN

Mark Rutland <[email protected]>
KVM: arm64: Remove VHE host restore of CPACR_EL1.ZEN

Mark Rutland <[email protected]>
KVM: arm64: Remove host FPSIMD saving for non-protected KVM

Mark Rutland <[email protected]>
KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state

Fuad Tabba <[email protected]>
KVM: arm64: Calculate cptr_el2 traps on activating traps

Arthur Mongodin <[email protected]>
mptcp: Fix data stream corruption in the address announcement

Namjae Jeon <[email protected]>
ksmbd: fix incorrect validation for num_aces field of smb_acl

Mario Limonciello <[email protected]>
drm/amd/display: Use HW lock mgr for PSR1 when only one eDP

Martin Tsai <[email protected]>
drm/amd/display: should support dmub hw lock on Replay

David Rosca <[email protected]>
drm/amdgpu: Fix JPEG video caps max size for navi1x and raven

David Rosca <[email protected]>
drm/amdgpu: Fix MPEG2, MPEG4 and VC1 video caps max size

qianyi liu <[email protected]>
drm/sched: Fix fence reference count leak

Nikita Zhandarovich <[email protected]>
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()

Saranya R <[email protected]>
soc: qcom: pdr: Fix the potential deadlock

Sven Eckelmann <[email protected]>
batman-adv: Ignore own maximum aggregation size during RX

Gavrilov Ilia <[email protected]>
xsk: fix an integer overflow in xp_create_and_assign_umem()

Ard Biesheuvel <[email protected]>

    efi/libstub: Avoid physical address 0x0 when doing random allocation

Geert Uytterhoeven <[email protected]>
ARM: shmobile: smp: Enforce shmobile_smp_* alignment

Stefan Eichenberger <[email protected]>
ARM: dts: imx6qdl-apalis: Fix poweroff on Apalis iMX6

Shakeel Butt <[email protected]>
memcg: drain obj stock on cpu hotplug teardown

Ye Bin <[email protected]>
proc: fix UAF in proc_get_inode()

Zi Yan <[email protected]>
mm/migrate: fix shmem xarray update during migration

Raphael S. Carvalho <[email protected]>
mm: fix error handling in __filemap_get_folio() with FGP_NOWAIT

Gu Bowen <[email protected]>
mmc: atmel-mci: Add missing clk_disable_unprepare()

Kamal Dasu <[email protected]>
mmc: sdhci-brcmstb: add cqhci suspend/resume to PM ops

Quentin Schulz <[email protected]>
arm64: dts: rockchip: fix pinmux of UART0 for PX30 Ringneck on Haikou

Stefan Eichenberger <[email protected]>
arm64: dts: freescale: imx8mm-verdin-dahlia: add Microphone Jack to sound card

Stefan Eichenberger <[email protected]>
arm64: dts: freescale: imx8mp-verdin-dahlia: add Microphone Jack to sound card

Dan Carpenter <[email protected]>
accel/qaic: Fix integer overflow in qaic_validate_req()

Christian Eggers <[email protected]>
regulator: check that dummy regulator has been probed before using it

Christian Eggers <[email protected]>
regulator: dummy: force synchronous probing

E Shattow <[email protected]>
riscv: dts: starfive: Fix a typo in StarFive JH7110 pin function definitions

Maíra Canal <[email protected]>
drm/v3d: Don't run jobs that have errors flagged in its fence

Haibo Chen <[email protected]>
can: flexcan: disable transceiver during system PM

Haibo Chen <[email protected]>
can: flexcan: only change CAN state when link up in system PM

Vincent Mailhol <[email protected]>
can: ucan: fix out of bound read in strscpy() source

Biju Das <[email protected]>
can: rcar_canfd: Fix page entries in the AFL list

Andreas Kemnade <[email protected]>
i2c: omap: fix IRQ storms

Guillaume Nault <[email protected]>
Revert "gre: Fix IPv6 link-local address generation."

Lin Ma <[email protected]>
net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES

Justin Iurman <[email protected]>
net: lwtunnel: fix recursion loops

Dan Carpenter <[email protected]>
net: atm: fix use after free in lec_send()

Kuniyuki Iwashima <[email protected]>
ipv6: Set errno after ip_fib_metrics_init() in ip6_route_info_create().

Kuniyuki Iwashima <[email protected]>
ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().

David Lechner <[email protected]>
ARM: davinci: da850: fix selecting ARCH_DAVINCI_DA8XX

Jeffrey Hugo <[email protected]>
accel/qaic: Fix possible data corruption in BOs > 2G

Arkadiusz Bokowy <[email protected]>
Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters

Dan Carpenter <[email protected]>
Bluetooth: Fix error code in chan_alloc_skb_cb()

Junxian Huang <[email protected]>
RDMA/hns: Fix wrong value of max_sge_rd

Junxian Huang <[email protected]>
RDMA/hns: Fix a missing rollback in error path of hns_roce_create_qp_common()

Junxian Huang <[email protected]>
RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db()

Junxian Huang <[email protected]>
RDMA/hns: Fix soft lockup during bt pages loop

Saravanan Vajravel <[email protected]>
RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path

Phil Elwell <[email protected]>
ARM: dts: bcm2711: Don't mark timer regs unconfigured

Arnd Bergmann <[email protected]>
ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP

Qasim Ijaz <[email protected]>
RDMA/mlx5: Handle errors returned from mlx5r_ib_rate()

Kashyap Desai <[email protected]>
RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx

Yao Zi <[email protected]>
arm64: dts: rockchip: Remove undocumented sdmmc property from lubancat-1

Phil Elwell <[email protected]>
ARM: dts: bcm2711: PL011 UARTs are actually r1p5

Peng Fan <[email protected]>
soc: imx8m: Unregister cpufreq and soc dev in cleanup path

Marek Vasut <[email protected]>
soc: imx8m: Use devm_* to simplify probe failure handling

Marek Vasut <[email protected]>
soc: imx8m: Remove global soc_uid

Cosmin Ratiu <[email protected]>
xfrm_output: Force software GSO only in tunnel mode

Alexandre Cassen <[email protected]>
xfrm: fix tunnel mode TX datapath in packet offload mode

Alexander Stein <[email protected]>
arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply

Joe Hattori <[email protected]>
firmware: imx-scu: fix OF node leak in .probe()

-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/boot/dts/broadcom/bcm2711.dtsi            |  11 +-
 arch/arm/boot/dts/nxp/imx/imx6qdl-apalis.dtsi      |  10 +-
 arch/arm/mach-davinci/Kconfig                      |   1 +
 arch/arm/mach-omap1/Kconfig                        |   1 +
 arch/arm/mach-shmobile/headsmp.S                   |   1 +
 .../boot/dts/freescale/imx8mm-verdin-dahlia.dtsi   |   6 +-
 .../arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi |  16 +--
 .../boot/dts/freescale/imx8mp-verdin-dahlia.dtsi   |   6 +-
 .../boot/dts/rockchip/px30-ringneck-haikou.dts     |   2 +
 arch/arm64/boot/dts/rockchip/rk3399-nanopi-r4s.dts |   2 +-
 arch/arm64/boot/dts/rockchip/rk3566-lubancat-1.dts |   1 -
 arch/arm64/include/asm/kvm_host.h                  |   7 +-
 arch/arm64/include/asm/kvm_hyp.h                   |   1 +
 arch/arm64/kernel/fpsimd.c                         |  25 ----
 arch/arm64/kvm/arm.c                               |   1 -
 arch/arm64/kvm/fpsimd.c                            |  89 +++---------
 arch/arm64/kvm/hyp/entry.S                         |   5 +
 arch/arm64/kvm/hyp/include/hyp/switch.h            | 106 ++++++++++-----
 arch/arm64/kvm/hyp/nvhe/hyp-main.c                 |  15 +-
 arch/arm64/kvm/hyp/nvhe/pkvm.c                     |  29 +---
 arch/arm64/kvm/hyp/nvhe/switch.c                   | 112 ++++++++++-----
 arch/arm64/kvm/hyp/vhe/switch.c                    |  13 +-
 arch/arm64/kvm/reset.c                             |   3 +
 arch/riscv/boot/dts/starfive/jh7110-pinfunc.h      |   2 +-
 drivers/accel/qaic/qaic_data.c                     |   9 +-
 drivers/firmware/efi/libstub/randomalloc.c         |   4 +
 drivers/firmware/imx/imx-scu.c                     |   1 +
 drivers/gpu/drm/amd/amdgpu/nv.c                    |  20 +--
 drivers/gpu/drm/amd/amdgpu/soc15.c                 |  20 +--
 drivers/gpu/drm/amd/amdgpu/vi.c                    |  36 ++---
 .../gpu/drm/amd/display/dc/dce/dmub_hw_lock_mgr.c  |  15 ++
 drivers/gpu/drm/radeon/radeon_vce.c                |   2 +-
 drivers/gpu/drm/scheduler/sched_entity.c           |  11 +-
 drivers/gpu/drm/v3d/v3d_sched.c                    |   9 +-
 drivers/i2c/busses/i2c-omap.c                      |  26 +---
 drivers/infiniband/hw/bnxt_re/qplib_fp.c           |   2 -
 drivers/infiniband/hw/bnxt_re/qplib_rcfw.h         |   3 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |  16 ++-
 drivers/infiniband/hw/hns/hns_roce_main.c          |   2 +-
 drivers/infiniband/hw/hns/hns_roce_qp.c            |  10 +-
 drivers/infiniband/hw/mlx5/ah.c                    |  14 +-
 drivers/mmc/host/atmel-mci.c                       |   4 +-
 drivers/mmc/host/sdhci-brcmstb.c                   |  10 ++
 drivers/net/can/flexcan/flexcan-core.c             |  18 ++-
 drivers/net/can/rcar/rcar_canfd.c                  |  28 ++--
 drivers/net/can/usb/ucan.c                         |  43 +++---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  10 +-
 drivers/net/wireless/intel/iwlwifi/fw/file.h       |   4 +-
 drivers/net/wireless/intel/iwlwifi/mvm/d3.c        |   9 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  37 ++++-
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c       |  28 ++++
 drivers/net/wireless/intel/iwlwifi/mvm/sta.h       |   3 +-
 drivers/regulator/core.c                           |  12 +-
 drivers/regulator/dummy.c                          |   2 +-
 drivers/soc/imx/soc-imx8m.c                        | 151 ++++++++++-----------
 drivers/soc/qcom/pdr_interface.c                   |   8 +-
 fs/btrfs/tree-checker.c                            |  30 ++--
 fs/btrfs/tree-checker.h                            |   1 +
 fs/proc/generic.c                                  |  10 +-
 fs/proc/inode.c                                    |   6 +-
 fs/proc/internal.h                                 |  14 ++
 fs/smb/server/smbacl.c                             |   5 +-
 include/linux/proc_fs.h                            |   7 +-
 include/net/bluetooth/hci.h                        |   2 +-
 kernel/sched/core.c                                |  22 +--
 mm/filemap.c                                       |  13 +-
 mm/memcontrol.c                                    |   9 ++
 mm/migrate.c                                       |  10 +-
 net/atm/lec.c                                      |   3 +-
 net/batman-adv/bat_iv_ogm.c                        |   3 +-
 net/batman-adv/bat_v_ogm.c                         |   3 +-
 net/bluetooth/6lowpan.c                            |   7 +-
 net/core/lwtunnel.c                                |  65 +++++++--
 net/core/neighbour.c                               |   1 +
 net/ipv6/addrconf.c                                |  15 +-
 net/ipv6/route.c                                   |   5 +-
 net/mptcp/options.c                                |   6 +-
 net/netfilter/nft_counter.c                        |  90 ++++++------
 net/xdp/xsk_buff_pool.c                            |   2 +-
 net/xfrm/xfrm_output.c                             |  43 +++++-
 81 files changed, 808 insertions(+), 600 deletions(-)

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:

Florian

The kernel, bpf tool, perf tool, and kselftest builds fine for v6.6.85-rc2 on x86 and arm64 Azure VM.

Kernel binary size for x86 build:

text      data      bss      dec       hex      filename
27318965  16715522  4640768  48675255  2e6b9b7  vmlinux

Kernel binary size for arm64 build:

text      data      bss      dec       hex      filename
34688860  13845666  970368   49504894  2f3627e  vmlinux

Thanks,
Hardik

Am 26.03.2025 um 16:44 schrieb Greg Kroah-Hartman:

Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.

Beste Grüße,
Peter Schneider

Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you.                    -- David McCullough Jr.

OpenPGP:  0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
https://keys.mailvelope.com/pks/lookup?op=get&[email protected]

Built and booted successfully on RISC-V RV64 (HiFive Unmatched).

Hi Greg,

No problems seen on x86_64 and aarch64 with our testing.

Thanks,
Harshit

Failures detected for Tegra ...

Test results for stable-v6.6:

    10 builds:	10 pass, 0 fail
    28 boots:	28 pass, 0 fail
    116 tests:	109 pass, 7 fail

Linux version: 6.6.85-rc2-g0bf29b955eac
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,

                tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
                tegra194-p3509-0000+p3668-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra210-p3450-0000,
                tegra30-cardhu-a04

Test failures: tegra186-p2771-0000: cpu-hotplug

                tegra186-p2771-0000: pm-system-suspend.sh
                tegra194-p2972-0000: pm-system-suspend.sh
                tegra210-p2371-2180: cpu-hotplug
                tegra210-p3450-0000: cpu-hotplug

Jon

Hi Greg,

Just to confirm, this is the same issue seen with 6.1.y.

Jon

nvpublic

Ugh, I missed that. I'll go drop that on 6.6.y and push out a new -rc for there...

Regressions on arm64 devices cpu hotplug tests failed with gcc-13 and clang-20 the stable-rc 6.6.85-rc2

These regressions are the same as stable-rc 6.1 cpu hotplug regressions.

First seen on the 6.6.85-rc2
Good: v6.6.83
Bad: 6.6.85-rc2

* dragonboard 845c
- selftests: cpu-hotplug: cpu-on-off-test.sh
- rseq_basic_percpu_ops_mm_cid_test
- rseq_basic_percpu_ops_test
- ltp-controllers: cpuset_hotplug_test.sh

Regression Analysis:
- New regression? yes
- Reproducibility? Yes

Test regression: arm64 arm cpuhotplug kernel NULL pointer dereference

## Test log
command: cpuset_hotplug_test.sh
cpuset_hotplug 1 TINFO: CPUs are numbered continuously starting at 0 (0-7) cpuset_hotplug 1 TINFO: Nodes are numbered continuously starting at 0 (0)

[  607.606520] IRQ118: set affinity failed(-22).
[  607.606657] IRQ165: set affinity failed(-22).
[  607.606670] IRQ167: set affinity failed(-22).
[  607.606764] IRQ206: set affinity failed(-22).
[  607.606775] IRQ207: set affinity failed(-22).
[  607.606786] IRQ208: set affinity failed(-22).
[  607.606797] IRQ209: set affinity failed(-22).
[  607.606807] IRQ210: set affinity failed(-22).
[  607.606816] IRQ211: set affinity failed(-22).
[  607.606825] IRQ212: set affinity failed(-22).
[  607.610148] psci: CPU1 killed (polled 0 ms)
cpuset_hotplug 1 TPASS: Cpuset vs CPU hotplug test succeeded.
[  608.845868] Detected VIPT I-cache on CPU1
[  608.845955] GICv3: CPU1: found redistributor 100 region 0:0x0000000017a80000
[  608.846049] CPU1: Booted secondary processor 0x0000000100 [0x517f803c]
[  609.103460] psci: CPU1 killed (polled 0 ms)
[  609.149280] Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000000
[  609.162506] Mem abort info:
[  609.170513]   ESR = 0x0000000096000004
[  609.177143]   EC = 0x25: DABT (current EL), IL = 32 bits
[  609.184803]   SET = 0, FnV = 0
[  609.190745]   EA = 0, S1PTW = 0
[  609.196414]   FSC = 0x04: level 0 translation fault
[  609.202957] Data abort info:
[  609.208001]   ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[  609.215282]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  609.221926]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  609.229042] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000108ec5000
[  609.238062] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
[  609.246582] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[  609.254427] Modules linked in: ax88179_178a usbnet fuse ip_tables

x_tables snd_soc_hdmi_codec venus_enc venus_dec videobuf2_dma_contig mcp251xfd xhci_pci xhci_pci_renesas lontium_lt9611 can_dev qcom_pon qcom_spmi_adc5 snd_soc_sdm845 rtc_pm8xxx ath10k_snoc leds_qcom_lpg snd_soc_rt5663 qcom_vadc_common venus_core ath10k_core snd_soc_qcom_common snd_soc_rl6231 led_class_multicolor qcom_spmi_temp_alarm ath crct10dif_ce qcom_stats v4l2_mem2mem soundwire_bus msm qcom_camss videobuf2_dma_sg videobuf2_v4l2 videobuf2_memops mac80211 ocmem hci_uart gpu_sched phy_qcom_qmp_combo btqca drm_dp_aux_bus btbcm reset_qcom_pdc drm_display_helper camcc_sdm845 bluetooth qcom_q6v5_mss spi_geni_qcom i2c_qcom_geni typec gpi videobuf2_common qcom_rng phy_qcom_qmp_usb coresight_stm stm_core qrtr qcrypto cfg80211 qcom_q6v5_pas ufs_qcom phy_qcom_qmp_ufs phy_qcom_qmp_pcie lmh rfkill slim_qcom_ngd_ctrl icc_osm_l3 qcom_pil_info slimbus qcom_wdt qcom_q6v5 pdr_interface display_connector llcc_qcom drm_kms_helper qcom_sysmon qcom_common

[  609.254673]  qcom_glink_smem mdt_loader icc_bwmon drm qmi_helpers
socinfo backlight rmtfs_mem
[  609.364260] CPU: 0 PID: 388 Comm: kworker/0:3 Not tainted 6.6.85-rc2 #1
[  609.373013] Hardware name: Thundercomm Dragonboard 845c (DT)
[  609.380818] Workqueue: events work_for_cpu_fn
[  609.387320] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  609.396471] pc : memcg_hotplug_cpu_dead

(include/linux/percpu-refcount.h:174 include/linux/percpu-refcount.h:332 include/linux/percpu-refcount.h:351 include/linux/memcontrol.h:809 mm/memcontrol.c:2392)

[  609.403452] lr : memcg_hotplug_cpu_dead

(include/linux/percpu-refcount.h:174 include/linux/percpu-refcount.h:332 include/linux/percpu-refcount.h:351 include/linux/memcontrol.h:809 mm/memcontrol.c:2392)

[  609.410429] sp : ffff80008107bc50
[  609.415903] x29: ffff80008107bc50 x28: 0000000000000000 x27: ffffad8428896ad8
[  609.425251] x26: 0000000000000028 x25: ffff60fdbd4a1a58 x24: ffffad842887eb00
[  609.434605] x23: 0000000000000000 x22: ffffad84288329c0 x21: 0000000000000000
[  609.443957] x20: ffffb37994c7e000 x19: 0000000000000000 x18: 00000000b8fbaf46
[  609.453329] x17: 0000000000000000 x16: 000000000000030d x15: 0000000000000049
[  609.462707] x14: 0000000000000197 x13: ffff800081078000 x12: ffff80008107c000
[  609.472102] x11: abc96095bed38f00 x10: 0000000000000000 x9 : 0000000000000001
[  609.481495] x8 : ffff60fd47b4d280 x7 : 000000f2b5503510 x6 : 0000000000300000
[  609.490872] x5 : 00000000801c0011 x4 : 0000000000000000 x3 : ffff80008107bc00
[  609.500269] x2 : ffff60fd47b4d280 x1 : ffffad84264a670c x0 : ffff60fdbd4b09c0
[  609.509655] Call trace:
[  609.514295] memcg_hotplug_cpu_dead

(include/linux/percpu-refcount.h:174 include/linux/percpu-refcount.h:332 include/linux/percpu-refcount.h:351 include/linux/memcontrol.h:809 mm/memcontrol.c:2392)

[  609.520968] cpuhp_invoke_callback (kernel/cpu.c:196)
[  609.527648] _cpu_down (kernel/cpu.c:0 kernel/cpu.c:980
kernel/cpu.c:1415 kernel/cpu.c:1476)
[  609.533283] __cpu_down_maps_locked (kernel/cpu.c:1507)
[  609.539889] work_for_cpu_fn (kernel/workqueue.c:5644)
[  609.545882] process_scheduled_works (kernel/workqueue.c:2639
kernel/workqueue.c:2711)
[  609.552752] worker_thread (include/linux/list.h:373
kernel/workqueue.c:841 kernel/workqueue.c:2793)
[  609.558741] kthread (kernel/kthread.c:390)
[  609.564193] ret_from_fork (arch/arm64/kernel/entry.S:862)
[ 609.570006] Code: d51b4235 8b160280 97ffebe0 97f694b5 (f9400269)

All code
========

Code starting with the faulting instruction
===========================================

[  609.578382] ---[ end trace 0000000000000000 ]---

## Test log 2
kselftest: Running tests in rseq
TAP version 13
1..9

# timeout set to 0
# selftests: rseq: basic_test
# testing current cpu
# basic_test: basic_test.c:30: test_cpu_pointer: Assertion
`sched_getcpu() == i' failed.
# Aborted
not ok 1 selftests: rseq: basic_test # exit=134
# timeout set to 0
# selftests: rseq: basic_percpu_ops_test
# spinlock
# Segmentation fault
not ok 2 selftests: rseq: basic_percpu_ops_test # exit=139
# timeout set to 0
# selftests: rseq: basic_percpu_ops_mm_cid_test
# spinlock
# Segmentation fault
not ok 3 selftests: rseq: basic_percpu_ops_mm_cid_test # exit=139

## Source
* Kernel version: 6.6.85-rc2
* Git tree: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* Git sha: 0bf29b955eacbaba63be87642f2b48f8a7c45055
* Git describe: v6.6.83-244-g0bf29b955eac
* Project details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.83-244-g0bf29b955eac

## Test
* Test log: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.83-244-g0bf29b955eac/testrun/27798819/suite/log-parser-test/test/internal-error-oops-oops-preempt-smp-ada4e7ef482d5d7749a545db62c1f4c97ae5ba4633a23ce654828f2d2e816088/log
* Test history:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.83-244-g0bf29b955eac/testrun/27798819/suite/log-parser-test/test/internal-error-oops-oops-preempt-smp-ada4e7ef482d5d7749a545db62c1f4c97ae5ba4633a23ce654828f2d2e816088/history/
* Test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.83-244-g0bf29b955eac/testrun/27798819/suite/log-parser-test/test/internal-error-oops-oops-preempt-smp-ada4e7ef482d5d7749a545db62c1f4c97ae5ba4633a23ce654828f2d2e816088/
* Test link: https://storage.tuxsuite.com/public/linaro/lkft/builds/2urSrAikljwhAncEhDz6bSva1iJ/
* Kernel config:
https://storage.tuxsuite.com/public/linaro/lkft/builds/2urSrAikljwhAncEhDz6bSva1iJ/config

--
Linaro LKFT
https://lkft.linaro.org

I have reverted this patch and confirms that reported regressions fixed,
memcg: drain obj stock on cpu hotplug teardown
commit 9f01b4954490d4ccdbcc2b9be34a9921ceee9cbb upstream.

- Naresh

Thanks for confirming, let me push out a -rc3...