6.6.120-rc1 review

This is the start of the stable review cycle for the 6.6.120 release. There are 737 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sun, 11 Jan 2026 11:19:41 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.120-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.6.120-rc1

Greg Kroah-Hartman <[email protected]>
Revert "iommu/amd: Skip enabling command/event buffers for kdump"

Amitai Gottlieb <[email protected]>
firmware: arm_scmi: Fix unused notifier-block in unregister

Jiri Slaby (SUSE) <[email protected]>
tty: fix tty_port_tty_*hangup() kernel-doc

Ming Lei <[email protected]>

    blk-mq: setup queue ->tag_set before initializing hctx

Sean Nyekjaer <[email protected]>
pwm: stm32: Always program polarity

Alexis Lothoré <[email protected]>
net: stmmac: make sure that ptp_rate is not 0 before configuring EST

Lizhi Xu <[email protected]>
ext4: filesystems without casefold feature cannot be mounted with siphash

Maximilian Immanuel Brandtner <[email protected]>
virtio_console: fix order of fields cols and rows

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures in damon_test_update_monitoring_result()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failure on damon_test_set_attrs()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures in damon_test_ops_registration()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures in damon_test_set_regions()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damos_test_filter_out()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory alloc failure from damon_test_aggregate()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_regions_of()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle memory failure from damon_test_target()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_merge_two()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on dasmon_test_merge_regions_of()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failures on damon_test_split_at()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle allocation failures in damon_test_regions()

SeongJae Park <[email protected]>
mm/damon/tests/core-kunit: handle alloc failres in damon_test_new_filter()

SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_test_split_evenly_succ()

Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests

Zhu Yanjun <[email protected]>
RDMA/rxe: Remove the direct link to net_device

Sebastian Andrzej Siewior <[email protected]>
net: Allow to use SMP threads for backlog NAPI.

Sebastian Andrzej Siewior <[email protected]>
net: Remove conditional threaded-NAPI wakeup based on task state.

Peter Zijlstra (Intel) <[email protected]>
sched/fair: Proportional newidle balance

Peter Zijlstra <[email protected]>
sched/fair: Small cleanup to update_newidle_cost()

Peter Zijlstra <[email protected]>
sched/fair: Small cleanup to sched_balance_newidle()

Zhu Yanjun <[email protected]>
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures on damon_do_test_apply_three_regions()

SeongJae Park <[email protected]>
mm/damon/tests/vaddr-kunit: handle alloc failures in damon_test_split_evenly_fail()

Yosry Ahmed <[email protected]>
KVM: SVM: Fix redundant updates of LBR MSR intercepts

Yosry Ahmed <[email protected]>
KVM: nSVM: Fix and simplify LBR virtualization handling with nested

Yosry Ahmed <[email protected]>
KVM: nSVM: Always recalculate LBR MSR intercepts in svm_update_lbrv()

Yosry Ahmed <[email protected]>
KVM: SVM: Introduce svm_recalc_lbr_msr_intercepts()

Chen-Yu Tsai <[email protected]>
media: mediatek: vcodec: Use spinlock for context list protection lock

Ming Qian <[email protected]>
media: amphion: Remove vpu_vb_is_codecconfig

Laurent Pinchart <[email protected]>
media: amphion: Make some vpu_v4l2 functions static

Ming Qian <[email protected]>
media: amphion: Add a frame flush mode for decoder

Dongli Zhang <[email protected]>
KVM: nVMX: Immediately refresh APICv controls as needed on nested VM-Exit

David Hildenbrand <[email protected]>
powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages

David Hildenbrand <[email protected]>
mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize()

David Hildenbrand <[email protected]>
mm/balloon_compaction: we cannot have isolated pages in the balloon list

Nicolas Dufresne <[email protected]>
media: verisilicon: Fix CPU stalls on G2 bus error

Benjamin Gaignard <[email protected]>
media: verisilicon: g2: Use common helpers to compute chroma and mv offsets

Benjamin Gaignard <[email protected]>
media: verisilicon: Store chroma and motion vectors offset

Chao Yu <[email protected]>
f2fs: fix to detect recoverable inode during dryrun of find_fsync_dnodes()

Chao Yu <[email protected]>
f2fs: use global inline_xattr_slab instead of per-sb slab cache

Chao Yu <[email protected]>
f2fs: fix to propagate error from f2fs_enable_checkpoint()

Chao Yu <[email protected]>
f2fs: fix to avoid updating compression context during writeback

Jaegeuk Kim <[email protected]>
f2fs: drop inode from the donation list when the last file is closed

Jaegeuk Kim <[email protected]>
f2fs: keep POSIX_FADV_NOREUSE ranges

Chao Yu <[email protected]>
f2fs: remove unused GC_FAILURE_PIN

Gyeyoung Baek <[email protected]>
genirq/irq_sim: Initialize work context pointers properly

Jingbo Xu <[email protected]>
mm: fix arithmetic for max_prop_frac when setting max_ratio

Jingbo Xu <[email protected]>
mm: fix arithmetic for bdi min_ratio

Vladimir Oltean <[email protected]>
net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()

Dong Chenchen <[email protected]>
page_pool: Fix use-after-free in page_pool_recycle_in_ring

Florian Westphal <[email protected]>
xfrm: state: fix out-of-bounds read during lookup

Ye Bin <[email protected]>
ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

Ye Bin <[email protected]>
ext4: introduce ITAIL helper

Gabriel Krisman Bertazi <[email protected]>
ext4: fix error message when rejecting the default hash

Hari Bathini <[email protected]>
powerpc/64s/radix/kfence: map __kfence_pool at page granularity

Chenghao Duan <[email protected]>
LoongArch: Refactor register restoration in ftrace_common_return

Aurabindo Pillai <[email protected]>
drm/amd/display: Fix null pointer deref in dcn20_resource.c

Thadeu Lima de Souza Cascardo <[email protected]>
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.

Michal Pecio <[email protected]>
usb: xhci: Apply the link chain quirk on NEC isoc endpoints

Niklas Neronin <[email protected]>
usb: xhci: move link chain bit quirk checks into one helper function.

Łukasz Bartosik <[email protected]>
xhci: dbgtty: fix device unregister: fixup

Jiri Slaby (SUSE) <[email protected]>
tty: introduce and use tty_port_tty_vhangup() helper

Kory Maincent (TI.com) <[email protected]>
drm/tilcdc: Fix removal actions in case of failed probe

Philipp Stanner <[email protected]>
drm/tilcdc: request and mapp iomem with devres

Johan Hovold <[email protected]>
drm/mediatek: Fix probe resource leaks

Johan Hovold <[email protected]>
drm/mediatek: Fix probe memory leak

Natalie Vock <[email protected]>
drm/amdgpu: Forward VMID reservation errors

Paolo Abeni <[email protected]>
mptcp: ensure context reset on disconnect()

Miaoqian Lin <[email protected]>
net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration

Wentao Liang <[email protected]>
pmdomain: imx: Fix reference count leak in imx_gpc_probe()

Rob Herring <[email protected]>
pmdomain: Use device_get_match_data()

Bijan Tabatabai <[email protected]>
mm: consider non-anon swap cache folios in folio_expected_ref_count()

David Hildenbrand <[email protected]>
mm: simplify folio_expected_ref_count()

Jouni Malinen <[email protected]>
wifi: mac80211: Discard Beacon frames to non-broadcast address

NeilBrown <[email protected]>
lockd: fix vfs_test_lock() calls

Paolo Abeni <[email protected]>
mptcp: fallback earlier on simult connection

Jim Quinlan <[email protected]>
PCI: brcmstb: Fix disabling L0s capability

Joanne Koong <[email protected]>
fuse: fix readahead reclaim deadlock

Joshua Rogers <[email protected]>
svcrdma: bound check rq_pages index in inline path

Nicolas Ferre <[email protected]>
ARM: dts: microchip: sama7g5: fix uart fifo size to 32

Askar Safin <[email protected]>
gpiolib: acpi: Add quirk for Dell Precision 7780

Chuck Lever <[email protected]>
NFSD: Clear SECLABEL in the suppattr_exclcreat bitmap

Chao Yu <[email protected]>
f2fs: fix to avoid potential deadlock

Chao Yu <[email protected]>
f2fs: use f2fs_err_ratelimited() to avoid redundant logs

Matthieu Baerts (NGI0) <[email protected]>
mptcp: pm: ignore unknown endpoint flags

Seunghwan Baek <[email protected]>
scsi: ufs: core: Add ufshcd_update_evt_hist() for UFS suspend error

Johan Hovold <[email protected]>
usb: ohci-nxp: fix device leak on probe failure

Zhang Zekun <[email protected]>
usb: ohci-nxp: Use helper function devm_clk_get_enabled()

xu xin <[email protected]>
mm/ksm: fix exec/fork inheritance support for prctl

Sven Eckelmann (Plasma Cloud) <[email protected]>
wifi: mt76: Fix DTS power-limits on little endian systems

Josef Bacik <[email protected]>
btrfs: don't rewrite ret from inode_permission

Alexey Velichayshiy <[email protected]>
gfs2: fix freeze error handling

Ye Bin <[email protected]>
jbd2: fix the inconsistency between checksum and data in memory for journal sb

Fedor Pchelkin <[email protected]>
ext4: fix string copying in parse_apply_sb_mount_options()

Denis Arefev <[email protected]>
ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()

Junrui Luo <[email protected]>
ALSA: wavefront: Clear substream pointers on close

Takashi Iwai <[email protected]>
ALSA: wavefront: Use guard() for spin locks

Junrui Luo <[email protected]>
ALSA: wavefront: Fix integer overflow in sample size validation

Takashi Iwai <[email protected]>
ALSA: wavefront: Use standard print API

Kuniyuki Iwashima <[email protected]>
mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().

Jarkko Sakkinen <[email protected]>
tpm: Cap the number of PCR banks

Ming Lei <[email protected]>
blk-mq: add helper for checking if one CPU is mapped to specified hctx

Johan Hovold <[email protected]>
usb: gadget: lpc32xx_udc: fix clock imbalance in error path

Lyude Paul <[email protected]>
drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb

Krzysztof Niemiec <[email protected]>
drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer

Nikolay Kuratov <[email protected]>
drm/msm/dpu: Add missing NULL pointer check for pingpong interface

René Rebe <[email protected]>
drm/mgag200: Fix big-endian support

Simon Richter <[email protected]>
drm/ttm: Avoid NULL pointer deref for evicted BOs

Miaoqian Lin <[email protected]>
drm/mediatek: Fix device node reference leak in mtk_dp_dt_parse()

Thomas Zimmermann <[email protected]>
drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()

Akhil P Oommen <[email protected]>
drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers

Pierre-Eric Pelloux-Prayer <[email protected]>
drm/amdgpu: add missing lock to amdgpu_ttm_access_memory_sdma

Xiaolei Wang <[email protected]>
net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()

Deepanshu Kartikey <[email protected]>
net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write

Ethan Nelson-Moore <[email protected]>
net: usb: sr9700: fix incorrect command used to write single register

Haoxiang Li <[email protected]>
nfsd: Drop the client reference in client_states_open()

Hengqi Chen <[email protected]>
LoongArch: BPF: Sign extend kfunc call arguments

Hengqi Chen <[email protected]>
LoongArch: BPF: Zero-extend bpf_tail_call() index

Haoxiang Li <[email protected]>
fjes: Add missing iounmap in fjes_hw_init()

Guangshuo Li <[email protected]>

    e1000: fix OOB in e1000_tbi_should_accept()

Jason Gunthorpe <[email protected]>
RDMA/cm: Fix leaking the multicast GID table reference

Jason Gunthorpe <[email protected]>
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly

Chenghao Duan <[email protected]>
samples/ftrace: Adjust LoongArch register restore order in direct calls

Kaushlendra Kumar <[email protected]>
tools/mm/page_owner_sort: fix timestamp comparison for stable sorting

Rong Zhang <[email protected]>
x86/microcode/AMD: Fix Entrysign revision check for Zen5/Strix Halo

Matthew Wilcox (Oracle) <[email protected]>
idr: fix idr_alloc() returning an ID out of range

Maciej Wieczor-Retman <[email protected]>
kasan: refactor pcpu kasan vmalloc unpoison

H. Peter Anvin <[email protected]>
compiler_types.h: add "auto" as a macro for "__auto_type"

Tiezhu Yang <[email protected]>
LoongArch: Use unsigned long for _end and _text

WangYuli <[email protected]>
LoongArch: Use __pmd()/__pte() for swap entry conversions

Huacai Chen <[email protected]>
LoongArch: Fix build errors for CONFIG_RANDSTRUCT

Qiang Ma <[email protected]>
LoongArch: Correct the calculation logic of thread_count

Huacai Chen <[email protected]>
LoongArch: Add new PCI ID for pci_fixup_vgadev()

Haoxiang Li <[email protected]>
media: mediatek: vcodec: Fix a reference leak in mtk_vcodec_fw_vpu_init()

Duoming Zhou <[email protected]>
media: i2c: adv7842: Remove redundant cancel_delayed_work in probe

Duoming Zhou <[email protected]>
media: i2c: ADV7604: Remove redundant cancel_delayed_work in probe

Ming Qian <[email protected]>
media: amphion: Cancel message work before releasing the VPU core

Johan Hovold <[email protected]>
media: vpif_display: fix section mismatch

Johan Hovold <[email protected]>
media: vpif_capture: fix section mismatch

Haotian Zhang <[email protected]>
media: videobuf2: Fix device reference leak in vb2_dc_alloc error path

Nicolas Dufresne <[email protected]>
media: verisilicon: Protect G2 HEVC decoder against invalid DPB index

Duoming Zhou <[email protected]>
media: TDA1997x: Remove redundant cancel_delayed_work in probe

Marek Szyprowski <[email protected]>
media: samsung: exynos4-is: fix potential ABBA deadlock on init

Miaoqian Lin <[email protected]>
media: renesas: rcar_drif: fix device node reference leak in rcar_drif_bond_enabled

Ivan Abramov <[email protected]>
media: msp3400: Avoid possible out-of-bounds array accesses in msp3400c_thread()

Haotian Zhang <[email protected]>
media: cec: Fix debugfs leak on bus_register() failure

René Rebe <[email protected]>
fbdev: tcx.c fix mem_map to correct smem_start offset

Thorsten Blum <[email protected]>
fbdev: pxafb: Fix multiple clamped values in pxafb_adjust_timing

Rene Rebe <[email protected]>
fbdev: gbefb: fix to use physical address instead of dma address

Mikulas Patocka <[email protected]>
dm-bufio: align write boundary on physical block size

Uladzislau Rezki (Sony) <[email protected]>
dm-ebs: Mark full buffer dirty even on partial write

Mahesh Rao <[email protected]>
firmware: stratix10-svc: Add mutex in stratix10 memory management

Ivan Abramov <[email protected]>
media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status()

David Hildenbrand <[email protected]>
powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION

Sven Schnelle <[email protected]>
parisc: entry: set W bit for !compat tasks in syscall_restore_rfi()

Sven Schnelle <[email protected]>
parisc: entry.S: fix space adjustment on interruption for 64-bit userspace

Haotian Zhang <[email protected]>
media: rc: st_rc: Fix reset control resource leak

Krzysztof Kozlowski <[email protected]>
mfd: max77620: Fix potential IRQ chip conflict when probing two devices

Johan Hovold <[email protected]>
mfd: altera-sysmgr: Fix device leak on sysmgr regmap lookup

Nathan Chancellor <[email protected]>
clk: samsung: exynos-clkout: Assign .num before accessing .hws

Christian Hitz <[email protected]>

    leds: leds-lp50xx: Enable chip before any communication

Christian Hitz <[email protected]>

    leds: leds-lp50xx: LP5009 supports 3 modules for a total of 9 LEDs

Christian Hitz <[email protected]>

    leds: leds-lp50xx: Allow LED 0 to be added to module bank

Donet Tom <[email protected]>
powerpc/64s/slb: Fix SLB multihit issue during SLB preload

Dave Vasilevsky <[email protected]>
powerpc, mm: Fix mprotect on book3s 32-bit

Siddharth Vadapalli <[email protected]>
arm64: dts: ti: k3-j721e-sk: Fix pinmux for pin Y1 used by power regulator

Lukas Wunner <[email protected]>
PCI/PM: Reinstate clearing state_saved in legacy and !PM codepaths

Hans de Goede <[email protected]>
HID: logitech-dj: Remove duplicate error logging

Lu Baolu <[email protected]>
iommu: disable SVA when CONFIG_X86 is set

Johan Hovold <[email protected]>
iommu/tegra: fix device leak on probe_device()

Johan Hovold <[email protected]>
iommu/sun50i: fix device leak on of_xlate()

Johan Hovold <[email protected]>
iommu/qcom: fix device leak on of_xlate()

Johan Hovold <[email protected]>
iommu/omap: fix device leaks on probe_device()

Johan Hovold <[email protected]>
iommu/mediatek: fix device leak on of_xlate()

Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leaks on probe()

Johan Hovold <[email protected]>
iommu/mediatek-v1: fix device leak on probe_device()

Johan Hovold <[email protected]>
iommu/ipmmu-vmsa: fix device leak on of_xlate()

Johan Hovold <[email protected]>
iommu/exynos: fix device leak on of_xlate()

Johan Hovold <[email protected]>
iommu/apple-dart: fix device leak on of_xlate()

Jinhui Guo <[email protected]>
iommu/amd: Fix pci_segment memleak in alloc_pci_segment()

Srinivas Kandagatla <[email protected]>
ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment.

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6adm: the the copp device only during last instance

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6asm-dai: perform correct state check before closing

Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr

Johan Hovold <[email protected]>
ASoC: stm32: sai: fix OF node leak on probe

Johan Hovold <[email protected]>
ASoC: stm32: sai: fix clk prepare imbalance on probe failure

Johan Hovold <[email protected]>
ASoC: stm32: sai: fix device leak on probe

Matthew Wilcox (Oracle) <[email protected]>
ntfs: Do not overwrite uptodate pages

Yipeng Zou <[email protected]>
selftests/ftrace: traceonoff_triggers: strip off names

Cong Zhang <[email protected]>
blk-mq: skip CPU offline notify on unmapped hctx

Ming Lei <[email protected]>
blk-mq: don't schedule block kworker on isolated CPUs

Thomas Fourier <[email protected]>
RDMA/bnxt_re: fix dma_free_coherent() pointer

Honggang LI <[email protected]>
RDMA/rtrs: Fix clt_path::max_pages_per_mr calculation

Zilin Guan <[email protected]>
ksmbd: Fix memory leak in get_file_all_info()

Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix to use correct page size for PDE table

Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix IB_SEND_IP_CSUM handling in post_send

Alok Tiwari <[email protected]>
RDMA/bnxt_re: Fix incorrect BAR check in bnxt_qplib_map_creq_db()

Jang Ingyu <[email protected]>
RDMA/core: Fix logic error in ib_get_gids_from_rdma_hdr()

Michael Margolin <[email protected]>
RDMA/efa: Remove possible negative shift

Michal Schmidt <[email protected]>
RDMA/irdma: avoid invalid read in irdma_net_event

Pwnverse <[email protected]>
net: rose: fix invalid array index in rose_kill_by_device()

Ido Schimmel <[email protected]>
ipv4: Fix reference count leak when using error routes with nexthop objects

Will Rosenberg <[email protected]>
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

Wei Fang <[email protected]>
net: stmmac: fix the crash issue for zero copy XDP_TX action

Anshumali Gaur <[email protected]>
octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"

Junrui Luo <[email protected]>
platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing

Bagas Sanjaya <[email protected]>
net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct

Deepanshu Kartikey <[email protected]>
net: usb: asix: validate PHY address before use

Jonas Gorski <[email protected]>
net: dsa: b53: skip multicast entries for fdb_dump()

Thomas Fourier <[email protected]>
firewire: nosy: Fix dma_free_coherent() size

Andrew Morton <[email protected]>
genalloc.h: fix htmldocs warning

Yeoreum Yun <[email protected]>
smc91x: fix broken irq-context in PREEMPT_RT

Alice C. Munduruca <[email protected]>
selftests: net: fix "buffer overflow detected" for tap.c

Deepakkumar Karn <[email protected]>
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure

Raju Rangoju <[email protected]>
amd-xgbe: reset retries and mode on RX adapt failures

Jiri Pirko <[email protected]>
team: fix check for port enabled in team_queue_override_port_prio_changed()

Junrui Luo <[email protected]>
platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic

Thomas Fourier <[email protected]>
platform/x86: msi-laptop: add missing sysfs_remove_group()

Eric Dumazet <[email protected]>
ip6_gre: make ip6gre_header() robust

Toke Høiland-Jørgensen <[email protected]>
net: openvswitch: Avoid needlessly taking the RTNL on vport destroy

Jacky Chou <[email protected]>
net: mdio: aspeed: add dummy read to avoid read-after-write issue

Raphael Pinsonneault-Thibeault <[email protected]>
Bluetooth: btusb: revert use of devm_kzalloc in btusb

Herbert Xu <[email protected]>

    crypto: seqiv - Do not use req->iv after crypto_aead_encrypt

Kohei Enju <[email protected]>
iavf: fix off-by-one issues in iavf_config_rss_reg()

Przemyslaw Korba <[email protected]>
i40e: fix scheduling in set_rx_mode

Aloka Dixit <[email protected]>
wifi: mac80211: do not use old MBSSID elements

Dan Carpenter <[email protected]>

    wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()

Ping-Ke Shih <[email protected]>
wifi: rtw88: limit indirect IO under powered off for RTL8822CS

Johan Hovold <[email protected]>
iommu/mediatek: fix use-after-free on probe deferral

Nicolas Ferre <[email protected]>
ARM: dts: microchip: sama5d2: fix spi flexcom fifo size to 32

Gui-Dong Han <[email protected]>
hwmon: (w83l786ng) Convert macros to functions to avoid TOCTOU

Gui-Dong Han <[email protected]>
hwmon: (w83791d) Convert macros to functions to avoid TOCTOU

Gui-Dong Han <[email protected]>
hwmon: (max16065) Use local variable to avoid TOCTOU

Ma Ke <[email protected]>
i2c: amd-mp2: fix reference leak in MP2 PCI device

Bartosz Golaszewski <[email protected]>
platform/x86: intel: chtwc_int33fe: don't dereference swnode args

Srinivas Kandagatla <[email protected]>
rpmsg: glink: fix rpmsg device leak

Johan Hovold <[email protected]>
soc: amlogic: canvas: fix device leak on lookup

Johan Hovold <[email protected]>
soc: qcom: ocmem: fix device leak on lookup

Steven Rostedt <[email protected]>
tracing: Fix fixed array of synthetic event

Johan Hovold <[email protected]>
amba: tegra-ahb: Fix device leak on SMMU enable

Guangshuo Li <[email protected]>
crypto: caam - Add check for kcalloc() in test_len()

Shivani Agarwal <[email protected]>
crypto: af_alg - zero initialize memory allocated via sock_kmalloc

Adrian Moreno <[email protected]>
selftests: openvswitch: Fix escape chars in regexp.

Alex Deucher <[email protected]>
drm/amd/display: Use GFP_ATOMIC in dc_create_plane_state()

Jens Axboe <[email protected]>
io_uring/poll: correctly handle io_poll_add() return value on update

Wentao Guan <[email protected]>
gpio: regmap: Fix memleak in error path in gpio_regmap_register()

Sven Schnelle <[email protected]>
s390/ipl: Clear SBP flag when bootprog is set

Filipe Manana <[email protected]>
btrfs: don't log conflicting inode if it's a dir moved in the current transaction

Nysal Jan K.A. <[email protected]>
powerpc/kexec: Enable SMT before waking offline CPUs

Joshua Rogers <[email protected]>
SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf

Joshua Rogers <[email protected]>
svcrdma: return 0 on success from svc_rdma_copy_inline_range

Andy Shevchenko <[email protected]>
nfsd: Mark variable __maybe_unused to avoid W=1 build break

caoping <[email protected]>
net/handshake: restore destructor on submit failure

Amir Goldstein <[email protected]>
fsnotify: do not generate ACCESS/MODIFY events on child for special files

René Rebe <[email protected]>

    r8169: fix RTL8117 Wake-on-Lan in DASH mode

Rafael J. Wysocki <[email protected]>
PM: runtime: Do not clear needs_force_resume with enabled runtime PM

Steven Rostedt <[email protected]>
tracing: Do not register unsupported perf events

Haoxiang Li <[email protected]>
xfs: fix a memory leak in xfs_buf_item_init()

Sean Christopherson <[email protected]>
KVM: nSVM: Clear exit_code_hi in VMCB when synthesizing nested VM-Exits

Sean Christopherson <[email protected]>
KVM: nSVM: Set exit_code_hi to -1 when synthesizing SVM_EXIT_ERR (failed VMRUN)

Jim Mattson <[email protected]>
KVM: SVM: Mark VMCB_PERM_MAP as dirty on nested VMRUN

Yosry Ahmed <[email protected]>
KVM: nSVM: Propagate SVM_EXIT_CR0_SEL_WRITE correctly for LMSW emulation

Jim Mattson <[email protected]>
KVM: SVM: Mark VMCB_NPT as dirty on nested VMRUN

Yosry Ahmed <[email protected]>
KVM: nSVM: Avoid incorrect injection of SVM_EXIT_CR0_SEL_WRITE

fuqiang wang <[email protected]>
KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer

fuqiang wang <[email protected]>
KVM: x86: Explicitly set new periodic hrtimer expiration in apic_timer_fn()

Sean Christopherson <[email protected]>
KVM: x86: WARN if hrtimer callback for periodic APIC timer fires with period=0

Ilya Dryomov <[email protected]>
libceph: make decode_pool() more resilient against corrupted osdmaps

Helge Deller <[email protected]>
parisc: Do not reprogram affinitiy on ASP chip

Zhichi Lin <[email protected]>
scs: fix a wrong parameter in __scs_magic

Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver

Maxim Levitsky <[email protected]>
KVM: x86: Don't clear async #PF queue when CR0.PG is disabled (e.g. on #SMI)

Prithvi Tambewagh <[email protected]>
ocfs2: fix kernel BUG in ocfs2_find_victim_chain

Jeongjun Park <[email protected]>
media: vidtv: initialize local pointers upon transfer of memory ownership

Alison Schofield <[email protected]>
tools/testing/nvdimm: Use per-DIMM device handle

Chao Yu <[email protected]>
f2fs: fix return value of f2fs_recover_fsync_data()

Xiaole He <[email protected]>
f2fs: fix age extent cache insertion skip on counter overflow

Deepanshu Kartikey <[email protected]>
f2fs: invalidate dentry cache on failed whiteout creation

Chao Yu <[email protected]>
f2fs: fix to avoid updating zero-sized extent in extent cache

Jan Prusakowski <[email protected]>
f2fs: ensure node page reads complete before f2fs_put_super() finishes

Andrey Vatoropin <[email protected]>
scsi: target: Reset t_task_cdb pointer in error case

Dai Ngo <[email protected]>
NFSD: use correct reservation type in nfsd4_scsi_fence_client

Junrui Luo <[email protected]>
scsi: aic94xx: fix use-after-free in device removal path

Tony Battersby <[email protected]>
scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"

Miaoqian Lin <[email protected]>
cpufreq: nforce2: fix reference count leak in nforce2

Rafael J. Wysocki <[email protected]>
cpuidle: governors: teo: Drop misguided target residency check

Ma Ke <[email protected]>
intel_th: Fix error handling in intel_th_output_open

Tianchu Chen <[email protected]>
char: applicom: fix NULL pointer dereference in ac_ioctl

Haoxiang Li <[email protected]>
usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc()

Udipto Goswami <[email protected]>
usb: dwc3: keep susphy enabled during exit to avoid controller faults

Miaoqian Lin <[email protected]>
usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe

Johan Hovold <[email protected]>
usb: phy: isp1301: fix non-OF device reference imbalance

Duoming Zhou <[email protected]>
usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal

Ma Ke <[email protected]>
USB: lpc32xx_udc: Fix error handling in probe

Johan Hovold <[email protected]>
phy: broadcom: bcm63xx-usbh: fix section mismatches

Colin Ian King <[email protected]>
media: pvrusb2: Fix incorrect variable used in trace message

Jeongjun Park <[email protected]>

    media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

Chen Changcheng <[email protected]>
usb: usb-storage: Maintain minimal modifications to the bcdDevice range.

Paolo Abeni <[email protected]>
mptcp: avoid deadlock on fallback while reinjecting

Paolo Abeni <[email protected]>
mptcp: schedule rtx timer only after pushing data

Laurent Pinchart <[email protected]>
media: v4l2-mem2mem: Fix outdated documentation

Byungchul Park <[email protected]>
jbd2: use a weaker annotation in journal handling

Tetsuo Handa <[email protected]>
jbd2: use a per-journal lock_class_key for jbd2_trans_commit_key

Baokun Li <[email protected]>
ext4: align max orphan file size with e2fsprogs limit

Yongjian Sun <[email protected]>
ext4: fix incorrect group number assertion in mb_check_buddy

Haibo Chen <[email protected]>
ext4: clear i_state_flags when alloc inode

Karina Yankevich <[email protected]>
ext4: xattr: fix null pointer deref in ext4_raw_inode()

Steven Rostedt <[email protected]>
ktest.pl: Fix uninitialized var in config-bisect.pl

Konstantin Komarov <[email protected]>
fs/ntfs3: fix mount failure for sparse runs in run_unpack()

Zheng Yejian <[email protected]>
kallsyms: Fix wrong "big" kernel symbol type read from procfs

Rene Rebe <[email protected]>

    floppy: fix for PAGE_SIZE != 4KB

Li Chen <[email protected]>
block: rate-limit capacity change info log

Stefan Haberland <[email protected]>
s390/dasd: Fix gendisk parent after copy pair swap

Eric Biggers <[email protected]>
lib/crypto: x86/blake2s: Fix 32-bit arg treated as 64-bit

Sarthak Garg <[email protected]>
mmc: sdhci-msm: Avoid early clock doubling during HS400 transition

Prithvi Tambewagh <[email protected]>
io_uring: fix filename leak in __io_openat_prep()

Jarkko Sakkinen <[email protected]>
KEYS: trusted: Fix a memory leak in tpm2_load_cmd

Zilin Guan <[email protected]>
cifs: Fix memory and information leak in smb3_reconfigure()

Stefano Garzarella <[email protected]>
vhost/vsock: improve RCU read sections around vhost_vsock_get()

Dan Carpenter <[email protected]>
block: rnbd-clt: Fix signedness bug in init_dev()

Chia-Lin Kao (AceLan) <[email protected]>
platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks

Daniel Wagner <[email protected]>
nvme-fc: don't hold rport lock when putting ctrl

Jinhui Guo <[email protected]>
i2c: designware: Disable SMBus interrupts to prevent storms from mis-configured firmware

Ian Rogers <[email protected]>
libperf cpumap: Fix perf_cpu_map__max for an empty/NULL map

Wenhua Lin <[email protected]>
serial: sprd: Return -EPROBE_DEFER when uart clock is not ready

Chen Changcheng <[email protected]>
usb: usb-storage: No additional quirks need to be added to the EL-R12 optical drive.

Hongyu Xie <[email protected]>
usb: xhci: limit run_graceperiod for only usb 3.0 devices

Pei Xiao <[email protected]>
iio: adc: ti_am335x_adc: Limit step_avg to valid range for gcc complains

Mark Pearson <[email protected]>
usb: typec: ucsi: Handle incorrect num_connectors capability

Lizhi Xu <[email protected]>
usbip: Fix locking bug in RT-enabled kernels

Yuezhang Mo <[email protected]>
exfat: fix remount failure in different process environments

Encrow Thorne <[email protected]>
reset: fix BIT macro reference

Li Qiang <[email protected]>
via_wdt: fix critical boot hang due to unnamed resource allocation

Bernd Schubert <[email protected]>
fuse: Invalidate the page cache after FOPEN_DIRECT_IO write

Bernd Schubert <[email protected]>
fuse: Always flush the page cache before FOPEN_DIRECT_IO write

Tony Battersby <[email protected]>
scsi: qla2xxx: Use reinit_completion on mbx_intr_comp

Tony Battersby <[email protected]>
scsi: qla2xxx: Fix initiator mode with qlini_mode=exclusive

Tony Battersby <[email protected]>
scsi: qla2xxx: Fix lost interrupts with qlini_mode=disabled

Ben Collins <[email protected]>
powerpc/addnote: Fix overflow on 32-bit builds

Josua Mayer <[email protected]>
clk: mvebu: cp110 add CLK_IGNORE_UNUSED to pcie_x10, pcie_x11 & pcie_x4

Matthias Schiffer <[email protected]>
ti-sysc: allow OMAP2 and OMAP4 timers to be reserved on AM33xx

Peng Fan <[email protected]>
firmware: imx: scu-irq: Init workqueue before request mbox channel

Jinhui Guo <[email protected]>
ipmi: Fix __scan_channels() failing to rescan channels

Jinhui Guo <[email protected]>
ipmi: Fix the race between __scan_channels() and deliver_response()

Shipei Qu <[email protected]>
ALSA: usb-mixer: us16x08: validate meter packet indices

Haotian Zhang <[email protected]>
ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path

Haotian Zhang <[email protected]>
ALSA: vxpocket: Fix resource leak in vxpocket_probe error path

Shaurya Rane <[email protected]>
net/hsr: fix NULL pointer dereference in prp_get_untagged_frame()

Andrew Jeffery <[email protected]>
dt-bindings: mmc: sdhci-of-aspeed: Switch ref to sdhci-common.yaml

Jared Kangas <[email protected]>
mmc: sdhci-esdhc-imx: add alternate ARCH_S32 dependency to Kconfig

Christophe Leroy <[email protected]>
spi: fsl-cpm: Check length parity before switching to 16 bit mode

Pengjie Zhang <[email protected]>
ACPI: CPPC: Fix missing PCC check for guaranteed_perf

Pengjie Zhang <[email protected]>
ACPI: PCC: Fix race condition by removing static qualifier

Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_can_open(): fix error handling

Christoffer Sandberg <[email protected]>
Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table

Junjie Cao <[email protected]>
Input: ti_am335x_tsc - fix off-by-one error in wire_order validation

Ping Cheng <[email protected]>
HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen

Namjae Jeon <[email protected]>
ksmbd: fix buffer validation by including null terminator size in EA length

Namjae Jeon <[email protected]>
ksmbd: Fix refcount leak when invalid session is found on session lookup

Qianchang Zhao <[email protected]>

    ksmbd: skip lock-range check on equal size to avoid size==0 underflow

Thomas Fourier <[email protected]>
block: rnbd-clt: Fix leaked ID in init_dev()

Anurag Dutta <[email protected]>
spi: cadence-quadspi: Fix clock disable on probe failure path

Juergen Gross <[email protected]>
x86/xen: Fix sparse warning in enlighten_pv.c

Brian Gerst <[email protected]>
x86/xen: Move Xen upcall handler

Marijn Suijten <[email protected]>
drm/panel: sony-td4353-jdi: Enable prepare_prev_first

Haoxiang Li <[email protected]>
MIPS: Fix a reference leak bug in ip22_check_gio()

Alexey Simakov <[email protected]>
hwmon: (tmp401) fix overflow caused by default conversion rate value

Junrui Luo <[email protected]>
hwmon: (ibmpex) fix use-after-free in high/low store

Jian Shen <[email protected]>
net: hns3: add VLAN id validation before using

Jian Shen <[email protected]>
net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx

Jian Shen <[email protected]>
net: hns3: using the num_tqps in the vf driver to apply for resources

Wei Fang <[email protected]>
net: enetc: do not transmit redirected XDP frames when the link is down

Scott Mayhew <[email protected]>
net/handshake: duplicate handshake cancellations leak socket

Shay Drory <[email protected]>
net/mlx5: Serialize firmware reset with devlink

Moshe Shemesh <[email protected]>
net/mlx5: Skip HotPlug check on sync reset using hot reset

Shay Drory <[email protected]>
net/mlx5: fw_tracer, Handle escaped percent properly

Shay Drory <[email protected]>
net/mlx5: fw_tracer, Validate format string parameters

Moshe Shemesh <[email protected]>
net/mlx5: Drain firmware reset in shutdown callback

Moshe Shemesh <[email protected]>
net/mlx5: fw reset, clear reset requested on drain_fw_reset

Gal Pressman <[email protected]>
ethtool: Avoid overflowing userspace buffer on stats query

Jason Gunthorpe <[email protected]>
iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove redundant chain validation on register store

Florian Westphal <[email protected]>
netfilter: nf_tables: allow loads only when register is initialized

Florian Westphal <[email protected]>
netfilter: nf_tables: pass context structure to nft_parse_register_load

Dan Carpenter <[email protected]>

    nfc: pn533: Fix error code in pn533_acr122_poweron_rdr()

Victor Nogueira <[email protected]>
net/sched: ets: Remove drr class from the active list if it changes to strict

Junrui Luo <[email protected]>
caif: fix integer underflow in cffrml_receive()

Slavin Liu <[email protected]>
ipvs: fix ipv4 null-ptr-deref in route error path

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: fix leaked ct in error paths

Alexey Simakov <[email protected]>
broadcom: b44: prevent uninitialized value usage

Ilya Maximets <[email protected]>
net: openvswitch: fix middle attribute validation in push_nsh() action

Ido Schimmel <[email protected]>
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats

Ido Schimmel <[email protected]>
mlxsw: spectrum_router: Fix neighbour use-after-free

Ido Schimmel <[email protected]>
mlxsw: spectrum_router: Fix possible neighbour reference count leak

Dmitry Skorodumov <[email protected]>
ipvlan: Ignore PACKET_LOOPBACK in handle_mode_l2()

Jamal Hadi Salim <[email protected]>
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

Wang Liang <[email protected]>
netrom: Fix memory leak in nr_sendmsg()

Wei Fang <[email protected]>
net: fec: ERR007885 Workaround for XDP TX path

Andreas Gruenbacher <[email protected]>
gfs2: Fix use of bio_chain

Gongwei Li <[email protected]>

    Bluetooth: btusb: Add new VID/PID 13d3/3533 for RTL8821CE

Chingbin Li <[email protected]>

    Bluetooth: btusb: Add new VID/PID 2b89/6275 for RTL8761BUV

Qianchang Zhao <[email protected]>
ksmbd: vfs: fix race on m_flags in vfs_cache

Namjae Jeon <[email protected]>
ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

ChenXiaoSong <[email protected]>
smb/server: fix return value of smb2_ioctl()

Andreas Gruenbacher <[email protected]>
gfs2: fix remote evict for read-only filesystems

Qu Wenruo <[email protected]>
btrfs: scrub: always update btrfs_scrub_progress::last_physical

Hans de Goede <[email protected]>
wifi: brcmfmac: Add DMI nvram filename quirk for Acer A1 840 tablet

Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/073

Tetsuo Handa <[email protected]>
hfsplus: Verify inode mode when loading from disk

Yang Chenzhi <[email protected]>
hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create

Viacheslav Dubeyko <[email protected]>
hfsplus: fix volume corruption issue for generic/070

Pedro Demarchi Gomes <[email protected]>
ntfs: set dummy blocksize to read boot_block when mounting

Mikhail Malyshev <[email protected]>
kbuild: Use objtree for module signing key path

Konstantin Komarov <[email protected]>
fs/ntfs3: Support timestamps prior to epoch

Song Liu <[email protected]>
livepatch: Match old_sympos 0 and 1 in klp_find_func()

Aboorva Devarajan <[email protected]>
cpuidle: menu: Use residency threshold in polling state override decisions

Shuhao Fu <[email protected]>
cpufreq: s5pv210: fix refcount leak

Hal Feng <[email protected]>
cpufreq: dt-platdev: Add JH7110S SOC to the allowlist

Sakari Ailus <[email protected]>
ACPI: property: Use ACPI functions in acpi_graph_get_next_endpoint() only

Cryolitia PukNgae <[email protected]>
ACPICA: Avoid walking the Namespace if start_node is NULL

Peter Zijlstra <[email protected]>
x86/ptrace: Always inline trivial accessors

Peter Zijlstra <[email protected]>
sched/fair: Revert max_newidle_lb_cost bump

Doug Berger <[email protected]>
sched/deadline: only set free_cpus for online runqueues

George Kennedy <[email protected]>
perf/x86/amd: Check event before enable to avoid GPF

Joanne Koong <[email protected]>
iomap: account for unaligned end offsets when truncating read range

Joanne Koong <[email protected]>
iomap: adjust read range correctly for non-block-aligned positions

Deepanshu Kartikey <[email protected]>
btrfs: fix memory leak of fs_devices in degraded seed device path

Ondrej Mosnacek <[email protected]>
bpf, arm64: Do not audit capability check in do_jit()

Qu Wenruo <[email protected]>
btrfs: fix a potential path leak in print_data_reloc_error()

Filipe Manana <[email protected]>
btrfs: do not skip logging new dentries when logging a new name

Xin Long <[email protected]>
ipv6: add exception routes to GC list in rt6_insert_exception

Eric Dumazet <[email protected]>
ipv6: avoid possible NULL deref in modify_prefix_route()

Junrui Luo <[email protected]>
ALSA: dice: fix buffer overflow in detect_stream_formats()

Diogo Ivo <[email protected]>
usb: phy: Initialize struct usb_phy list_head

Haotien Hsu <[email protected]>
usb: gadget: tegra-xudc: Always reinitialize data toggle when clear halt

Thangaraj Samynathan <[email protected]>
net: lan743x: Allocate rings outside ZONE_DMA

Huacai Chen <[email protected]>
LoongArch: Add machine_kexec_mask_interrupts() implementation

Dmitry Antipov <[email protected]>
ocfs2: fix memory leak in ocfs2_merge_rec_left()

Dan Carpenter <[email protected]>
irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()

Mauro Carvalho Chehab <[email protected]>
efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs

Mauro Carvalho Chehab <[email protected]>
efi/cper: Adjust infopfx size to accept an extra space

Mauro Carvalho Chehab <[email protected]>
efi/cper: Add a new helper function to print bitmasks

Haotian Zhang <[email protected]>
dm log-writes: Add missing set_freezable() for freezable kthread

Alexey Simakov <[email protected]>
dm-raid: fix possible NULL dereference with undefined raid type

Mohamed Khalfella <[email protected]>

    block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock

Liyuan Pang <[email protected]>
ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()

Junrui Luo <[email protected]>
ALSA: firewire-motu: add bounds check in put_user loop for DSP events

Haotian Zhang <[email protected]>
rtc: gamecube: Check the return value of ioremap()

Andres J Rosa <[email protected]>
ALSA: uapi: Fix typo in asound.h comment

Dave Kleikamp <[email protected]>
dma/pool: eliminate alloc_pages warning in atomic_pool_expand

Junrui Luo <[email protected]>
ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

Israel Rukshin <[email protected]>
nvme-auth: use kvfree() for memory allocated with kvcalloc()

shechenglong <[email protected]>
block: fix comment for op_is_zone_mgmt() to include RESET_ALL

Cong Zhang <[email protected]>
blk-mq: Abort suspend when wakeup events are pending

Shengjiu Wang <[email protected]>
ASoC: ak5558: Disable regulator when error happens

Shengjiu Wang <[email protected]>
ASoC: ak4458: Disable regulator when error happens

Haotian Zhang <[email protected]>
ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure()

Anton Khirnov <[email protected]>
platform/x86: asus-wmi: use brightness_set_blocking() for kbd led

Armin Wolf <[email protected]>
fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()

Trond Myklebust <[email protected]>
NFS: Fix inheritance of the block sizes when automounting

Trond Myklebust <[email protected]>

    Expand the type of nfs_fattr->valid

Trond Myklebust <[email protected]>
NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags

Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when mounting nfs"

Trond Myklebust <[email protected]>
Revert "nfs: clear SB_RDONLY before getting superblock"

Trond Myklebust <[email protected]>
Revert "nfs: ignore SB_RDONLY when remounting nfs"

Jonathan Curley <[email protected]>
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

Trond Myklebust <[email protected]>
NFS: Initialise verifiers for visible dentries in nfs_atomic_open()

Trond Myklebust <[email protected]>
NFS: Initialise verifiers for visible dentries in readdir and lookup

Armin Wolf <[email protected]>
fs/nls: Fix utf16 to utf8 conversion

Trond Myklebust <[email protected]>
NFS: Avoid changing nlink when file removes and attribute updates race

Eric Sandeen <[email protected]>
9p: fix cache/debug options printing in v9fs_show_options

Abdun Nihaal <[email protected]>
fbdev: ssd1307fb: fix potential page leak in ssd1307fb_probe()

Haotian Zhang <[email protected]>
pinctrl: single: Fix incorrect type for error return variable

Matthijs Kooijman <[email protected]>
pinctrl: single: Fix PIN_CONFIG_BIAS_DISABLE handling

Namhyung Kim <[email protected]>
perf tools: Fix split kallsyms DSO counting

Xiang Mei <[email protected]>
net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

Johan Hovold <[email protected]>
clk: keystone: fix compile testing

Yu Kuai <[email protected]>
md/raid5: fix IO hang when array is broken with IO inflight

Alexandru Gagniuc <[email protected]>
remoteproc: qcom_q6v5_wcss: fix parsing of qcom,halt-regs

Ivan Stepchenko <[email protected]>
mtd: lpddr_cmds: fix signed shifts in lpddr_cmds

Hangbin Liu <[email protected]>
selftests: bonding: add delay before each xvlan_over_bond connectivity check

Etienne Champetier <[email protected]>
selftests: bonding: add ipvlan over bond testing

Benjamin Poirier <[email protected]>
selftests: bonding: Add more missing config options

Jakub Kicinski <[email protected]>
selftests: bonding: add missing build configs

Haotian Zhang <[email protected]>
mtd: rawnand: renesas: Handle devm_pm_runtime_enable() errors

Alexey Kodanev <[email protected]>
net: stmmac: fix rx limit check in stmmac_rx_zc()

Fernando Fernandez Mancera <[email protected]>
netfilter: nft_connlimit: update the count if add was skipped

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: rework API to use sk_buff directly

Pablo Neira Ayuso <[email protected]>
netfilter: flowtable: check for maximum number of encapsulations in bridge vlan

Ilias Stamatis <[email protected]>
Reinstate "resource: avoid unnecessary lookups in find_next_iomem_res()"

Andy Shevchenko <[email protected]>
resource: introduce is_type_match() helper and use it

Andy Shevchenko <[email protected]>
resource: replace open coded resource_intersection()

Andy Shevchenko <[email protected]>
resource: Reuse for_each_resource() macro

sparkhuang <[email protected]>
regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex

Marek Szyprowski <[email protected]>
ARM: dts: samsung: exynos4412-midas: turn off SDIO WLAN chip during system suspend

Marek Szyprowski <[email protected]>
ARM: dts: samsung: exynos4210-trats: turn off SDIO WLAN chip during system suspend

Marek Szyprowski <[email protected]>
ARM: dts: samsung: exynos4210-i9100: turn off SDIO WLAN chip during system suspend

Marek Szyprowski <[email protected]>
ARM: dts: samsung: universal_c210: turn off SDIO WLAN chip during system suspend

Cezary Rojewski <[email protected]>
ASoC: Intel: catpt: Fix error path in hw_params()

Alok Tiwari <[email protected]>
vdpa/pds: use %pe for ERR_PTR() in event handler registration

Michael S. Tsirkin <[email protected]>
virtio: fix virtqueue_set_affinity() docs

Michael S. Tsirkin <[email protected]>
virtio: fix whitespace in virtio_config_ops

Michael S. Tsirkin <[email protected]>
virtio: fix typo in virtio_device_ready() comment

Alok Tiwari <[email protected]>
virtio_vdpa: fix misleading return in void function

Yongjian Sun <[email protected]>
ext4: improve integrity checking in __mb_check_buddy by enhancing order-0 validation

Kemeng Shi <[email protected]>
ext4: remove unused return value of __mb_check_buddy

Kevin Brodsky <[email protected]>
ublk: prevent invalid access with DEBUG

Caleb Sander Mateos <[email protected]>
ublk: complete command synchronously on error

Ming Lei <[email protected]>
ublk: make sure io cmd handled in submitter task context

René Rebe <[email protected]>
ACPI: processor_core: fix map_x2apic_id for amd-pstate on am4

Haotian Zhang <[email protected]>
hwmon: sy7636a: Fix regulator_enable resource leak on error path

Dan Carpenter <[email protected]>
drm/amd/display: Fix logical vs bitwise bug in get_embedded_panel_info_v2_1()

Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: clear the channel status control memory

Jacob Moroni <[email protected]>
RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY

Sindhu Devale <[email protected]>
RDMA/irdma: Add support to re-register a memory region

Krzysztof Czurylo <[email protected]>
RDMA/irdma: Fix data race in irdma_free_pble

Krzysztof Czurylo <[email protected]>
RDMA/irdma: Fix data race in irdma_sc_ccq_arm

Stephan Gerhold <[email protected]>
iommu/arm-smmu-qcom: Enable use of all SMR groups when running bare-metal

Randy Dunlap <[email protected]>
backlight: lp855x: Fix lp855x.h kernel-doc warnings

Luca Ceresoli <[email protected]>
backlight: led-bl: Add devlink to supplier LEDs

Ria Thomas <[email protected]>
wifi: ieee80211: correct FILS status codes

Christoph Hellwig <[email protected]>
iomap: always run error completions in user context

Christoph Hellwig <[email protected]>
iomap: factor out a iomap_dio_done helper

Timur Tabi <[email protected]>
drm/nouveau: restrict the flush page to a 32-bit address

Shawn Lin <[email protected]>
PCI: dwc: Fix wrong PORT_LOGIC_LTSSM_STATE_MASK definition

Filipe Manana <[email protected]>
btrfs: fix leaf leak in an error path in btrfs_del_items()

Jianglei Nie <[email protected]>
staging: fbtft: core: fix potential memory leak in fbtft_probe_common()

Dinh Nguyen <[email protected]>
firmware: stratix10-svc: fix make htmldocs warning for stratix10_svc

Zilin Guan <[email protected]>

    mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add()

Selvin Xavier <[email protected]>
RDMA/bnxt_re: Fix the inline size for GenP7 devices

Fangyu Yu <[email protected]>
RISC-V: KVM: Fix guest page fault within HLV* instructions

Haotian Zhang <[email protected]>
crypto: ccree - Correctly handle return of sg_nents_for_len

Haotian Zhang <[email protected]>
crypto: starfive - Correctly handle return of sg_nents_for_len

Matt Bobrowski <[email protected]>
selftests/bpf: Improve reliability of test_perf_branches_no_hw()

Matt Bobrowski <[email protected]>
selftests/bpf: skip test_perf_branches_hw() on unsupported platforms

Gopi Krishna Menon <[email protected]>
usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE

Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during suspend if set as peripheral

Jisheng Zhang <[email protected]>
usb: dwc2: fix hang during shutdown if set as peripheral

Jisheng Zhang <[email protected]>
usb: dwc2: disable platform lowlevel hw resources during shutdown

Oliver Neukum <[email protected]>
usb: chaoskey: fix locking for O_NONBLOCK

Zhao Yipeng <[email protected]>
ima: Handle error code returned by ima_filter_rule_match()

Seungjin Bae <[email protected]>
wifi: rtl818x: rtl8187: Fix potential buffer underflow in rtl8187_rx_cb()

Chen Ridong <[email protected]>
cpuset: Treat cpusets in attaching as populated

Alexander Dahl <[email protected]>
net: phy: adin1100: Fix software power-down ready condition

Christophe JAILLET <[email protected]>
phy: renesas: rcar-gen3-usb2: Fix an error handling path in rcar_gen3_phy_usb2_probe()

Haotian Zhang <[email protected]>
mfd: mt6358-irq: Fix missing irq_domain_remove() in error path

Haotian Zhang <[email protected]>
mfd: mt6397-irq: Fix missing irq_domain_remove() in error path

Chien Wong <[email protected]>
wifi: mac80211: fix CMAC functions not handling errors

Johannes Berg <[email protected]>
wifi: mac80211: remove RX_DROP_UNUSABLE

Zilin Guan <[email protected]>
scsi: qla2xxx: Fix improper freeing of purex item

Uwe Kleine-König <[email protected]>
pwm: bcm2835: Make sure the channel is enabled after pwm_request()

Leo Yan <[email protected]>
perf arm_spe: Fix memset subclass in operation

Leo Yan <[email protected]>
perf arm-spe: Extend branch operations

Fernando Fernandez Mancera <[email protected]>
ipv6: clear RA flags when adding a static route

Kui-Feng Lee <[email protected]>
net/ipv6: Remove expired routes with a separated list of routes.

Jay Liu <[email protected]>
drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue

Edward Adam Davis <[email protected]>
fs/ntfs3: Prevent memory leaks in add sub record

Edward Adam Davis <[email protected]>
fs/ntfs3: out1 also needs to put mi

Ritesh Harjani (IBM) <[email protected]>
powerpc/64s/ptdump: Fix kernel_hash_pagetable dump for ISA v3.00 HPTE format

Ritesh Harjani (IBM) <[email protected]>
powerpc/64s/hash: Restrict stress_hpt_struct memblock region to within RMA limit

Pu Lehui <[email protected]>

    bpf: Fix invalid prog->stats access when update_effective_progs fails

Jose Fernandez <[email protected]>
bpf: Improve program stats run-time calculation

Abdun Nihaal <[email protected]>
wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring()

Dmitry Baryshkov <[email protected]>
drm/msm/a2xx: stop over-complaining about the legacy firmware

Sergey Bashirov <[email protected]>
NFSD/blocklayout: Fix minlength check in proc_layoutget

Al Viro <[email protected]>
tracefs: fix a leak in eventfs_create_events_dir()

Haotian Zhang <[email protected]>
watchdog: starfive: Fix resource leak in probe error path

Haotian Zhang <[email protected]>
watchdog: wdat_wdt: Fix ACPI table leak in probe function

Martin KaFai Lau <[email protected]>

    bpf: Check skb->transport_header is set in bpf_skb_check_mtu

Alexei Starovoitov <[email protected]>
selftests/bpf: Fix failure paths in send_signal test

Menglong Dong <[email protected]>
bpf: Handle return value of ftrace_set_filter_ip in register_fentry

Rene Rebe <[email protected]>
ps3disk: use memcpy_{from,to}_bvec index

FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: Add eeprom vcc-supply for Radxa ROCK 5A

FUKAUMI Naoki <[email protected]>
arm64: dts: rockchip: Move the EEPROM to correct I2C bus on Radxa ROCK 5A

Siddharth Vadapalli <[email protected]>
PCI: keystone: Exit ks_pcie_probe() for invalid mode

Leon Hwang <[email protected]>
bpf: Free special fields when update [lru_,]percpu_hash maps

Haotian Zhang <[email protected]>
leds: netxbig: Fix GPIO descriptor leak in error paths

Haotian Zhang <[email protected]>
scsi: sim710: Fix resource leak by adding missing ioport_unmap() calls

Haotian Zhang <[email protected]>
ACPI: property: Fix fwnode refcount leak in acpi_fwnode_graph_parse_endpoint()

Dmitry Antipov <[email protected]>
ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent()

Andy Shevchenko <[email protected]>
lib/vsprintf: Check pointer before dereferencing in time_and_date()

Haotian Zhang <[email protected]>
clk: renesas: r9a06g032: Fix memory leak in error path

Leo Yan <[email protected]>
coresight: etm4x: Add context synchronization before enabling trace

Leo Yan <[email protected]>
coresight: etm4x: Extract the trace unit controlling

Leo Yan <[email protected]>
coresight: etm4x: Correct polling IDLE bit

Zheng Qixing <[email protected]>
nbd: defer config unlock in nbd_genl_connect

Abdun Nihaal <[email protected]>
wifi: cw1200: Fix potential memory leak in cw1200_bh_rx_helper()

Long Li <[email protected]>
macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse

Christophe Leroy <[email protected]>
powerpc/32: Fix unpaired stwcx. on interrupt exit

Gautham R. Shenoy <[email protected]>
cpufreq/amd-pstate: Call cppc_set_auto_sel() only for online CPUs

Bean Huo <[email protected]>
scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string_desc()

Edward Adam Davis <[email protected]>
ntfs3: init run lock for extend inode

Jihed Chaibi <[email protected]>
ARM: dts: stm32: stm32mp157c-phycore: Fix STMPE811 touchscreen node properties

Ma Ke <[email protected]>
RDMA/rtrs: server: Fix error handling in get_or_create_srv

Manivannan Sadhasivam <[email protected]>
dt-bindings: PCI: amlogic: Fix the register name of the DBI region

Johan Hovold <[email protected]>
staging: most: remove broken i2c driver

Uwe Kleine-König <[email protected]>
staging: most: i2c: Drop explicit initialization of struct i2c_device_id::driver_data to 0

Mike McGowen <[email protected]>
scsi: smartpqi: Fix device resources accessed after device removal

Haotian Zhang <[email protected]>
scsi: stex: Fix reboot_notifier leak in probe error path

Zheng Qixing <[email protected]>
nbd: defer config put in recv_work

Gabor Juhos <[email protected]>
regulator: core: disable supply if enabling main regulator fails

Dapeng Mi <[email protected]>
perf/x86/intel: Correct large PEBS flag check

Zhang Yi <[email protected]>
ext4: correct the checking of quota files before moving extents

Haotian Zhang <[email protected]>
mfd: da9055: Fix missing regmap_del_irq_chip() in error path

Usama Arif <[email protected]>
efi/libstub: Fix page table access in 5-level to 4-level paging transition

Usama Arif <[email protected]>
x86/boot: Fix page table access in 5-level to 4-level paging transition

Jihed Chaibi <[email protected]>
ARM: dts: omap3: n900: Correct obsolete TWL4030 power compatible

Jihed Chaibi <[email protected]>
ARM: dts: omap3: beagle-xm: Correct obsolete TWL4030 power compatible

Yegor Yefremov <[email protected]>
ARM: dts: am335x-netcom-plus-2xx: add missing GPIO labels

Vishwaroop A <[email protected]>
spi: tegra210-quad: Fix timeout handling

Tingmao Wang <[email protected]>
fs/9p: Don't open remote file with APPEND mode when writeback cache is used

Bart Van Assche <[email protected]>
scsi: target: Do not write NUL characters into ASCII configfs output

Ahelenia Ziemiańska <[email protected]>
power: supply: apm_power: only unset own apm_get_power_status

Ivan Abramov <[email protected]>
power: supply: wm831x: Check wm831x_set_bits() return value

Murad Masimov <[email protected]>
power: supply: rt9467: Prevent using uninitialized local variable in rt9467_set_value_from_ranges()

Ivan Abramov <[email protected]>
power: supply: rt9467: Return error on failure in rt9467_set_value_from_ranges()

Ivan Abramov <[email protected]>
power: supply: cw2015: Check devm_delayed_work_autocancel() return code

Shuai Xue <[email protected]>
perf record: skip synthesize event when open evsel failed

Namhyung Kim <[email protected]>
perf lock contention: Load kernel map before lookup

Ian Rogers <[email protected]>
perf maps: Add maps__load_first()

Kuan-Wei Chiu <[email protected]>
interconnect: debugfs: Fix incorrect error handling for NULL path

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: msm8996: add interconnect paths to USB2 controller

Dmitry Baryshkov <[email protected]>
interconnect: qcom: msm8996: add missing link to SLAVE_USB_HS

Stanley Chu <[email protected]>
i3c: master: svc: Prevent incomplete IBI transaction

Frank Li <[email protected]>
i3c: fix refcount inconsistency in i3c_master_register

Jarkko Nikula <[email protected]>
i3c: master: Inherit DMA masks and parameters from parent device

Haotian Zhang <[email protected]>
pinctrl: stm32: fix hwspinlock resource leak in probe function

Haotian Zhang <[email protected]>
soc: qcom: smem: fix hwspinlock resource leak in probe error paths

Benjamin Berg <[email protected]>
tools/nolibc/stdio: let perror work when NOLIBC_IGNORE_ERRNO is set

Tengda Wu <[email protected]>
x86/dumpstack: Prevent KASAN false positive warnings in __show_regs()

Peter Zijlstra <[email protected]>
task_work: Fix NMI race condition

Haotian Zhang <[email protected]>
mtd: rawnand: lpc32xx_slc: fix GPIO descriptor leak on probe error and remove

Aryan Srivastava <[email protected]>
mtd: nand: relax ECC parameter validation check

Aryan Srivastava <[email protected]>
Revert "mtd: rawnand: marvell: fix layouts"

Wolfram Sang <[email protected]>
ARM: dts: renesas: r9a06g032-rzn1d400-db: Drop invalid #cells properties

Wolfram Sang <[email protected]>
ARM: dts: renesas: gose: Remove superfluous port property

Zhu Yanjun <[email protected]>

    RDMA/rxe: Fix null deref on srq->rq.queue after resize failure

Kuniyuki Iwashima <[email protected]>
sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock().

Horatiu Vultur <[email protected]>
phy: mscc: Fix PTP for VSC8574 and VSC8572

Gergo Koteles <[email protected]>
arm64: dts: qcom: sdm845-oneplus: Correct gpio used for slider

Peng Fan <[email protected]>
firmware: imx: scu-irq: fix OF node leak in

Randolph Sapp <[email protected]>
arm64: dts: ti: k3-am62p: Fix memory ranges for GPU

Heiko Carstens <[email protected]>
s390/ap: Don't leak debug feature files if AP instructions are not available

Heiko Carstens <[email protected]>
s390/smp: Fix fallback CPU detection

Baochen Qiang <[email protected]>
wifi: ath11k: fix peer HE MCS assignment

nieweiqiang <[email protected]>
crypto: hisilicon/qm - restore original qos values

Thorsten Blum <[email protected]>
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id

Luca Weiss <[email protected]>
clk: qcom: camcc-sm6350: Fix PLL config of PLL2

Vladimir Zapolskiy <[email protected]>
clk: qcom: camcc-sm6350: Specify Titan GDSC power domain as a parent to other

Li Qiang <[email protected]>
uio: uio_fsl_elbc_gpcm:: Add null pointer check to uio_fsl_elbc_gpcm_probe

Geert Uytterhoeven <[email protected]>
PCI: rcar-gen2: Drop ARM dependency from PCI_RCAR_GEN2

Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw702x: remove off-board sdhc1

Tim Harvey <[email protected]>
arm64: dts: imx8mp-venice-gw702x: remove off-board uart

Tim Harvey <[email protected]>
arm64: dts: imx8mm-venice-gw72xx: remove unused sdhc1 pinctrl

Tim Harvey <[email protected]>
arm64: dts: freescale: imx8mp-venice-gw7905-2x: remove duplicate usdhc1 props

Francesco Lavra <[email protected]>
iio: imu: st_lsm6dsx: Fix measurement unit for odr struct member

Xuanqiang Luo <[email protected]>
inet: Avoid ehash lookup race in inet_ehash_insert()

Xuanqiang Luo <[email protected]>
rculist: Add hlist_nulls_replace_rcu() and hlist_nulls_replace_init_rcu()

Sidharth Seela <[email protected]>
ntfs3: Fix uninit buffer allocated by __getname()

Raphael Pinsonneault-Thibeault <[email protected]>
ntfs3: fix uninit memory after failed mi_read in mi_format_new

Herbert Xu <[email protected]>
crypto: authenc - Correctly pass EINPROGRESS back up to the caller

Johan Hovold <[email protected]>
irqchip/qcom-irq-combiner: Fix section mismatch

Johan Hovold <[email protected]>
irqchip/imx-mu-msi: Fix section mismatch

Johan Hovold <[email protected]>
irqchip/irq-brcmstb-l2: Fix section mismatch

Johan Hovold <[email protected]>
irqchip/irq-bcm7120-l2: Fix section mismatch

Johan Hovold <[email protected]>
irqchip/irq-bcm7038-l1: Fix section mismatch

Fernand Sieber <[email protected]>
sched/fair: Forfeit vruntime on yield

Josh Poimboeuf <[email protected]>
objtool: Fix weak symbol detection

Dylan Hatch <[email protected]>

    objtool: Fix standalone --hacks=jump_label

Mavroudis Chatzilazaridis <[email protected]>
HID: logitech-hidpp: Do not assume FAP in hidpp_send_message_sync()

Marek Vasut <[email protected]>
clk: renesas: cpg-mssr: Read back reset registers to assure values latched

Thierry Bultel <[email protected]>
clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register

Geert Uytterhoeven <[email protected]>
clk: renesas: Use str_on_off() helper

Claudiu Beznea <[email protected]>
clk: renesas: rzg2l: Use %x format specifier to print CLK_ON_R()

Claudiu Beznea <[email protected]>
clk: renesas: rzg2l: Remove critical area

Claudiu Beznea <[email protected]>
clk: renesas: rzg2l: Simplify the logic in rzg2l_mod_clock_endisable()

Marek Vasut <[email protected]>
clk: renesas: cpg-mssr: Add missing 1ms delay into reset toggle callback

Seungjin Bae <[email protected]>
USB: Fix descriptor count when handling invalid MBIM extended descriptor

Janusz Krzysztofik <[email protected]>
drm/vgem-fence: Fix potential deadlock on release

Guido Günther <[email protected]>
drm/panel: visionox-rm69299: Don't clear all mode flags

Mainak Sen <[email protected]>
gpu: host1x: Fix race in syncpt alloc/free

Konstantin Andreev <[email protected]>
smack: fix bug: unprivileged task can create labels

Navaneeth K <[email protected]>
staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing

Navaneeth K <[email protected]>
staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing

Navaneeth K <[email protected]>
staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser

Nikita Zhandarovich <[email protected]>
comedi: check device's attached status in compat ioctls

Nikita Zhandarovich <[email protected]>
comedi: multiq3: sanitize config options in multiq3_attach()

Ian Abbott <[email protected]>
comedi: c6xdigio: Fix invalid PNP driver unregistration

Zenm Chen <[email protected]>

    wifi: rtw88: Add USB ID 2001:3329 for D-Link AC13U rev. A1

Linus Torvalds <[email protected]>
samples: work around glibc redefining some of our defines wrong

Huacai Chen <[email protected]>
LoongArch: Mask all interrupts during kexec/kdump

Naoki Ueki <[email protected]>
HID: elecom: Add support for ELECOM M-XT3URBK (018F)

Antheas Kapenekakis <[email protected]>
platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally

Antheas Kapenekakis <[email protected]>
platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list

Jia Ston <[email protected]>
platform/x86: huawei-wmi: add keys for HONOR models

April Grimoire <[email protected]>
HID: apple: Add SONiX AK870 PRO to non_apple_keyboards quirk list

Armin Wolf <[email protected]>
platform/x86: acer-wmi: Ignore backlight event

Praveen Talari <[email protected]>
pinctrl: qcom: msm: Fix deadlock in pinmux configuration

Keith Busch <[email protected]>
nvme: fix admin request_queue lifetime

Mario Limonciello (AMD) <[email protected]>
HID: hid-input: Extend Elan ignore battery quirk to USB

Tetsuo Handa <[email protected]>
bfs: Reconstruct file type when loading from disk

Lushih Hsieh <[email protected]>
ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series

Yiqi Sun <[email protected]>
smb: fix invalid username check in smb3_fs_context_parse_param()

Max Chou <[email protected]>
Bluetooth: btrtl: Avoid loading the config file on security chips

Ian Forbes <[email protected]>
drm/vmwgfx: Use kref in vmw_bo_dirty

Robin Gong <[email protected]>
spi: imx: keep dma request disabled before dma transfer setup

Alvaro Gamez Machado <[email protected]>
spi: xilinx: increase number of retries before declaring stall

Song Liu <[email protected]>
ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()

Johan Hovold <[email protected]>
USB: serial: kobil_sct: fix TIOCMBIS and TIOCMBIC

Johan Hovold <[email protected]>
USB: serial: belkin_sa: fix TIOCMBIS and TIOCMBIC

Magne Bruno <[email protected]>
serial: add support of CPCI cards

Johan Hovold <[email protected]>
USB: serial: ftdi_sio: match on interface number for jtag

Fabio Porcedda <[email protected]>

    USB: serial: option: move Telit 0x10c7 composition in the right place

Fabio Porcedda <[email protected]>
USB: serial: option: add Telit Cinterion FE910C04 new compositions

Slark Xiao <[email protected]>
USB: serial: option: add Foxconn T99W760

Omar Sandoval <[email protected]>
KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced

Nikita Zhandarovich <[email protected]>
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()

Alexey Nepomnyashih <[email protected]>
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()

Alexander Sverdlin <[email protected]>
locking/spinlock/debug: Fix data-race in do_raw_write_lock

Qianchang Zhao <[email protected]>
ksmbd: ipc: fix use-after-free in ipc_msg_send_request

Deepanshu Kartikey <[email protected]>
ext4: refresh inline data size before write operations

Ye Bin <[email protected]>
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted

Bagas Sanjaya <[email protected]>
Documentation: process: Also mention Sasha Levin as stable tree maintainer

Stefan Kalscheuer <[email protected]>
leds: spi-byte: Use devm_led_classdev_register_ext()

Sabrina Dubroca <[email protected]>
xfrm: flush all states in xfrm_state_fini

Sabrina Dubroca <[email protected]>
xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added

Sabrina Dubroca <[email protected]>
Revert "xfrm: destroy xfrm_state synchronously on net exit path"

Sabrina Dubroca <[email protected]>

    xfrm: delete x->tunnel as we delete x

-------------

Diffstat:

 .../devicetree/bindings/mmc/aspeed,sdhci.yaml      |   2 +-
 .../devicetree/bindings/pci/amlogic,axg-pcie.yaml  |   6 +-
 Documentation/driver-api/tty/tty_port.rst          |   5 +-
 Documentation/process/2.Process.rst                |   6 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/microchip/sama5d2.dtsi           |  10 +-
 arch/arm/boot/dts/microchip/sama7g5.dtsi           |   4 +-
 arch/arm/boot/dts/renesas/r8a7793-gose.dts         |   1 -
 .../arm/boot/dts/renesas/r9a06g032-rzn1d400-db.dts |   2 -
 arch/arm/boot/dts/samsung/exynos4210-i9100.dts     |   1 +
 arch/arm/boot/dts/samsung/exynos4210-trats.dts     |   1 +
 .../boot/dts/samsung/exynos4210-universal_c210.dts |   1 +
 arch/arm/boot/dts/samsung/exynos4412-midas.dtsi    |   1 +
 .../dts/st/stm32mp157c-phycore-stm32mp15-som.dtsi  |   8 +-
 .../boot/dts/ti/omap/am335x-netcom-plus-2xx.dts    |   8 +-
 arch/arm/boot/dts/ti/omap/omap3-beagle-xm.dts      |   2 +-
 arch/arm/boot/dts/ti/omap/omap3-n900.dts           |   2 +-
 arch/arm/include/asm/word-at-a-time.h              |  10 +-
 .../boot/dts/freescale/imx8mm-venice-gw72xx.dtsi   |  11 -
 .../boot/dts/freescale/imx8mp-venice-gw702x.dtsi   |  51 ---
 .../boot/dts/freescale/imx8mp-venice-gw72xx.dtsi   |  11 -
 arch/arm64/boot/dts/qcom/msm8996.dtsi              |   3 +
 .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi |   4 +-
 arch/arm64/boot/dts/rockchip/rk3588s-rock-5a.dts   |  15 +-
 arch/arm64/boot/dts/ti/k3-am62p.dtsi               |   2 +-
 arch/arm64/boot/dts/ti/k3-j721e-sk.dts             |  12 +-
 arch/arm64/net/bpf_jit_comp.c                      |   2 +-
 arch/loongarch/include/asm/pgtable.h               |   4 +-
 arch/loongarch/kernel/machine_kexec.c              |  24 ++
 arch/loongarch/kernel/mcount_dyn.S                 |  14 +-
 arch/loongarch/kernel/relocate.c                   |   4 +-
 arch/loongarch/kernel/setup.c                      |   8 +-
 arch/loongarch/kernel/switch.S                     |   4 +-
 arch/loongarch/net/bpf_jit.c                       |  18 +
 arch/loongarch/net/bpf_jit.h                       |  26 ++
 arch/loongarch/pci/pci.c                           |   2 +
 arch/mips/sgi-ip22/ip22-gio.c                      |   3 +-
 arch/parisc/kernel/asm-offsets.c                   |   2 +
 arch/parisc/kernel/entry.S                         |  16 +-
 arch/powerpc/boot/addnote.c                        |   7 +-
 arch/powerpc/include/asm/book3s/32/tlbflush.h      |   5 +-
 arch/powerpc/include/asm/book3s/64/mmu-hash.h      |   1 -
 arch/powerpc/include/asm/kfence.h                  |  11 +-
 arch/powerpc/kernel/entry_32.S                     |  10 +-
 arch/powerpc/kernel/process.c                      |   5 -
 arch/powerpc/kexec/core_64.c                       |  19 ++
 arch/powerpc/mm/book3s32/tlb.c                     |   9 +
 arch/powerpc/mm/book3s64/hash_utils.c              |  10 +-
 arch/powerpc/mm/book3s64/internal.h                |   2 -
 arch/powerpc/mm/book3s64/mmu_context.c             |   2 -
 arch/powerpc/mm/book3s64/radix_pgtable.c           |  84 ++++-
 arch/powerpc/mm/book3s64/slb.c                     |  88 -----
 arch/powerpc/mm/init-common.c                      |   3 +
 arch/powerpc/mm/ptdump/hashpagetable.c             |   6 +
 arch/powerpc/platforms/pseries/cmm.c               |   5 +-
 arch/riscv/kvm/vcpu_insn.c                         |  22 ++
 arch/s390/include/uapi/asm/ipl.h                   |   1 +
 arch/s390/kernel/ipl.c                             |  48 ++-
 arch/s390/kernel/smp.c                             |   1 +
 arch/x86/boot/compressed/pgtable_64.c              |  11 +-
 arch/x86/crypto/blake2s-core.S                     |   4 +-
 arch/x86/entry/common.c                            |  72 ----
 arch/x86/events/amd/core.c                         |   7 +-
 arch/x86/events/intel/core.c                       |   4 +-
 arch/x86/include/asm/kvm_host.h                    |   9 +
 arch/x86/include/asm/ptrace.h                      |  20 +-
 arch/x86/kernel/cpu/microcode/amd.c                |   2 +-
 arch/x86/kernel/dumpstack.c                        |  23 +-
 arch/x86/kvm/lapic.c                               |  32 +-
 arch/x86/kvm/svm/nested.c                          |  26 +-
 arch/x86/kvm/svm/svm.c                             | 176 +++++-----
 arch/x86/kvm/svm/svm.h                             |   8 +-
 arch/x86/kvm/vmx/nested.c                          |   2 +-
 arch/x86/kvm/vmx/vmx.c                             |   2 +-
 arch/x86/kvm/vmx/vmx.h                             |   1 +
 arch/x86/kvm/x86.c                                 |  46 ++-
 arch/x86/xen/enlighten_pv.c                        |  69 ++++
 block/blk-mq.c                                     | 120 +++++--
 block/genhd.c                                      |   2 +-
 crypto/af_alg.c                                    |   5 +-
 crypto/algif_hash.c                                |   3 +-
 crypto/algif_rng.c                                 |   3 +-
 crypto/asymmetric_keys/asymmetric_type.c           |  12 +-
 crypto/authenc.c                                   |  75 +++--
 crypto/seqiv.c                                     |   8 +-
 drivers/acpi/acpi_pcc.c                            |   2 +-
 drivers/acpi/acpica/nswalk.c                       |   9 +-
 drivers/acpi/apei/ghes.c                           |  16 +-
 drivers/acpi/cppc_acpi.c                           |   3 +-
 drivers/acpi/processor_core.c                      |   2 +-
 drivers/acpi/property.c                            |   9 +-
 drivers/amba/tegra-ahb.c                           |   1 +
 drivers/base/power/runtime.c                       |  22 +-
 drivers/block/floppy.c                             |   2 +-
 drivers/block/nbd.c                                |   5 +-
 drivers/block/ps3disk.c                            |   4 +
 drivers/block/rnbd/rnbd-clt.c                      |  13 +-
 drivers/block/rnbd/rnbd-clt.h                      |   2 +-
 drivers/block/ublk_drv.c                           |  35 +-
 drivers/bluetooth/btrtl.c                          |  24 +-
 drivers/bluetooth/btusb.c                          |  16 +-
 drivers/bus/ti-sysc.c                              |  11 +-
 drivers/char/applicom.c                            |   5 +-
 drivers/char/ipmi/ipmi_msghandler.c                |  20 +-
 drivers/char/tpm/tpm-chip.c                        |   1 -
 drivers/char/tpm/tpm1-cmd.c                        |   5 -
 drivers/char/tpm/tpm2-cmd.c                        |   8 +-
 drivers/char/virtio_console.c                      |   2 +-
 drivers/clk/Makefile                               |   3 +-
 drivers/clk/mvebu/cp110-system-controller.c        |  20 ++
 drivers/clk/qcom/camcc-sm6350.c                    |  13 +-
 drivers/clk/renesas/r7s9210-cpg-mssr.c             |   7 +-
 drivers/clk/renesas/r8a77970-cpg-mssr.c            |   8 +-
 drivers/clk/renesas/r9a06g032-clocks.c             |   6 +-
 drivers/clk/renesas/rcar-gen2-cpg.c                |   5 +-
 drivers/clk/renesas/rcar-gen2-cpg.h                |   3 +-
 drivers/clk/renesas/rcar-gen3-cpg.c                |   6 +-
 drivers/clk/renesas/rcar-gen3-cpg.h                |   3 +-
 drivers/clk/renesas/rcar-gen4-cpg.c                |   6 +-
 drivers/clk/renesas/rcar-gen4-cpg.h                |   3 +-
 drivers/clk/renesas/renesas-cpg-mssr.c             | 150 +++++----
 drivers/clk/renesas/renesas-cpg-mssr.h             |  20 +-
 drivers/clk/renesas/rzg2l-cpg.c                    |  15 +-
 drivers/clk/samsung/clk-exynos-clkout.c            |   2 +-
 drivers/comedi/comedi_fops.c                       |  42 ++-
 drivers/comedi/drivers/c6xdigio.c                  |  46 ++-
 drivers/comedi/drivers/multiq3.c                   |   9 +
 drivers/comedi/drivers/pcl818.c                    |   5 +-
 drivers/cpufreq/amd-pstate.c                       |   2 +-
 drivers/cpufreq/cpufreq-dt-platdev.c               |   1 +
 drivers/cpufreq/cpufreq-nforce2.c                  |   3 +
 drivers/cpufreq/s5pv210-cpufreq.c                  |   6 +-
 drivers/cpuidle/governors/menu.c                   |   9 +-
 drivers/cpuidle/governors/teo.c                    |   7 +-
 drivers/crypto/caam/caamrng.c                      |   4 +-
 drivers/crypto/ccree/cc_buffer_mgr.c               |   6 +-
 drivers/crypto/hisilicon/qm.c                      |  14 +-
 drivers/crypto/starfive/jh7110-hash.c              |   6 +-
 drivers/firewire/nosy.c                            |  10 +-
 drivers/firmware/arm_scmi/notify.c                 |   1 +
 drivers/firmware/efi/cper-arm.c                    |  52 ++-
 drivers/firmware/efi/cper.c                        |  60 ++++
 drivers/firmware/efi/libstub/x86-5lvl.c            |   4 +-
 drivers/firmware/imx/imx-scu-irq.c                 |   8 +-
 drivers/firmware/stratix10-svc.c                   |  12 +
 drivers/gpio/gpio-regmap.c                         |   2 +-
 drivers/gpio/gpiolib-acpi.c                        |  22 ++
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   6 +-
 drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c |   8 +-
 drivers/gpu/drm/amd/display/dc/core/dc_surface.c   |   2 +-
 .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c  |   9 +-
 drivers/gpu/drm/gma500/fbdev.c                     |  43 ---
 drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c     |  37 +-
 drivers/gpu/drm/mediatek/mtk_disp_ccorr.c          |  23 +-
 drivers/gpu/drm/mediatek/mtk_dp.c                  |   1 +
 drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c        |  22 +-
 drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h        |   2 +-
 drivers/gpu/drm/mediatek/mtk_drm_drv.c             |   4 +-
 drivers/gpu/drm/mgag200/mgag200_mode.c             |  25 ++
 drivers/gpu/drm/msm/adreno/a2xx_gpu.c              |   2 +-
 drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c        |   2 +-
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c    |  10 +-
 drivers/gpu/drm/nouveau/dispnv50/atom.h            |  13 +
 drivers/gpu/drm/nouveau/dispnv50/wndw.c            |   2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/fb/base.c      |   2 +-
 drivers/gpu/drm/panel/panel-sony-td4353-jdi.c      |   2 +
 drivers/gpu/drm/panel/panel-visionox-rm69299.c     |   2 +-
 drivers/gpu/drm/tilcdc/tilcdc_crtc.c               |   2 +-
 drivers/gpu/drm/tilcdc/tilcdc_drv.c                |  72 ++--
 drivers/gpu/drm/tilcdc/tilcdc_drv.h                |   2 +-
 drivers/gpu/drm/ttm/ttm_bo_vm.c                    |   6 +
 drivers/gpu/drm/vgem/vgem_fence.c                  |   2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c         |  12 +-
 drivers/gpu/host1x/syncpt.c                        |   4 +-
 drivers/hid/hid-apple.c                            |   1 +
 drivers/hid/hid-elecom.c                           |   6 +-
 drivers/hid/hid-ids.h                              |   3 +-
 drivers/hid/hid-input.c                            |  23 +-
 drivers/hid/hid-logitech-dj.c                      |  56 ++-
 drivers/hid/hid-logitech-hidpp.c                   |   9 +-
 drivers/hid/hid-quirks.c                           |   3 +-
 drivers/hwmon/ibmpex.c                             |   9 +-
 drivers/hwmon/max16065.c                           |   7 +-
 drivers/hwmon/sy7636a-hwmon.c                      |   7 +-
 drivers/hwmon/tmp401.c                             |   2 +-
 drivers/hwmon/w83791d.c                            |  19 +-
 drivers/hwmon/w83l786ng.c                          |  26 +-
 drivers/hwtracing/coresight/coresight-etm4x-core.c | 130 ++++---
 drivers/hwtracing/intel_th/core.c                  |  20 +-
 drivers/i2c/busses/i2c-amd-mp2-pci.c               |   5 +-
 drivers/i2c/busses/i2c-designware-core.h           |   1 +
 drivers/i2c/busses/i2c-designware-master.c         |   7 +
 drivers/i3c/master.c                               |  12 +-
 drivers/i3c/master/svc-i3c-master.c                |  22 +-
 drivers/iio/adc/ti_am335x_adc.c                    |   2 +-
 drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h            |   2 +-
 drivers/infiniband/core/addr.c                     |  33 +-
 drivers/infiniband/core/cma.c                      |   3 +
 drivers/infiniband/core/device.c                   |   6 +
 drivers/infiniband/core/verbs.c                    |   2 +-
 drivers/infiniband/hw/bnxt_re/ib_verbs.c           |   7 +-
 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c         |   2 +-
 drivers/infiniband/hw/bnxt_re/qplib_res.c          |   8 +-
 drivers/infiniband/hw/bnxt_re/qplib_sp.c           |   2 +-
 drivers/infiniband/hw/efa/efa_verbs.c              |   4 -
 drivers/infiniband/hw/irdma/cm.c                   |   2 +-
 drivers/infiniband/hw/irdma/ctrl.c                 |   3 +
 drivers/infiniband/hw/irdma/main.h                 |   2 +-
 drivers/infiniband/hw/irdma/pble.c                 |   6 +-
 drivers/infiniband/hw/irdma/utils.c                |   3 +-
 drivers/infiniband/hw/irdma/verbs.c                | 241 ++++++++++---
 drivers/infiniband/hw/irdma/verbs.h                |   3 +
 drivers/infiniband/sw/rxe/rxe.c                    |  22 +-
 drivers/infiniband/sw/rxe/rxe.h                    |   3 +-
 drivers/infiniband/sw/rxe/rxe_mcast.c              |  22 +-
 drivers/infiniband/sw/rxe/rxe_net.c                |  25 +-
 drivers/infiniband/sw/rxe/rxe_srq.c                |   7 +-
 drivers/infiniband/sw/rxe/rxe_verbs.c              |  26 +-
 drivers/infiniband/sw/rxe/rxe_verbs.h              |  11 +-
 drivers/infiniband/ulp/rtrs/rtrs-clt.c             |   1 +
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |   2 +-
 drivers/input/serio/i8042-acpipnpio.h              |   7 +
 drivers/input/touchscreen/ti_am335x_tsc.c          |   2 +-
 drivers/interconnect/debugfs-client.c              |   7 +-
 drivers/interconnect/qcom/msm8996.c                |   1 +
 drivers/iommu/amd/init.c                           |  43 ++-
 drivers/iommu/apple-dart.c                         |   2 +
 drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c         |  27 +-
 drivers/iommu/arm/arm-smmu/qcom_iommu.c            |  10 +-
 drivers/iommu/exynos-iommu.c                       |   9 +-
 drivers/iommu/iommu-sva.c                          |   3 +
 drivers/iommu/iommufd/selftest.c                   |   8 +-
 drivers/iommu/ipmmu-vmsa.c                         |   2 +
 drivers/iommu/mtk_iommu.c                          |  27 +-
 drivers/iommu/mtk_iommu_v1.c                       |  25 +-
 drivers/iommu/omap-iommu.c                         |   2 +-
 drivers/iommu/omap-iommu.h                         |   2 -
 drivers/iommu/sun50i-iommu.c                       |   2 +
 drivers/iommu/tegra-smmu.c                         |   5 +-
 drivers/irqchip/irq-bcm7038-l1.c                   |   8 +-
 drivers/irqchip/irq-bcm7120-l2.c                   |  17 +-
 drivers/irqchip/irq-brcmstb-l2.c                   |  12 +-
 drivers/irqchip/irq-imx-mu-msi.c                   |  14 +-
 drivers/irqchip/irq-mchp-eic.c                     |   2 +-
 drivers/irqchip/qcom-irq-combiner.c                |   2 +-
 drivers/isdn/capi/capi.c                           |   8 +-
 drivers/leds/leds-lp50xx.c                         |  67 ++--
 drivers/leds/leds-netxbig.c                        |  36 +-
 drivers/leds/leds-spi-byte.c                       |  11 +-
 drivers/macintosh/mac_hid.c                        |   3 +-
 drivers/md/dm-bufio.c                              |  10 +-
 drivers/md/dm-ebs-target.c                         |   2 +-
 drivers/md/dm-log-writes.c                         |   1 +
 drivers/md/dm-raid.c                               |   2 +
 drivers/md/raid5.c                                 |   6 +-
 drivers/media/cec/core/cec-core.c                  |   1 +
 .../media/common/videobuf2/videobuf2-dma-contig.c  |   1 +
 drivers/media/i2c/adv7604.c                        |   4 +-
 drivers/media/i2c/adv7842.c                        |  11 +-
 drivers/media/i2c/msp3400-kthreads.c               |   2 +
 drivers/media/i2c/tda1997x.c                       |   1 -
 drivers/media/platform/amphion/vpu_malone.c        |  35 +-
 drivers/media/platform/amphion/vpu_v4l2.c          |  28 +-
 drivers/media/platform/amphion/vpu_v4l2.h          |  18 -
 .../mediatek/vcodec/common/mtk_vcodec_fw_vpu.c     |  14 +-
 .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c   |  12 +-
 .../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.h   |   2 +-
 .../platform/mediatek/vcodec/decoder/vdec_vpu_if.c |   5 +-
 .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.c   |  12 +-
 .../mediatek/vcodec/encoder/mtk_vcodec_enc_drv.h   |   2 +-
 .../platform/mediatek/vcodec/encoder/venc_vpu_if.c |   5 +-
 drivers/media/platform/renesas/rcar_drif.c         |   1 +
 .../media/platform/samsung/exynos4-is/media-dev.c  |  10 +-
 drivers/media/platform/ti/davinci/vpif_capture.c   |   4 +-
 drivers/media/platform/ti/davinci/vpif_display.c   |   4 +-
 drivers/media/platform/verisilicon/hantro.h        |   2 +
 drivers/media/platform/verisilicon/hantro_g2.c     |  98 +++++-
 .../platform/verisilicon/hantro_g2_hevc_dec.c      |  35 +-
 .../media/platform/verisilicon/hantro_g2_regs.h    |  13 +
 .../media/platform/verisilicon/hantro_g2_vp9_dec.c |  30 +-
 drivers/media/platform/verisilicon/hantro_hw.h     |   4 +
 drivers/media/platform/verisilicon/imx8m_vpu_hw.c  |   2 +
 drivers/media/rc/st_rc.c                           |   2 +-
 drivers/media/test-drivers/vidtv/vidtv_channel.c   |   3 +
 drivers/media/usb/dvb-usb/dtv5100.c                |   5 +
 drivers/media/usb/pvrusb2/pvrusb2-hdw.c            |   2 +-
 drivers/mfd/altera-sysmgr.c                        |   2 +
 drivers/mfd/da9055-core.c                          |   1 +
 drivers/mfd/max77620.c                             |  15 +-
 drivers/mfd/mt6358-irq.c                           |   1 +
 drivers/mfd/mt6397-irq.c                           |   1 +
 drivers/misc/vmw_balloon.c                         |   3 +-
 drivers/mmc/host/Kconfig                           |   4 +-
 drivers/mmc/host/sdhci-msm.c                       |  27 +-
 drivers/mtd/lpddr/lpddr_cmds.c                     |   8 +-
 drivers/mtd/nand/raw/lpc32xx_slc.c                 |   2 +
 drivers/mtd/nand/raw/marvell_nand.c                |  13 +-
 drivers/mtd/nand/raw/nand_base.c                   |  13 +-
 drivers/mtd/nand/raw/renesas-nand-controller.c     |   5 +-
 drivers/net/can/usb/gs_usb.c                       |   2 +-
 drivers/net/dsa/b53/b53_common.c                   |   3 +
 drivers/net/dsa/sja1105/sja1105_static_config.c    |   6 +-
 drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c        |   2 +
 drivers/net/ethernet/broadcom/b44.c                |   3 +
 drivers/net/ethernet/cadence/macb_main.c           |   3 +-
 drivers/net/ethernet/freescale/enetc/enetc.c       |   3 +-
 drivers/net/ethernet/freescale/fec_main.c          |   7 +-
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |   3 +
 .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c |   4 +-
 .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c  |   4 +-
 drivers/net/ethernet/intel/e1000/e1000_main.c      |  10 +-
 drivers/net/ethernet/intel/i40e/i40e_main.c        |   1 +
 drivers/net/ethernet/intel/iavf/iavf_main.c        |   4 +-
 .../ethernet/marvell/octeontx2/nic/otx2_ethtool.c  |   8 +
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c  |   5 +
 .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c   |  97 +++++-
 .../ethernet/mellanox/mlx5/core/diag/fw_tracer.h   |   1 +
 .../ethernet/mellanox/mlx5/core/eswitch_offloads.c |   6 +
 drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c |  59 +++-
 drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |   1 +
 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c  |   2 +
 .../net/ethernet/mellanox/mlxsw/spectrum_router.c  |  27 +-
 drivers/net/ethernet/microchip/lan743x_main.c      |   3 +-
 drivers/net/ethernet/realtek/r8169_main.c          |   5 +-
 drivers/net/ethernet/smsc/smc91x.c                 |  10 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac5.c       |   5 +
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |   5 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  19 +-
 drivers/net/fjes/fjes_hw.c                         |  12 +-
 drivers/net/ipvlan/ipvlan_core.c                   |   3 +
 drivers/net/mdio/mdio-aspeed.c                     |   7 +
 drivers/net/phy/adin1100.c                         |   2 +-
 drivers/net/phy/mediatek-ge-soc.c                  |   2 +-
 drivers/net/phy/mscc/mscc_main.c                   |   6 +-
 drivers/net/team/team.c                            |   2 +-
 drivers/net/usb/asix_common.c                      |   5 +
 drivers/net/usb/rtl8150.c                          |   2 +
 drivers/net/usb/sr9700.c                           |   4 +-
 drivers/net/wireless/ath/ath11k/mac.c              |   4 +-
 drivers/net/wireless/ath/ath11k/wmi.c              |   7 +-
 .../net/wireless/broadcom/brcm80211/brcmfmac/dmi.c |  14 +
 drivers/net/wireless/mediatek/mt76/eeprom.c        |  37 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mcu.c    |   4 +-
 drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c |   9 +-
 drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c |  27 +-
 drivers/net/wireless/realtek/rtw88/rtw8822cu.c     |   2 +
 drivers/net/wireless/realtek/rtw88/sdio.c          |   4 +-
 drivers/net/wireless/st/cw1200/bh.c                |   6 +-
 drivers/nfc/pn533/usb.c                            |   2 +-
 drivers/nvme/host/auth.c                           |   2 +-
 drivers/nvme/host/core.c                           |   3 +-
 drivers/nvme/host/fc.c                             |   6 +-
 drivers/parisc/gsc.c                               |   4 +-
 drivers/pci/controller/Kconfig                     |   7 +-
 drivers/pci/controller/dwc/pci-keystone.c          |   2 +
 drivers/pci/controller/dwc/pcie-designware.h       |   2 +-
 drivers/pci/controller/pcie-brcmstb.c              |  10 +-
 drivers/pci/pci-driver.c                           |   4 +
 drivers/phy/broadcom/phy-bcm63xx-usbh.c            |   6 +-
 drivers/phy/renesas/phy-rcar-gen3-usb2.c           |  20 +-
 drivers/pinctrl/pinctrl-single.c                   |  25 +-
 drivers/pinctrl/qcom/pinctrl-msm.c                 |   2 +-
 drivers/pinctrl/stm32/pinctrl-stm32.c              |   2 +-
 drivers/platform/chrome/cros_ec_ishtp.c            |   1 +
 drivers/platform/x86/acer-wmi.c                    |   4 +
 drivers/platform/x86/amd/pmc/pmc-quirks.c          |  25 ++
 drivers/platform/x86/asus-wmi.c                    |   8 +-
 .../platform/x86/hp/hp-bioscfg/enum-attributes.c   |   4 +-
 .../platform/x86/hp/hp-bioscfg/int-attributes.c    |   2 +-
 .../x86/hp/hp-bioscfg/order-list-attributes.c      |   5 +
 .../x86/hp/hp-bioscfg/passwdobj-attributes.c       |   5 +
 .../platform/x86/hp/hp-bioscfg/string-attributes.c |   2 +-
 drivers/platform/x86/huawei-wmi.c                  |   4 +
 drivers/platform/x86/ibm_rtl.c                     |   2 +-
 drivers/platform/x86/intel/chtwc_int33fe.c         |  29 +-
 drivers/platform/x86/intel/hid.c                   |  12 +
 drivers/platform/x86/msi-laptop.c                  |   3 +
 drivers/pmdomain/actions/owl-sps.c                 |  16 +-
 drivers/pmdomain/imx/gpc.c                         |  12 +-
 drivers/pmdomain/rockchip/pm-domains.c             |  13 +-
 drivers/power/supply/apm_power.c                   |   3 +-
 drivers/power/supply/cw2015_battery.c              |   8 +-
 drivers/power/supply/rt9467-charger.c              |   6 +-
 drivers/power/supply/wm831x_power.c                |  10 +-
 drivers/pwm/pwm-bcm2835.c                          |  28 +-
 drivers/pwm/pwm-stm32.c                            |   3 +-
 drivers/regulator/core.c                           |  37 +-
 drivers/remoteproc/qcom_q6v5_wcss.c                |   8 +-
 drivers/rpmsg/qcom_glink_native.c                  |   8 +
 drivers/rtc/rtc-gamecube.c                         |   4 +
 drivers/s390/block/dasd_eckd.c                     |   8 +
 drivers/s390/crypto/ap_bus.c                       |   8 +-
 drivers/scsi/aic94xx/aic94xx_init.c                |   3 +
 drivers/scsi/qla2xxx/qla_def.h                     |   1 -
 drivers/scsi/qla2xxx/qla_gbl.h                     |   2 +-
 drivers/scsi/qla2xxx/qla_isr.c                     |  32 +-
 drivers/scsi/qla2xxx/qla_mbx.c                     |   2 +
 drivers/scsi/qla2xxx/qla_mid.c                     |   4 +-
 drivers/scsi/qla2xxx/qla_nvme.c                    |   2 +-
 drivers/scsi/qla2xxx/qla_os.c                      |  14 +-
 drivers/scsi/sim710.c                              |   2 +
 drivers/scsi/smartpqi/smartpqi_init.c              |  19 ++
 drivers/scsi/stex.c                                |   1 +
 drivers/soc/amlogic/meson-canvas.c                 |   5 +-
 drivers/soc/qcom/ocmem.c                           |   2 +-
 drivers/soc/qcom/smem.c                            |   3 +-
 drivers/spi/spi-cadence-quadspi.c                  |   4 +-
 drivers/spi/spi-fsl-spi.c                          |   2 +-
 drivers/spi/spi-imx.c                              |  15 +-
 drivers/spi/spi-tegra210-quad.c                    |  22 +-
 drivers/spi/spi-xilinx.c                           |   2 +-
 drivers/staging/fbtft/fbtft-core.c                 |   4 +-
 drivers/staging/greybus/uart.c                     |   7 +-
 drivers/staging/most/Kconfig                       |   2 -
 drivers/staging/most/Makefile                      |   1 -
 drivers/staging/most/i2c/Kconfig                   |  13 -
 drivers/staging/most/i2c/Makefile                  |   4 -
 drivers/staging/most/i2c/i2c.c                     | 374 ---------------------
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |  14 +-
 drivers/staging/rtl8723bs/core/rtw_mlme_ext.c      |  13 +-
 drivers/target/target_core_configfs.c              |   1 -
 drivers/target/target_core_transport.c             |   1 +
 drivers/tty/serial/8250/8250_pci.c                 |  37 ++
 drivers/tty/serial/serial_core.c                   |   7 +-
 drivers/tty/serial/sprd_serial.c                   |   6 +
 drivers/tty/tty_port.c                             |  17 +-
 drivers/ufs/core/ufshcd.c                          |   7 +-
 drivers/uio/uio_fsl_elbc_gpcm.c                    |   7 +
 drivers/usb/class/cdc-acm.c                        |   7 +-
 drivers/usb/core/message.c                         |   2 +-
 drivers/usb/dwc2/platform.c                        |  16 +-
 drivers/usb/dwc3/dwc3-of-simple.c                  |   7 +-
 drivers/usb/dwc3/gadget.c                          |   2 +-
 drivers/usb/dwc3/host.c                            |   2 +-
 drivers/usb/gadget/legacy/raw_gadget.c             |   3 +
 drivers/usb/gadget/udc/lpc32xx_udc.c               |  21 +-
 drivers/usb/gadget/udc/tegra-xudc.c                |   6 -
 drivers/usb/host/ohci-nxp.c                        |  20 +-
 drivers/usb/host/xhci-dbgtty.c                     |   2 +-
 drivers/usb/host/xhci-hub.c                        |   2 +-
 drivers/usb/host/xhci-mem.c                        |  10 +-
 drivers/usb/host/xhci-ring.c                       |   8 +-
 drivers/usb/host/xhci.h                            |  16 +-
 drivers/usb/misc/chaoskey.c                        |  16 +-
 drivers/usb/phy/phy-fsl-usb.c                      |   1 +
 drivers/usb/phy/phy-isp1301.c                      |   7 +-
 drivers/usb/phy/phy.c                              |   4 +
 drivers/usb/renesas_usbhs/pipe.c                   |   2 +
 drivers/usb/serial/belkin_sa.c                     |  28 +-
 drivers/usb/serial/ftdi_sio.c                      |  72 ++--
 drivers/usb/serial/kobil_sct.c                     |  18 +-
 drivers/usb/serial/option.c                        |  22 +-
 drivers/usb/serial/usb-serial.c                    |   7 +-
 drivers/usb/storage/unusual_uas.h                  |   2 +-
 drivers/usb/typec/ucsi/ucsi.c                      |   6 +
 drivers/usb/usbip/vhci_hcd.c                       |   6 +-
 drivers/vdpa/pds/vdpa_dev.c                        |   2 +-
 drivers/vhost/vsock.c                              |  15 +-
 drivers/video/backlight/led_bl.c                   |  13 +
 drivers/video/fbdev/gbefb.c                        |   5 +-
 drivers/video/fbdev/pxafb.c                        |  12 +-
 drivers/video/fbdev/ssd1307fb.c                    |   4 +-
 drivers/video/fbdev/tcx.c                          |   2 +-
 drivers/virtio/virtio_balloon.c                    |   4 +-
 drivers/virtio/virtio_vdpa.c                       |   2 +-
 drivers/watchdog/starfive-wdt.c                    |   4 +-
 drivers/watchdog/via_wdt.c                         |   1 +
 drivers/watchdog/wdat_wdt.c                        |  64 ++--
 fs/9p/v9fs.c                                       |   4 +-
 fs/9p/vfs_file.c                                   |  11 +-
 fs/9p/vfs_inode.c                                  |   3 +-
 fs/9p/vfs_inode_dotl.c                             |   2 +-
 fs/bfs/inode.c                                     |  19 +-
 fs/btrfs/ctree.c                                   |   2 +-
 fs/btrfs/inode.c                                   |   1 +
 fs/btrfs/ioctl.c                                   |   4 +-
 fs/btrfs/scrub.c                                   |   5 +
 fs/btrfs/tree-log.c                                |  46 ++-
 fs/btrfs/volumes.c                                 |   1 +
 fs/exfat/super.c                                   |  19 +-
 fs/ext4/ext4.h                                     |   1 +
 fs/ext4/ialloc.c                                   |   1 -
 fs/ext4/inline.c                                   |  14 +-
 fs/ext4/inode.c                                    |   6 +-
 fs/ext4/mballoc.c                                  |  58 ++--
 fs/ext4/move_extent.c                              |   2 +-
 fs/ext4/orphan.c                                   |   4 +-
 fs/ext4/super.c                                    |  34 +-
 fs/ext4/xattr.c                                    |  38 +--
 fs/ext4/xattr.h                                    |  10 +
 fs/f2fs/compress.c                                 |   5 +-
 fs/f2fs/data.c                                     |  17 +
 fs/f2fs/debug.c                                    |   3 +
 fs/f2fs/extent_cache.c                             |   5 +-
 fs/f2fs/f2fs.h                                     |  41 ++-
 fs/f2fs/file.c                                     |  92 ++++-
 fs/f2fs/inode.c                                    |  20 +-
 fs/f2fs/namei.c                                    |   6 +-
 fs/f2fs/recovery.c                                 |  23 +-
 fs/f2fs/segment.c                                  |   9 +-
 fs/f2fs/super.c                                    | 119 +++----
 fs/f2fs/xattr.c                                    |  30 +-
 fs/f2fs/xattr.h                                    |  10 +-
 fs/fuse/file.c                                     |  37 +-
 fs/gfs2/glops.c                                    |   3 +-
 fs/gfs2/lops.c                                     |   2 +-
 fs/gfs2/super.c                                    |   4 +-
 fs/hfsplus/bnode.c                                 |   4 +-
 fs/hfsplus/dir.c                                   |   7 +-
 fs/hfsplus/inode.c                                 |  32 +-
 fs/iomap/buffered-io.c                             |  41 ++-
 fs/iomap/direct-io.c                               |  79 +++--
 fs/jbd2/journal.c                                  |  20 +-
 fs/jbd2/transaction.c                              |  21 +-
 fs/lockd/svc4proc.c                                |   4 +-
 fs/lockd/svclock.c                                 |  21 +-
 fs/lockd/svcproc.c                                 |   5 +-
 fs/locks.c                                         |  12 +-
 fs/nfs/client.c                                    |  21 +-
 fs/nfs/dir.c                                       |  27 +-
 fs/nfs/inode.c                                     |   2 +-
 fs/nfs/internal.h                                  |   3 +-
 fs/nfs/namespace.c                                 |  11 +-
 fs/nfs/nfs4client.c                                |  18 +-
 fs/nfs/pnfs.c                                      |   1 +
 fs/nfs/super.c                                     |  33 +-
 fs/nfsd/blocklayout.c                              |   7 +-
 fs/nfsd/export.c                                   |   2 +-
 fs/nfsd/nfs4state.c                                |   4 +-
 fs/nfsd/nfs4xdr.c                                  |   5 +
 fs/nls/nls_base.c                                  |  27 +-
 fs/notify/fsnotify.c                               |   9 +-
 fs/ntfs3/frecord.c                                 |  43 ++-
 fs/ntfs3/fsntfs.c                                  |   9 +-
 fs/ntfs3/inode.c                                   |   2 +
 fs/ntfs3/ntfs_fs.h                                 |   9 +-
 fs/ntfs3/run.c                                     |   6 +-
 fs/ntfs3/super.c                                   |   5 +
 fs/ocfs2/alloc.c                                   |   1 -
 fs/ocfs2/move_extents.c                            |   8 +-
 fs/ocfs2/suballoc.c                                |  10 +
 fs/smb/client/fs_context.c                         |   4 +-
 fs/smb/server/mgmt/tree_connect.c                  |  18 +-
 fs/smb/server/mgmt/tree_connect.h                  |   1 -
 fs/smb/server/mgmt/user_session.c                  |   4 +-
 fs/smb/server/smb2pdu.c                            |  20 +-
 fs/smb/server/transport_ipc.c                      |   7 +-
 fs/smb/server/vfs.c                                |   5 +-
 fs/smb/server/vfs_cache.c                          |  88 +++--
 fs/tracefs/event_inode.c                           |   3 +-
 fs/xfs/xfs_buf_item.c                              |   1 +
 include/linux/balloon_compaction.h                 |  43 +--
 include/linux/blk_types.h                          |   5 +-
 include/linux/compiler_types.h                     |  13 +
 include/linux/cper.h                               |  12 +-
 include/linux/filter.h                             |  16 +-
 include/linux/genalloc.h                           |   1 +
 include/linux/ieee80211.h                          |   4 +-
 include/linux/if_bridge.h                          |   6 +-
 include/linux/jbd2.h                               |   6 +
 include/linux/kasan.h                              |  15 +
 include/linux/mm.h                                 |  10 +-
 include/linux/nfs_fs_sb.h                          |   7 +-
 include/linux/nfs_xdr.h                            |  54 +--
 include/linux/platform_data/lp855x.h               |   4 +-
 include/linux/rculist_nulls.h                      |  59 ++++
 include/linux/reset.h                              |   1 +
 include/linux/sched/topology.h                     |   3 +
 include/linux/tpm.h                                |   8 +-
 include/linux/tty_port.h                           |  21 +-
 include/linux/virtio_config.h                      |   6 +-
 include/media/v4l2-mem2mem.h                       |   3 +-
 include/net/ip6_fib.h                              |  46 ++-
 include/net/netfilter/nf_conntrack_count.h         |  15 +-
 include/net/netfilter/nf_tables.h                  |   4 +-
 include/net/sock.h                                 |  13 +
 include/net/xfrm.h                                 |  13 +-
 include/rdma/ib_verbs.h                            |   2 +
 include/sound/snd_wavefront.h                      |   4 -
 include/uapi/linux/mptcp.h                         |   1 +
 include/uapi/sound/asound.h                        |   2 +-
 io_uring/openclose.c                               |   2 +-
 io_uring/poll.c                                    |   9 +-
 kernel/bpf/hashtab.c                               |  10 +-
 kernel/bpf/syscall.c                               |   3 +
 kernel/bpf/trampoline.c                            |   7 +-
 kernel/cgroup/cpuset.c                             |  35 +-
 kernel/dma/pool.c                                  |   2 +-
 kernel/irq/irq_sim.c                               |   2 +-
 kernel/kallsyms.c                                  |   5 +-
 kernel/livepatch/core.c                            |   8 +-
 kernel/locking/spinlock_debug.c                    |   4 +-
 kernel/resource.c                                  |  78 +++--
 kernel/sched/core.c                                |   3 +
 kernel/sched/cpudeadline.c                         |  34 +-
 kernel/sched/cpudeadline.h                         |   4 +-
 kernel/sched/deadline.c                            |   8 +-
 kernel/sched/fair.c                                |  89 +++--
 kernel/sched/features.h                            |   5 +
 kernel/sched/sched.h                               |   7 +
 kernel/sched/topology.c                            |   6 +
 kernel/scs.c                                       |   2 +-
 kernel/task_work.c                                 |   8 +-
 kernel/trace/ftrace.c                              |  40 ++-
 kernel/trace/trace_events.c                        |   2 +
 kernel/trace/trace_events_synth.c                  |   1 -
 lib/idr.c                                          |   2 +
 lib/vsprintf.c                                     |   6 +-
 mm/balloon_compaction.c                            |   9 +-
 mm/damon/core-test.h                               | 110 +++++-
 mm/damon/vaddr-test.h                              |  26 +-
 mm/kasan/common.c                                  |  17 +
 mm/ksm.c                                           |  18 +-
 mm/page-writeback.c                                |   4 +-
 mm/vmalloc.c                                       |   4 +-
 net/bluetooth/rfcomm/tty.c                         |   7 +-
 net/bridge/br_ioctl.c                              |  36 +-
 net/bridge/br_private.h                            |   4 +-
 net/bridge/netfilter/nft_meta_bridge.c             |   2 +-
 net/caif/cffrml.c                                  |   9 +-
 net/ceph/osdmap.c                                  | 116 +++----
 net/core/dev.c                                     | 172 +++++++---
 net/core/dev_ioctl.c                               |  16 -
 net/core/filter.c                                  |   9 +-
 net/core/page_pool.c                               |  27 +-
 net/ethtool/ioctl.c                                |  30 +-
 net/handshake/request.c                            |   8 +-
 net/hsr/hsr_forward.c                              |   2 +
 net/ipv4/fib_trie.c                                |   7 +-
 net/ipv4/inet_hashtables.c                         |   8 +-
 net/ipv4/ipcomp.c                                  |   2 +
 net/ipv4/netfilter/nft_dup_ipv4.c                  |   4 +-
 net/ipv6/addrconf.c                                |  58 +++-
 net/ipv6/calipso.c                                 |   3 +-
 net/ipv6/ip6_fib.c                                 |  64 +++-
 net/ipv6/ip6_gre.c                                 |   9 +-
 net/ipv6/ipcomp6.c                                 |   2 +
 net/ipv6/ndisc.c                                   |  10 +-
 net/ipv6/netfilter/nft_dup_ipv6.c                  |   4 +-
 net/ipv6/route.c                                   |  14 +-
 net/ipv6/xfrm6_tunnel.c                            |   2 +-
 net/key/af_key.c                                   |   2 +-
 net/mac80211/aes_cmac.c                            |  63 +++-
 net/mac80211/aes_cmac.h                            |   8 +-
 net/mac80211/cfg.c                                 |  10 -
 net/mac80211/drop.h                                |  33 +-
 net/mac80211/rx.c                                  |  57 ++--
 net/mac80211/wep.c                                 |   9 +-
 net/mac80211/wpa.c                                 |  62 ++--
 net/mptcp/options.c                                |  10 +
 net/mptcp/pm_netlink.c                             |   3 +-
 net/mptcp/protocol.c                               |  36 +-
 net/mptcp/protocol.h                               |   9 +-
 net/mptcp/subflow.c                                |  10 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |   3 +
 net/netfilter/nf_conncount.c                       | 208 ++++++++----
 net/netfilter/nf_tables_api.c                      |  52 ++-
 net/netfilter/nft_bitwise.c                        |   4 +-
 net/netfilter/nft_byteorder.c                      |   2 +-
 net/netfilter/nft_cmp.c                            |   6 +-
 net/netfilter/nft_connlimit.c                      |  34 +-
 net/netfilter/nft_ct.c                             |   2 +-
 net/netfilter/nft_dup_netdev.c                     |   2 +-
 net/netfilter/nft_dynset.c                         |   4 +-
 net/netfilter/nft_exthdr.c                         |   2 +-
 net/netfilter/nft_flow_offload.c                   |   9 +-
 net/netfilter/nft_fwd_netdev.c                     |   6 +-
 net/netfilter/nft_hash.c                           |   2 +-
 net/netfilter/nft_lookup.c                         |   2 +-
 net/netfilter/nft_masq.c                           |   4 +-
 net/netfilter/nft_meta.c                           |   2 +-
 net/netfilter/nft_nat.c                            |   8 +-
 net/netfilter/nft_objref.c                         |   2 +-
 net/netfilter/nft_payload.c                        |   2 +-
 net/netfilter/nft_queue.c                          |   2 +-
 net/netfilter/nft_range.c                          |   2 +-
 net/netfilter/nft_redir.c                          |   4 +-
 net/netfilter/nft_tproxy.c                         |   4 +-
 net/netfilter/xt_connlimit.c                       |  14 +-
 net/netrom/nr_out.c                                |   4 +-
 net/nfc/core.c                                     |   9 +-
 net/openvswitch/conntrack.c                        |  16 +-
 net/openvswitch/flow_netlink.c                     |  13 +-
 net/openvswitch/vport-netdev.c                     |  17 +-
 net/rose/af_rose.c                                 |   2 +-
 net/sched/sch_cake.c                               |  60 ++--
 net/sched/sch_ets.c                                |   6 +-
 net/sctp/socket.c                                  |   5 +-
 net/socket.c                                       |  19 +-
 net/sunrpc/auth_gss/svcauth_gss.c                  |   3 +-
 net/sunrpc/xprtrdma/svc_rdma_rw.c                  |   5 +-
 net/wireless/sme.c                                 |   2 +-
 net/xfrm/xfrm_ipcomp.c                             |   1 -
 net/xfrm/xfrm_state.c                              | 125 ++++---
 net/xfrm/xfrm_user.c                               |   2 +-
 samples/ftrace/ftrace-direct-modify.c              |   8 +-
 samples/ftrace/ftrace-direct-multi-modify.c        |   8 +-
 samples/ftrace/ftrace-direct-multi.c               |   4 +-
 samples/ftrace/ftrace-direct-too.c                 |   4 +-
 samples/ftrace/ftrace-direct.c                     |   4 +-
 samples/vfs/test-statx.c                           |   6 +
 samples/watch_queue/watch_test.c                   |   6 +
 scripts/Makefile.modinst                           |   2 +-
 security/integrity/ima/ima_policy.c                |   2 +-
 security/keys/trusted-keys/trusted_tpm2.c          |   6 +-
 security/smack/smack_lsm.c                         |  41 ++-
 sound/firewire/dice/dice-extension.c               |   4 +-
 sound/firewire/motu/motu-hwdep.c                   |   7 +-
 sound/isa/wavefront/wavefront.c                    |  61 ++--
 sound/isa/wavefront/wavefront_fx.c                 |  36 +-
 sound/isa/wavefront/wavefront_midi.c               | 146 ++++----
 sound/isa/wavefront/wavefront_synth.c              | 216 ++++++------
 sound/pci/hda/cs35l41_hda.c                        |   2 +
 sound/pcmcia/pdaudiocf/pdaudiocf.c                 |   8 +-
 sound/pcmcia/vx/vxpocket.c                         |   8 +-
 sound/soc/bcm/bcm63xx-pcm-whistler.c               |   4 +-
 sound/soc/codecs/ak4458.c                          |  10 +-
 sound/soc/codecs/ak5558.c                          |  10 +-
 sound/soc/fsl/fsl_xcvr.c                           |   2 +-
 sound/soc/intel/catpt/pcm.c                        |   4 +-
 sound/soc/qcom/qdsp6/q6adm.c                       | 146 ++++----
 sound/soc/qcom/qdsp6/q6apm-dai.c                   |   2 +
 sound/soc/qcom/qdsp6/q6asm-dai.c                   |   7 +-
 sound/soc/stm/stm32_sai.c                          |  14 +-
 sound/soc/stm/stm32_sai_sub.c                      |  51 ++-
 sound/usb/mixer_us16x08.c                          |  20 +-
 sound/usb/quirks.c                                 |   6 +
 tools/include/nolibc/stdio.h                       |   4 +
 tools/lib/perf/cpumap.c                            |  10 +-
 tools/mm/page_owner_sort.c                         |   6 +-
 tools/objtool/check.c                              |   3 +-
 tools/objtool/elf.c                                |   8 +-
 tools/perf/builtin-record.c                        |   2 +-
 .../util/arm-spe-decoder/arm-spe-pkt-decoder.c     |  37 +-
 .../util/arm-spe-decoder/arm-spe-pkt-decoder.h     |  26 +-
 tools/perf/util/bpf_lock_contention.c              |   6 +-
 tools/perf/util/maps.c                             |  13 +
 tools/perf/util/maps.h                             |   2 +
 tools/perf/util/symbol.c                           |   4 +-
 tools/testing/ktest/config-bisect.pl               |   4 +-
 tools/testing/nvdimm/test/nfit.c                   |   7 +-
 tools/testing/radix-tree/idr-test.c                |  21 ++
 .../selftests/bpf/prog_tests/perf_branches.c       |  22 +-
 .../testing/selftests/bpf/prog_tests/send_signal.c |   5 +
 .../selftests/bpf/progs/test_perf_branches.c       |   3 +
 .../testing/selftests/drivers/net/bonding/Makefile |   2 +-
 .../selftests/drivers/net/bonding/bond_macvlan.sh  |  99 ------
 .../drivers/net/bonding/bond_macvlan_ipvlan.sh     |  97 ++++++
 tools/testing/selftests/drivers/net/bonding/config |   9 +
 .../test.d/ftrace/func_traceonoff_triggers.tc      |   5 +-
 .../testing/selftests/net/openvswitch/ovs-dpctl.py |  16 +-
 tools/testing/selftests/net/tap.c                  |  16 +-
 754 files changed, 6987 insertions(+), 4373 deletions(-)

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sabrina Dubroca <[email protected]>

[ Upstream commit b441cf3f8c4b8576639d20c8eb4aa32917602ecd ]

The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete.

We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state.

Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped.

A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked.

---
 include/net/xfrm.h      |  1 -
 net/ipv4/ipcomp.c       |  2 ++
 net/ipv6/ipcomp6.c      |  2 ++
 net/ipv6/xfrm6_tunnel.c |  2 +-
 net/xfrm/xfrm_ipcomp.c  |  1 -
 net/xfrm/xfrm_state.c   | 19 ++++++++-----------
 6 files changed, 13 insertions(+), 14 deletions(-)

index 84a1c8c861d29..f7a52b9b56acc 100644
@@ -414,7 +414,6 @@ int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
 int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
 
 void xfrm_flush_gc(void);
-void xfrm_state_delete_tunnel(struct xfrm_state *x);
 
 struct xfrm_type {
 	struct module		*owner;

index 5a4fb2539b08b..9a45aed508d19 100644
@@ -54,6 +54,7 @@ static int ipcomp4_err(struct sk_buff *skb, u32 info)
 }
 
 /* We always hold one tunnel user reference to indicate a tunnel */
+static struct lock_class_key xfrm_state_lock_key;
 static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
 {
 	struct net *net = xs_net(x);

@@ -62,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
 	t = xfrm_state_alloc(net);
 	if (!t)
 		goto out;
+	lockdep_set_class(&t->lock, &xfrm_state_lock_key);
 
 	t->id.proto = IPPROTO_IPIP;
 	t->id.spi = x->props.saddr.a4;

index 72d4858dec18a..8607569de34f3 100644
@@ -71,6 +71,7 @@ static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	return 0;
 }
 
+static struct lock_class_key xfrm_state_lock_key;
 static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
 {
 	struct net *net = xs_net(x);

@@ -79,6 +80,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
 	t = xfrm_state_alloc(net);
 	if (!t)
 		goto out;
+	lockdep_set_class(&t->lock, &xfrm_state_lock_key);
 
 	t->id.proto = IPPROTO_IPV6;
 	t->id.spi = xfrm6_tunnel_alloc_spi(net, (xfrm_address_t *)&x->props.saddr);

index 1323f2f6928e2..1702b4de1c1ef 100644
@@ -334,8 +334,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
 	struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
 	unsigned int i;
 
-	xfrm_flush_gc();
 	xfrm_state_flush(net, 0, false, true);
+	xfrm_flush_gc();
 
 	for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
 		WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));

index 9c0fa0e1786a2..f2e70e918f114 100644
@@ -315,7 +315,6 @@ void ipcomp_destroy(struct xfrm_state *x)
 	struct ipcomp_data *ipcd = x->data;
 	if (!ipcd)
 		return;
-	xfrm_state_delete_tunnel(x);
 	mutex_lock(&ipcomp_resource_mutex);
 	ipcomp_free_data(ipcd);
 	mutex_unlock(&ipcomp_resource_mutex);

index ded559f557675..7c8aeec4fe274 100644
@@ -736,6 +736,7 @@ void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
 }
 EXPORT_SYMBOL(__xfrm_state_destroy);
 
+static void xfrm_state_delete_tunnel(struct xfrm_state *x);
 int __xfrm_state_delete(struct xfrm_state *x)
 {
 	struct net *net = xs_net(x);

@@ -756,6 +757,8 @@ int __xfrm_state_delete(struct xfrm_state *x)
 
 		xfrm_dev_state_delete(x);
 
+		xfrm_state_delete_tunnel(x);
+
 		/* All xfrm_state objects are created by xfrm_state_alloc.
 		 * The xfrm_state_alloc call gives a reference, and that
 		 * is what we are dropping here.

@@ -859,10 +862,7 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync)
 				err = xfrm_state_delete(x);
 				xfrm_audit_state_delete(x, err ? 0 : 1,
 							task_valid);
-				if (sync)
-					xfrm_state_put_sync(x);
-				else
-					xfrm_state_put(x);
+				xfrm_state_put(x);
 				if (!err)
 					cnt++;
 

@@ -2798,20 +2798,17 @@ void xfrm_flush_gc(void)
 }
 EXPORT_SYMBOL(xfrm_flush_gc);
 
-/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
-void xfrm_state_delete_tunnel(struct xfrm_state *x)
+static void xfrm_state_delete_tunnel(struct xfrm_state *x)
 {
 	if (x->tunnel) {
 		struct xfrm_state *t = x->tunnel;
 
-		if (atomic_read(&t->tunnel_users) == 2)
+		if (atomic_dec_return(&t->tunnel_users) == 1)
 			xfrm_state_delete(t);
-		atomic_dec(&t->tunnel_users);
-		xfrm_state_put_sync(t);
+		xfrm_state_put(t);
 		x->tunnel = NULL;
 	}
 }
-EXPORT_SYMBOL(xfrm_state_delete_tunnel);
 
 u32 xfrm_state_mtu(struct xfrm_state *x, int mtu)
 {

@@ -2989,8 +2986,8 @@ void xfrm_state_fini(struct net *net)
 	unsigned int sz;
 
 	flush_work(&net->xfrm.state_hash_work);
-	flush_work(&xfrm_state_gc_work);
 	xfrm_state_flush(net, 0, false, true);
+	flush_work(&xfrm_state_gc_work);
 
 	WARN_ON(!list_empty(&net->xfrm.state_all));
 

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sabrina Dubroca <[email protected]>

[ Upstream commit 2a198bbec6913ae1c90ec963750003c6213668c7 ]

This reverts commit f75a2804da391571563c4b6b29e7797787332673.

With all states (whether user or kern) removed from the hashtables during deletion, there's no need for synchronous destruction of states. xfrm6_tunnel states still need to have been destroyed (which will be the case when its last user is deleted (not destroyed)) so that xfrm6_tunnel_free_spi removes it from the per-netns hashtable before the netns is destroyed.

This has the benefit of skipping one synchronize_rcu per state (in __xfrm_state_destroy(sync=true)) when we exit a netns.

---
 include/net/xfrm.h      | 12 +++---------
 net/ipv6/xfrm6_tunnel.c |  2 +-
 net/key/af_key.c        |  2 +-
 net/xfrm/xfrm_state.c   | 23 +++++++++--------------
 net/xfrm/xfrm_user.c    |  2 +-
 5 files changed, 15 insertions(+), 26 deletions(-)

index f7a52b9b56acc..892fb8c31c322 100644
@@ -809,7 +809,7 @@ static inline void xfrm_pols_put(struct xfrm_policy **pols, int npols)
 		xfrm_pol_put(pols[i]);
 }
 
-void __xfrm_state_destroy(struct xfrm_state *, bool);
+void __xfrm_state_destroy(struct xfrm_state *);
 
 static inline void __xfrm_state_put(struct xfrm_state *x)
 {

@@ -819,13 +819,7 @@ static inline void __xfrm_state_put(struct xfrm_state *x)
 static inline void xfrm_state_put(struct xfrm_state *x)
 {
 	if (refcount_dec_and_test(&x->refcnt))
-		__xfrm_state_destroy(x, false);
-}
-
-static inline void xfrm_state_put_sync(struct xfrm_state *x)
-{
-	if (refcount_dec_and_test(&x->refcnt))
-		__xfrm_state_destroy(x, true);
+		__xfrm_state_destroy(x);
 }
 
 static inline void xfrm_state_hold(struct xfrm_state *x)

@@ -1661,7 +1655,7 @@ struct xfrmk_spdinfo {
 
 struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
 int xfrm_state_delete(struct xfrm_state *x);
-int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync);
+int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
 int xfrm_dev_state_flush(struct net *net, struct net_device *dev, bool task_valid);
 int xfrm_dev_policy_flush(struct net *net, struct net_device *dev,
 			  bool task_valid);

index 1702b4de1c1ef..3645ab427e128 100644
@@ -334,7 +334,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
 	struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
 	unsigned int i;
 
-	xfrm_state_flush(net, 0, false, true);
+	xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
 	xfrm_flush_gc();
 
 	for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)

index d68d01804dc7b..6c4448908afed 100644
@@ -1765,7 +1765,7 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_m
 	if (proto == 0)
 		return -EINVAL;
 
-	err = xfrm_state_flush(net, proto, true, false);
+	err = xfrm_state_flush(net, proto, true);
 	err2 = unicast_flush_resp(sk, hdr);
 	if (err || err2) {
 		if (err == -ESRCH) /* empty table - go quietly */

index 7c8aeec4fe274..b0e2958342ad2 100644
@@ -521,7 +521,7 @@ void xfrm_state_free(struct xfrm_state *x)
 }
 EXPORT_SYMBOL(xfrm_state_free);
 
-static void ___xfrm_state_destroy(struct xfrm_state *x)
+static void xfrm_state_gc_destroy(struct xfrm_state *x)
 {
 	hrtimer_cancel(&x->mtimer);
 	del_timer_sync(&x->rtimer);

@@ -559,7 +559,7 @@ static void xfrm_state_gc_task(struct work_struct *work)
 	synchronize_rcu();
 
 	hlist_for_each_entry_safe(x, tmp, &gc_list, gclist)
-		___xfrm_state_destroy(x);
+		xfrm_state_gc_destroy(x);
 }
 
 static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)

@@ -720,19 +720,14 @@ void xfrm_dev_state_free(struct xfrm_state *x)
 }
 #endif
 
-void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
+void __xfrm_state_destroy(struct xfrm_state *x)
 {
 	WARN_ON(x->km.state != XFRM_STATE_DEAD);
 
-	if (sync) {
-		synchronize_rcu();
-		___xfrm_state_destroy(x);
-	} else {
-		spin_lock_bh(&xfrm_state_gc_lock);
-		hlist_add_head(&x->gclist, &xfrm_state_gc_list);
-		spin_unlock_bh(&xfrm_state_gc_lock);
-		schedule_work(&xfrm_state_gc_work);
-	}
+	spin_lock_bh(&xfrm_state_gc_lock);
+	hlist_add_head(&x->gclist, &xfrm_state_gc_list);
+	spin_unlock_bh(&xfrm_state_gc_lock);
+	schedule_work(&xfrm_state_gc_work);
 }
 EXPORT_SYMBOL(__xfrm_state_destroy);
 

@@ -840,7 +835,7 @@ xfrm_dev_state_flush_secctx_check(struct net *net, struct net_device *dev, bool
 }
 #endif
 
-int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync)
+int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
 {
 	int i, err = 0, cnt = 0;
 

@@ -2986,7 +2981,7 @@ void xfrm_state_fini(struct net *net)
 	unsigned int sz;
 
 	flush_work(&net->xfrm.state_hash_work);
-	xfrm_state_flush(net, 0, false, true);
+	xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
 	flush_work(&xfrm_state_gc_work);
 
 	WARN_ON(!list_empty(&net->xfrm.state_all));

index 1d91b42e79971..5b3ab4532aec2 100644
@@ -2380,7 +2380,7 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
 	struct xfrm_usersa_flush *p = nlmsg_data(nlh);
 	int err;
 
-	err = xfrm_state_flush(net, p->proto, true, false);
+	err = xfrm_state_flush(net, p->proto, true);
 	if (err) {
 		if (err == -ESRCH) /* empty table */
 			return 0;

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sabrina Dubroca <[email protected]>

[ Upstream commit 10deb69864840ccf96b00ac2ab3a2055c0c04721 ]

In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists.

In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel.

There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved.

At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work).

---
 net/xfrm/xfrm_state.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index b0e2958342ad2..3d806492e1de9 100644
@@ -521,6 +521,7 @@ void xfrm_state_free(struct xfrm_state *x)
 }
 EXPORT_SYMBOL(xfrm_state_free);
 
+static void xfrm_state_delete_tunnel(struct xfrm_state *x);
 static void xfrm_state_gc_destroy(struct xfrm_state *x)
 {
 	hrtimer_cancel(&x->mtimer);

@@ -535,6 +536,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
 	kfree(x->preplay_esn);
 	if (x->type_offload)
 		xfrm_put_type_offload(x->type_offload);
+	xfrm_state_delete_tunnel(x);
 	if (x->type) {
 		x->type->destructor(x);
 		xfrm_put_type(x->type);

@@ -731,7 +733,6 @@ void __xfrm_state_destroy(struct xfrm_state *x)
 }
 EXPORT_SYMBOL(__xfrm_state_destroy);
 
-static void xfrm_state_delete_tunnel(struct xfrm_state *x);
 int __xfrm_state_delete(struct xfrm_state *x)
 {
 	struct net *net = xs_net(x);

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sabrina Dubroca <[email protected]>

[ Upstream commit 42e42562c9cfcdacf000f1b42284a4fad24f8546 ]

While reverting commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path"), I incorrectly changed xfrm_state_flush's "proto" argument back to IPSEC_PROTO_ANY. This reverts some of the changes in commit dbb2483b2a46 ("xfrm: clean up xfrm protocol checks"), and leads to some states not being removed when we exit the netns.

Pass 0 instead of IPSEC_PROTO_ANY from both xfrm_state_fini xfrm6_tunnel_net_exit, so that xfrm_state_flush deletes all states.

---
 net/ipv6/xfrm6_tunnel.c | 2 +-
 net/xfrm/xfrm_state.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

index 3645ab427e128..775ae1171ef89 100644
@@ -334,7 +334,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
 	struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
 	unsigned int i;
 
-	xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
+	xfrm_state_flush(net, 0, false);
 	xfrm_flush_gc();
 
 	for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)

index 3d806492e1de9..5396fe6b90c66 100644
@@ -2982,7 +2982,7 @@ void xfrm_state_fini(struct net *net)
 	unsigned int sz;
 
 	flush_work(&net->xfrm.state_hash_work);
-	xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
+	xfrm_state_flush(net, 0, false);
 	flush_work(&xfrm_state_gc_work);
 
 	WARN_ON(!list_empty(&net->xfrm.state_all));

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Stefan Kalscheuer <[email protected]>

[ Upstream commit ccc35ff2fd2911986b716a87fe65e03fac2312c9 ]

Use extended classdev registration to generate generic device names from color and function enums instead of reading only the label from the device tree.

---
 drivers/leds/leds-spi-byte.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

index afe9bff7c7c16..b04cf502e6035 100644
@@ -83,7 +83,7 @@ static int spi_byte_probe(struct spi_device *spi)
 	struct device_node *child;
 	struct device *dev = &spi->dev;
 	struct spi_byte_led *led;
-	const char *name = "leds-spi-byte::";
+	struct led_init_data init_data = {};
 	const char *state;
 	int ret;
 

@@ -96,12 +96,9 @@ static int spi_byte_probe(struct spi_device *spi)
 	if (!led)
 		return -ENOMEM;
 
-	of_property_read_string(child, "label", &name);
-	strscpy(led->name, name, sizeof(led->name));
 	led->spi = spi;
 	mutex_init(&led->mutex);
 	led->cdef = device_get_match_data(dev);
-	led->ldev.name = led->name;
 	led->ldev.brightness = LED_OFF;
 	led->ldev.max_brightness = led->cdef->max_value - led->cdef->off_value;
 	led->ldev.brightness_set_blocking = spi_byte_brightness_set_blocking;

@@ -121,7 +118,11 @@ static int spi_byte_probe(struct spi_device *spi)
 	spi_byte_brightness_set_blocking(&led->ldev,
 					 led->ldev.brightness);
 
-	ret = devm_led_classdev_register(&spi->dev, &led->ldev);
+	init_data.fwnode = of_fwnode_handle(child);
+	init_data.devicename = "leds-spi-byte";
+	init_data.default_label = ":";
+
+	ret = devm_led_classdev_register_ext(&spi->dev, &led->ldev, &init_data);
 	if (ret) {
 		of_node_put(child);
 		mutex_destroy(&led->mutex);

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bagas Sanjaya <[email protected]>

commit ba2457109d5b47a90fe565b39524f7225fc23e60 upstream.

Sasha has also maintaining stable branch in conjunction with Greg since cb5d21946d2a2f ("MAINTAINERS: Add Sasha as a stable branch maintainer"). Mention him in 2.Process.rst.

Message-ID: <[email protected]>

---
 Documentation/process/2.Process.rst |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -104,8 +104,10 @@ kernels go out with a handful of known r
 of them are serious.
 
 Once a stable release is made, its ongoing maintenance is passed off to the
-"stable team," currently Greg Kroah-Hartman. The stable team will release
-occasional updates to the stable release using the 5.x.y numbering scheme.
+"stable team," currently consists of Greg Kroah-Hartman and Sasha Levin. The
+stable team will release occasional updates to the stable release using the
+5.x.y numbering scheme.
+
 To be considered for an update release, a patch must (1) fix a significant
 bug, and (2) already be merged into the mainline for the next development
 kernel. Kernels will typically receive stable updates for a little more

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ye Bin <[email protected]>

commit 986835bf4d11032bba4ab8414d18fce038c61bb4 upstream.

There's issue when file system corrupted:

------------[ cut here ]------------
kernel BUG at fs/jbd2/transaction.c:1289!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next
RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0
RSP: 0018:ffff888117aafa30 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534
RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010
RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 __ext4_journal_get_create_access+0x42/0x170
 ext4_getblk+0x319/0x6f0
 ext4_bread+0x11/0x100
 ext4_append+0x1e6/0x4a0
 ext4_init_new_dir+0x145/0x1d0
 ext4_mkdir+0x326/0x920
 vfs_mkdir+0x45c/0x740
 do_mkdirat+0x234/0x2f0
 __x64_sys_mkdir+0xd6/0x120
 do_syscall_64+0x5f/0xfa0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The above issue occurs with us in errors=continue mode when accompanied by storage failures. There have been many inconsistencies in the file system data.
In the case of file system data inconsistency, for example, if the block bitmap of a referenced block is not set, it can lead to the situation where a block being committed is allocated and used again. As a result, the following condition will not be satisfied then trigger BUG_ON. Of course, it is entirely possible to construct a problematic image that can trigger this BUG_ON through specific operations. In fact, I have constructed such an image and easily reproduced this issue.
Therefore, J_ASSERT() holds true only under ideal conditions, but it may not necessarily be satisfied in exceptional scenarios. Using J_ASSERT() directly in abnormal situations would cause the system to crash, which is clearly not what we want. So here we directly trigger a JBD abort instead of immediately invoking BUG_ON.

Message-ID: <[email protected]>

---
 fs/jbd2/transaction.c |   19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

@@ -1274,14 +1274,23 @@ int jbd2_journal_get_create_access(handl
 	 * committing transaction's lists, but it HAS to be in Forget state in
 	 * that case: the transaction must have deleted the buffer for it to be
 	 * reused here.
+	 * In the case of file system data inconsistency, for example, if the
+	 * block bitmap of a referenced block is not set, it can lead to the
+	 * situation where a block being committed is allocated and used again.
+	 * As a result, the following condition will not be satisfied, so here
+	 * we directly trigger a JBD abort instead of immediately invoking
+	 * bugon.
 	 */
 	spin_lock(&jh->b_state_lock);
-	J_ASSERT_JH(jh, (jh->b_transaction == transaction ||
-		jh->b_transaction == NULL ||
-		(jh->b_transaction == journal->j_committing_transaction &&
-			  jh->b_jlist == BJ_Forget)));
+	if (!(jh->b_transaction == transaction || jh->b_transaction == NULL ||
+	      (jh->b_transaction == journal->j_committing_transaction &&
+	       jh->b_jlist == BJ_Forget)) || jh->b_next_transaction != NULL) {
+		err = -EROFS;
+		spin_unlock(&jh->b_state_lock);
+		jbd2_journal_abort(journal, err);
+		goto out;
+	}
 
-	J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
 	J_ASSERT_JH(jh, buffer_locked(jh2bh(jh)));
 
 	if (jh->b_transaction == NULL) {

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deepanshu Kartikey <[email protected]>

commit 892e1cf17555735e9d021ab036c36bc7b58b0e3b upstream.

The cached ei->i_inline_size can become stale between the initial size check and when ext4_update_inline_data()/ext4_create_inline_data() use it. Although ext4_get_max_inline_size() reads the correct value at the time of the check, concurrent xattr operations can modify i_inline_size before ext4_write_lock_xattr() is acquired.

This causes ext4_update_inline_data() and ext4_create_inline_data() to work with stale capacity values, leading to a BUG_ON() crash in ext4_write_inline_data():

kernel BUG at fs/ext4/inline.c:1331! BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers

Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock() immediately after acquiring xattr_sem. This ensures ext4_update_inline_data() and ext4_create_inline_data() work with current values that are protected from concurrent modifications.

This is similar to commit a54c4613dac1 ("ext4: fix race writing to an inline_data file while its xattrs are changing") which fixed i_inline_off staleness. This patch addresses the related i_inline_size staleness issue.

Message-ID: <[email protected]>

---
 fs/ext4/inline.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -413,7 +413,12 @@ static int ext4_prepare_inline_data(hand
 		return -ENOSPC;
 
 	ext4_write_lock_xattr(inode, &no_expand);
-
+	/*
+	 * ei->i_inline_size may have changed since the initial check
+	 * if other xattrs were added. Recalculate to ensure
+	 * ext4_update_inline_data() validates against current capacity.
+	 */
+	(void) ext4_find_inline_data_nolock(inode);
 	if (ei->i_inline_off)
 		ret = ext4_update_inline_data(handle, inode, len);
 	else

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qianchang Zhao <[email protected]>

commit 1fab1fa091f5aa97265648b53ea031deedd26235 upstream.

ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack. The generic netlink handler (handle_generic_event()/handle_response()) fills entry->response under ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free entry->response without holding the same lock.

Under high concurrency this allows a race where handle_response() is copying data into entry->response while ipc_msg_send_request() has just freed it, leading to a slab-use-after-free reported by KASAN in handle_generic_event():

  BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]
  Write of size 12 at addr ffff888198ee6e20 by task pool/109349
  ...
  Freed by task:
    kvfree
    ipc_msg_send_request [ksmbd]
    ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]

Fix by:
- Taking ipc_msg_table_lock in ipc_msg_send_request() while validating entry->response, freeing it when invalid, and removing the entry from ipc_msg_table.
- Returning the final entry->response pointer to the caller only after the hash entry is removed under the lock.
- Returning NULL in the error path, preserving the original API semantics.

This makes all accesses to entry->response consistent with handle_response(), which already updates and fills the response buffer under ipc_msg_table_lock, and closes the race that allowed the UAF.

---
 fs/smb/server/transport_ipc.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

@@ -520,12 +520,16 @@ static void *ipc_msg_send_request(struct
 	up_write(&ipc_msg_table_lock);
 
 	ret = ipc_msg_send(msg);
-	if (ret)
+	if (ret) {
+		down_write(&ipc_msg_table_lock);
 		goto out;
+	}
 
 	ret = wait_event_interruptible_timeout(entry.wait,
 					       entry.response != NULL,
 					       IPC_WAIT_TIMEOUT);
+
+	down_write(&ipc_msg_table_lock);
 	if (entry.response) {
 		ret = ipc_validate_msg(&entry);
 		if (ret) {

@@ -534,7 +538,6 @@ static void *ipc_msg_send_request(struct
 		}
 	}
 out:
-	down_write(&ipc_msg_table_lock);
 	hash_del(&entry.ipc_table_hlist);
 	up_write(&ipc_msg_table_lock);
 	return entry.response;

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexander Sverdlin <[email protected]>

commit c14ecb555c3ee80eeb030a4e46d00e679537f03a upstream.

KCSAN reports:

BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:

 do_raw_write_lock+0x120/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:

 do_raw_write_lock+0x88/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

value changed: 0xffffffff -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:

CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111

Commit 1a365e822372 ("locking/spinlock/debug: Fix various data races") has adressed most of these races, but seems to be not consistent/not complete.

converted to WRITE_ONCE(), but not debug_write_lock_before() part. Do it now.

---
 kernel/locking/spinlock_debug.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -183,8 +183,8 @@ void do_raw_read_unlock(rwlock_t *lock)
 static inline void debug_write_lock_before(rwlock_t *lock)
 {
 	RWLOCK_BUG_ON(lock->magic != RWLOCK_MAGIC, lock, "bad magic");
-	RWLOCK_BUG_ON(lock->owner == current, lock, "recursion");
-	RWLOCK_BUG_ON(lock->owner_cpu == raw_smp_processor_id(),
+	RWLOCK_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion");
+	RWLOCK_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(),
 							lock, "cpu recursion");
 }
 

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alexey Nepomnyashih <[email protected]>

commit 0cd8feea8777f8d9b9a862b89c688b049a5c8475 upstream.

Fix a race between inline data destruction and block mapping.

The function ext4_destroy_inline_data_nolock() changes the inode data layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS. At the same time, another thread may execute ext4_map_blocks(), which tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks() or ext4_ind_map_blocks().

Without i_data_sem protection, ext4_ind_map_blocks() may receive inode with EXT4_INODE_EXTENTS flag and triggering assert.

kernel BUG at fs/ext4/indirect.c:546!
EXT4-fs (loop2): unmounting filesystem.
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546

Call Trace:
 <TASK>
 ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681
 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822
 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124
 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255
 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000
 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846
 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285
 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679
 call_write_iter include/linux/fs.h:2271 [inline]
 do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735
 do_iter_write+0x186/0x710 fs/read_write.c:861
 vfs_iter_write+0x70/0xa0 fs/read_write.c:902
 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685
 do_splice_from fs/splice.c:763 [inline]
 direct_splice_actor+0x10f/0x170 fs/splice.c:950
 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896
 do_splice_direct+0x1a9/0x280 fs/splice.c:1002
 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Message-ID: <[email protected]>

---
 fs/ext4/inline.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

@@ -446,9 +446,13 @@ static int ext4_destroy_inline_data_nolo
 	if (!ei->i_inline_off)
 		return 0;
 
+	down_write(&ei->i_data_sem);
+
 	error = ext4_get_inode_loc(inode, &is.iloc);
-	if (error)
+	if (error) {
+		up_write(&ei->i_data_sem);
 		return error;
+	}
 
 	error = ext4_xattr_ibody_find(inode, &i, &is);
 	if (error)

@@ -487,6 +491,7 @@ out:
 	brelse(is.iloc.bh);
 	if (error == -ENODATA)
 		error = 0;
+	up_write(&ei->i_data_sem);
 	return error;
 }
 

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Nikita Zhandarovich <[email protected]>

commit a51f025b5038abd3d22eed2ede4cd46793d89565 upstream.

Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its pointer to &struct comedi_async as intended. Thus, any such dereferencing of &s->async->cmd will lead to general protection fault and kernel crash.

Mitigate this problem by removing a call to pcl818_ai_cancel() from pcl818_detach() altogether. This way, if the subdevice setups its support for async commands, everything async-related will be handled via subdevice's own ->cancel() function in comedi_device_detach_locked() even before pcl818_detach(). If no support for asynchronous commands is provided, there is no need to cancel anything either.

[1] Syzbot crash:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762
...
Call Trace:
 <TASK>
 pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115
 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207
 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline]
 comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]

...

---
 drivers/comedi/drivers/pcl818.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

@@ -1111,10 +1111,9 @@ static void pcl818_detach(struct comedi_
 {
 	struct pcl818_private *devpriv = dev->private;
 
-	if (devpriv) {
-		pcl818_ai_cancel(dev, dev->read_subdev);
+	if (devpriv)
 		pcl818_reset(dev);
-	}
+
 	pcl818_free_dma(dev);
 	comedi_legacy_detach(dev);
 }

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Omar Sandoval <[email protected]>

commit 4da3768e1820cf15cced390242d8789aed34f54d upstream.

When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn instruction, discard the exception and retry the instruction if the code stream is changed (e.g. by a different vCPU) between when the CPU executes the instruction and when KVM decodes the instruction to get the next RIP.

As effectively predicted by commit 6ef88d6e36c2 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction"), failure to verify that the correct INTn instruction was decoded can effectively clobber guest state due to decoding the wrong instruction and thus specifying the wrong next RIP.

The bug most often manifests as "Oops: int3" panics on static branch checks in Linux guests. Enabling or disabling a static branch in Linux uses the kernel's "text poke" code patching mechanism. To modify code while other CPUs may be executing that code, Linux (temporarily) replaces the first byte of the original instruction with an int3 (opcode 0xcc), then patches in the new code stream except for the first byte, and finally replaces the int3 with the first byte of the new code stream. If a CPU hits the int3, i.e. executes the code while it's being modified, then the guest kernel must look up the RIP to determine how to handle the #BP, e.g. by emulating the new instruction. If the RIP is incorrect, then this lookup fails and the guest kernel panics.

The bug reproduces almost instantly by hacking the guest kernel to repeatedly check a static branch[1] while running a drgn script[2] on the host to constantly swap out the memory containing the guest's TSS.

[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b

---
 arch/x86/include/asm/kvm_host.h |    9 +++++++++
 arch/x86/kvm/svm/svm.c          |   24 +++++++++++++-----------
 arch/x86/kvm/x86.c              |   21 +++++++++++++++++++++
 3 files changed, 43 insertions(+), 11 deletions(-)

@@ -1950,6 +1950,11 @@ u64 vcpu_tsc_khz(struct kvm_vcpu *vcpu);
  *			     the gfn, i.e. retrying the instruction will hit a
  *			     !PRESENT fault, which results in a new shadow page
  *			     and sends KVM back to square one.
+ *
+ * EMULTYPE_SKIP_SOFT_INT - Set in combination with EMULTYPE_SKIP to only skip
+ *                          an instruction if it could generate a given software
+ *                          interrupt, which must be encoded via
+ *                          EMULTYPE_SET_SOFT_INT_VECTOR().
  */
 #define EMULTYPE_NO_DECODE	    (1 << 0)
 #define EMULTYPE_TRAP_UD	    (1 << 1)

@@ -1960,6 +1965,10 @@ u64 vcpu_tsc_khz(struct kvm_vcpu *vcpu);
 #define EMULTYPE_PF		    (1 << 6)
 #define EMULTYPE_COMPLETE_USER_EXIT (1 << 7)
 #define EMULTYPE_WRITE_PF_TO_SP	    (1 << 8)
+#define EMULTYPE_SKIP_SOFT_INT	    (1 << 9)
+
+#define EMULTYPE_SET_SOFT_INT_VECTOR(v)	((u32)((v) & 0xff) << 16)
+#define EMULTYPE_GET_SOFT_INT_VECTOR(e)	(((e) >> 16) & 0xff)
 
 int kvm_emulate_instruction(struct kvm_vcpu *vcpu, int emulation_type);
 int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,

@@ -370,6 +370,7 @@ static bool svm_can_emulate_instruction(
 					void *insn, int insn_len);
 
 static int __svm_skip_emulated_instruction(struct kvm_vcpu *vcpu,
+					   int emul_type,
 					   bool commit_side_effects)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);

@@ -399,7 +400,7 @@ static int __svm_skip_emulated_instructi
 		if (unlikely(!commit_side_effects))
 			old_rflags = svm->vmcb->save.rflags;
 
-		if (!kvm_emulate_instruction(vcpu, EMULTYPE_SKIP))
+		if (!kvm_emulate_instruction(vcpu, emul_type))
 			return 0;
 
 		if (unlikely(!commit_side_effects))

@@ -417,11 +418,13 @@ done:
 
 static int svm_skip_emulated_instruction(struct kvm_vcpu *vcpu)
 {
-	return __svm_skip_emulated_instruction(vcpu, true);
+	return __svm_skip_emulated_instruction(vcpu, EMULTYPE_SKIP, true);
 }
 
-static int svm_update_soft_interrupt_rip(struct kvm_vcpu *vcpu)
+static int svm_update_soft_interrupt_rip(struct kvm_vcpu *vcpu, u8 vector)
 {
+	const int emul_type = EMULTYPE_SKIP | EMULTYPE_SKIP_SOFT_INT |
+			      EMULTYPE_SET_SOFT_INT_VECTOR(vector);
 	unsigned long rip, old_rip = kvm_rip_read(vcpu);
 	struct vcpu_svm *svm = to_svm(vcpu);
 

@@ -437,7 +440,7 @@ static int svm_update_soft_interrupt_rip
 	 * in use, the skip must not commit any side effects such as clearing
 	 * the interrupt shadow or RFLAGS.RF.
 	 */
-	if (!__svm_skip_emulated_instruction(vcpu, !nrips))
+	if (!__svm_skip_emulated_instruction(vcpu, emul_type, !nrips))
 		return -EIO;
 
 	rip = kvm_rip_read(vcpu);

@@ -473,7 +476,7 @@ static void svm_inject_exception(struct
 	kvm_deliver_exception_payload(vcpu, ex);
 
 	if (kvm_exception_is_soft(ex->vector) &&
-	    svm_update_soft_interrupt_rip(vcpu))
+	    svm_update_soft_interrupt_rip(vcpu, ex->vector))
 		return;
 
 	svm->vmcb->control.event_inj = ex->vector

@@ -3668,11 +3671,12 @@ static bool svm_set_vnmi_pending(struct
 
 static void svm_inject_irq(struct kvm_vcpu *vcpu, bool reinjected)
 {
+	struct kvm_queued_interrupt *intr = &vcpu->arch.interrupt;
 	struct vcpu_svm *svm = to_svm(vcpu);
 	u32 type;
 
-	if (vcpu->arch.interrupt.soft) {
-		if (svm_update_soft_interrupt_rip(vcpu))
+	if (intr->soft) {
+		if (svm_update_soft_interrupt_rip(vcpu, intr->nr))
 			return;
 
 		type = SVM_EVTINJ_TYPE_SOFT;

@@ -3680,12 +3684,10 @@ static void svm_inject_irq(struct kvm_vc
 		type = SVM_EVTINJ_TYPE_INTR;
 	}
 
-	trace_kvm_inj_virq(vcpu->arch.interrupt.nr,
-			   vcpu->arch.interrupt.soft, reinjected);
+	trace_kvm_inj_virq(intr->nr, intr->soft, reinjected);
 	++vcpu->stat.irq_injections;
 
-	svm->vmcb->control.event_inj = vcpu->arch.interrupt.nr |
-				       SVM_EVTINJ_VALID | type;
+	svm->vmcb->control.event_inj = intr->nr | SVM_EVTINJ_VALID | type;
 }
 
 void svm_complete_interrupt_delivery(struct kvm_vcpu *vcpu, int delivery_mode,

@@ -8864,6 +8864,23 @@ static bool is_vmware_backdoor_opcode(st
 	return false;
 }
 
+static bool is_soft_int_instruction(struct x86_emulate_ctxt *ctxt,
+				    int emulation_type)
+{
+	u8 vector = EMULTYPE_GET_SOFT_INT_VECTOR(emulation_type);
+
+	switch (ctxt->b) {
+	case 0xcc:
+		return vector == BP_VECTOR;
+	case 0xcd:
+		return vector == ctxt->src.val;
+	case 0xce:
+		return vector == OF_VECTOR;
+	default:
+		return false;
+	}
+}
+
 /*
  * Decode an instruction for emulation.  The caller is responsible for handling
  * code breakpoints.  Note, manually detecting code breakpoints is unnecessary

@@ -8954,6 +8971,10 @@ int x86_emulate_instruction(struct kvm_v
 	 * injecting single-step #DBs.
 	 */
 	if (emulation_type & EMULTYPE_SKIP) {
+		if (emulation_type & EMULTYPE_SKIP_SOFT_INT &&
+		    !is_soft_int_instruction(ctxt, emulation_type))
+			return 0;
+
 		if (ctxt->mode != X86EMUL_MODE_PROT64)
 			ctxt->eip = (u32)ctxt->_eip;
 		else

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Slark Xiao <[email protected]>

commit 7970b4969c4c99bcdaf105f9f39c6d2021f6d244 upstream.

T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are three serial ports to be enumerated: Modem, NMEA and Diag.

test evidence as below:

T:  Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=5000  MxCh= 0
D:  Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e123 Rev=05.15
S:  Manufacturer=QCOM
S:  Product=SDXBAAGHA-IDP _SN:39A8D3E4
S:  SerialNumber=39a8d3e4
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms

0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag

---
 drivers/usb/serial/option.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -2376,6 +2376,8 @@ static const struct usb_device_id option
 	  .driver_info = RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff),			/* Foxconn T99W373 MBIM */
 	  .driver_info = RSVD(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe123, 0xff),			/* Foxconn T99W760 MBIM */
+	  .driver_info = RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe145, 0xff),			/* Foxconn T99W651 RNDIS */
 	  .driver_info = RSVD(5) | RSVD(6) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe15f, 0xff),                     /* Foxconn T99W709 */

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fabio Porcedda <[email protected]>

commit c908039a29aa70870871f4848125b3d743f929bf upstream.

Add the following Telit Cinterion new compositions:

0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c1 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag)

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  8 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c2 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag)

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  9 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c3 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=82(I) Atr=03(Int.) MxPS=  16 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag)

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c5 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag)

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c6 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb

T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c9 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb

T:  Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#=  9 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10cb Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

---
 drivers/usb/serial/option.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

@@ -1433,10 +1433,24 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b3, 0xff, 0xff, 0x60) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c0, 0xff),	/* Telit FE910C04 (rmnet) */
 	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c1, 0xff),	/* Telit FE910C04 (RNDIS) */
+	  .driver_info = NCTRL(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c2, 0xff),	/* Telit FE910C04 (MBIM) */
+	  .driver_info = NCTRL(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c3, 0xff),	/* Telit FE910C04 (ECM) */
+	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c4, 0xff),	/* Telit FE910C04 (rmnet) */
 	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c5, 0xff),	/* Telit FE910C04 (RNDIS) */
+	  .driver_info = NCTRL(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff),	/* Telit FE910C04 (MBIM) */
+	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff),	/* Telit FE910C04 (rmnet) */
 	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff),	/* Telit FE910C04 (MBIM) */
+	  .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10cb, 0xff),	/* Telit FE910C04 (RNDIS) */
+	  .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x30),	/* Telit FN990B (rmnet) */
 	  .driver_info = NCTRL(5) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fabio Porcedda <[email protected]>

commit 072f2c49572547f4b0776fe2da6b8f61e4b34699 upstream.

Move Telit 0x10c7 composition right after 0x10c6 composition and before 0x10c8 composition.

---
 drivers/usb/serial/option.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

@@ -1445,6 +1445,9 @@ static const struct usb_device_id option
 	  .driver_info = NCTRL(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c6, 0xff),	/* Telit FE910C04 (MBIM) */
 	  .driver_info = NCTRL(4) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30),	/* Telit FE910C04 (ECM) */
+	  .driver_info = NCTRL(4) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c8, 0xff),	/* Telit FE910C04 (rmnet) */
 	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10c9, 0xff),	/* Telit FE910C04 (MBIM) */

@@ -1455,9 +1458,6 @@ static const struct usb_device_id option
 	  .driver_info = NCTRL(5) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d0, 0xff, 0xff, 0x60) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x30),	/* Telit FE910C04 (ECM) */
-	  .driver_info = NCTRL(4) },
-	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10c7, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x30),	/* Telit FN990B (MBIM) */
 	  .driver_info = NCTRL(6) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10d1, 0xff, 0xff, 0x40) },

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit 4e31a5d0a9ee672f708fc993c1d5520643f769fd upstream.

Some FTDI devices have the first port reserved for JTAG and have been using a dedicated quirk to prevent binding to it.

As can be inferred directly or indirectly from the commit messages, almost all of these devices are dual port devices which means that the more recently added macro for matching on interface number can be used instead (and some such devices do so already).

This avoids probing interfaces that will never be bound and cleans up the match table somewhat.

Note that the JTAG quirk is kept for quad port devices, which would otherwise require three match entries.

---
 drivers/usb/serial/ftdi_sio.c |   72 ++++++++++++++----------------------------
 1 file changed, 24 insertions(+), 48 deletions(-)

@@ -628,10 +628,8 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_TAVIR_STK500_PID) },
-	{ USB_DEVICE(FTDI_VID, FTDI_TIAO_UMPA_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TIAO_UMPA_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_NT_ORIONLXM_PID, 1) },
 	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLX_PLUS_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORION_IO_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_NT_ORIONMX_PID) },

@@ -842,24 +840,17 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
-	{ USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, CYBER_CORTEX_AV_PID, 1) },
 	{ USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) },
 	{ USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) },
 	{ USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) },
 	{ USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) },
-	{ USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, FTDI_TURTELIZER_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(FIC_VID, FIC_NEO1973_DEBUG_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_OOCDLINK_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_DEVEL_BOARD_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_EVAL_BOARD_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, LMI_LM3S_ICDI_BOARD_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_TURTELIZER_PID, 1) },
 	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
 	{ USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_SCU18) },
 	{ USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },

@@ -901,17 +892,14 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(ATMEL_VID, STK541_PID) },
 	{ USB_DEVICE(DE_VID, STB_PID) },
 	{ USB_DEVICE(DE_VID, WHT_PID) },
-	{ USB_DEVICE(ADI_VID, ADI_GNICE_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICE_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(ADI_VID, ADI_GNICEPLUS_PID, 1) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
 					USB_CLASS_VENDOR_SPEC,
 					USB_SUBCLASS_VENDOR_SPEC, 0x00) },
 	{ USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) },
 	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
-	{ USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(MARVELL_VID, MARVELL_SHEEVAPLUG_PID, 1) },
 	{ USB_DEVICE(LARSENBRUSGAARD_VID, LB_ALTITRACK_PID) },
 	{ USB_DEVICE(GN_OTOMETRICS_VID, AURICAL_USB_PID) },
 	{ USB_DEVICE(FTDI_VID, PI_C865_PID) },

@@ -934,10 +922,8 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(PI_VID, PI_1016_PID) },
 	{ USB_DEVICE(KONDO_VID, KONDO_USB_SERIAL_PID) },
 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
-	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, TI_XDS100V2_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, MARVELL_OPENRD_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, TI_XDS100V2_PID, 1) },
 	{ USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
 	{ USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
 	{ USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },

@@ -946,18 +932,14 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(FTDI_VID, MJSG_SR_RADIO_PID) },
 	{ USB_DEVICE(FTDI_VID, MJSG_HD_RADIO_PID) },
 	{ USB_DEVICE(FTDI_VID, MJSG_XM_RADIO_PID) },
-	{ USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_ST_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_ST_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SLITE_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, XVERVE_SIGNALYZER_SH2_PID, 1) },
 	{ USB_DEVICE(FTDI_VID, XVERVE_SIGNALYZER_SH4_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
 	{ USB_DEVICE(FTDI_VID, SEGWAY_RMP200_PID) },
 	{ USB_DEVICE(FTDI_VID, ACCESIO_COM4SM_PID) },
-	{ USB_DEVICE(IONICS_VID, IONICS_PLUGCOMPUTER_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(IONICS_VID, IONICS_PLUGCOMPUTER_PID, 1) },
 	{ USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_24_MASTER_WING_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_PC_WING_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_CHAMSYS_USB_DMX_PID) },

@@ -972,15 +954,12 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_FHE_PID) },
 	{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
-	{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(ST_VID, ST_STMCLT_2232_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(ST_VID, ST_STMCLT_2232_PID, 1) },
 	{ USB_DEVICE(ST_VID, ST_STMCLT_4232_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
 	{ USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
-	{ USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID, 1) },
 	{ USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
 	/* Crucible Devices */
 	{ USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },

@@ -1055,8 +1034,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7561U_PID) },
 	{ USB_DEVICE(ICPDAS_VID, ICPDAS_I7563U_PID) },
 	{ USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
-	{ USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(TI_VID, TI_CC3200_LAUNCHPAD_PID, 1) },
 	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
 	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
 	{ USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) },

@@ -1076,10 +1054,8 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
 	{ USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },
 	/* FreeCalypso USB adapters */
-	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-	{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID),
-		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID, 1) },
+	{ USB_DEVICE_INTERFACE_NUMBER(FTDI_VID, FTDI_FALCONIA_JTAG_UNBUF_PID, 1) },
 	/* GMC devices */
 	{ USB_DEVICE(GMC_VID, GMC_Z216C_PID) },
 	/* Altera USB Blaster 3 */

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Magne Bruno <[email protected]>

commit 0e5a99e0e5f50353b86939ff6e424800d769c818 upstream.

Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI). Those cards are identified with different DeviceIds. Those cards integrating standard UARTs work the same way as PCI/PCIe models already supported in the serial driver.

---
 drivers/tty/serial/8250/8250_pci.c |   37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

@@ -1971,6 +1971,11 @@ pci_moxa_setup(struct serial_private *pr
 #define	PCI_DEVICE_ID_MOXA_CP138E_A	0x1381
 #define	PCI_DEVICE_ID_MOXA_CP168EL_A	0x1683
 
+#define PCI_DEVICE_ID_ADDIDATA_CPCI7500        0x7003
+#define PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG     0x7024
+#define PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG     0x7025
+#define PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG     0x7026
+
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584	0x1584
 #define PCI_SUBDEVICE_ID_UNKNOWN_0x1588	0x1588

@@ -5868,6 +5873,38 @@ static const struct pci_device_id serial
 		0,
 		pbn_ADDIDATA_PCIe_8_3906250 },
 
+	{	PCI_VENDOR_ID_ADDIDATA,
+		PCI_DEVICE_ID_ADDIDATA_CPCI7500,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+		pbn_b0_4_115200 },
+
+	{	PCI_VENDOR_ID_ADDIDATA,
+		PCI_DEVICE_ID_ADDIDATA_CPCI7500_NG,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+		pbn_b0_4_115200 },
+
+	{	PCI_VENDOR_ID_ADDIDATA,
+		PCI_DEVICE_ID_ADDIDATA_CPCI7420_NG,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+		pbn_b0_2_115200 },
+
+	{	PCI_VENDOR_ID_ADDIDATA,
+		PCI_DEVICE_ID_ADDIDATA_CPCI7300_NG,
+		PCI_ANY_ID,
+		PCI_ANY_ID,
+		0,
+		0,
+		pbn_b0_1_115200 },
+
 	{	PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,
 		PCI_VENDOR_ID_IBM, 0x0299,
 		0, 0, pbn_b0_bt_2_115200 },

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit b6e0b3016187446ddef9edac03cd9d544ac63f11 upstream.

Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.

Fix this long-standing regression dating back to 2003 when the tiocmset() callback was introduced.

---
 drivers/usb/serial/belkin_sa.c |   28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

@@ -436,7 +436,7 @@ static int belkin_sa_tiocmset(struct tty
 	struct belkin_sa_private *priv = usb_get_serial_port_data(port);
 	unsigned long control_state;
 	unsigned long flags;
-	int retval;
+	int retval = 0;
 	int rts = 0;
 	int dtr = 0;
 

@@ -453,26 +453,32 @@ static int belkin_sa_tiocmset(struct tty
 	}
 	if (clear & TIOCM_RTS) {
 		control_state &= ~TIOCM_RTS;
-		rts = 0;
+		rts = 1;
 	}
 	if (clear & TIOCM_DTR) {
 		control_state &= ~TIOCM_DTR;
-		dtr = 0;
+		dtr = 1;
 	}
 
 	priv->control_state = control_state;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
-	retval = BSA_USB_CMD(BELKIN_SA_SET_RTS_REQUEST, rts);
-	if (retval < 0) {
-		dev_err(&port->dev, "Set RTS error %d\n", retval);
-		goto exit;
+	if (rts) {
+		retval = BSA_USB_CMD(BELKIN_SA_SET_RTS_REQUEST,
+					!!(control_state & TIOCM_RTS));
+		if (retval < 0) {
+			dev_err(&port->dev, "Set RTS error %d\n", retval);
+			goto exit;
+		}
 	}
 
-	retval = BSA_USB_CMD(BELKIN_SA_SET_DTR_REQUEST, dtr);
-	if (retval < 0) {
-		dev_err(&port->dev, "Set DTR error %d\n", retval);
-		goto exit;
+	if (dtr) {
+		retval = BSA_USB_CMD(BELKIN_SA_SET_DTR_REQUEST,
+					!!(control_state & TIOCM_DTR));
+		if (retval < 0) {
+			dev_err(&port->dev, "Set DTR error %d\n", retval);
+			goto exit;
+		}
 	}
 exit:
 	return retval;

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johan Hovold <[email protected]>

commit d432df758f92c4c28aac409bc807fd1716167577 upstream.

Asserting or deasserting a modem control line using TIOCMBIS or TIOCMBIC should not deassert any lines that are not in the mask.

Fix this long-standing issue dating back to 2003 when the support for these ioctls was added with the introduction of the tiocmset() callback.

---
 drivers/usb/serial/kobil_sct.c |   18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

@@ -420,7 +420,7 @@ static int kobil_tiocmset(struct tty_str
 	struct usb_serial_port *port = tty->driver_data;
 	struct device *dev = &port->dev;
 	struct kobil_private *priv;
-	int result;
+	int result = 0;
 	int dtr = 0;
 	int rts = 0;
 

@@ -437,12 +437,12 @@ static int kobil_tiocmset(struct tty_str
 	if (set & TIOCM_DTR)
 		dtr = 1;
 	if (clear & TIOCM_RTS)
-		rts = 0;
+		rts = 1;
 	if (clear & TIOCM_DTR)
-		dtr = 0;
+		dtr = 1;
 
-	if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID) {
-		if (dtr != 0)
+	if (dtr && priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID) {
+		if (set & TIOCM_DTR)
 			dev_dbg(dev, "%s - Setting DTR\n", __func__);
 		else
 			dev_dbg(dev, "%s - Clearing DTR\n", __func__);

@@ -450,13 +450,13 @@ static int kobil_tiocmset(struct tty_str
 			  usb_sndctrlpipe(port->serial->dev, 0),
 			  SUSBCRequest_SetStatusLinesOrQueues,
 			  USB_TYPE_VENDOR | USB_RECIP_ENDPOINT | USB_DIR_OUT,
-			  ((dtr != 0) ? SUSBCR_SSL_SETDTR : SUSBCR_SSL_CLRDTR),
+			  ((set & TIOCM_DTR) ? SUSBCR_SSL_SETDTR : SUSBCR_SSL_CLRDTR),
 			  0,
 			  NULL,
 			  0,
 			  KOBIL_TIMEOUT);
-	} else {
-		if (rts != 0)
+	} else if (rts) {
+		if (set & TIOCM_RTS)
 			dev_dbg(dev, "%s - Setting RTS\n", __func__);
 		else
 			dev_dbg(dev, "%s - Clearing RTS\n", __func__);

@@ -464,7 +464,7 @@ static int kobil_tiocmset(struct tty_str
 			usb_sndctrlpipe(port->serial->dev, 0),
 			SUSBCRequest_SetStatusLinesOrQueues,
 			USB_TYPE_VENDOR | USB_RECIP_ENDPOINT | USB_DIR_OUT,
-			((rts != 0) ? SUSBCR_SSL_SETRTS : SUSBCR_SSL_CLRRTS),
+			((set & TIOCM_RTS) ? SUSBCR_SSL_SETRTS : SUSBCR_SSL_CLRRTS),
 			0,
 			NULL,
 			0,

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Song Liu <[email protected]>

[ Upstream commit 3e9a18e1c3e931abecf501cbb23d28d69f85bb56 ]

ftrace_hash_ipmodify_enable() checks IPMODIFY and DIRECT ftrace_ops on the same kernel function. When needed, ftrace_hash_ipmodify_enable() calls ops->ops_func() to prepare the direct ftrace (BPF trampoline) to share the same function as the IPMODIFY ftrace (livepatch).

ftrace_hash_ipmodify_enable() is called in register_ftrace_direct() path, but not called in modify_ftrace_direct() path. As a result, the following operations will break livepatch:

1. Load livepatch to a kernel function;
2. Attach fentry program to the kernel function;
3. Attach fexit program to the kernel function.

After 3, the kernel function being used will not be the livepatched version, but the original version.

Fix this by adding __ftrace_hash_update_ipmodify() to __modify_ftrace_direct() and adjust some logic around the call.

---
 kernel/trace/ftrace.c | 40 +++++++++++++++++++++++++++++++---------
 1 file changed, 31 insertions(+), 9 deletions(-)

index 44e31eebb7aaa..8f2d44e741510 100644
@@ -1937,7 +1937,8 @@ static void ftrace_hash_rec_enable_modify(struct ftrace_ops *ops,
  */
 static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
 					 struct ftrace_hash *old_hash,
-					 struct ftrace_hash *new_hash)
+					 struct ftrace_hash *new_hash,
+					 bool update_target)
 {
 	struct ftrace_page *pg;
 	struct dyn_ftrace *rec, *end = NULL;

@@ -1972,10 +1973,13 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
 		if (rec->flags & FTRACE_FL_DISABLED)
 			continue;
 
-		/* We need to update only differences of filter_hash */
+		/*
+		 * Unless we are updating the target of a direct function,
+		 * we only need to update differences of filter_hash
+		 */
 		in_old = !!ftrace_lookup_ip(old_hash, rec->ip);
 		in_new = !!ftrace_lookup_ip(new_hash, rec->ip);
-		if (in_old == in_new)
+		if (!update_target && (in_old == in_new))
 			continue;
 
 		if (in_new) {

@@ -1986,7 +1990,16 @@ static int __ftrace_hash_update_ipmodify(struct ftrace_ops *ops,
 				if (is_ipmodify)
 					goto rollback;
 
-				FTRACE_WARN_ON(rec->flags & FTRACE_FL_DIRECT);
+				/*
+				 * If this is called by __modify_ftrace_direct()
+				 * then it is only changing where the direct
+				 * pointer is jumping to, and the record already
+				 * points to a direct trampoline. If it isn't,
+				 * then it is a bug to update ipmodify on a direct
+				 * caller.
+				 */
+				FTRACE_WARN_ON(!update_target &&
+					       (rec->flags & FTRACE_FL_DIRECT));
 
 				/*
 				 * Another ops with IPMODIFY is already

@@ -2043,7 +2056,7 @@ static int ftrace_hash_ipmodify_enable(struct ftrace_ops *ops)
 	if (ftrace_hash_empty(hash))
 		hash = NULL;
 
-	return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash);
+	return __ftrace_hash_update_ipmodify(ops, EMPTY_HASH, hash, false);
 }
 
 /* Disabling always succeeds */

@@ -2054,7 +2067,7 @@ static void ftrace_hash_ipmodify_disable(struct ftrace_ops *ops)
 	if (ftrace_hash_empty(hash))
 		hash = NULL;
 
-	__ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH);
+	__ftrace_hash_update_ipmodify(ops, hash, EMPTY_HASH, false);
 }
 
 static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,

@@ -2068,7 +2081,7 @@ static int ftrace_hash_ipmodify_update(struct ftrace_ops *ops,
 	if (ftrace_hash_empty(new_hash))
 		new_hash = NULL;
 
-	return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash);
+	return __ftrace_hash_update_ipmodify(ops, old_hash, new_hash, false);
 }
 
 static void print_ip_ins(const char *fmt, const unsigned char *p)

@@ -5531,7 +5544,7 @@ EXPORT_SYMBOL_GPL(unregister_ftrace_direct);
 static int
 __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
 {
-	struct ftrace_hash *hash;
+	struct ftrace_hash *hash = ops->func_hash->filter_hash;
 	struct ftrace_func_entry *entry, *iter;
 	static struct ftrace_ops tmp_ops = {
 		.func		= ftrace_stub,

@@ -5551,13 +5564,21 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
 	if (err)
 		return err;
 
+	/*
+	 * Call __ftrace_hash_update_ipmodify() here, so that we can call
+	 * ops->ops_func for the ops. This is needed because the above
+	 * register_ftrace_function_nolock() worked on tmp_ops.
+	 */
+	err = __ftrace_hash_update_ipmodify(ops, hash, hash, true);
+	if (err)
+		goto out;
+
 	/*
 	 * Now the ftrace_ops_list_func() is called to do the direct callers.
 	 * We can safely change the direct functions attached to each entry.
 	 */
 	mutex_lock(&ftrace_lock);
 
-	hash = ops->func_hash->filter_hash;
 	size = 1 << hash->size_bits;
 	for (i = 0; i < size; i++) {
 		hlist_for_each_entry(iter, &hash->buckets[i], hlist) {

@@ -5572,6 +5593,7 @@ __modify_ftrace_direct(struct ftrace_ops *ops, unsigned long addr)
 
 	mutex_unlock(&ftrace_lock);
 
+out:
 	/* Removing the tmp_ops will add the updated direct callers to the functions */
 	unregister_ftrace_function(&tmp_ops);
 

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alvaro Gamez Machado <[email protected]>

[ Upstream commit 939edfaa10f1d22e6af6a84bf4bd96dc49c67302 ]

SPI devices using a (relative) slow frequency need a larger time.

For instance, microblaze running at 83.25MHz and performing a 3 bytes transaction using a 10MHz/16 = 625kHz needed this stall value increased to at least 20. The SPI device is quite slow, but also is the microblaze, so set this value to 32 to give it even more margin.

---
 drivers/spi/spi-xilinx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 8e6e3876aa9af..b5405d9974ba6 100644
@@ -299,7 +299,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t)
 
 		/* Read out all the data from the Rx FIFO */
 		rx_words = n_words;
-		stalled = 10;
+		stalled = 32;
 		while (rx_words) {
 			if (rx_words == n_words && !(stalled--) &&
 			    !(sr & XSPI_SR_TX_EMPTY_MASK) &&

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Robin Gong <[email protected]>

[ Upstream commit 86d57d9c07d54e8cb385ffe800930816ccdba0c1 ]

Since sdma hardware configure postpone to transfer phase, have to disable dma request before dma transfer setup because there is a hardware limitation on sdma event enable(ENBLn) as below:

"It is thus essential for the Arm platform to program them before any DMA
request is triggered to the SDMA, otherwise an unpredictable combination of channels may be started."

---
 drivers/spi/spi-imx.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

index da4442954375b..76f8747c29432 100644
@@ -503,9 +503,15 @@ static void mx51_ecspi_trigger(struct spi_imx_data *spi_imx)
 {
 	u32 reg;
 
-	reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
-	reg |= MX51_ECSPI_CTRL_XCH;
-	writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
+	if (spi_imx->usedma) {
+		reg = readl(spi_imx->base + MX51_ECSPI_DMA);
+		reg |= MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN;
+		writel(reg, spi_imx->base + MX51_ECSPI_DMA);
+	} else {
+		reg = readl(spi_imx->base + MX51_ECSPI_CTRL);
+		reg |= MX51_ECSPI_CTRL_XCH;
+		writel(reg, spi_imx->base + MX51_ECSPI_CTRL);
+	}
 }
 
 static void mx51_ecspi_disable(struct spi_imx_data *spi_imx)

@@ -699,7 +705,6 @@ static void mx51_setup_wml(struct spi_imx_data *spi_imx)
 	writel(MX51_ECSPI_DMA_RX_WML(spi_imx->wml - 1) |
 		MX51_ECSPI_DMA_TX_WML(tx_wml) |
 		MX51_ECSPI_DMA_RXT_WML(spi_imx->wml) |
-		MX51_ECSPI_DMA_TEDEN | MX51_ECSPI_DMA_RXDEN |
 		MX51_ECSPI_DMA_RXTDEN, spi_imx->base + MX51_ECSPI_DMA);
 }
 

@@ -1458,6 +1463,8 @@ static int spi_imx_dma_transfer(struct spi_imx_data *spi_imx,
 	reinit_completion(&spi_imx->dma_tx_completion);
 	dma_async_issue_pending(controller->dma_tx);
 
+	spi_imx->devtype_data->trigger(spi_imx);
+
 	transfer_timeout = spi_imx_calculate_timeout(spi_imx, transfer->len);
 
 	/* Wait SDMA to finish the data transfer.*/

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ian Forbes <[email protected]>

[ Upstream commit c1962742ffff7e245f935903a4658eb6f94f6058 ]

Rather than using an ad hoc reference count use kref which is atomic and has underflow warnings.

---
 drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

index 74ff2812d66a1..de2498749e276 100644
@@ -51,22 +51,22 @@ enum vmw_bo_dirty_method {
 
 /**
  * struct vmw_bo_dirty - Dirty information for buffer objects
+ * @ref_count: Reference count for this structure. Must be first member!
  * @start: First currently dirty bit
  * @end: Last currently dirty bit + 1
  * @method: The currently used dirty method
  * @change_count: Number of consecutive method change triggers
- * @ref_count: Reference count for this structure
  * @bitmap_size: The size of the bitmap in bits. Typically equal to the
  * nuber of pages in the bo.
  * @bitmap: A bitmap where each bit represents a page. A set bit means a
  * dirty page.
  */
 struct vmw_bo_dirty {
+	struct   kref ref_count;
 	unsigned long start;
 	unsigned long end;
 	enum vmw_bo_dirty_method method;
 	unsigned int change_count;
-	unsigned int ref_count;
 	unsigned long bitmap_size;
 	unsigned long bitmap[];
 };

@@ -235,7 +235,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
 	int ret;
 
 	if (dirty) {
-		dirty->ref_count++;
+		kref_get(&dirty->ref_count);
 		return 0;
 	}
 

@@ -249,7 +249,7 @@ int vmw_bo_dirty_add(struct vmw_bo *vbo)
 	dirty->bitmap_size = num_pages;
 	dirty->start = dirty->bitmap_size;
 	dirty->end = 0;
-	dirty->ref_count = 1;
+	kref_init(&dirty->ref_count);
 	if (num_pages < PAGE_SIZE / sizeof(pte_t)) {
 		dirty->method = VMW_BO_DIRTY_PAGETABLE;
 	} else {

@@ -288,10 +288,8 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo)
 {
 	struct vmw_bo_dirty *dirty = vbo->dirty;
 
-	if (dirty && --dirty->ref_count == 0) {
-		kvfree(dirty);
+	if (dirty && kref_put(&dirty->ref_count, (void *)kvfree))
 		vbo->dirty = NULL;
-	}
 }
 
 /**

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Max Chou <[email protected]>

[ Upstream commit cd8dbd9ef600435439bb0e70af0a1d9e2193aecb ]

For chips with security enabled, it's only possible to load firmware with a valid signature pattern.
If key_id is not zero, it indicates a security chip, and the driver will not load the config file.

- Example log for a security chip.

Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301
Bluetooth: hci0: RTL: fw version 0x41c0c905

- Example log for a normal chip.

Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a
lmp_ver=0c lmp_subver=8922
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: btrtl_initialize: key id 0
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin
Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin
Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307
Bluetooth: hci0: RTL: fw version 0x41c0c905

---
 drivers/bluetooth/btrtl.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

index 24dae5440c036..3d995790a5071 100644
@@ -49,7 +49,7 @@
 
 #define	RTL_CHIP_SUBVER (&(struct rtl_vendor_cmd) {{0x10, 0x38, 0x04, 0x28, 0x80}})
 #define	RTL_CHIP_REV    (&(struct rtl_vendor_cmd) {{0x10, 0x3A, 0x04, 0x28, 0x80}})
-#define	RTL_SEC_PROJ    (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0x0D, 0x00, 0xb0}})
+#define	RTL_SEC_PROJ    (&(struct rtl_vendor_cmd) {{0x10, 0xA4, 0xAD, 0x00, 0xb0}})
 
 #define RTL_PATCH_SNIPPETS		0x01
 #define RTL_PATCH_DUMMY_HEADER		0x02

@@ -513,7 +513,6 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 {
 	struct rtl_epatch_header_v2 *hdr;
 	int rc;
-	u8 reg_val[2];
 	u8 key_id;
 	u32 num_sections;
 	struct rtl_section *section;

@@ -528,14 +527,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 		.len  = btrtl_dev->fw_len - 7, /* Cut the tail */
 	};
 
-	rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
-	if (rc < 0)
-		return -EIO;
-	key_id = reg_val[0];
-
-	rtl_dev_dbg(hdev, "%s: key id %u", __func__, key_id);
-
-	btrtl_dev->key_id = key_id;
+	key_id = btrtl_dev->key_id;
 
 	hdr = rtl_iov_pull_data(&iov, sizeof(*hdr));
 	if (!hdr)

@@ -1049,6 +1041,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 	u16 hci_rev, lmp_subver;
 	u8 hci_ver, lmp_ver, chip_type = 0;
 	int ret;
+	int rc;
+	u8 key_id;
 	u8 reg_val[2];
 
 	btrtl_dev = kzalloc(sizeof(*btrtl_dev), GFP_KERNEL);

@@ -1159,6 +1153,14 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 		goto err_free;
 	}
 
+	rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
+	if (rc < 0)
+		goto err_free;
+
+	key_id = reg_val[0];
+	btrtl_dev->key_id = key_id;
+	rtl_dev_info(hdev, "%s: key id %u", __func__, key_id);
+
 	btrtl_dev->fw_len = -EIO;
 	if (lmp_subver == RTL_ROM_LMP_8852A && hci_rev == 0x000c) {
 		snprintf(fw_name, sizeof(fw_name), "%s_v2.bin",

@@ -1181,7 +1183,7 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 		goto err_free;
 	}
 
-	if (btrtl_dev->ic_info->cfg_name) {
+	if (btrtl_dev->ic_info->cfg_name && !btrtl_dev->key_id) {
 		if (postfix) {
 			snprintf(cfg_name, sizeof(cfg_name), "%s-%s.bin",
 				 btrtl_dev->ic_info->cfg_name, postfix);

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yiqi Sun <[email protected]>

[ Upstream commit ed6612165b74f09db00ef0abaf9831895ab28b7f ]

Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() is always FALSE and invalid.

Fix the comparison in if statement.

---
 fs/smb/client/fs_context.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a64c0b0dbec78..6358f2483c869 100644
@@ -1386,7 +1386,7 @@ static int smb3_fs_context_parse_param(struct fs_context *fc,
 			break;
 		}
 
-		if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) >
+		if (strnlen(param->string, CIFS_MAX_USERNAME_LEN) ==
 		    CIFS_MAX_USERNAME_LEN) {
 			pr_warn("username too long\n");
 			goto cifs_parse_mount_err;

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Lushih Hsieh <[email protected]>

[ Upstream commit 21a9ab5b90b3716a631d559e62818029b4e7f5b7 ]

The PureAudio APA DAC and Lotus DAC5 series are USB Audio 2.0 Class devices that support native Direct Stream Digital (DSD) playback via specific vendor protocols.

Without these quirks, the devices may only function in standard PCM mode, or fail to correctly report their DSD format capabilities to the ALSA framework, preventing native DSD playback under Linux.

This commit adds new quirk entries for the mentioned DAC models based on their respective Vendor/Product IDs (VID:PID), for example:
0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc.

The quirk ensures correct DSD format handling by setting the required SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA DSD API to correctly address the device for high-bitrate DSD streams, bypassing the need for DoP (DSD over PCM).

Test on APA DAC and Lotus DAC5 SE under Arch Linux.

---
 sound/usb/quirks.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 68238e62020b0..44274f39d6937 100644
@@ -1922,6 +1922,8 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
 	case USB_ID(0x16d0, 0x09d8): /* NuPrime IDA-8 */
 	case USB_ID(0x16d0, 0x09db): /* NuPrime Audio DAC-9 */
 	case USB_ID(0x16d0, 0x09dd): /* Encore mDSD */
+	case USB_ID(0x16d0, 0x0ab1): /* PureAudio APA DAC */
+	case USB_ID(0x16d0, 0xeca1): /* PureAudio Lotus DAC5, DAC5 SE, DAC5 Pro */
 	case USB_ID(0x1db5, 0x0003): /* Bryston BDA3 */
 	case USB_ID(0x20a0, 0x4143): /* WaveIO USB Audio 2.0 */
 	case USB_ID(0x22e1, 0xca01): /* HDTA Serenade DSD */

@@ -2189,6 +2191,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
 		   QUIRK_FLAG_IGNORE_CLOCK_SOURCE),
 	DEVICE_FLG(0x1686, 0x00dd, /* Zoom R16/24 */
 		   QUIRK_FLAG_TX_LENGTH | QUIRK_FLAG_CTL_MSG_DELAY_1M),
+	DEVICE_FLG(0x16d0, 0x0ab1, /* PureAudio APA DAC */
+		   QUIRK_FLAG_DSD_RAW),
+	DEVICE_FLG(0x16d0, 0xeca1, /* PureAudio Lotus DAC5, DAC5 SE and DAC5 Pro */
+		   QUIRK_FLAG_DSD_RAW),
 	DEVICE_FLG(0x17aa, 0x1046, /* Lenovo ThinkStation P620 Rear Line-in, Line-out and Microphone */
 		   QUIRK_FLAG_DISABLE_AUTOSUSPEND),
 	DEVICE_FLG(0x17aa, 0x104d, /* Lenovo ThinkStation P620 Internal Speaker + Front Headset */

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tetsuo Handa <[email protected]>

[ Upstream commit 34ab4c75588c07cca12884f2bf6b0347c7a13872 ]

syzbot is reporting that S_IFMT bits of inode->i_mode can become bogus when the S_IFMT bits of the 32bits "mode" field loaded from disk are corrupted or when the 32bits "attributes" field loaded from disk are corrupted.

A documentation says that BFS uses only lower 9 bits of the "mode" field. But I can't find an explicit explanation that the unused upper 23 bits (especially, the S_IFMT bits) are initialized with 0.

Therefore, ignore the S_IFMT bits of the "mode" field loaded from disk. Also, verify that the value of the "attributes" field loaded from disk is either BFS_VREG or BFS_VDIR (because BFS supports only regular files and the root directory).

---
 fs/bfs/inode.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

index e6a76ae9eb444..42805e3dbdaec 100644
@@ -60,7 +60,19 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
 	off = (ino - BFS_ROOT_INO) % BFS_INODES_PER_BLOCK;
 	di = (struct bfs_inode *)bh->b_data + off;
 
-	inode->i_mode = 0x0000FFFF & le32_to_cpu(di->i_mode);
+	/*
+	 * https://martin.hinner.info/fs/bfs/bfs-structure.html explains that
+	 * BFS in SCO UnixWare environment used only lower 9 bits of di->i_mode
+	 * value. This means that, although bfs_write_inode() saves whole
+	 * inode->i_mode bits (which include S_IFMT bits and S_IS{UID,GID,VTX}
+	 * bits), middle 7 bits of di->i_mode value can be garbage when these
+	 * bits were not saved by bfs_write_inode().
+	 * Since we can't tell whether middle 7 bits are garbage, use only
+	 * lower 12 bits (i.e. tolerate S_IS{UID,GID,VTX} bits possibly being
+	 * garbage) and reconstruct S_IFMT bits for Linux environment from
+	 * di->i_vtype value.
+	 */
+	inode->i_mode = 0x00000FFF & le32_to_cpu(di->i_mode);
 	if (le32_to_cpu(di->i_vtype) == BFS_VDIR) {
 		inode->i_mode |= S_IFDIR;
 		inode->i_op = &bfs_dir_inops;

@@ -70,6 +82,11 @@ struct inode *bfs_iget(struct super_block *sb, unsigned long ino)
 		inode->i_op = &bfs_file_inops;
 		inode->i_fop = &bfs_file_operations;
 		inode->i_mapping->a_ops = &bfs_aops;
+	} else {
+		brelse(bh);
+		printf("Unknown vtype=%u %s:%08lx\n",
+		       le32_to_cpu(di->i_vtype), inode->i_sb->s_id, ino);
+		goto error;
 	}
 
 	BFS_I(inode)->i_sblock =  le32_to_cpu(di->i_sblock);

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mario Limonciello (AMD) <[email protected]>

[ Upstream commit 534ca75e8e3b713514b3f2da85dab96831cf5b2a ]

USB Elan devices have the same problem as the I2C ones with a fake battery device showing up.

---
 drivers/hid/hid-input.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

index f073d5621050a..fa3efe9701c96 100644
@@ -386,10 +386,11 @@ static const struct hid_device_id hid_battery_quirks[] = {
 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_CHROMEBOOK_TROGDOR_POMPOM),
 	  HID_BATTERY_QUIRK_AVOID_QUERY },
 	/*
-	 * Elan I2C-HID touchscreens seem to all report a non present battery,
-	 * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C-HID devices.
+	 * Elan HID touchscreens seem to all report a non present battery,
+	 * set HID_BATTERY_QUIRK_IGNORE for all Elan I2C and USB HID devices.
 	 */
 	{ HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_ELAN, HID_ANY_ID), HID_BATTERY_QUIRK_IGNORE },
 	{}
 };
 

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Keith Busch <[email protected]>

[ Upstream commit 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 ]

The namespaces can access the controller's admin request_queue, and stale references on the namespaces may exist after tearing down the controller. Ensure the admin request_queue is active by moving the controller's 'put' to after all controller references have been released to ensure no one is can access the request_queue. This fixes a reported use-after-free bug:

  BUG: KASAN: slab-use-after-free in blk_queue_enter+0x41c/0x4a0
  Read of size 8 at addr ffff88c0a53819f8 by task nvme/3287
  CPU: 67 UID: 0 PID: 3287 Comm: nvme Tainted: G            E       6.13.2-ga1582f1a031e #15
  Tainted: [E]=UNSIGNED_MODULE
  Hardware name: Jabil /EGS 2S MB1, BIOS 1.00 06/18/2025
  Call Trace:
   <TASK>
   dump_stack_lvl+0x4f/0x60
   print_report+0xc4/0x620
   ? _raw_spin_lock_irqsave+0x70/0xb0
   ? _raw_read_unlock_irqrestore+0x30/0x30
   ? blk_queue_enter+0x41c/0x4a0
   kasan_report+0xab/0xe0
   ? blk_queue_enter+0x41c/0x4a0
   blk_queue_enter+0x41c/0x4a0
   ? __irq_work_queue_local+0x75/0x1d0
   ? blk_queue_start_drain+0x70/0x70
   ? irq_work_queue+0x18/0x20
   ? vprintk_emit.part.0+0x1cc/0x350
   ? wake_up_klogd_work_func+0x60/0x60
   blk_mq_alloc_request+0x2b7/0x6b0
   ? __blk_mq_alloc_requests+0x1060/0x1060
   ? __switch_to+0x5b7/0x1060
   nvme_submit_user_cmd+0xa9/0x330
   nvme_user_cmd.isra.0+0x240/0x3f0
   ? force_sigsegv+0xe0/0xe0
   ? nvme_user_cmd64+0x400/0x400
   ? vfs_fileattr_set+0x9b0/0x9b0
   ? cgroup_update_frozen_flag+0x24/0x1c0
   ? cgroup_leave_frozen+0x204/0x330
   ? nvme_ioctl+0x7c/0x2c0
   blkdev_ioctl+0x1a8/0x4d0
   ? blkdev_common_ioctl+0x1930/0x1930
   ? fdget+0x54/0x380
   __x64_sys_ioctl+0x129/0x190
   do_syscall_64+0x5b/0x160
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7f765f703b0b
  Code: ff ff ff 85 c0 79 9b 49 c7 c4 ff ff ff ff 5b 5d 4c 89 e0 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 52 0f 00 f7 d8 64 89 01 48
  RSP: 002b:00007ffe2cefe808 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
  RAX: ffffffffffffffda RBX: 00007ffe2cefe860 RCX: 00007f765f703b0b
  RDX: 00007ffe2cefe860 RSI: 00000000c0484e41 RDI: 0000000000000003
  RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
  R10: 00007f765f611d50 R11: 0000000000000202 R12: 0000000000000003
  R13: 00000000c0484e41 R14: 0000000000000001 R15: 00007ffe2cefea60
   </TASK>

---
 drivers/nvme/host/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 78d00e25a1790..f09ebcbe11798 100644
@@ -4318,7 +4318,6 @@ EXPORT_SYMBOL_GPL(nvme_alloc_admin_tag_set);
 void nvme_remove_admin_tag_set(struct nvme_ctrl *ctrl)
 {
 	blk_mq_destroy_queue(ctrl->admin_q);
-	blk_put_queue(ctrl->admin_q);
 	if (ctrl->ops->flags & NVME_F_FABRICS) {
 		blk_mq_destroy_queue(ctrl->fabrics_q);
 		blk_put_queue(ctrl->fabrics_q);

@@ -4463,6 +4462,8 @@ static void nvme_free_ctrl(struct device *dev)
 		container_of(dev, struct nvme_ctrl, ctrl_device);
 	struct nvme_subsystem *subsys = ctrl->subsys;
 
+	if (ctrl->admin_q)
+		blk_put_queue(ctrl->admin_q);
 	if (!subsys || ctrl->instance != subsys->instance)
 		ida_free(&nvme_instance_ida, ctrl->instance);
 

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Praveen Talari <[email protected]>

[ Upstream commit 1c2e70397b4125022dba80f6111271a37fb36bae ]

Replace disable_irq() with disable_irq_nosync() in msm_pinmux_set_mux() to prevent deadlock when wakeup IRQ is triggered on the same GPIO being reconfigured.

The issue occurs when a wakeup IRQ is triggered on a GPIO and the IRQ handler attempts to reconfigure the same GPIO's pinmux. In this scenario, msm_pinmux_set_mux() calls disable_irq() which waits for the currently running IRQ handler to complete, creating a circular dependency that results in deadlock.

Using disable_irq_nosync() avoids waiting for the IRQ handler to complete, preventing the deadlock condition while still properly disabling the interrupt during pinmux reconfiguration.

---
 drivers/pinctrl/qcom/pinctrl-msm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 13dc8bc1d0cff..688f3d01f4af8 100644
@@ -214,7 +214,7 @@ static int msm_pinmux_set_mux(struct pinctrl_dev *pctldev,
 	 */
 	if (d && i != gpio_func &&
 	    !test_and_set_bit(d->hwirq, pctrl->disabled_for_mux))
-		disable_irq(irq);
+		disable_irq_nosync(irq);
 
 	raw_spin_lock_irqsave(&pctrl->lock, flags);
 

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Armin Wolf <[email protected]>

[ Upstream commit 444a9256f8d106e08a6bc2dc8ef28a8699e4b3ba ]

On the Acer Nitro AN515-58, the event 4 - 0 is send by the ACPI firmware when the backlight up/down keys are pressed. Ignore this event to avoid spamming the kernel log with error messages, as the acpi-video driver already handles brightness up/down events.

---
 drivers/platform/x86/acer-wmi.c | 4 ++++
 1 file changed, 4 insertions(+)

index 868faccfb8628..e7a43f824272f 100644
@@ -86,6 +86,7 @@ MODULE_ALIAS("wmi:676AA15E-6A47-4D9F-A2CC-1E6D18D14026");
 
 enum acer_wmi_event_ids {
 	WMID_HOTKEY_EVENT = 0x1,
+	WMID_BACKLIGHT_EVENT = 0x4,
 	WMID_ACCEL_OR_KBD_DOCK_EVENT = 0x5,
 	WMID_GAMING_TURBO_KEY_EVENT = 0x7,
 	WMID_AC_EVENT = 0x8,

@@ -1992,6 +1993,9 @@ static void acer_wmi_notify(u32 value, void *context)
 			sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
 		}
 		break;
+	case WMID_BACKLIGHT_EVENT:
+		/* Already handled by acpi-video */
+		break;
 	case WMID_ACCEL_OR_KBD_DOCK_EVENT:
 		acer_gsensor_event();
 		acer_kbd_dock_event(&return_value);

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: April Grimoire <[email protected]>

[ Upstream commit 743c81cdc98fd4fef62a89eb70efff994112c2d9 ]

SONiX AK870 PRO keyboard pretends to be an apple keyboard by VID:PID, rendering function keys not treated properly. Despite being a SONiX USB DEVICE, it uses a different name, so adding it to the list.

---
 drivers/hid/hid-apple.c | 1 +
 1 file changed, 1 insertion(+)

index 7cf17c671da48..2b8021628d3c6 100644
@@ -341,6 +341,7 @@ static const struct apple_key_translation swapped_fn_leftctrl_keys[] = {
 
 static const struct apple_non_apple_keyboard non_apple_keyboards[] = {
 	{ "SONiX USB DEVICE" },
+	{ "SONiX AK870 PRO" },
 	{ "Keychron" },
 	{ "AONE" },
 	{ "GANSS" },

2.51.0

6.6-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jia Ston <[email protected]>