6.18.14-rc1 review

This is the start of the stable review cycle for the 6.18.14 release. There are 641 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 27 Feb 2026 01:22:34 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.14-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.14-rc1

Huacai Chen <[email protected]>
net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz

Ivan Lipski <[email protected]>
drm/amd/display: Clear HDMI HPD pending work only if it is enabled

Martin KaFai Lau <[email protected]>
selftests/bpf: Test bpf_skb_check_mtu(BPF_MTU_CHK_SEGS) when transport_header is not set

Joanne Koong <[email protected]>
io_uring/rsrc: clean up buffer cloning arg validation

Jan Kiszka <[email protected]>
Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT

Jeongjun Park <[email protected]>
drm/exynos: vidi: fix to avoid directly dereferencing user pointer

Jeongjun Park <[email protected]>

    drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

Lewis Mason <[email protected]>
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)

Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314

Eric Naim <[email protected]>
ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)

Shengjiu Wang <[email protected]>
ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names

Shengjiu Wang <[email protected]>
ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names

Shengjiu Wang <[email protected]>
ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false

Vikram Sharma <[email protected]>
dt-bindings: media: qcom,qcs8300-camss: Add missing power supplies

Abel Vesa <[email protected]>
dt-bindings: phy: qcom-edp: Add missing clock for X Elite

Daniel Hodges <[email protected]>
SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path

Chuck Lever <[email protected]>
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths

Damien Le Moal <[email protected]>
ata: libata-scsi: avoid Non-NCQ command starvation

Damien Le Moal <[email protected]>
ata: libata-scsi: refactor ata_scsi_translate()

Linus Walleij <[email protected]>
ata: pata_ftide010: Fix some DMA timings

Jan Kara <[email protected]>
ext4: use optimized mballoc scanning regardless of inode format

Jan Kara <[email protected]>
ext4: always allocate blocks only from groups inode can use

Brian Foster <[email protected]>
ext4: fix dirtyclusters double decrement on fs shutdown

Yongjian Sun <[email protected]>
ext4: fix e4b bitmap inconsistency reports

Zilin Guan <[email protected]>
ext4: fix memory leak in ext4_ext_shift_extents()

Zhang Yi <[email protected]>
ext4: drop extent cache when splitting extent fails

Zhang Yi <[email protected]>
ext4: drop extent cache after doing PARTIAL_VALID1 zeroout

Zhang Yi <[email protected]>
ext4: don't cache extent during splitting extent

Zhang Yi <[email protected]>
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1

Zhang Yi <[email protected]>
ext4: subdivide EXT4_EXT_DATA_VALID1

Yao Zi <[email protected]>
MIPS: Work around LLVM bug when gp is used as global register variable

Thomas Richard (TI) <[email protected]>
usb: cdns3: fix role switching during resume

Mario Kleiner <[email protected]>
drm/amd/display: Use same max plane scaling limits for all 64 bpp formats

Detlev Casanova <[email protected]>
ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk

Ethan Tidmore <[email protected]>
x86/hyperv: Fix error pointer dereference

Filipe Manana <[email protected]>
btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found

Filipe Manana <[email protected]>
btrfs: use the correct type to initialize block reserve for delayed refs

Jiasheng Jiang <[email protected]>
btrfs: reset block group size class when it becomes empty

Filipe Manana <[email protected]>
btrfs: reduce block group critical section in btrfs_free_reserved_bytes()

Filipe Manana <[email protected]>
btrfs: remove fs_info argument from btrfs_try_granting_tickets()

Kiryl Shutsemau (Meta) <[email protected]>
efi: Fix reservation of unaccepted memory table

Dmitry Torokhov <[email protected]>
gpio: amd-fch: ionly return allowed values from amd_fch_gpio_get()

Raag Jadav <[email protected]>
drm/xe/bo: Redirect faults to dummy page for wedged device

Shuicheng Lin <[email protected]>
drm/xe: Make xe_modparam.force_vram_bar_size signed

Matt Roper <[email protected]>

    drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138

Shuicheng Lin <[email protected]>
drm/xe/mmio: Avoid double-adjust in 64-bit reads

Michal Wajdeczko <[email protected]>
drm/xe/configfs: Fix 'parameter name omitted' errors

Alexander Egorenkov <[email protected]>
s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n

Felix Gu <[email protected]>
spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix out-of-bounds stream encoder index v3

Timur Kristóf <[email protected]>
drm/amd/display: Reject cursor plane on DCE when scaled differently than primary

Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

Kai-Heng Feng <[email protected]>
PCI: Validate window resource type in pbus_select_window_for_type()

Alexandre Ferrieux <[email protected]>
ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init

Kaushlendra Kumar <[email protected]>
drm/i915/acpi: free _DSM package when no connectors

Ziyi Guo <[email protected]>
ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()

Li RongQing <[email protected]>
mshv: fix SRCU protection in irqfd resampler ack handler

Alex Deucher <[email protected]>
drm/amdgpu/sdma6: enable queue resets unconditionally

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: enable queue resets unconditionally

Alex Deucher <[email protected]>
drm/amdgpu/sdma5: enable queue resets unconditionally

Alex Deucher <[email protected]>
drm/amdgpu: move reset debug disable handling

Zilin Guan <[email protected]>
drm/amdgpu: Fix memory leak in amdgpu_ras_init()

Zilin Guan <[email protected]>
drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()

Zilin Guan <[email protected]>
drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

John Johansen <[email protected]>
apparmor: fix aa_label to return state from compount and component match

Georgia Garcia <[email protected]>
apparmor: fix invalid deref of rawdata when export_binary is unset

Zhengmian Hu <[email protected]>
apparmor: avoid per-cpu hold underflow in aa_get_buffer

John Johansen <[email protected]>
apparmor: make label_match return a consistent value

John Johansen <[email protected]>
apparmor: remove apply_modes_to_perms from label_match

John Johansen <[email protected]>
apparmor: fix rlimit for posix cpu timers

John Johansen <[email protected]>
apparmor: move check for aa_null file to cover all cases

Ryan Lee <[email protected]>
apparmor: account for in_atomic removal in common_file_perm

John Johansen <[email protected]>
apparmor: drop in_atomic flag in common_mmap, and common_file_perm

Ryan Lee <[email protected]>
apparmor: fix boolean argument in apparmor_mmap_file

Ryan Lee <[email protected]>
apparmor: return -ENOMEM in unpack_perms_table upon alloc failure

Helge Deller <[email protected]>
apparmor: Fix & Optimize table creation from possibly unaligned memory

Helge Deller <[email protected]>
AppArmor: Allow apparmor to handle unaligned dfa tables

John Johansen <[email protected]>
apparmor: fix NULL sock in aa_sock_file_perm

System Administrator <root@localhost>
apparmor: fix NULL pointer dereference in __unix_needs_revalidation

Cosmin Ratiu <[email protected]>
net/mlx5e: Use unsigned for mlx5e_get_max_num_channels

Cosmin Ratiu <[email protected]>
net/mlx5e: Fix deadlocks between devlink and netdev instance locks

Gal Pressman <[email protected]>
net/mlx5: Fix misidentification of write combining CQE during poll loop

Shay Drory <[email protected]>
net/mlx5: Fix multiport device check over light SFs

Hangbin Liu <[email protected]>
bonding: alb: fix UAF in rlb_arp_recv during bond up/down

Vikas Gupta <[email protected]>
bnge: fix reserving resources from FW

Dimitri Daskalakis <[email protected]>
eth: fbnic: Advertise supported XDP features.

Hariprasad Kelam <[email protected]>
octeontx2-af: Fix default entries mcam entry action

Eric Dumazet <[email protected]>
ipv6: icmp: remove obsolete code in icmpv6_xrlim_allow()

Eric Dumazet <[email protected]>
inet: move icmp_global_{credit,stamp} to a separate cache line

Eric Dumazet <[email protected]>
icmp: prevent possible overflow in icmp_global_allow()

Dimitri Daskalakis <[email protected]>
eth: fbnic: Add validation for MTU changes

Eric Dumazet <[email protected]>
macvlan: observe an RCU grace period in macvlan_common_newlink() error path

Jakub Kicinski <[email protected]>
selftests: tc_actions: don't dump 2MB of \0 to stdout

Eric Dumazet <[email protected]>
ping: annotate data-races in ping_lookup()

Arnd Bergmann <[email protected]>
net: psp: select CONFIG_SKB_EXTENSIONS

Jakub Kicinski <[email protected]>
bpftool: Fix truncated netlink dumps

Eric Dumazet <[email protected]>
ipv6: fix a race in ip6_sock_set_v6only()

Inseo An <[email protected]>
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

Pablo Neira Ayuso <[email protected]>
net: remove WARN_ON_ONCE when accessing forward path array

Julian Anastasov <[email protected]>
ipvs: do not keep dest_dst if dev is going down

Florian Westphal <[email protected]>
netfilter: nf_conntrack_h323: don't pass uninitialised l3num value

Aleksei Oladko <[email protected]>
selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled

Aleksei Oladko <[email protected]>
selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled

Nikolay Aleksandrov <[email protected]>
net: bridge: mcast: always update mdb_n_entries for vlan contexts

Allison Henderson <[email protected]>
net/rds: rds_sendmsg should not discard payload_len

Ziyi Guo <[email protected]>
xen-netback: reject zero-queue configuration from guest

Ziyi Guo <[email protected]>
net: usb: catc: enable basic endpoint checking

Antonio Quartulli <[email protected]>
ovpn: tcp - don't deref NULL sk_socket member after tcp_close()

Bobby Eshleman <[email protected]>
eth: fbnic: set DMA_HINT_L4 for all flows

Bobby Eshleman <[email protected]>
eth: fbnic: increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes

Bobby Eshleman <[email protected]>
eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0

Mohsin Bashir <[email protected]>
eth: fbnic: Configure RDE settings for pause frame

Anton Protopopov <[email protected]>
bpf: Add a map/btf from a fd array more consistently

Anton Protopopov <[email protected]>
bpf: Fix a potential use-after-free of BTF object

Amery Hung <[email protected]>
libbpf: Fix invalid write loop logic in bpf_linker__add_buf()

Chengfeng Ye <[email protected]>
fbnic: close fw_log race between users and teardown

Daniel Machon <[email protected]>
net: sparx5/lan969x: fix PTP clock max_adj value

Kuniyuki Iwashima <[email protected]>
ipv6: Fix out-of-bound access in fib6_add_rt2node().

Pin-yen Lin <[email protected]>
selftests: netconsole: Increase port listening timeout

Andre Carvalho <[email protected]>
selftests: netconsole: remove log noise due to socat exit

Ziyi Guo <[email protected]>
net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()

Ziyi Guo <[email protected]>
net: mscc: ocelot: split xmit into FDMA and register injection paths

Ziyi Guo <[email protected]>
net: mscc: ocelot: extract ocelot_xmit_timestamp() helper

Daniel Machon <[email protected]>
net: sparx5/lan969x: fix DWRR cost max to match hardware register width

Jie Zhang <[email protected]>
net: stmmac: fix oops when split header is enabled

Russell King (Oracle) <[email protected]>
net: stmmac: replace has_xxxx with core_type

Russell King (Oracle) <[email protected]>
net: stmmac: remove broken PCS code

Yue Haibing <[email protected]>
selftests: net: lib: Fix jq parsing error

Ido Schimmel <[email protected]>
selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2

Ralf Lici <[email protected]>
ovpn: fix VPN TX bytes counting

Ralf Lici <[email protected]>
ovpn: fix possible use-after-free in ovpn_net_xmit

Ralf Lici <[email protected]>
ovpn: set sk_user_data before overriding callbacks

Aboorva Devarajan <[email protected]>
cpuidle: Skip governor when only one idle state is available

Zhai Can <[email protected]>
ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO

zhouwenhao <[email protected]>
objpool: fix the overestimation of object pooling metadata size

Aristeu Rozanski <[email protected]>
selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT

Josh Poimboeuf <[email protected]>
kbuild: Add objtool to top-level clean target

Kuppuswamy Sathyanarayanan <[email protected]>
powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check

Sean V Kelley <[email protected]>
ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs

Jiasheng Jiang <[email protected]>
fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot

Edward Adam Davis <[email protected]>
fs/ntfs3: prevent infinite loops caused by the next valid being the same

Bartlomiej Kubik <[email protected]>
fs/ntfs3: Initialize new folios before use

Jens Axboe <[email protected]>
io_uring/cancel: de-unionize file and user_data in struct io_cancel_data

Pavel Begunkov <[email protected]>
io_uring: delay sqarray static branch disablement

Christoph Böhmwalder <[email protected]>
drbd: always set BLK_FEAT_STABLE_WRITES

Jared Kangas <[email protected]>
dmaengine: fsl-edma: don't explicitly disable clocks in .remove()

Barnabás Czémán <[email protected]>
backlight: qcom-wled: Change PM8950 WLED configurations

Barnabás Czémán <[email protected]>
backlight: qcom-wled: Support ovp values for PMI8994

Haotian Zhang <[email protected]>
leds: qcom-lpg: Check the return value of regmap_bulk_write()

Duje Mihanović <[email protected]>
leds: expresswire: Fix chip state breakage

Jiayu Du <[email protected]>
pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

Wei Li <[email protected]>
pinctrl: single: fix refcount leak in pcs_add_gpio_func()

Felix Gu <[email protected]>
pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers

Luca Weiss <[email protected]>
pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition

Luca Boccassi <[email protected]>
pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns

Randy Dunlap <[email protected]>
mips: LOONGSON32: drop a dangling Kconfig symbol

Harshit Mogalapalli <[email protected]>
iio: sca3000: Fix a resource leak in sca3000_probe()

Qing Wang <[email protected]>
ovl: Fix uninit-value in ovl_fill_real

Felix Gu <[email protected]>
pinctrl: equilibrium: Fix device node reference leak in pinbank_init()

Jose Javier Rodriguez Barbarin <[email protected]>
mcb: fix incorrect sanity check

Randy Dunlap <[email protected]>
nvmem: an8855: drop an unused Kconfig symbol

Justin Chen <[email protected]>
usb: bdc: fix sleep during atomic

Svyatoslav Ryhel <[email protected]>
drivers: iio: mpu3050: use dev_err_probe for regulator request

Robert Marko <[email protected]>
mfd: simple-mfd-i2c: Add Delta TN48M CPLD support

Haotian Zhang <[email protected]>
mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure

Greg Kroah-Hartman <[email protected]>
Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"

Yicong Yang <[email protected]>
coresight: tmc-etr: Fix race condition between sysfs and perf mode

Thomas Richard <[email protected]>
phy: freescale: imx8qm-hsio: fix NULL pointer dereference

Antonio Borneo <[email protected]>
coresight: etm3x: Fix cpulocked warning on cpuhp

Kery Qi <[email protected]>
watchdog: starfive-wdt: Fix PM reference leak in probe error path

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix pressure calculation

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix scan_type struct

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix interrupt flag

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix SPI CS delay violation

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

Matthew Schwartz <[email protected]>
mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms

Zilin Guan <[email protected]>
gpib: Fix memory leak in ni_usb_init()

Dan Carpenter <[email protected]>
gpib: Fix error code in ni_usb_write_registers()

Dan Carpenter <[email protected]>
gpib: Fix error code in ibonline()

Randy Dunlap <[email protected]>
serial: SH_SCI: improve "DMA support" prompt

Randy Dunlap <[email protected]>
serial: imx: change SERIAL_IMX_CONSOLE to bool

Chaitanya Mishra <[email protected]>
staging: greybus: lights: avoid NULL deref

Randy Dunlap <[email protected]>
usb: typec: ucsi: drop an unused Kconfig symbol

Randy Dunlap <[email protected]>
iio: test: drop dangling symbol in gain-time-scale helpers

Arnd Bergmann <[email protected]>
soundwire: intel_ace2x: add SND_HDA_CORE dependency

Alper Ak <[email protected]>
char: misc: Use IS_ERR() for filp_open() return value

Cristian Ciocaltea <[email protected]>
phy: rockchip: samsung-hdptx: Pre-compute HDMI PLL config for 461.10125 MHz output

Nuno Sá <[email protected]>
dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue

Nuno Sá <[email protected]>
dma: dma-axi-dmac: fix SW cyclic transfers

AngeloGioacchino Del Regno <[email protected]>
dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX

Nicolas Frattaroli <[email protected]>
interconnect: mediatek: Aggregate bandwidth with saturating add

Nicolas Frattaroli <[email protected]>
interconnect: mediatek: Don't hijack parent device

Krzysztof Kozlowski <[email protected]>
clk: zynqmp: pll: Fix zynqmp_clk_divider_determine_rate kerneldoc

Krzysztof Kozlowski <[email protected]>
clk: zynqmp: divider: Fix zynqmp_clk_divider_determine_rate kerneldoc

Haotian Zhang <[email protected]>
clk: mediatek: Fix error handling in runtime PM setup

Nicolas Frattaroli <[email protected]>
clk: mediatek: Add mfg_eb as parent to mt8196 mfgpll clocks

Sjoerd Simons <[email protected]>
clk: mediatek: Drop __initconst from gates

Brian Masney <[email protected]>
clk: zynqmp: divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: x86: cgu: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: versaclock3: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: stm32: stm32-core: convert from divider_round_rate_parent() to divider_determine_rate()

Brian Masney <[email protected]>
clk: stm32: stm32-core: convert from divider_ro_round_rate() to divider_ro_determine_rate()

Brian Masney <[email protected]>
clk: sprd: div: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: sophgo: sg2042-clkgen: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: nxp: lpc32xx: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: nuvoton: ma35d1-divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: milbeaut: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: loongson1: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: hisilicon: clkdivider-hi6220: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: bm1880: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: actions: owl-divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: actions: owl-composite: convert from owl_divider_helper_round_rate() to divider_determine_rate()

Dmitry Baryshkov <[email protected]>
clk: qcom: gfx3d: add parent to parent request map

David Heidelberg <[email protected]>
clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src

Petr Hodina <[email protected]>
clk: qcom: dispcc-sdm845: Enable parents for pixel clocks

Brian Masney <[email protected]>
clk: qcom: regmap-divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: qcom: regmap-divider: convert from divider_ro_round_rate() to divider_ro_determine_rate()

Geert Uytterhoeven <[email protected]>
clk: Move clk_{save,restore}_context() to COMMON_CLK section

Vladimir Zapolskiy <[email protected]>
Input: adp5589 - remove a leftover header file

Brian Masney <[email protected]>
clk: microchip: core: remove duplicate determine_rate on pic32_sclk_ops

Miaoqian Lin <[email protected]>
clk: rockchip: Fix error pointer check after rockchip_clk_register_gate_link()

Brian Masney <[email protected]>
clk: qcom: alpha-pll: convert from divider_round_rate() to divider_determine_rate()

George Moussalem <[email protected]>
clk: qcom: gcc-ipq5018: flag sleep clock as critical

Barnabás Czémán <[email protected]>
clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc

Barnabás Czémán <[email protected]>
clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-glymur: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-milos: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sm8750: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops

Martin Blumenstingl <[email protected]>
clk: meson: g12a: Limit the HDMI PLL OD to /4

Martin Blumenstingl <[email protected]>
clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs

Taniya Das <[email protected]>
clk: qcom: rcg2: compute 2d using duty fraction directly

Vladimir Zapolskiy <[email protected]>
clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs

Vladimir Zapolskiy <[email protected]>
clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs

Inochi Amaoto <[email protected]>
clk: spacemit: Respect Kconfig setting when building modules

Yao Zi <[email protected]>
clk: thead: th1520-ap: Poll for PLL lock and wait for stability

Felix Gu <[email protected]>
fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()

Felix Gu <[email protected]>
fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings()

Sudeep Holla <[email protected]>
Revert "mailbox/pcc: support mailbox management of the shared buffer"

Shengjiu Wang <[email protected]>
remoteproc: imx_dsp_rproc: Only reset carveout memory at RPROC_OFFLINE state

Steven Rostedt <[email protected]>
tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros

Miaoqian Lin <[email protected]>
tracing: Properly process error handling in event_hist_trigger_parse()

Sagi Grimberg <[email protected]>
fs/nfs: Fix readdir slow-start regression

Li Chen <[email protected]>
nvdimm: virtio_pmem: serialize flush requests

Colin Ian King <[email protected]>
scsi: csiostor: Fix dereference of null pointer rn

Arnd Bergmann <[email protected]>
scsi: ufs: host: mediatek: Require CONFIG_PM

Zilin Guan <[email protected]>
scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

Olga Kornievskaia <[email protected]>
pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN

Yi Liu <[email protected]>
RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc

Val Packett <[email protected]>
power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer

Waqar Hameed <[email protected]>
power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler

Weili Qian <[email protected]>
hisi_acc_vfio_pci: fix VF reset timeout issue

Miquel Raynal <[email protected]>
mtd: spinand: Fix kernel doc

Weigang He <[email protected]>
mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()

Yuxiong Wang <[email protected]>
cxl: Fix premature commit_end increment on decoder commit failure

Chuck Lever <[email protected]>
RDMA/core: add rdma_rw_max_sge() helper for SQ sizing

Li Zhijian <[email protected]>
RDMA/rxe: Fix race condition in QP timer handlers

Zilin Guan <[email protected]>
RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler

Yi Liu <[email protected]>
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

Li Zhijian <[email protected]>

    RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

Cheatham, Benjamin <[email protected]>
cxl/core: Fix cxl_dport debugfs EINJ entries

Mike Snitzer <[email protected]>
NFS/localio: remove -EAGAIN handling in nfs_local_doio()

Mike Snitzer <[email protected]>
NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit

Mike Snitzer <[email protected]>
NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

Trond Myklebust <[email protected]>
NFS/localio: Handle short writes by retrying

Zilin Guan <[email protected]>
mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Factor out ring destroy handling to a helper

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Add an S4 restore flow

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails

Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Prevent TEE errors after hibernate

Anthony Pighin (Nokia) <[email protected]>
vfio/pci: Lock upstream bridge for vfio_pci_core_disable()

Alexander Usyskin <[email protected]>
mtd: intel-dg: Fix accessing regions before setting nregions

Alok Tiwari <[email protected]>
mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper

Or Har-Toov <[email protected]>
IB/mlx5: Fix port speed query for representors

Chiara Meiohas <[email protected]>
RDMA/mlx5: Fix UMR hang in LAG error state unload

Malaya Kumar Rout <[email protected]>
tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus()

Krishna Chomal <[email protected]>
platform/x86: hp-wmi: fix platform profile values for Omen 16-wf1xxx

Jacob Moroni <[email protected]>
RDMA/iwcm: Fix workqueue list corruption by removing work_list

Jiasheng Jiang <[email protected]>
RDMA/rxe: Fix double free in rxe_srq_from_init

Roman Penyaev <[email protected]>
RDMA/rtrs-srv: fix SG mapping

Waqar Hameed <[email protected]>
power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()

Haotian Zhang <[email protected]>
power: supply: bq27xxx: fix wrong errno when bus ops are unsupported

Alexander Koskovich <[email protected]>
power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write

Waqar Hameed <[email protected]>
power: supply: sbs-battery: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: rt9455: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: goldfish: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: bq25980: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: bq256xx: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: act8945a: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: ab8500: Fix use-after-free in power_supply_changed()

Dan Williams <[email protected]>
cxl/mem: Fix devm_cxl_memdev_edac_release() confusion

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix ucaps init error flow

Chengchang Tang <[email protected]>
RDMA/hns: Notify ULP of remaining soft-WCs during reset

Junxian Huang <[email protected]>
RDMA/hns: Fix RoCEv1 failure due to DSCP

Chengchang Tang <[email protected]>
RDMA/hns: Fix WQ_MEM_RECLAIM warning

Etienne AUJAMES <[email protected]>
IB/cache: update gid cache on client reregister event

Honggang LI <[email protected]>
RDMA/rtrs: server: remove dead code

Kuniyuki Iwashima <[email protected]>
af_unix: Fix memleak of newsk in unix_stream_connect().

Hariprasad Kelam <[email protected]>
octeontx2-pf: Unregister devlink on probe failure

Michael Dege <[email protected]>
net: renesas: rswitch: fix forwarding offload statemachine

Eric Joyner <[email protected]>
ionic: Rate limit unknown xcvr type messages

Vimlesh Kumar <[email protected]>
octeon_ep_vf: ensure dbell BADDR updation

Vimlesh Kumar <[email protected]>
octeon_ep: ensure dbell BADDR updation

Vimlesh Kumar <[email protected]>
octeon_ep: disable per ring interrupts

Jiayuan Chen <[email protected]>
serial: caif: fix use-after-free in caif_serial ldisc_close()

Jiayuan Chen <[email protected]>
xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path

René Rebe <[email protected]>
net: sunhme: Fix sbus regression

Jiayuan Chen <[email protected]>
net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

Stefan Metzmacher <[email protected]>
smb: client: correct value for smbd_max_fragmented_recv_size

Jinliang Zheng <[email protected]>
procfs: fix missing RCU protection when reading real_parent in do_task_stat()

Jian Shen <[email protected]>
net: hns3: fix double free issue for tx spare buffer

Ivan Vecera <[email protected]>
dpll: zl3073x: Fix output pin phase adjustment sign

Ivan Vecera <[email protected]>
dpll: zl3073x: Cache all output properties in zl3073x_out

Ivan Vecera <[email protected]>
dpll: zl3073x: Split ref, out, and synth logic from core

Ivan Vecera <[email protected]>
dpll: zl3073x: Store raw register values instead of parsed state

Ivan Vecera <[email protected]>
dpll: zl3073x: Specify phase adjustment granularity for pins

Ivan Vecera <[email protected]>
dpll: add phase-adjust-gran pin attribute

Nicolas Cavallari <[email protected]>

    PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: validate open interval overlap

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: validate element belonging to interval

Florian Westphal <[email protected]>
netfilter: nft_set_rbtree: don't gc elements on insert

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: remove seqcount_rwlock_t

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: use binary search array in get command

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: translate rbtree to array for binary search

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval

Anders Grahn <[email protected]>
netfilter: nft_counter: fix reset of counters on 32bit archs

Florian Westphal <[email protected]>
netfilter: nft_set_hash: fix get operation on big endian

Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

Scott Mitchell <[email protected]>
netfilter: nfnetlink_queue: optimize verdict lookup with hash table

Votokina Victoria <[email protected]>
nfc: hci: shdlc: Stop timers and work before freeing context

Eric Dumazet <[email protected]>
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Thomas Bogendoerfer <[email protected]>
bonding: only set speed/duplex to unknown, if getting speed failed

Anshumali Gaur <[email protected]>
octeontx2-af: Fix PF driver crash with kexec kernel booting

Paolo Abeni <[email protected]>
mptcp: fix receive space timestamp initialization

Paolo Abeni <[email protected]>
mptcp: do not account for OoO in mptcp_rcvbuf_grow()

Tuo Li <[email protected]>
of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy()

Chia-Yu Chang <[email protected]>
tcp: accecn: handle unexpected AccECN negotiation feedback

Chia-Yu Chang <[email protected]>
tcp: disable RFC3168 fallback identifier for CC modules

Chia-Yu Chang <[email protected]>
tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers

Arnd Bergmann <[email protected]>
jfs: avoid -Wtautological-constant-out-of-range-compare warning

Ondrej Mosnacek <[email protected]>
ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

Ondrej Mosnacek <[email protected]>
ipc: don't audit capability check in ipc_permissions()

Kevin Brodsky <[email protected]>
selftests/mm: fix faulting-in code in pagemap_ioctl test

Kevin Brodsky <[email protected]>
selftests/mm: fix usage of FORCE_READ() in cow tests

Håkon Bugge <[email protected]>
PCI/ACPI: Restrict program_hpx_type2() to AER bits

Håkon Bugge <[email protected]>
PCI: Initialize RCB from pci_configure_device()

Aaradhana Sahu <[email protected]>

    wifi: ath12k: clear stale link mapping of ahvif->links_map

Aaradhana Sahu <[email protected]>
wifi: ath12k: Fix index decrement when array_len is zero

Miaoqing Pan <[email protected]>
wifi: ath11k: add usecase firmware handling based on device compatible

Ziyi Guo <[email protected]>
wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump()

Sergey Shtylyov <[email protected]>
PCI: Check parent for NULL in of_pci_bus_release_domain_nr()

Eric Dumazet <[email protected]>
tcp: tcp_tx_timestamp() must look at the rtx queue

Ilpo Järvinen <[email protected]>
PCI: Remove old_size limit from bridge window sizing

Ilpo Järvinen <[email protected]>
PCI: Stop over-estimating bridge window size

Ilpo Järvinen <[email protected]>
PCI: Rewrite bridge window head alignment function

Zhiyu Zhang <[email protected]>
fat: avoid parent link count underflow in rmdir

Alice Ryhl <[email protected]>
rust: task: restrict Task::group_leader() to current

Chaitanya Mishra <[email protected]>
lib/kstrtox: fix kstrtobool() docstring to mention enabled/disabled

Anthony Iliopoulos <[email protected]>
nfsd: never defer requests during idmap lookup

Chuck Lever <[email protected]>
xdrgen: Remove inclusion of nlm4.h header

Chuck Lever <[email protected]>
xdrgen: Initialize data pointer for zero-length items

Chuck Lever <[email protected]>
NFS: NFSERR_INVAL is not defined by NFSv2

Chuck Lever <[email protected]>
xdrgen: Fix struct prefix for typedef types in program wrappers

Mikulas Patocka <[email protected]>
dm: use bio_clone_blkg_association

Lu Baolu <[email protected]>
iommu/vt-d: Clear Present bit before tearing down context entry

Lu Baolu <[email protected]>
iommu/vt-d: Clear Present bit before tearing down PASID entry

Dmytro Maluka <[email protected]>
iommu/vt-d: Flush cache for PASID table before using it

Zilin Guan <[email protected]>
wifi: rtw89: debug: Fix memory leak in __print_txpwr_map()

Jörg Wedekind <[email protected]>
PCI: Mark 3ware-9650SA Root Port Extended Tags as broken

Petr Mladek <[email protected]>
kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()

Petr Mladek <[email protected]>
module: add helper function for reading module_buildid()

Petr Mladek <[email protected]>
kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup()

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: fix tracking of connections from localhost

Florian Westphal <[email protected]>
netfilter: nft_compat: add more restrictions on netlink attributes

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: increase the connection clean up limit to 64

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: make nf_conncount_gc_list() to disable BH

Florian Westphal <[email protected]>
netfilter: nf_tables: reset table validation state on abort

Li Chen <[email protected]>
ext4: fast commit: make s_fc_lock reclaim-safe

Miri Korenblit <[email protected]>

    wifi: cfg80211: stop NAN and P2P in cfg80211_leave

Matt Johnston <[email protected]>
mctp i2c: initialise event handler read bytes

Jian Zhang <[email protected]>
net: mctp-i2c: fix duplicate reception of old data

Abhishek Bapat <[email protected]>
quota: fix livelock between quotactl and freeze_super

Baochen Qiang <[email protected]>
wifi: ath12k: do WoW offloads only on primary link

Rosen Penev <[email protected]>
wifi: ath9k: add OF dependency to AHB

Alistair Popple <[email protected]>
PCI/P2PDMA: Reset page reference count when page mapping fails

Aadityarangan Shridhar Iyengar <[email protected]>
PCI/PTM: Fix pcie_ptm_create_debugfs() memory leak

Mikulas Patocka <[email protected]>
dm: use READ_ONCE in dm_blk_report_zones

Mikulas Patocka <[email protected]>
dm: fix unlocked test for dm_suspended_md

Uwe Kleine-König <[email protected]>
PCI/portdrv: Fix potential resource leak

Inochi Amaoto <[email protected]>
PCI: sophgo: Disable L0s and L1 on Sophgo 2044 PCIe Root Ports

Håkon Bugge <[email protected]>
PCI: Do not attempt to set ExtTag for VFs

Shuai Xue <[email protected]>
Documentation: tracing: Add PCI tracepoint documentation

Hou Tao <[email protected]>
PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition

Hou Tao <[email protected]>
PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails

Huang Chenming <[email protected]>
wifi: cfg80211: Fix use_for flag update on BSS refresh

Brian Norris <[email protected]>

    PCI/PM: Avoid redundant delays on D3hot->D3cold

Baruch Siach <[email protected]>
Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors

Haotian Zhang <[email protected]>
PCI: xilinx: Fix INTx IRQ domain leak in error paths

Haotian Zhang <[email protected]>
PCI: mediatek: Fix IRQ domain leak when MSI allocation fails

Carl Lee <[email protected]>
hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification

Guenter Roeck <[email protected]>
Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

Francesco Lavra <[email protected]>
spi: tools: Add include folder to .gitignore

Charles Keepax <[email protected]>
ASoC: SDCA: Handle volatile controls correctly

Charles Keepax <[email protected]>
ASoC: SDCA: Force some SDCA Controls to be volatile

Charles Keepax <[email protected]>
ASoC: SDCA: Remove outdated todo comment

Lizhi Hou <[email protected]>
accel/amdxdna: Fix incorrect error code returned for failed chain command

Ryan Lin <[email protected]>
HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients

Zishun Yi <[email protected]>
accel/amdxdna: Fix memory leak in amdxdna_ubuf_map

Lizhi Hou <[email protected]>
accel/amdxdna: Stop job scheduling across aie2_release_resource()

Lizhi Hou <[email protected]>
accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()

Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_lightbar: Fix response size initialization

Sheetal <[email protected]>
ASoC: tegra: Add AHUB writeable_reg for RX holes

Harry Yoo <[email protected]>
mm/slab: fix false lockdep warning in __kfree_rcu_sheaf()

Shuicheng Lin <[email protected]>
drm/xe: Unregister drm device on probe error

Vinay Belgaumkar <[email protected]>
drm/xe/ptl: Disable DCC on PTL

Roberto Sassu <[email protected]>
evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix allocation for small frame sizes

Gokul Praveen <[email protected]>
pwm: tiehrpwm: Enable pwmchip's parent device before setting configuration

Andy Shevchenko <[email protected]>
platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev

Nathan Chancellor <[email protected]>
drm/msm/dp: Avoid division by zero in msm_dp_ctrl_config_msa()

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: program correct register for UBWC config on DPU 8.x+

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: offset HBB values written to DPU by -13

Dmitry Baryshkov <[email protected]>
drm/msm/mdss: correct HBB programmed on UBWC 5.x and 6.x devices

Cristian Ciocaltea <[email protected]>
drm/rockchip: dw_hdmi_qp: Fix RK3576 HPD interrupt handling

Baihan Li <[email protected]>
drm/hisilicon/hibmc: Adding reset colorbar cfg in dp init.

Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix no showing problem with loading hibmc manually

Baihan Li <[email protected]>
drm/hisilicon/hibmc: add dp mode valid check

Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix dp probabilistical detect errors after HPD irq

Michał Grzelak <[email protected]>
drm/buddy: release free_trees array on buddy mm teardown

Dmitry Baryshkov <[email protected]>
drm/msm/a2xx: fix pixel shader start on A225

David Heidelberg <[email protected]>
media: ccs: Accommodate C-PHY into the calculation

Lizhi Hou <[email protected]>
accel/amdxdna: Fix notifier_wq flushing warning

Brian Masney <[email protected]>
drm/msm/dsi_phy_14nm: convert from divider_round_rate() to divider_determine_rate()

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x

Dmitry Baryshkov <[email protected]>
drm/msm/disp: set num_planes to 1 for interleaved YUV formats

Haotian Zhang <[email protected]>
HID: playstation: Add missing check for input_ff_create_memless

André Draszik <[email protected]>
regulator: core: move supply check earlier in set_machine_constraints()

Jani Nikula <[email protected]>
mei: late_bind: fix struct intel_lb_component_ops kernel-doc

Mani Chandana Ballary Kuntumalla <[email protected]>
drm/msm/dp: Update msm_dp_controller IDs for sa8775p

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: fix WD timer handling on DPU 8.x

Teguh Sobirin <[email protected]>
drm/msm/dpu: Set vsync source irrespective of mdp top support

Mahadevan P <[email protected]>
drm/msm/disp/dpu: add merge3d support for sc7280

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init

Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix signal_eviction_fence() bool return value

Mario Limonciello (AMD) <[email protected]>
drm/amd: Drop "amdgpu kernel modesetting enabled" message

Zilin Guan <[email protected]>
media: chips-media: wave5: Fix memory leak on codec_info allocation failure

Cristian Ciocaltea <[email protected]>

    ASoC: nau8821: Fixup nau8821_enable_jack_detect()

Konstantin Andreev <[email protected]>
smack: /smack/doi: accept previously used values

Konstantin Andreev <[email protected]>
smack: /smack/doi must be > 0

Ketil Johnsen <[email protected]>
drm/panthor: Evict groups before VM termination

Simon Trimmer <[email protected]>
ASoC: SDCA: Allow sample width wild cards in set_usage()

Takashi Iwai <[email protected]>
ALSA: vmaster: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: pcm: Relax __free() variable declarations

David Heidelberg <[email protected]>
drm/panel: sw43408: Remove manual invocation of unprepare at remove

Lizhi Hou <[email protected]>
accel/amdxdna: Fix race where send ring appears full due to delayed head update

Boris Brezillon <[email protected]>
drm/panthor: Fix panthor_gpu_coherency_set()

Lai Jiangshan <[email protected]>
workqueue: Process rescuer work items one-by-one using a cursor

Lai Jiangshan <[email protected]>
workqueue: Only assign rescuer work when really needed

Lai Jiangshan <[email protected]>
workqueue: Factor out assign_rescuer_work()

Boris Brezillon <[email protected]>
drm/panthor: Make sure we resume the tick when new jobs are submitted

Boris Brezillon <[email protected]>
drm/panthor: Fix the logic that decides when to stop ticking

Boris Brezillon <[email protected]>
drm/panthor: Fix immediate ticking on a disabled tick

Boris Brezillon <[email protected]>
drm/panthor: Fix the group priority rotation logic

Boris Brezillon <[email protected]>
drm/panthor: Fix the full_tick check

Boris Brezillon <[email protected]>
drm/panthor: Recover from panthor_gpu_flush_caches() failures

Junhui Liu <[email protected]>
reset: canaan: k230: drop OF dependency and enable by default

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions

Konrad Dybcio <[email protected]>
arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions

Viken Dadhaniya <[email protected]>
arm64: dts: qcom: talos: Drop opp-shared from QUP OPP table

Jonathan Marek <[email protected]>

    arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models)

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1

Dmitry Baryshkov <[email protected]>

    arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm

Jerome Brunet <[email protected]>
arm64: dts: amlogic: g12: assign the MMC A signal clock

Jerome Brunet <[email protected]>
arm64: dts: amlogic: g12: assign the MMC B and C signal clocks

Jerome Brunet <[email protected]>
arm64: dts: amlogic: gx: assign the MMC signal clocks

Jerome Brunet <[email protected]>
arm64: dts: amlogic: axg: assign the MMC signal clocks

Jerome Brunet <[email protected]>
arm64: dts: amlogic: c3: assign the MMC signal clocks

Haotian Zhang <[email protected]>
hwspinlock: omap: Handle devm_pm_runtime_enable() errors

Dmitry Baryshkov <[email protected]>
soc: qcom: ubwc: add missing include

Abhash Kumar Jha <[email protected]>

    arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4

Abhash Kumar Jha <[email protected]>
arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order

Jerome Brunet <[email protected]>
arm64: dts: amlogic: s4: fix mmc clock assignment

Jerome Brunet <[email protected]>
arm64: dts: amlogic: s4: assign mmc b clock to 24MHz

AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node

Vladimir Zapolskiy <[email protected]>
arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node

Lad Prabhakar <[email protected]>
arm64: dts: renesas: rzt2h-n2h-evk-common: Use GPIO for SD0 write protect

Narayana Murty N <[email protected]>
powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling

Zilin Guan <[email protected]>
soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()

Haotian Zhang <[email protected]>
soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe

Christophe Leroy <[email protected]>
powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user()

Chen-Yu Tsai <[email protected]>
ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147

Geert Uytterhoeven <[email protected]>

    arm64: dts: renesas: r9a09g047e57-smarc: Remove duplicate SW_LCD_EN

Abel Vesa <[email protected]>
arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks

Casey Connolly <[email protected]>
arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on

Casey Connolly <[email protected]>
arm64: dts: qcom: sdm845-oneplus: Don't keep panel regulator always on

Casey Connolly <[email protected]>
arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm630: fix gpu_speed_bin size

Haotian Zhang <[email protected]>
clk: qcom: Return correct error code in qcom_cc_probe_by_index()

Alexander Stein <[email protected]>
arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings

Alexander Stein <[email protected]>
arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings

Sudeep Holla <[email protected]>
firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET

Dan Carpenter <[email protected]>
EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()

Dan Carpenter <[email protected]>
EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()

Jorge Ramirez-Ortiz <[email protected]>
soc: qcom: smem: handle ENOMEM error during probe

Sai Ritvik Tanksalkar <[email protected]>
pstore/ram: fix buffer overflow in persistent_ram_save_old()

Larysa Zaremba <[email protected]>
selftests/xsk: fix number of Tx frags in invalid packet

Larysa Zaremba <[email protected]>
selftests/xsk: properly handle batch ending in the middle of a packet

Bastien Curutchet (eBPF Foundation) <[email protected]>
selftests/bpf: test_xsk: Split xskxceiver

Lianjie Wang <[email protected]>
hwrng: core - use RCU and work_struct to fix race condition

Jonathan McDowell <[email protected]>
hwrng: core - Allow runtime disabling of the HW RNG

Zilin Guan <[email protected]>
crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req()

KP Singh <[email protected]>
bpf: Require frozen map for calculating map hash

KP Singh <[email protected]>
bpf: Limit bpf program signature size

Titouan Ameline de Cadeville <[email protected]>
fs/tests: exec: drop duplicate bprm_stack_limits test vectors

Chen Jinghuang <[email protected]>
sched/rt: Skip currently executing CPU in rto_next_cpu()

Joel Fernandes <[email protected]>
sched/deadline: Clear the defer params

Sebastian Andrzej Siewior <[email protected]>
media: pci: mg4b: Use IRQF_NO_THREAD

Sebastian Andrzej Siewior <[email protected]>
mfd: wm8350-core: Use IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
rtc: amlogic-a4: Remove IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
usb: typec: fusb302: Remove IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
EDAC/altera: Remove IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
scsi: efct: Use IRQF_ONESHOT and default primary handler

Sebastian Andrzej Siewior <[email protected]>
Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler

Sebastian Andrzej Siewior <[email protected]>
iommu/amd: Use core's primary handler and set IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()

Sebastian Andrzej Siewior <[email protected]>
genirq: Set IRQF_COND_ONESHOT in devm_request_irq().

Paul Chaignon <[email protected]>
bpf: Fix bpf_xdp_store_bytes proto for read-only arg

Jianpeng Chang <[email protected]>
crypto: caam - fix netdev memory leak in dpaa2_caam_probe

Weili Qian <[email protected]>
crypto: hisilicon/trng - support tfms sharing the device

Jiri Olsa <[email protected]>
selftests/bpf: Fix kprobe multi stacktrace_ips test

Jiri Olsa <[email protected]>
x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path

Jiri Olsa <[email protected]>
x86/fgraph: Fix return_to_handler regs.rsp value

Aleksander Jan Bajkowski <[email protected]>
crypto: inside-secure/eip93 - unregister only available algorithm

Ella Ma <[email protected]>
crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

Luis Gerhorst <[email protected]>
bpf: Fix verifier_bug_if to account for BPF_CALL

Guillaume Gonnet <[email protected]>
bpf: Fix tcx/netkit detach permissions when prog fd isn't given

Jiayuan Chen <[email protected]>
bpf, sockmap: Fix FIONREAD for sockmap

Jiayuan Chen <[email protected]>
bpf, sockmap: Fix incorrect copied_seq calculation

Kumar Kartikeya Dwivedi <[email protected]>
rqspinlock: Fix TAS fallback lock entry creation

Aleksander Jan Bajkowski <[email protected]>
hwrng: airoha - set rng quality to 900

Tycho Andersen (AMD) <[email protected]>
crypto: ccp - narrow scope of snp_range_list

Tom Lendacky <[email protected]>
crypto: ccp - Fix a case where SNP_SHUTDOWN is missed

Aleksander Jan Bajkowski <[email protected]>
crypto: inside-secure/eip93 - fix kernel panic in driver detach

Thomas Gleixner <[email protected]>
hrtimer: Fix trace oddity

Kery Qi <[email protected]>
selftests/bpf: Fix resource leak in serial_test_wq on attach failure

Zesen Liu <[email protected]>
bpf: Fix memory access flags in helper prototypes

Puranjay Mohan <[email protected]>
bpf: Preserve id of register in sync_linked_regs()

Chenghai Huang <[email protected]>
crypto: hisilicon/sgl - fix inconsistent map/unmap direction issue

Qi Tao <[email protected]>
crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable

Weili Qian <[email protected]>
crypto: hisilicon/hpre - support the hpre algorithm fallback

Chenghai Huang <[email protected]>
crypto: hisilicon - consolidate qp creation and start in hisi_qm_alloc_qps_node

Chenghai Huang <[email protected]>
crypto: hisilicon/zip - support fallback for zip

Chenghai Huang <[email protected]>
crypto: hisilicon/qm - centralize the sending locks of each module into qm

Chenghai Huang <[email protected]>
crypto: hisilicon/qm - enhance the configuration of req_type in queue attributes

lizhi <[email protected]>
crypto: hisilicon/hpre: extend tag field to 64 bits for better performance

Chenghai Huang <[email protected]>
crypto: hisilicon/sec - move backlog management to qp and store sqe in qp for callback

Chenghai Huang <[email protected]>
crypto: hisilicon/zip - adjust the way to obtain the req in the callback function

Thomas Fourier <[email protected]>
crypto: octeontx - fix dma_free_coherent() size

Thomas Fourier <[email protected]>
crypto: cavium - fix dma_free_coherent() size

Gabriele Monaco <[email protected]>
sched: Fix build for modules using set_tsk_need_resched()

Thomas Gleixner <[email protected]>
time/sched_clock: Use ACCESS_PRIVATE() to evaluate hrtimer::function

Thomas Weißschuh <[email protected]>
ARM: VDSO: Patch out __vdso_clock_getres() if unavailable

Gabriele Monaco <[email protected]>
sched: Export hidden tracepoints to modules

Varun R Mallya <[email protected]>
libbpf: Fix OOB read in btf_dump_get_bitfield_value

Puranjay Mohan <[email protected]>
selftests/bpf: veristat: fix printing order in output_stats()

Giovanni Cabiddu <[email protected]>
crypto: qat - fix warning on adf_pfvf_pf_proto.c

Sandipan Das <[email protected]>
perf/x86/core: Do not set bit width for unavailable counters

Andrew Cooper <[email protected]>
x86/cpu/amd: Correct the microcode table for Zenbleed

Jens Axboe <[email protected]>
io_uring/kbuf: fix memory leak if io_buffer_add_list fails

Salah Triki <[email protected]>
s390/cio: Fix device lifecycle handling in css_alloc_subchannel()

Gui-Dong Han <[email protected]>
PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races

Yaxiong Tian <[email protected]>
cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible

Leo Yan <[email protected]>
perf: arm_spe: Properly set hw.state on failures

Breno Leitao <[email protected]>
arm64/gcs: Fix error handling in arch_set_shadow_stack_status()

Samuel Wu <[email protected]>
PM: wakeup: Handle empty list in wakeup_sources_walk_start()

Xiao Ni <[email protected]>
md: fix return value of mddev_trylock

Zilin Guan <[email protected]>
md/raid1: fix memory leak in raid1_run()

Roger Pau Monne <[email protected]>
Partial revert "x86/xen: fix balloon target initialization for PVH dom0"

Govindarajulu Varadarajan <[email protected]>
ublk: Validate SQE128 flag before accessing the cmd

Caleb Sander Mateos <[email protected]>
ublk: restore auto buf unregister refcount optimization

Felix Gu <[email protected]>
thermal/of: Fix reference leak in thermal_of_cm_lookup()

Christoph Hellwig <[email protected]>
iomap: fix submission side handling of completion side errors

Felix Gu <[email protected]>
cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()

Aleks Todorov <[email protected]>
OPP: Return correct value in dev_pm_opp_get_level

Yu Kuai <[email protected]>
md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

Yu Kuai <[email protected]>
md/raid5: fix IO hang with degraded array with llbitmap

Li Nan <[email protected]>
md/raid10: fix any_working flag handling in raid10_sync_request

Yu Kuai <[email protected]>
md/raid5: fix raid5_run() to return error when log_init() fails

Rafael J. Wysocki <[email protected]>
thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature

Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Always check timers with tick stopped

Jens Axboe <[email protected]>
io_uring/sync: validate passed in offset

Jens Axboe <[email protected]>

    io_uring/eventfd: remove unused ctx->evfd_last_cq_tail member

Alexey Simakov <[email protected]>
ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()

Caleb Sander Mateos <[email protected]>
io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED

Teddy Astie <[email protected]>
xen/virtio: Don't use grant-dma-ops when running as Dom0

Rafael J. Wysocki <[email protected]>
ACPI: processor: Update cpuidle driver check in __acpi_processor_start()

Florian-Ewald Mueller <[email protected]>
rnbd-srv: Fix server side setting of bi_size for special IOs

Shyam Prasad N <[email protected]>
netfs: avoid double increment of retry_count in subreq

Paulo Alcantara <[email protected]>
smb: client: fix potential UAF and double free in smb2_open_file()

Gao Xiang <[email protected]>
erofs: fix inline data read failure for ztailpacking pclusters

Boris Burkov <[email protected]>
btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation

Boris Burkov <[email protected]>
btrfs: fix block_group_tree dirty_list corruption

Filipe Manana <[email protected]>
btrfs: qgroup: return correct error when deleting qgroup relation item

Johannes Thumshirn <[email protected]>
btrfs: zoned: don't zone append to conventional zone

Josef Bacik <[email protected]>
btrfs: add orig_logical to btrfs_bio for encryption

Qu Wenruo <[email protected]>
btrfs: introduce btrfs_bio::async_csum

Qu Wenruo <[email protected]>
btrfs: make sure all btrfs_bio::end_io are called in task context

Qu Wenruo <[email protected]>
btrfs: remove btrfs_bio::fs_info by extracting it from btrfs_bio::inode

Qu Wenruo <[email protected]>
btrfs: headers cleanup to remove unnecessary local includes

Gao Xiang <[email protected]>
erofs: handle end of filesystem properly for file-backed mounts

Gao Xiang <[email protected]>
erofs: get rid of raw bi_end_io() usage

Alper Ak <[email protected]>
tpm: st33zp24: Fix missing cleanup on get_burstcount() error

Alper Ak <[email protected]>
tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure

Zilin Guan <[email protected]>
i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()

Fredrik Markstrom <[email protected]>
i3c: dw: Initialize spinlock to avoid upsetting lockdep

Deepanshu Kartikey <[email protected]>
gfs2: Fix use-after-free in iomap inline data write path

Andreas Gruenbacher <[email protected]>
gfs2: Fix slab-use-after-free in qd_put

Andreas Gruenbacher <[email protected]>

    gfs2: Retries missing in gfs2_{rename,exchange}

Adrian Hunter <[email protected]>
i3c: master: Update hot-join flag only on success

Ben Dooks <[email protected]>
fs: add <linux/init_task.h> for 'init_fs'

Amir Goldstein <[email protected]>
fs: move initializing f_mode before file_ref_init()

Breno Leitao <[email protected]>
device_cgroup: remove branch hint after code refactor

Billy Tsai <[email protected]>
i3c: Move device name assignment after i3c_bus_init

Xiaochen Shen <[email protected]>
selftests/resctrl: Fix a division by zero error on Hygon

Ben Dooks <[email protected]>

    audit: move the compat_xxx_class[] extern declarations to audit_arch.h

Yao Kai <[email protected]>
rcu: Fix rcu_read_unlock() deadloop due to softirq

Shardul Bankar <[email protected]>
hfsplus: return error when node already exists in hfs_bnode_create

Thomas Fourier <[email protected]>
auxdisplay: arm-charlcd: fix release_mem_region() size

YunJe Shin <[email protected]>
RDMA/umad: Reject negative data_len in ib_umad_write

YunJe Shin <[email protected]>
RDMA/siw: Fix potential NULL pointer dereference in header processing

-------------

Diffstat:

 Documentation/PCI/endpoint/pci-vntb-howto.rst      |   14 +-
 .../bindings/media/qcom,qcs8300-camss.yaml         |   13 +
 .../devicetree/bindings/phy/qcom,edp-phy.yaml      |   28 +-
 .../bindings/sound/asahi-kasei,ak4458.yaml         |    6 +-
 .../bindings/sound/asahi-kasei,ak5558.yaml         |    4 +-
 Documentation/driver-api/dpll.rst                  |   36 +-
 Documentation/netlink/specs/dpll.yaml              |    7 +
 Documentation/networking/ip-sysctl.rst             |    7 +-
 Documentation/trace/events-pci.rst                 |   74 +
 Documentation/trace/index.rst                      |    1 +
 Makefile                                           |   15 +-
 arch/arm/boot/dts/allwinner/sun5i-a13-utoo-p66.dts |    1 +
 arch/arm/boot/dts/nxp/lpc/lpc32xx.dtsi             |    1 +
 arch/arm/kernel/vdso.c                             |    1 +
 arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi        |    7 +
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi         |    6 +
 arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi  |    9 +
 arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi        |    9 +
 arch/arm64/boot/dts/amlogic/meson-gxl.dtsi         |    9 +
 arch/arm64/boot/dts/amlogic/meson-s4.dtsi          |   13 +-
 .../freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts   |    2 +-
 .../dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts    |    2 +-
 .../dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts    |    2 +-
 .../boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi  |    2 +-
 arch/arm64/boot/dts/qcom/qcm2290.dtsi              |    8 +-
 arch/arm64/boot/dts/qcom/qrb4210-rb2.dts           |    2 +-
 arch/arm64/boot/dts/qcom/sdm630.dtsi               |    4 +-
 arch/arm64/boot/dts/qcom/sdm845-db845c.dts         |    8 +-
 .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi |    3 +-
 arch/arm64/boot/dts/qcom/sm6115.dtsi               |    8 +-
 arch/arm64/boot/dts/qcom/sm6150.dtsi               |    1 -
 arch/arm64/boot/dts/qcom/x1e80100.dtsi             |    8 +-
 arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts |    1 -
 .../boot/dts/renesas/rzt2h-n2h-evk-common.dtsi     |    4 +-
 .../boot/dts/ti/k3-j784s4-j742s2-main-common.dtsi  |   36 -
 arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi         |   58 +-
 arch/arm64/mm/gcs.c                                |    4 +-
 arch/arm64/net/bpf_jit_comp.c                      |    2 +-
 arch/loongarch/net/bpf_jit.c                       |    2 +-
 arch/mips/Kconfig                                  |    1 -
 arch/mips/kernel/relocate.c                        |   13 +
 arch/powerpc/include/asm/eeh.h                     |    2 +
 arch/powerpc/include/asm/kup.h                     |    2 -
 arch/powerpc/include/asm/uaccess.h                 |    4 +
 arch/powerpc/kernel/eeh_driver.c                   |   11 +-
 arch/powerpc/kernel/eeh_pe.c                       |   74 +-
 arch/powerpc/net/bpf_jit_comp.c                    |    2 +-
 arch/s390/Kconfig                                  |    3 +-
 arch/x86/events/core.c                             |    4 +-
 arch/x86/hyperv/hv_vtl.c                           |    8 +-
 arch/x86/include/asm/ftrace.h                      |    2 +-
 arch/x86/kernel/cpu/amd.c                          |   30 +-
 arch/x86/kernel/ftrace_64.S                        |    5 +-
 arch/x86/xen/enlighten.c                           |    2 +-
 drivers/accel/amdxdna/aie2_ctx.c                   |    8 +-
 drivers/accel/amdxdna/amdxdna_mailbox.c            |   27 +-
 drivers/accel/amdxdna/amdxdna_pci_drv.c            |    5 +-
 drivers/accel/amdxdna/amdxdna_pci_drv.h            |    1 +
 drivers/accel/amdxdna/amdxdna_ubuf.c               |   10 +-
 drivers/acpi/acpica/evregion.c                     |    4 +-
 drivers/acpi/cppc_acpi.c                           |    4 +-
 drivers/acpi/power.c                               |   13 +
 drivers/acpi/processor_driver.c                    |    2 +-
 drivers/ata/libata-core.c                          |    5 +
 drivers/ata/libata-eh.c                            |    6 +
 drivers/ata/libata-scsi.c                          |  174 +-
 drivers/ata/libata.h                               |    2 +
 drivers/ata/pata_ftide010.c                        |    6 +-
 drivers/auxdisplay/arm-charlcd.c                   |    2 +-
 drivers/base/power/wakeirq.c                       |   11 +-
 drivers/base/power/wakeup.c                        |    4 +-
 drivers/block/drbd/drbd_main.c                     |    3 -
 drivers/block/drbd/drbd_nl.c                       |   20 +-
 drivers/block/rnbd/rnbd-srv.c                      |   33 +-
 drivers/block/ublk_drv.c                           |   10 +-
 drivers/bluetooth/btintel_pcie.c                   |    9 +-
 drivers/char/hw_random/airoha-trng.c               |    1 +
 drivers/char/hw_random/core.c                      |  173 +-
 drivers/char/misc_minor_kunit.c                    |    2 +-
 drivers/char/tpm/st33zp24/st33zp24.c               |    6 +-
 drivers/char/tpm/tpm_i2c_infineon.c                |    6 +-
 drivers/clk/actions/owl-composite.c                |   11 +-
 drivers/clk/actions/owl-divider.c                  |   17 +-
 drivers/clk/actions/owl-divider.h                  |    5 -
 drivers/clk/clk-bm1880.c                           |    5 +-
 drivers/clk/clk-loongson1.c                        |    5 +-
 drivers/clk/clk-milbeaut.c                         |    5 +-
 drivers/clk/clk-versaclock3.c                      |    7 +-
 drivers/clk/hisilicon/clkdivider-hi6220.c          |    6 +-
 drivers/clk/mediatek/clk-mt7981-eth.c              |    6 +-
 drivers/clk/mediatek/clk-mt8196-mfg.c              |   13 +-
 drivers/clk/mediatek/clk-mt8516.c                  |    2 +-
 drivers/clk/mediatek/clk-mtk.c                     |   12 +-
 drivers/clk/mediatek/clk-pll.c                     |    3 +
 drivers/clk/mediatek/clk-pll.h                     |    1 +
 drivers/clk/meson/g12a.c                           |   17 +-
 drivers/clk/meson/gxbb.c                           |   17 +-
 drivers/clk/microchip/clk-core.c                   |   10 -
 drivers/clk/nuvoton/clk-ma35d1-divider.c           |    7 +-
 drivers/clk/nxp/clk-lpc32xx.c                      |    6 +-
 drivers/clk/qcom/clk-alpha-pll.c                   |   21 +-
 drivers/clk/qcom/clk-rcg2.c                        |    7 +-
 drivers/clk/qcom/clk-regmap-divider.c              |   16 +-
 drivers/clk/qcom/common.c                          |    2 +-
 drivers/clk/qcom/dispcc-sdm845.c                   |    4 +-
 drivers/clk/qcom/dispcc-sm7150.c                   |    2 +-
 drivers/clk/qcom/gcc-glymur.c                      |    4 +-
 drivers/clk/qcom/gcc-ipq5018.c                     |    1 +
 drivers/clk/qcom/gcc-milos.c                       |    6 +-
 drivers/clk/qcom/gcc-msm8917.c                     |    1 -
 drivers/clk/qcom/gcc-msm8953.c                     |    1 -
 drivers/clk/qcom/gcc-qdu1000.c                     |    4 +-
 drivers/clk/qcom/gcc-sdx75.c                       |    4 +-
 drivers/clk/qcom/gcc-sm4450.c                      |    6 +-
 drivers/clk/qcom/gcc-sm8450.c                      |    4 +-
 drivers/clk/qcom/gcc-sm8550.c                      |    4 +-
 drivers/clk/qcom/gcc-sm8650.c                      |    4 +-
 drivers/clk/qcom/gcc-sm8750.c                      |    4 +-
 drivers/clk/qcom/gcc-x1e80100.c                    |    4 +-
 drivers/clk/rockchip/clk.c                         |    2 +-
 drivers/clk/sophgo/clk-sg2042-clkgen.c             |   15 +-
 drivers/clk/spacemit/Makefile                      |    9 +-
 drivers/clk/spacemit/ccu-k1.c                      |    1 +
 drivers/clk/spacemit/ccu_common.c                  |    6 +
 drivers/clk/spacemit/ccu_ddn.c                     |    1 +
 drivers/clk/spacemit/ccu_mix.c                     |    9 +
 drivers/clk/spacemit/ccu_pll.c                     |    1 +
 drivers/clk/sprd/div.c                             |    6 +-
 drivers/clk/stm32/clk-stm32-core.c                 |   42 +-
 drivers/clk/thead/clk-th1520-ap.c                  |   34 +-
 drivers/clk/x86/clk-cgu.c                          |    6 +-
 drivers/clk/zynqmp/divider.c                       |   10 +-
 drivers/clk/zynqmp/pll.c                           |    5 +-
 drivers/cpufreq/intel_pstate.c                     |    2 +-
 drivers/cpufreq/scmi-cpufreq.c                     |    1 +
 drivers/cpuidle/cpuidle.c                          |   10 +
 drivers/cpuidle/governors/menu.c                   |   22 +-
 drivers/crypto/caam/caamalg_qi2.c                  |   27 +-
 drivers/crypto/caam/caamalg_qi2.h                  |    2 +
 drivers/crypto/cavium/cpt/cptvf_main.c             |    3 +-
 drivers/crypto/ccp/ccp-ops.c                       |    2 +-
 drivers/crypto/ccp/psp-dev.c                       |   11 +
 drivers/crypto/ccp/sev-dev.c                       |   59 +-
 drivers/crypto/ccp/sp-dev.c                        |   12 +
 drivers/crypto/ccp/sp-dev.h                        |    3 +
 drivers/crypto/ccp/sp-pci.c                        |   16 +-
 drivers/crypto/ccp/tee-dev.c                       |   56 +-
 drivers/crypto/ccp/tee-dev.h                       |    1 +
 drivers/crypto/hisilicon/Kconfig                   |    1 +
 drivers/crypto/hisilicon/hpre/hpre.h               |    5 +-
 drivers/crypto/hisilicon/hpre/hpre_crypto.c        |  418 ++--
 drivers/crypto/hisilicon/hpre/hpre_main.c          |    2 +-
 drivers/crypto/hisilicon/qm.c                      |  112 +-
 drivers/crypto/hisilicon/sec2/sec.h                |    7 -
 drivers/crypto/hisilicon/sec2/sec_crypto.c         |  163 +-
 drivers/crypto/hisilicon/sec2/sec_main.c           |   21 +-
 drivers/crypto/hisilicon/sgl.c                     |    2 +-
 drivers/crypto/hisilicon/trng/trng.c               |  123 +-
 drivers/crypto/hisilicon/zip/zip.h                 |    2 +-
 drivers/crypto/hisilicon/zip/zip_crypto.c          |  133 +-
 drivers/crypto/hisilicon/zip/zip_main.c            |    4 +-
 drivers/crypto/inside-secure/eip93/eip93-main.c    |   94 +-
 .../intel/qat/qat_common/adf_pfvf_pf_proto.c       |   10 +
 drivers/crypto/marvell/octeontx/otx_cptvf_main.c   |    3 +-
 drivers/crypto/starfive/jh7110-aes.c               |    9 +-
 drivers/cxl/core/edac.c                            |   64 +-
 drivers/cxl/core/hdm.c                             |    3 +-
 drivers/cxl/core/memdev.c                          |    1 -
 drivers/cxl/core/port.c                            |    8 +-
 drivers/cxl/cxlmem.h                               |    5 +-
 drivers/dma/dma-axi-dmac.c                         |   11 +-
 drivers/dma/fsl-edma-main.c                        |    1 -
 drivers/dma/mediatek/mtk-uart-apdma.c              |   10 +-
 drivers/dpll/dpll_netlink.c                        |   12 +-
 drivers/dpll/zl3073x/Makefile                      |    3 +-
 drivers/dpll/zl3073x/core.c                        |  225 --
 drivers/dpll/zl3073x/core.h                        |  167 +-
 drivers/dpll/zl3073x/dpll.c                        |  436 +---
 drivers/dpll/zl3073x/out.c                         |  157 ++
 drivers/dpll/zl3073x/out.h                         |   93 +
 drivers/dpll/zl3073x/prop.c                        |   19 +-
 drivers/dpll/zl3073x/ref.c                         |  112 +
 drivers/dpll/zl3073x/ref.h                         |   66 +
 drivers/dpll/zl3073x/synth.c                       |   87 +
 drivers/dpll/zl3073x/synth.h                       |   72 +
 drivers/edac/altera_edac.c                         |   11 +-
 drivers/edac/i5000_edac.c                          |    1 +
 drivers/edac/i5400_edac.c                          |    2 +-
 drivers/firmware/arm_ffa/driver.c                  |   33 +-
 drivers/firmware/efi/efi.c                         |    8 +-
 drivers/gpio/gpio-amd-fch.c                        |    7 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c           |    4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |    1 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_job.c            |    8 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            |    2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c           |    3 -
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |    3 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |    6 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c             |    3 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |    2 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c            |    6 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c           |    8 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c             |   14 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c             |   20 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c             |   14 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c             |    3 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c              |   45 +-
 drivers/gpu/drm/amd/amdkfd/kfd_debug.c             |   20 +-
 drivers/gpu/drm/amd/amdkfd/kfd_process.c           |    2 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   21 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c    |    5 +
 .../display/dc/resource/dcn315/dcn315_resource.c   |    8 +-
 .../display/dc/resource/dcn316/dcn316_resource.c   |    8 +-
 .../amd/display/dc/resource/dcn32/dcn32_resource.c |    8 +-
 .../display/dc/resource/dcn321/dcn321_resource.c   |    8 +-
 .../amd/display/dc/resource/dcn35/dcn35_resource.c |    8 +-
 .../display/dc/resource/dcn351/dcn351_resource.c   |    8 +-
 drivers/gpu/drm/drm_buddy.c                        |    1 +
 drivers/gpu/drm/exynos/exynos_drm_drv.h            |    1 +
 drivers/gpu/drm/exynos/exynos_drm_vidi.c           |   36 +-
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h       |    4 +
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h     |    2 +
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c         |   38 +-
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h         |    8 +
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h        |    3 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c     |   71 +-
 drivers/gpu/drm/i915/display/intel_acpi.c          |    1 +
 drivers/gpu/drm/msm/adreno/a2xx_gpu.c              |    5 +-
 .../gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h |   14 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c        |   18 +-
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c   |    7 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c        |   49 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h        |    3 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c        |   35 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c         |    7 -
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h        |    7 +
 drivers/gpu/drm/msm/disp/mdp_format.c              |    8 +-
 drivers/gpu/drm/msm/dp/dp_ctrl.c                   |   24 +-
 drivers/gpu/drm/msm/dp/dp_display.c                |    4 +-
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c         |    7 +-
 drivers/gpu/drm/msm/msm_mdss.c                     |    2 +-
 drivers/gpu/drm/panel/panel-lg-sw43408.c           |    4 -
 drivers/gpu/drm/panthor/panthor_gpu.c              |   21 +-
 drivers/gpu/drm/panthor/panthor_mmu.c              |    4 +
 drivers/gpu/drm/panthor/panthor_sched.c            |  169 +-
 drivers/gpu/drm/panthor/panthor_sched.h            |    1 +
 drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c     |    7 +-
 drivers/gpu/drm/xe/xe_bo.c                         |    2 +-
 drivers/gpu/drm/xe/xe_configfs.h                   |   12 +-
 drivers/gpu/drm/xe/xe_device.c                     |    1 +
 drivers/gpu/drm/xe/xe_guc_pc.c                     |   34 +
 drivers/gpu/drm/xe/xe_mmio.c                       |   10 +-
 drivers/gpu/drm/xe/xe_module.h                     |    2 +-
 drivers/gpu/drm/xe/xe_wa.c                         |   18 +-
 drivers/hid/hid-playstation.c                      |    4 +-
 drivers/hid/intel-ish-hid/ishtp/bus.c              |    2 +-
 drivers/hv/mshv_eventfd.c                          |    5 +-
 drivers/hv/vmbus_drv.c                             |   66 +-
 drivers/hwmon/ibmpex.c                             |    9 +-
 drivers/hwmon/pmbus/mpq8785.c                      |   28 +
 drivers/hwspinlock/omap_hwspinlock.c               |    4 +-
 drivers/hwtracing/coresight/coresight-etm3x-core.c |   12 +-
 drivers/hwtracing/coresight/coresight-tmc-etr.c    |   13 +
 drivers/i3c/master.c                               |    6 +-
 drivers/i3c/master/dw-i3c-master.c                 |    3 +
 drivers/iio/accel/sca3000.c                        |    6 +-
 drivers/iio/gyro/mpu3050-core.c                    |    6 +-
 drivers/iio/pressure/mprls0025pa.c                 |   36 +-
 drivers/iio/pressure/mprls0025pa.h                 |    2 -
 drivers/iio/pressure/mprls0025pa_spi.c             |   19 +-
 drivers/iio/test/Kconfig                           |    1 -
 drivers/infiniband/core/cache.c                    |    3 +-
 drivers/infiniband/core/iwcm.c                     |   56 +-
 drivers/infiniband/core/iwcm.h                     |    1 -
 drivers/infiniband/core/rw.c                       |   53 +-
 drivers/infiniband/core/user_mad.c                 |    8 +-
 drivers/infiniband/core/uverbs_cmd.c               |    7 +-
 drivers/infiniband/hw/hns/hns_roce_ah.c            |   23 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |   54 +-
 drivers/infiniband/hw/mlx5/main.c                  |  101 +-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               |    2 +
 drivers/infiniband/hw/mlx5/std_types.c             |    4 +-
 drivers/infiniband/sw/rxe/rxe_comp.c               |    3 +
 drivers/infiniband/sw/rxe/rxe_mr.c                 |  285 ++-
 drivers/infiniband/sw/rxe/rxe_req.c                |    3 +
 drivers/infiniband/sw/rxe/rxe_srq.c                |    6 +-
 drivers/infiniband/sw/rxe/rxe_verbs.h              |   10 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |    3 +-
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |   33 +-
 drivers/interconnect/mediatek/icc-emi.c            |    9 +-
 drivers/iommu/amd/amd_iommu.h                      |    1 -
 drivers/iommu/amd/init.c                           |   12 +-
 drivers/iommu/amd/iommu.c                          |    5 -
 drivers/iommu/intel/iommu.c                        |    4 +-
 drivers/iommu/intel/iommu.h                        |   21 +-
 drivers/iommu/intel/pasid.c                        |   18 +-
 drivers/iommu/intel/pasid.h                        |   14 +
 drivers/leds/leds-expresswire.c                    |   24 +-
 drivers/leds/rgb/leds-qcom-lpg.c                   |    8 +-
 drivers/mailbox/pcc.c                              |  102 +-
 drivers/mcb/mcb-core.c                             |    9 +-
 drivers/md/dm-zone.c                               |   11 +-
 drivers/md/dm.c                                    |    2 +
 drivers/md/md-llbitmap.c                           |    4 +-
 drivers/md/md.h                                    |    4 +-
 drivers/md/raid1.c                                 |    1 +
 drivers/md/raid10.c                                |    2 +-
 drivers/md/raid5.c                                 |   10 +-
 drivers/media/i2c/ccs/ccs-core.c                   |   16 +-
 drivers/media/pci/mgb4/mgb4_trigger.c              |    2 +-
 .../platform/chips-media/wave5/wave5-vpu-dec.c     |    4 +-
 .../platform/chips-media/wave5/wave5-vpu-enc.c     |    4 +-
 drivers/media/usb/uvc/uvc_video.c                  |    3 +-
 drivers/mfd/Kconfig                                |   11 +
 drivers/mfd/arizona-core.c                         |    2 +-
 drivers/mfd/simple-mfd-i2c.c                       |    1 +
 drivers/mtd/devices/mtd_intel_dg.c                 |    9 +-
 drivers/mtd/nand/raw/cadence-nand-controller.c     |    2 +-
 drivers/mtd/parsers/ofpart_core.c                  |   16 +-
 drivers/mtd/parsers/tplink_safeloader.c            |    1 +
 drivers/net/bonding/bond_main.c                    |   21 +-
 drivers/net/caif/caif_serial.c                     |    5 +-
 drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c |    2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |   11 +-
 .../net/ethernet/marvell/octeon_ep/octep_cn9k_pf.c |   21 +-
 .../net/ethernet/marvell/octeon_ep/octep_cnxk_pf.c |   64 +-
 .../net/ethernet/marvell/octeon_ep/octep_main.h    |    2 +-
 .../marvell/octeon_ep/octep_regs_cn9k_pf.h         |    1 +
 .../marvell/octeon_ep/octep_regs_cnxk_pf.h         |    1 +
 drivers/net/ethernet/marvell/octeon_ep/octep_rx.c  |    8 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_cn9k.c  |    3 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_cnxk.c  |   39 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_main.h  |    2 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c    |    8 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |   11 +
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |   41 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |    1 +
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |    3 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c   |   14 -
 .../ethernet/mellanox/mlx5/core/en/reporter_rx.c   |   13 +
 .../ethernet/mellanox/mlx5/core/en/reporter_tx.c   |   52 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   40 -
 drivers/net/ethernet/mellanox/mlx5/core/wc.c       |   14 +-
 drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c    |    3 +
 drivers/net/ethernet/meta/fbnic/fbnic_fw_log.c     |    3 -
 drivers/net/ethernet/meta/fbnic/fbnic_netdev.c     |   20 +
 drivers/net/ethernet/meta/fbnic/fbnic_netdev.h     |    2 +
 drivers/net/ethernet/meta/fbnic/fbnic_pci.c        |   19 +-
 drivers/net/ethernet/meta/fbnic/fbnic_phylink.c    |    3 +
 drivers/net/ethernet/meta/fbnic/fbnic_rpc.c        |    5 +-
 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c       |   43 +-
 drivers/net/ethernet/meta/fbnic/fbnic_txrx.h       |    3 +-
 drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c |    2 +-
 drivers/net/ethernet/microchip/sparx5/sparx5_qos.h |    2 +-
 drivers/net/ethernet/mscc/ocelot_net.c             |   89 +-
 .../net/ethernet/pensando/ionic/ionic_ethtool.c    |    7 +-
 drivers/net/ethernet/renesas/rswitch_l2.c          |   15 +-
 drivers/net/ethernet/stmicro/stmmac/common.h       |    5 +
 .../ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c    |    2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c  |    5 +-
 .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c    |    2 +-
 .../net/ethernet/stmicro/stmmac/dwmac-loongson.c   |    6 +-
 .../net/ethernet/stmicro/stmmac/dwmac-lpc18xx.c    |    2 +-
 .../ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c    |    6 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c     |    4 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-s32.c    |    2 +-
 .../net/ethernet/stmicro/stmmac/dwmac-socfpga.c    |    2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.c  |    2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c  |    2 +-
 drivers/net/ethernet/stmicro/stmmac/hwif.c         |   73 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_est.c   |    4 +-
 .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c   |   68 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |   63 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c  |   14 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c   |    4 +-
 .../net/ethernet/stmicro/stmmac/stmmac_platform.c  |    9 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c   |    4 +-
 drivers/net/ethernet/sun/sunhme.c                  |    3 +
 drivers/net/macvlan.c                              |    5 +
 drivers/net/mctp/mctp-i2c.c                        |    9 +
 drivers/net/ovpn/io.c                              |   57 +-
 drivers/net/ovpn/socket.c                          |   41 +-
 drivers/net/ovpn/tcp.c                             |   23 +-
 drivers/net/ovpn/udp.c                             |    1 +
 drivers/net/usb/catc.c                             |   37 +-
 drivers/net/wireless/ath/ath10k/sdio.c             |    6 +
 drivers/net/wireless/ath/ath11k/core.c             |   27 +
 drivers/net/wireless/ath/ath11k/core.h             |    4 +
 .../net/wireless/ath/ath12k/debugfs_htt_stats.c    |    8 +-
 drivers/net/wireless/ath/ath12k/mac.c              |    4 +-
 drivers/net/wireless/ath/ath12k/wow.c              |   16 +
 drivers/net/wireless/ath/ath9k/Kconfig             |    2 +-
 drivers/net/wireless/realtek/rtw89/debug.c         |    8 +-
 drivers/net/xen-netback/xenbus.c                   |    5 +-
 drivers/nvdimm/nd_virtio.c                         |    3 +-
 drivers/nvdimm/virtio_pmem.c                       |    1 +
 drivers/nvdimm/virtio_pmem.h                       |    4 +
 drivers/nvmem/Kconfig                              |    2 +-
 drivers/of/unittest.c                              |    6 +-
 drivers/opp/core.c                                 |    2 +-
 drivers/pci/controller/dwc/pcie-sophgo.c           |   18 +
 drivers/pci/controller/pcie-mediatek.c             |    4 +-
 drivers/pci/controller/pcie-xilinx.c               |    9 +-
 drivers/pci/p2pdma.c                               |   10 +-
 drivers/pci/pci-acpi.c                             |   59 +-
 drivers/pci/pci.c                                  |    5 +-
 drivers/pci/pci.h                                  |    3 +
 drivers/pci/pcie/aer.c                             |    3 -
 drivers/pci/pcie/portdrv.c                         |    6 +-
 drivers/pci/pcie/ptm.c                             |    5 +-
 drivers/pci/probe.c                                |   35 +-
 drivers/pci/quirks.c                               |    5 +
 drivers/pci/setup-bus.c                            |  138 +-
 drivers/perf/arm_spe_pmu.c                         |   18 +-
 drivers/phy/freescale/phy-fsl-imx8qm-hsio.c        |    2 +-
 drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c  |    2 +
 drivers/pinctrl/meson/pinctrl-amlogic-a4.c         |   10 +-
 drivers/pinctrl/pinctrl-equilibrium.c              |    1 +
 drivers/pinctrl/pinctrl-k230.c                     |    7 +-
 drivers/pinctrl/pinctrl-single.c                   |    2 +
 drivers/pinctrl/qcom/pinctrl-sm8250-lpass-lpi.c    |    2 +-
 drivers/platform/chrome/cros_ec_lightbar.c         |    2 +-
 drivers/platform/chrome/cros_typec_switch.c        |    6 +-
 drivers/platform/x86/amd/pmf/core.c                |   62 +-
 drivers/platform/x86/amd/pmf/pmf.h                 |   10 +
 drivers/platform/x86/amd/pmf/tee-if.c              |   12 +-
 drivers/platform/x86/hp/hp-wmi.c                   |  179 +-
 drivers/platform/x86/intel/int0002_vgpio.c         |    4 +-
 drivers/power/reset/nvmem-reboot-mode.c            |   15 +-
 drivers/power/supply/ab8500_charger.c              |   40 +-
 drivers/power/supply/act8945a_charger.c            |   16 +-
 drivers/power/supply/bq256xx_charger.c             |   12 +-
 drivers/power/supply/bq25980_charger.c             |   12 +-
 drivers/power/supply/bq27xxx_battery.c             |    6 +-
 drivers/power/supply/cpcap-battery.c               |    8 +-
 drivers/power/supply/goldfish_battery.c            |   12 +-
 drivers/power/supply/pm8916_bms_vm.c               |   18 +-
 drivers/power/supply/pm8916_lbc.c                  |   18 +-
 drivers/power/supply/qcom_battmgr.c                |    3 +-
 drivers/power/supply/rt9455_charger.c              |   17 +-
 drivers/power/supply/sbs-battery.c                 |   36 +-
 drivers/power/supply/wm97xx_battery.c              |   34 +-
 drivers/powercap/intel_rapl_tpmi.c                 |    2 +-
 drivers/pwm/pwm-tiehrpwm.c                         |    6 +-
 drivers/regulator/core.c                           |   55 +-
 drivers/remoteproc/imx_dsp_rproc.c                 |    8 +-
 drivers/reset/Kconfig                              |    2 +-
 drivers/rtc/rtc-amlogic-a4.c                       |    2 +-
 drivers/s390/cio/css.c                             |    2 +-
 drivers/scsi/csiostor/csio_scsi.c                  |    3 +-
 drivers/scsi/elx/efct/efct_driver.c                |    8 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |   13 +-
 drivers/soc/mediatek/mtk-svs.c                     |    5 +-
 drivers/soc/qcom/cmd-db.c                          |    7 +-
 drivers/soc/qcom/smem.c                            |    4 +-
 drivers/soundwire/Kconfig                          |    1 +
 drivers/spi/spi-wpcm-fiu.c                         |    2 +-
 drivers/staging/gpib/common/iblib.c                |    5 +-
 drivers/staging/gpib/ni_usb/ni_usb_gpib.c          |   14 +-
 drivers/staging/greybus/light.c                    |    8 +-
 drivers/thermal/intel/x86_pkg_temp_thermal.c       |    3 +
 drivers/thermal/thermal_of.c                       |    4 +-
 drivers/tty/serial/Kconfig                         |    8 +-
 drivers/ufs/host/Kconfig                           |    1 +
 drivers/ufs/host/ufs-mediatek.c                    |   12 +-
 drivers/usb/cdns3/core.c                           |    2 +-
 drivers/usb/gadget/udc/bdc/bdc_core.c              |    4 +-
 drivers/usb/typec/tcpm/fusb302.c                   |    3 +-
 drivers/usb/typec/ucsi/Kconfig                     |    1 -
 drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c     |   24 +
 drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.h     |    2 +
 drivers/vfio/pci/vfio_pci_core.c                   |   17 +-
 drivers/video/backlight/qcom-wled.c                |   42 +-
 drivers/video/fbdev/au1200fb.c                     |    6 +-
 drivers/video/of_display_timing.c                  |    6 +-
 drivers/watchdog/starfive-wdt.c                    |    2 +-
 drivers/xen/balloon.c                              |   19 +-
 drivers/xen/grant-dma-ops.c                        |    3 +-
 drivers/xen/unpopulated-alloc.c                    |    3 +
 fs/btrfs/accessors.h                               |    1 +
 fs/btrfs/bio.c                                     |  167 +-
 fs/btrfs/bio.h                                     |   30 +-
 fs/btrfs/block-group.c                             |   31 +-
 fs/btrfs/block-rsv.c                               |    9 +-
 fs/btrfs/btrfs_inode.h                             |    8 +-
 fs/btrfs/compression.c                             |    6 +-
 fs/btrfs/compression.h                             |    6 +-
 fs/btrfs/ctree.h                                   |    2 -
 fs/btrfs/defrag.c                                  |    1 +
 fs/btrfs/dir-item.c                                |    1 +
 fs/btrfs/direct-io.c                               |    6 +-
 fs/btrfs/disk-io.c                                 |    1 +
 fs/btrfs/disk-io.h                                 |    3 +-
 fs/btrfs/extent-tree.c                             |    1 +
 fs/btrfs/extent_io.c                               |   22 +-
 fs/btrfs/extent_io.h                               |    1 -
 fs/btrfs/extent_map.h                              |    3 +-
 fs/btrfs/file-item.c                               |   64 +-
 fs/btrfs/file-item.h                               |    4 +-
 fs/btrfs/inode.c                                   |    8 +-
 fs/btrfs/qgroup.c                                  |   15 +-
 fs/btrfs/scrub.c                                   |   51 +-
 fs/btrfs/space-info.c                              |   15 +-
 fs/btrfs/space-info.h                              |    5 +-
 fs/btrfs/subpage.h                                 |    1 -
 fs/btrfs/transaction.c                             |   11 +-
 fs/btrfs/transaction.h                             |    4 -
 fs/btrfs/tree-log.c                                |    1 +
 fs/btrfs/tree-log.h                                |    3 +-
 fs/btrfs/volumes.c                                 |  243 +-
 fs/btrfs/zoned.c                                   |    4 +-
 fs/btrfs/zoned.h                                   |    1 -
 fs/erofs/fileio.c                                  |   22 +-
 fs/erofs/fscache.c                                 |    4 +-
 fs/erofs/zdata.c                                   |   30 +-
 fs/ext4/ext4.h                                     |   16 +
 fs/ext4/extents.c                                  |   54 +-
 fs/ext4/fast_commit.c                              |   51 +-
 fs/ext4/mballoc-test.c                             |    2 +-
 fs/ext4/mballoc.c                                  |   73 +-
 fs/fat/namei_msdos.c                               |    7 +-
 fs/fat/namei_vfat.c                                |    7 +-
 fs/file_table.c                                    |   10 +-
 fs/fs_struct.c                                     |    1 +
 fs/gfs2/bmap.c                                     |   13 +-
 fs/gfs2/glock.c                                    |   36 +-
 fs/gfs2/glock.h                                    |    3 +-
 fs/gfs2/inode.c                                    |   18 +-
 fs/gfs2/quota.c                                    |    1 +
 fs/hfsplus/bnode.c                                 |    2 +-
 fs/iomap/direct-io.c                               |   10 +-
 fs/jfs/jfs_dtree.c                                 |    4 +-
 fs/netfs/write_retry.c                             |    1 -
 fs/nfs/dir.c                                       |    4 +-
 fs/nfs/localio.c                                   |   92 +-
 fs/nfs/pnfs.c                                      |    3 +-
 fs/nfsd/nfs2acl.c                                  |    2 +-
 fs/nfsd/nfs4idmap.c                                |   48 +-
 fs/nfsd/nfs4proc.c                                 |    2 -
 fs/nfsd/nfs4xdr.c                                  |   16 +
 fs/nfsd/nfsproc.c                                  |    2 +-
 fs/ntfs3/file.c                                    |   10 +-
 fs/ntfs3/fslog.c                                   |    3 +
 fs/overlayfs/readdir.c                             |    2 +-
 fs/pidfs.c                                         |    2 +-
 fs/proc/array.c                                    |    2 +-
 fs/pstore/ram_core.c                               |   11 +
 fs/quota/quota.c                                   |    1 +
 fs/smb/client/smb2file.c                           |    2 +
 fs/smb/client/smbdirect.c                          |   19 +-
 fs/tests/exec_kunit.c                              |    6 -
 include/acpi/pcc.h                                 |   29 -
 include/asm-generic/rqspinlock.h                   |    2 +-
 include/drm/intel/intel_lb_mei_interface.h         |    3 +-
 include/linux/audit.h                              |    6 -
 include/linux/audit_arch.h                         |    7 +
 include/linux/bpf.h                                |    5 +
 include/linux/bpf_mprog.h                          |   10 +
 include/linux/capability.h                         |    6 +
 include/linux/clk.h                                |   48 +-
 include/linux/device_cgroup.h                      |    2 +-
 include/linux/dpll.h                               |    1 +
 include/linux/filter.h                             |   26 +-
 include/linux/ftrace.h                             |    6 +-
 include/linux/hisi_acc_qm.h                        |   13 +-
 include/linux/hw_random.h                          |    2 +
 include/linux/input/adp5589.h                      |  180 --
 include/linux/interrupt.h                          |    2 +-
 include/linux/io_uring_types.h                     |    7 +-
 include/linux/leds-expresswire.h                   |    3 -
 include/linux/libata.h                             |    3 +
 include/linux/mfd/wm8350/core.h                    |    2 +-
 include/linux/mlx5/driver.h                        |    4 +-
 include/linux/module.h                             |    9 +
 include/linux/mtd/spinand.h                        |    2 +-
 include/linux/psp.h                                |    1 +
 include/linux/skmsg.h                              |   70 +-
 include/linux/soc/qcom/ubwc.h                      |    1 +
 include/linux/stmmac.h                             |   12 +-
 include/linux/sunrpc/xdrgen/_builtins.h            |   20 +-
 include/linux/u64_stats_sync.h                     |   10 +
 include/net/inet_ecn.h                             |   20 +-
 include/net/ipv6.h                                 |   11 +-
 include/net/netfilter/nf_conntrack_count.h         |    1 +
 include/net/netfilter/nf_queue.h                   |    4 +
 include/net/netfilter/nf_tables.h                  |    4 +
 include/net/netns/ipv4.h                           |    9 +-
 include/net/tcp.h                                  |   31 +-
 include/net/tcp_ecn.h                              |   66 +-
 include/rdma/rw.h                                  |    2 +
 include/sound/sdca_function.h                      |    1 +
 include/uapi/linux/dpll.h                          |    1 +
 include/uapi/linux/nfs.h                           |    2 +-
 include/ufs/ufshcd.h                               |    4 -
 include/xen/xen.h                                  |    2 +
 io_uring/cancel.h                                  |    6 +-
 io_uring/io_uring.c                                |   14 +-
 io_uring/kbuf.c                                    |    5 +-
 io_uring/msg_ring.c                                |   12 +-
 io_uring/register.c                                |    3 +-
 io_uring/rsrc.c                                    |   27 +-
 io_uring/sync.c                                    |    2 +
 ipc/ipc_sysctl.c                                   |    2 +-
 kernel/bpf/core.c                                  |    4 +-
 kernel/bpf/helpers.c                               |    2 +-
 kernel/bpf/rqspinlock.c                            |    7 +-
 kernel/bpf/syscall.c                               |   19 +-
 kernel/bpf/verifier.c                              |   66 +-
 kernel/kallsyms.c                                  |    9 +-
 kernel/module/kallsyms.c                           |    9 +-
 kernel/rcu/tree.h                                  |    2 +-
 kernel/rcu/tree_plugin.h                           |   15 +-
 kernel/sched/core.c                                |    4 +
 kernel/sched/deadline.c                            |    3 +
 kernel/sched/rt.c                                  |    5 +
 kernel/time/hrtimer.c                              |    2 +-
 kernel/time/sched_clock.c                          |    2 +-
 kernel/trace/bpf_trace.c                           |    6 +-
 kernel/trace/ftrace.c                              |    5 +-
 kernel/trace/trace_events.c                        |    5 -
 kernel/trace/trace_events_hist.c                   |    2 +-
 kernel/ucount.c                                    |    2 +-
 kernel/workqueue.c                                 |   92 +-
 lib/kstrtox.c                                      |    4 +-
 lib/objpool.c                                      |    2 +-
 mm/slub.c                                          |   20 +
 net/atm/signaling.c                                |   56 +-
 net/bridge/br_multicast.c                          |   45 +-
 net/core/dev.c                                     |    2 +-
 net/core/filter.c                                  |   22 +-
 net/core/skmsg.c                                   |   30 +-
 net/ipv4/icmp.c                                    |   32 +-
 net/ipv4/ping.c                                    |   33 +-
 net/ipv4/tcp.c                                     |    3 +
 net/ipv4/tcp_bpf.c                                 |   25 +-
 net/ipv4/tcp_cong.c                                |    5 +-
 net/ipv4/tcp_input.c                               |    5 +-
 net/ipv4/tcp_minisocks.c                           |    7 +-
 net/ipv4/udp_bpf.c                                 |   23 +-
 net/ipv6/af_inet6.c                                |    2 +-
 net/ipv6/icmp.c                                    |   13 +-
 net/ipv6/ip6_fib.c                                 |    2 +-
 net/mptcp/protocol.c                               |   14 +-
 net/mptcp/protocol.h                               |    5 +
 net/netfilter/ipvs/ip_vs_xmit.c                    |   46 +-
 net/netfilter/nf_conncount.c                       |   54 +-
 net/netfilter/nf_conntrack_h323_main.c             |   10 +-
 net/netfilter/nf_tables_api.c                      |   34 +-
 net/netfilter/nfnetlink_queue.c                    |  267 ++-
 net/netfilter/nft_compat.c                         |   13 +-
 net/netfilter/nft_connlimit.c                      |    7 +-
 net/netfilter/nft_counter.c                        |    4 +-
 net/netfilter/nft_set_hash.c                       |    9 +-
 net/netfilter/nft_set_rbtree.c                     |  794 +++++--
 net/nfc/hci/llc_shdlc.c                            |    8 +
 net/psp/Kconfig                                    |    1 +
 net/rds/send.c                                     |    6 +-
 net/sunrpc/auth_gss/auth_gss.c                     |    3 +
 net/sunrpc/auth_gss/gss_rpc_xdr.c                  |   82 +-
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |    8 +-
 net/unix/af_unix.c                                 |   11 +-
 net/wireless/core.c                                |    4 +-
 net/wireless/scan.c                                |    2 +-
 rust/kernel/task.rs                                |   24 +-
 security/apparmor/apparmorfs.c                     |    9 +
 security/apparmor/file.c                           |   15 +-
 security/apparmor/include/match.h                  |   12 +-
 security/apparmor/label.c                          |   33 +-
 security/apparmor/lsm.c                            |   33 +-
 security/apparmor/match.c                          |   22 +-
 security/apparmor/net.c                            |    6 +-
 security/apparmor/policy_unpack.c                  |    6 +-
 security/apparmor/resource.c                       |    5 +
 security/integrity/evm/evm_crypto.c                |   14 +-
 security/smack/smackfs.c                           |   79 +-
 sound/core/pcm.c                                   |    4 +-
 sound/core/pcm_compat.c                            |    9 +-
 sound/core/pcm_native.c                            |   50 +-
 sound/core/vmaster.c                               |   12 +-
 sound/hda/codecs/conexant.c                        |   10 +
 sound/hda/codecs/realtek/alc269.c                  |    2 +
 sound/soc/codecs/aw88261.c                         |    3 +-
 sound/soc/codecs/nau8821.c                         |    5 +
 sound/soc/codecs/nau8821.h                         |    1 +
 sound/soc/fsl/fsl_xcvr.c                           |    3 -
 sound/soc/rockchip/rockchip_i2s_tdm.c              |   10 +
 sound/soc/sdca/sdca_asoc.c                         |   54 +-
 sound/soc/sdca/sdca_functions.c                    |   62 +-
 sound/soc/sdca/sdca_regmap.c                       |    9 +-
 sound/soc/tegra/tegra210_ahub.c                    |   57 +
 sound/soc/tegra/tegra210_ahub.h                    |   30 +
 tools/bpf/bpftool/net.c                            |    5 +-
 tools/lib/bpf/btf_dump.c                           |    9 +
 tools/lib/bpf/linker.c                             |    2 +-
 tools/lib/bpf/netlink.c                            |    4 +-
 tools/net/sunrpc/xdrgen/generators/__init__.py     |    3 +-
 .../xdrgen/templates/C/program/decoder/argument.j2 |    4 +
 .../xdrgen/templates/C/program/encoder/result.j2   |    6 +
 .../sunrpc/xdrgen/templates/C/source_top/client.j2 |    1 -
 tools/objtool/Makefile                             |    2 +
 tools/power/x86/intel-speed-select/isst-config.c   |    2 +
 tools/spi/.gitignore                               |    1 +
 tools/testing/selftests/bpf/Makefile               |    2 +-
 tools/testing/selftests/bpf/prog_tests/check_mtu.c |   23 +-
 .../selftests/bpf/prog_tests/stacktrace_ips.c      |   19 +-
 tools/testing/selftests/bpf/prog_tests/wq.c        |    5 +-
 tools/testing/selftests/bpf/progs/test_check_mtu.c |   12 +
 tools/testing/selftests/bpf/test_xsk.c             | 2422 +++++++++++++++++++
 tools/testing/selftests/bpf/test_xsk.h             |  297 +++
 tools/testing/selftests/bpf/veristat.c             |    2 +-
 tools/testing/selftests/bpf/xskxceiver.c           | 2497 +-------------------
 tools/testing/selftests/bpf/xskxceiver.h           |  156 --
 .../selftests/drivers/net/lib/sh/lib_netcons.sh    |    6 +-
 .../selftests/drivers/net/mlxsw/tc_restrictions.sh |    4 +-
 tools/testing/selftests/memfd/memfd_test.c         |  113 +-
 tools/testing/selftests/mm/cow.c                   |   16 +-
 tools/testing/selftests/mm/pagemap_ioctl.c         |    9 +-
 .../testing/selftests/net/forwarding/tc_actions.sh |    2 +-
 .../selftests/net/forwarding/vxlan_bridge_1d.sh    |   26 +-
 .../net/forwarding/vxlan_bridge_1d_ipv6.sh         |    2 +-
 tools/testing/selftests/net/lib.sh                 |    2 +-
 tools/testing/selftests/resctrl/resctrlfs.c        |   10 +
 723 files changed, 11582 insertions(+), 7566 deletions(-)

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: YunJe Shin <[email protected]>

commit 14ab3da122bd18920ad57428f6cf4fade8385142 upstream.

If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present.

KASAN splat:

[  101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
[  101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

---
 drivers/infiniband/sw/siw/siw_qp_rx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -1435,7 +1435,8 @@ int siw_tcp_rx_data(read_descriptor_t *r
 		}
 		if (unlikely(rv != 0 && rv != -EAGAIN)) {
 			if ((srx->state > SIW_GET_HDR ||
-			     qp->rx_fpdu->more_ddp_segs) && run_completion)
+			     (qp->rx_fpdu && qp->rx_fpdu->more_ddp_segs)) &&
+			    run_completion)
 				siw_rdmap_complete(qp, rv);
 
 			siw_dbg_qp(qp, "rx error %d, rx state %d\n", rv,

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: YunJe Shin <[email protected]>

commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 upstream.

ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list().

Add an explicit check to reject negative data_len before creating the send buffer.

KASAN splat:

[  211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0
[  211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102
[  211.365867] ib_create_send_mad+0xa01/0x11b0
[  211.365887] ib_umad_write+0x853/0x1c80

---
 drivers/infiniband/core/user_mad.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -514,7 +514,8 @@ static ssize_t ib_umad_write(struct file
 	struct rdma_ah_attr ah_attr;
 	struct ib_ah *ah;
 	__be64 *tid;
-	int ret, data_len, hdr_len, copy_offset, rmpp_active;
+	int ret, hdr_len, copy_offset, rmpp_active;
+	size_t data_len;
 	u8 base_version;
 
 	if (count < hdr_size(file) + IB_MGMT_RMPP_HDR)

@@ -588,7 +589,10 @@ static ssize_t ib_umad_write(struct file
 	}
 
 	base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version;
-	data_len = count - hdr_size(file) - hdr_len;
+	if (check_sub_overflow(count, hdr_size(file) + hdr_len, &data_len)) {
+		ret = -EINVAL;
+		goto err_ah;
+	}
 	packet->msg = ib_create_send_mad(agent,
 					 be32_to_cpu(packet->mad.hdr.qpn),
 					 packet->mad.hdr.pkey_index, rmpp_active,

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Fourier <[email protected]>

[ Upstream commit b5c23a4d291d2ac1dfdd574a68a3a68c8da3069e ]

It seems like, after the request_mem_region(), the corresponding release_mem_region() must take the same size. This was done in (now removed due to previous refactoring) charlcd_remove() but not in the error path in charlcd_probe().

---
 drivers/auxdisplay/arm-charlcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a7eae99a48f77..4e22882f57c9c 100644
@@ -323,7 +323,7 @@ static int __init charlcd_probe(struct platform_device *pdev)
 out_no_irq:
 	iounmap(lcd->virtbase);
 out_no_memregion:
-	release_mem_region(lcd->phybase, SZ_4K);
+	release_mem_region(lcd->phybase, lcd->physize);
 out_no_resource:
 	kfree(lcd);
 	return ret;

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shardul Bankar <[email protected]>

[ Upstream commit d8a73cc46c8462a969a7516131feb3096f4c49d3 ]

When hfs_bnode_create() finds that a node is already hashed (which should not happen in normal operation), it currently returns the existing node without incrementing its reference count. This causes a reference count inconsistency that leads to a kernel panic when the node is later freed in hfs_bnode_put():

kernel BUG at fs/hfsplus/bnode.c:676!
BUG_ON(!atomic_read(&node->refcnt))

This scenario can occur when hfs_bmap_alloc() attempts to allocate a node that is already in use (e.g., when node 0's bitmap bit is incorrectly unset), or due to filesystem corruption.

Returning an existing node from a create path is not normal operation.

Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's already hashed. This properly signals the error condition to callers, which already check for IS_ERR() return values.

---
 fs/hfsplus/bnode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 482a6c5faa197..8e60e04c427bd 100644
@@ -629,7 +629,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
 	if (node) {
 		pr_crit("new node %u already hashed?\n", num);
 		WARN_ON(1);
-		return node;
+		return ERR_PTR(-EEXIST);
 	}
 	node = __hfs_bnode_create(tree, num);
 	if (!node)

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yao Kai <[email protected]>

[ Upstream commit d41e37f26b3157b3f1d10223863519a943aa239b ]

Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") removes the recursion-protection code from __rcu_read_unlock(). Therefore, we could invoke the deadloop in raise_softirq_irqoff() with ftrace enabled as follows:

WARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 __ftrace_trace_stack.constprop.0+0x172/0x180
Modules linked in: my_irq_work(O)
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full)
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:__ftrace_trace_stack.constprop.0+0x172/0x180
RSP: 0018:ffffc900000034a8 EFLAGS: 00010002
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329
RBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c
R10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000
R13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054
FS:  0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <IRQ>
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 unwind_next_frame+0x203/0x9b0
 __unwind_start+0x15d/0x1c0
 arch_stack_walk+0x62/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 unwind_next_frame+0x203/0x9b0
 __unwind_start+0x15d/0x1c0
 arch_stack_walk+0x62/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 unwind_next_frame+0x203/0x9b0
 __unwind_start+0x15d/0x1c0
 arch_stack_walk+0x62/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 __is_insn_slot_addr+0x54/0x70
 kernel_text_address+0x48/0xc0
 __kernel_text_address+0xd/0x40
 unwind_get_return_address+0x1e/0x40
 arch_stack_walk+0x9c/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 __raise_softirq_irqoff+0x61/0x80
 __flush_smp_call_function_queue+0x115/0x420
 __sysvec_call_function_single+0x17/0xb0
 sysvec_call_function_single+0x8c/0xc0
 </IRQ>

Commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work") fixed the infinite loop in rcu_read_unlock_special() for IRQ work by setting a flag before calling irq_work_queue_on(). We fix this issue by setting the same flag before calling raise_softirq_irqoff() and rename the flag to defer_qs_pending for more common.

---
 kernel/rcu/tree.h        |  2 +-
 kernel/rcu/tree_plugin.h | 15 +++++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

index b8bbe7960cda7..2265b9c2906e1 100644
@@ -203,7 +203,7 @@ struct rcu_data {
 					/*  during and after the last grace */
 					/* period it is aware of. */
 	struct irq_work defer_qs_iw;	/* Obtain later scheduler attention. */
-	int defer_qs_iw_pending;	/* Scheduler attention pending? */
+	int defer_qs_pending;		/* irqwork or softirq pending? */
 	struct work_struct strict_work;	/* Schedule readers for strict GPs. */
 
 	/* 2) batch handling */

index d85763336b3c0..cafb1cc8eff84 100644
@@ -487,8 +487,8 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags)
 	union rcu_special special;
 
 	rdp = this_cpu_ptr(&rcu_data);
-	if (rdp->defer_qs_iw_pending == DEFER_QS_PENDING)
-		rdp->defer_qs_iw_pending = DEFER_QS_IDLE;
+	if (rdp->defer_qs_pending == DEFER_QS_PENDING)
+		rdp->defer_qs_pending = DEFER_QS_IDLE;
 
 	/*
 	 * If RCU core is waiting for this CPU to exit its critical section,

@@ -645,7 +645,7 @@ static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp)
 	 * 5. Deferred QS reporting does not happen.
 	 */
 	if (rcu_preempt_depth() > 0)
-		WRITE_ONCE(rdp->defer_qs_iw_pending, DEFER_QS_IDLE);
+		WRITE_ONCE(rdp->defer_qs_pending, DEFER_QS_IDLE);
 }
 
 /*

@@ -747,7 +747,10 @@ static void rcu_read_unlock_special(struct task_struct *t)
 			// Using softirq, safe to awaken, and either the
 			// wakeup is free or there is either an expedited
 			// GP in flight or a potential need to deboost.
-			raise_softirq_irqoff(RCU_SOFTIRQ);
+			if (rdp->defer_qs_pending != DEFER_QS_PENDING) {
+				rdp->defer_qs_pending = DEFER_QS_PENDING;
+				raise_softirq_irqoff(RCU_SOFTIRQ);
+			}
 		} else {
 			// Enabling BH or preempt does reschedule, so...
 			// Also if no expediting and no possible deboosting,

@@ -756,11 +759,11 @@ static void rcu_read_unlock_special(struct task_struct *t)
 			set_tsk_need_resched(current);
 			set_preempt_need_resched();
 			if (IS_ENABLED(CONFIG_IRQ_WORK) && irqs_were_disabled &&
-			    needs_exp && rdp->defer_qs_iw_pending != DEFER_QS_PENDING &&
+			    needs_exp && rdp->defer_qs_pending != DEFER_QS_PENDING &&
 			    cpu_online(rdp->cpu)) {
 				// Get scheduler to re-evaluate and call hooks.
 				// If !IRQ_WORK, FQS scan will eventually IPI.
-				rdp->defer_qs_iw_pending = DEFER_QS_PENDING;
+				rdp->defer_qs_pending = DEFER_QS_PENDING;
 				irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu);
 			}
 		}

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Dooks <[email protected]>

[ Upstream commit 76489955c6d4a065ca69dc88faf7a50a59b66f35 ]

The comapt_xxx_class symbols aren't declared in anything that lib/comapt_audit.c is including (arm64 build) which is causing the following sparse warnings:

lib/compat_audit.c:7:10: warning: symbol 'compat_dir_class'
was not declared. Should it be static?
lib/compat_audit.c:12:10: warning: symbol 'compat_read_class'
was not declared. Should it be static?
lib/compat_audit.c:17:10: warning: symbol 'compat_write_class'
was not declared. Should it be static?
lib/compat_audit.c:22:10: warning: symbol 'compat_chattr_class'
was not declared. Should it be static?
lib/compat_audit.c:27:10: warning: symbol 'compat_signal_class'
was not declared. Should it be static?

Trying to fix this by chaning compat_audit.c to inclde <linux/audit.h> does not work on arm64 due to compile errors with the extra includes that changing this header makes. The simpler thing would be just to move the definitons of these symbols out of <linux/audit.h> into <linux/audit_arch.h> which is included.

---
 include/linux/audit.h      | 6 ------
 include/linux/audit_arch.h | 7 +++++++
 2 files changed, 7 insertions(+), 6 deletions(-)

index 536f8ee8da818..b8d8029c6c480 100644
@@ -128,12 +128,6 @@ enum audit_nfcfgop {
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
 extern int audit_classify_arch(int arch);
-/* only for compat system calls */
-extern unsigned compat_write_class[];
-extern unsigned compat_read_class[];
-extern unsigned compat_dir_class[];
-extern unsigned compat_chattr_class[];
-extern unsigned compat_signal_class[];
 
 /* audit_names->type values */
 #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

index 0e34d673ef171..2b8153791e6a5 100644
@@ -23,4 +23,11 @@ enum auditsc_class_t {
 
 extern int audit_classify_compat_syscall(int abi, unsigned syscall);
 
+/* only for compat system calls */
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
 #endif

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiaochen Shen <[email protected]>

[ Upstream commit 671ef08d9455f5754d1fc96f5a14e357d6b80936 ]

Change to adjust effective L3 cache size with SNC enabled change introduced the snc_nodes_per_l3_cache() function to detect the Intel Sub-NUMA Clustering (SNC) feature by comparing #CPUs in node0 with #CPUs sharing LLC with CPU0. The function was designed to return:
(1) >1: SNC mode is enabled.
(2) 1: SNC mode is not enabled or not supported.

However, on certain Hygon CPUs, #CPUs sharing LLC with CPU0 is actually less than #CPUs in node0. This results in snc_nodes_per_l3_cache() returning 0 (calculated as cache_cpus / node_cpus).

This leads to a division by zero error in get_cache_size():
*cache_size /= snc_nodes_per_l3_cache();

Causing the resctrl selftest to fail with:
"Floating point exception (core dumped)"

Fix the issue by ensuring snc_nodes_per_l3_cache() returns 1 when SNC mode is not supported on the platform.

Updated commit log to fix commit has issues:
Shuah Khan <[email protected]>

---
 tools/testing/selftests/resctrl/resctrlfs.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

index 195f04c4d1586..b9c1bfb6cc029 100644
@@ -243,6 +243,16 @@ int snc_nodes_per_l3_cache(void)
 		}
 		snc_mode = cache_cpus / node_cpus;
 
+		/*
+		 * On some platforms (e.g. Hygon),
+		 * cache_cpus < node_cpus, the calculated snc_mode is 0.
+		 *
+		 * Set snc_mode = 1 to indicate that SNC mode is not
+		 * supported on the platform.
+		 */
+		if (!snc_mode)
+			snc_mode = 1;
+
 		if (snc_mode > 1)
 			ksft_print_msg("SNC-%d mode discovered.\n", snc_mode);
 	}

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Billy Tsai <[email protected]>

[ Upstream commit 3502cea99c7ceb331458cbd34ef6792c83144687 ]

Move device name initialization to occur after i3c_bus_init() so that i3cbus->id is guaranteed to be assigned before it is used.

---
 drivers/i3c/master.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 66513a27e6e77..bc68a5e7455be 100644
@@ -2884,7 +2884,6 @@ int i3c_master_register(struct i3c_master_controller *master,
 	INIT_LIST_HEAD(&master->boardinfo.i3c);
 
 	device_initialize(&master->dev);
-	dev_set_name(&master->dev, "i3c-%d", i3cbus->id);
 
 	master->dev.dma_mask = parent->dma_mask;
 	master->dev.coherent_dma_mask = parent->coherent_dma_mask;

@@ -2894,6 +2893,8 @@ int i3c_master_register(struct i3c_master_controller *master,
 	if (ret)
 		goto err_put_dev;
 
+	dev_set_name(&master->dev, "i3c-%d", i3cbus->id);
+
 	ret = of_populate_i3c_bus(master);
 	if (ret)
 		goto err_put_dev;

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Breno Leitao <[email protected]>

[ Upstream commit 6784f274722559c0cdaaa418bc8b7b1d61c314f9 ]

commit 4ef4ac360101 ("device_cgroup: avoid access to ->i_rdev in the common case in devcgroup_inode_permission()") reordered the checks in devcgroup_inode_permission() to check the inode mode before checking i_rdev, for better cache behavior.

However, the likely() annotation on the i_rdev check was not updated to reflect the new code flow. Originally, when i_rdev was checked first, likely(!inode->i_rdev) made sense because most inodes were(?) regular files/directories, thus i_rdev == 0.

After the reorder, by the time we reach the i_rdev check, we have already confirmed the inode IS a block or character device. Block and character special files are precisely defined by having a device number (i_rdev), so !inode->i_rdev is now the rare edge case, not the common case.

Branch profiling confirmed this is 100% mispredicted:

  correct incorrect  %    Function                      File              Line
  ------- ---------  -    --------                      ----              ----
        0   2631904 100   devcgroup_inode_permission    device_cgroup.h   24

Remove likely() to avoid giving the wrong hint to the CPU.

---
 include/linux/device_cgroup.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 0864773a57e8f..822085bc2d202 100644
@@ -21,7 +21,7 @@ static inline int devcgroup_inode_permission(struct inode *inode, int mask)
 	if (likely(!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode)))
 		return 0;
 
-	if (likely(!inode->i_rdev))
+	if (!inode->i_rdev)
 		return 0;
 
 	if (S_ISBLK(inode->i_mode))

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Amir Goldstein <[email protected]>

[ Upstream commit 1219e0feaefc9697f738b223540e8e8906291cb3 ]

The comment above file_ref_init() says:
"We're SLAB_TYPESAFE_BY_RCU so initialize f_ref last." but file_set_fsnotify_mode() was added after file_ref_init().

Move it right after setting f_mode, where it makes more sense.

---
 fs/file_table.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

index cd4a3db4659ac..34244fccf2edf 100644
@@ -176,6 +176,11 @@ static int init_file(struct file *f, int flags, const struct cred *cred)
 
 	f->f_flags	= flags;
 	f->f_mode	= OPEN_FMODE(flags);
+	/*
+	 * Disable permission and pre-content events for all files by default.
+	 * They may be enabled later by fsnotify_open_perm_and_set_mode().
+	 */
+	file_set_fsnotify_mode(f, FMODE_NONOTIFY_PERM);
 
 	f->f_op		= NULL;
 	f->f_mapping	= NULL;

@@ -197,11 +202,6 @@ static int init_file(struct file *f, int flags, const struct cred *cred)
 	 * refcount bumps we should reinitialize the reused file first.
 	 */
 	file_ref_init(&f->f_ref, 1);
-	/*
-	 * Disable permission and pre-content events for all files by default.
-	 * They may be enabled later by fsnotify_open_perm_and_set_mode().
-	 */
-	file_set_fsnotify_mode(f, FMODE_NONOTIFY_PERM);
 	return 0;
 }
 

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Dooks <[email protected]>

[ Upstream commit 589cff4975afe1a4eaaa1d961652f50b1628d78d ]

The init_fs symbol is defined in <linux/init_task.h> but was not included in fs/fs_struct.c so fix by adding the include.

Fixes the following sparse warning:
fs/fs_struct.c:150:18: warning: symbol 'init_fs' was not declared. Should it be static?

---
 fs/fs_struct.c | 1 +
 1 file changed, 1 insertion(+)

index 28be762ac1c63..a0b40ad5e7423 100644
@@ -6,6 +6,7 @@
 #include <linux/path.h>
 #include <linux/slab.h>
 #include <linux/fs_struct.h>
+#include <linux/init_task.h>
 #include "internal.h"
 
 /*

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Adrian Hunter <[email protected]>

[ Upstream commit f0775157b9f9a28ae3eabc8d05b0bc52e8056c80 ]

To prevent inconsistent state when an error occurs, ensure the hot-join flag is updated only when enabling or disabling hot-join succeeds.

---
 drivers/i3c/master.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index bc68a5e7455be..425e36b36009b 100644
@@ -620,7 +620,8 @@ static int i3c_set_hotjoin(struct i3c_master_controller *master, bool enable)
 	else
 		ret = master->ops->disable_hotjoin(master);
 
-	master->hotjoin = enable;
+	if (!ret)
+		master->hotjoin = enable;
 
 	i3c_bus_normaluse_unlock(&master->bus);
 

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email protected]>

[ Upstream commit 11d763f0b0afc2cf5f92f4adae5dbbbbef712f8f ]

Fix a bug in gfs2's asynchronous glock handling for rename and exchange operations. The original async implementation from commit ad26967b9afa ("gfs2: Use async glocks for rename") mentioned that retries were needed but never implemented them, causing operations to fail with -ESTALE instead of retrying on timeout.

Also makes the waiting interruptible.

In addition, the timeouts used were too high for situations in which timing out is a rare but expected scenario. Switch to shorter timeouts with randomization and exponentional backoff.

---
 fs/gfs2/glock.c | 36 +++++++++++++++++++++++++++---------
 fs/gfs2/glock.h |  3 ++-
 fs/gfs2/inode.c | 18 ++++++++++++++----
 3 files changed, 43 insertions(+), 14 deletions(-)

index 9f2eb7e385695..7aec6cfdfd91d 100644
@@ -1354,31 +1354,45 @@ static int glocks_pending(unsigned int num_gh, struct gfs2_holder *ghs)
  * gfs2_glock_async_wait - wait on multiple asynchronous glock acquisitions
  * @num_gh: the number of holders in the array
  * @ghs: the glock holder array
+ * @retries: number of retries attempted so far
  *
  * Returns: 0 on success, meaning all glocks have been granted and are held.
  *          -ESTALE if the request timed out, meaning all glocks were released,
  *          and the caller should retry the operation.
  */
 
-int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs)
+int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs,
+			  unsigned int retries)
 {
 	struct gfs2_sbd *sdp = ghs[0].gh_gl->gl_name.ln_sbd;
-	int i, ret = 0, timeout = 0;
 	unsigned long start_time = jiffies;
+	int i, ret = 0;
+	long timeout;
 
 	might_sleep();
-	/*
-	 * Total up the (minimum hold time * 2) of all glocks and use that to
-	 * determine the max amount of time we should wait.
-	 */
-	for (i = 0; i < num_gh; i++)
-		timeout += ghs[i].gh_gl->gl_hold_time << 1;
 
-	if (!wait_event_timeout(sdp->sd_async_glock_wait,
+	timeout = GL_GLOCK_MIN_HOLD;
+	if (retries) {
+		unsigned int max_shift;
+		long incr;
+
+		/* Add a random delay and increase the timeout exponentially. */
+		max_shift = BITS_PER_LONG - 2 - __fls(GL_GLOCK_HOLD_INCR);
+		incr = min(GL_GLOCK_HOLD_INCR << min(retries - 1, max_shift),
+			   10 * HZ - GL_GLOCK_MIN_HOLD);
+		schedule_timeout_interruptible(get_random_long() % (incr / 3));
+		if (signal_pending(current))
+			goto interrupted;
+		timeout += (incr / 3) + get_random_long() % (incr / 3);
+	}
+
+	if (!wait_event_interruptible_timeout(sdp->sd_async_glock_wait,
 				!glocks_pending(num_gh, ghs), timeout)) {
 		ret = -ESTALE; /* request timed out. */
 		goto out;
 	}
+	if (signal_pending(current))
+		goto interrupted;
 
 	for (i = 0; i < num_gh; i++) {
 		struct gfs2_holder *gh = &ghs[i];

@@ -1402,6 +1416,10 @@ int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs)
 		}
 	}
 	return ret;
+
+interrupted:
+	ret = -EINTR;
+	goto out;
 }
 
 /**

index d041b922b45e3..2d4fd1a2bbbb8 100644
@@ -204,7 +204,8 @@ int gfs2_glock_poll(struct gfs2_holder *gh);
 int gfs2_instantiate(struct gfs2_holder *gh);
 int gfs2_glock_holder_ready(struct gfs2_holder *gh);
 int gfs2_glock_wait(struct gfs2_holder *gh);
-int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs);
+int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs,
+			  unsigned int retries);
 void gfs2_glock_dq(struct gfs2_holder *gh);
 void gfs2_glock_dq_wait(struct gfs2_holder *gh);
 void gfs2_glock_dq_uninit(struct gfs2_holder *gh);

index d7e35a05c1610..63d9fe7464344 100644
@@ -1495,7 +1495,7 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
 	unsigned int num_gh;
 	int dir_rename = 0;
 	struct gfs2_diradd da = { .nr_blocks = 0, .save_loc = 0, };
-	unsigned int x;
+	unsigned int retries = 0, x;
 	int error;
 
 	gfs2_holder_mark_uninitialized(&r_gh);

@@ -1545,12 +1545,17 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
 		num_gh++;
 	}
 
+again:
 	for (x = 0; x < num_gh; x++) {
 		error = gfs2_glock_nq(ghs + x);
 		if (error)
 			goto out_gunlock;
 	}
-	error = gfs2_glock_async_wait(num_gh, ghs);
+	error = gfs2_glock_async_wait(num_gh, ghs, retries);
+	if (error == -ESTALE) {
+		retries++;
+		goto again;
+	}
 	if (error)
 		goto out_gunlock;
 

@@ -1739,7 +1744,7 @@ static int gfs2_exchange(struct inode *odir, struct dentry *odentry,
 	struct gfs2_sbd *sdp = GFS2_SB(odir);
 	struct gfs2_holder ghs[4], r_gh;
 	unsigned int num_gh;
-	unsigned int x;
+	unsigned int retries = 0, x;
 	umode_t old_mode = oip->i_inode.i_mode;
 	umode_t new_mode = nip->i_inode.i_mode;
 	int error;

@@ -1783,13 +1788,18 @@ static int gfs2_exchange(struct inode *odir, struct dentry *odentry,
 	gfs2_holder_init(nip->i_gl, LM_ST_EXCLUSIVE, GL_ASYNC, ghs + num_gh);
 	num_gh++;
 
+again:
 	for (x = 0; x < num_gh; x++) {
 		error = gfs2_glock_nq(ghs + x);
 		if (error)
 			goto out_gunlock;
 	}
 
-	error = gfs2_glock_async_wait(num_gh, ghs);
+	error = gfs2_glock_async_wait(num_gh, ghs, retries);
+	if (error == -ESTALE) {
+		retries++;
+		goto again;
+	}
 	if (error)
 		goto out_gunlock;
 

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email protected]>

[ Upstream commit 22150a7d401d9e9169b9b68e05bed95f7f49bf69 ]

Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list.

Fix this by removing qd objects from the LRU list before freeing them in qd_put().

Initial fix from Deepanshu Kartikey <[email protected]>.

---
 fs/gfs2/quota.c | 1 +
 1 file changed, 1 insertion(+)

index f2df01f801b81..898fc3937b449 100644
@@ -334,6 +334,7 @@ static void qd_put(struct gfs2_quota_data *qd)
 		lockref_mark_dead(&qd->qd_lockref);
 		spin_unlock(&qd->qd_lockref.lock);
 
+		list_lru_del_obj(&gfs2_qd_lru, &qd->qd_lru);
 		gfs2_qd_dispose(qd);
 		return;
 	}

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deepanshu Kartikey <[email protected]>

[ Upstream commit faddeb848305e79db89ee0479bb0e33380656321 ]

The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area.

The bug sequence:
1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode metadata into dibh
2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)
3. Calls release_metapath() which calls brelse(dibh), dropping refcount to 0
4. kswapd reclaims the page (~39ms later in the syzbot report)
5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data
6. KASAN detects use-after-free write to freed memory

Fix by storing dibh in iomap->private and incrementing its refcount with get_bh() in gfs2_iomap_begin(). The buffer is then properly released in gfs2_iomap_end() after the inline write completes, ensuring the page stays alive for the entire iomap operation.

Note: A C reproducer is not available for this issue. The fix is based on analysis of the KASAN report and code review showing the buffer head is freed before use.

[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid leaks in gfs2_iomap_get() and gfs2_iomap_alloc().]

---
 fs/gfs2/bmap.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

index 131091520de6b..fdcac8e3f2ba2 100644
@@ -1127,10 +1127,18 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
 			goto out_unlock;
 		break;
 	default:
-		goto out_unlock;
+		goto out;
 	}
 
 	ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp);
+	if (ret)
+		goto out_unlock;
+
+out:
+	if (iomap->type == IOMAP_INLINE) {
+		iomap->private = metapath_dibh(&mp);
+		get_bh(iomap->private);
+	}
 
 out_unlock:
 	release_metapath(&mp);

@@ -1144,6 +1152,9 @@ static int gfs2_iomap_end(struct inode *inode, loff_t pos, loff_t length,
 	struct gfs2_inode *ip = GFS2_I(inode);
 	struct gfs2_sbd *sdp = GFS2_SB(inode);
 
+	if (iomap->private)
+		brelse(iomap->private);
+
 	switch (flags & (IOMAP_WRITE | IOMAP_ZERO)) {
 	case IOMAP_WRITE:
 		if (flags & IOMAP_DIRECT)

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fredrik Markstrom <[email protected]>

[ Upstream commit b58eaa4761ab02fc38c39d674a6bcdd55e00f388 ]

The devs_lock spinlock introduced when adding support for ibi:s was never initialized.

---
 drivers/i3c/master/dw-i3c-master.c | 2 ++
 1 file changed, 2 insertions(+)

index 9ceedf09c3b6a..75f813d72f851 100644
@@ -1563,6 +1563,8 @@ int dw_i3c_common_probe(struct dw_i3c_master *master,
 	spin_lock_init(&master->xferqueue.lock);
 	INIT_LIST_HEAD(&master->xferqueue.list);
 
+	spin_lock_init(&master->devs_lock);
+
 	writel(INTR_ALL, master->regs + INTR_STATUS);
 	irq = platform_get_irq(pdev, 0);
 	ret = devm_request_irq(&pdev->dev, irq,

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zilin Guan <[email protected]>

[ Upstream commit 2537089413514caaa9a5fdeeac3a34d45100f747 ]

The dw_i3c_master_i2c_xfers() function allocates memory for the xfer structure using dw_i3c_master_alloc_xfer(). If pm_runtime_resume_and_get() fails, the function returns without freeing the allocated xfer, resulting in a memory leak.

Add a dw_i3c_master_free_xfer() call to the error path to ensure the allocated memory is properly freed.

Compile tested only. Issue found using a prototype static analysis tool and code review.

---
 drivers/i3c/master/dw-i3c-master.c | 1 +
 1 file changed, 1 insertion(+)

index 75f813d72f851..c06595cb74010 100644
@@ -1094,6 +1094,7 @@ static int dw_i3c_master_i2c_xfers(struct i2c_dev_desc *dev,
 		dev_err(master->dev,
 			"<%s> cannot resume i3c bus master, err: %d\n",
 			__func__, ret);
+		dw_i3c_master_free_xfer(xfer);
 		return ret;
 	}
 

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alper Ak <[email protected]>

[ Upstream commit bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713 ]

get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send().

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

---
 drivers/char/tpm/tpm_i2c_infineon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index bdf1f329a6794..8b7d32de0b2ef 100644
@@ -544,8 +544,10 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz,
 		burstcnt = get_burstcount(chip);
 
 		/* burstcnt < 0 = TPM is busy */
-		if (burstcnt < 0)
-			return burstcnt;
+		if (burstcnt < 0) {
+			rc = burstcnt;
+			goto out_err;
+		}
 
 		if (burstcnt > (len - 1 - count))
 			burstcnt = len - 1 - count;

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alper Ak <[email protected]>

[ Upstream commit 3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9 ]

get_burstcount() can return -EBUSY on timeout. When this happens, st33zp24_send() returns directly without releasing the locality acquired earlier.

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

---
 drivers/char/tpm/st33zp24/st33zp24.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index 2ed7815e4899b..e2b7451ea7ccd 100644
@@ -328,8 +328,10 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf,
 
 	for (i = 0; i < len - 1;) {
 		burstcnt = get_burstcount(chip);
-		if (burstcnt < 0)
-			return burstcnt;
+		if (burstcnt < 0) {
+			ret = burstcnt;
+			goto out_err;
+		}
 		size = min_t(int, len - i - 1, burstcnt);
 		ret = tpm_dev->ops->send(tpm_dev->phy_id, TPM_DATA_FIFO,
 					 buf + i, size);

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

[ Upstream commit 80d0c27a0a4af8e0678d7412781482e6f73c22c7 ]

These BIOs are actually harmless in practice, as they are all pseudo BIOs and do not use advanced features like chaining. Using the BIO interface is a more friendly and unified approach for both bdev and and file-backed I/Os (compared to awkward bvec interfaces).

Let's use bio_endio() instead.

Stable-dep-of: bc804a8d7e86 ("erofs: handle end of filesystem properly for file-backed mounts")

---
 fs/erofs/fileio.c  | 2 +-
 fs/erofs/fscache.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

index a47c6bab98ff9..e2eaa7119bd4f 100644
@@ -35,13 +35,13 @@ static void erofs_fileio_ki_complete(struct kiocb *iocb, long ret)
 	if (rq->bio.bi_end_io) {
 		if (ret < 0 && !rq->bio.bi_status)
 			rq->bio.bi_status = errno_to_blk_status(ret);
-		rq->bio.bi_end_io(&rq->bio);
 	} else {
 		bio_for_each_folio_all(fi, &rq->bio) {
 			DBG_BUGON(folio_test_uptodate(fi.folio));
 			erofs_onlinefolio_end(fi.folio, ret, false);
 		}
 	}
+	bio_endio(&rq->bio);
 	bio_uninit(&rq->bio);
 	if (refcount_dec_and_test(&rq->ref))
 		kfree(rq);

index 362acf828279f..7a346e20f7b7a 100644
@@ -185,7 +185,7 @@ static void erofs_fscache_bio_endio(void *priv, ssize_t transferred_or_error)
 
 	if (IS_ERR_VALUE(transferred_or_error))
 		io->bio.bi_status = errno_to_blk_status(transferred_or_error);
-	io->bio.bi_end_io(&io->bio);
+	bio_endio(&io->bio);
 	BUILD_BUG_ON(offsetof(struct erofs_fscache_bio, io) != 0);
 	erofs_fscache_io_put(&io->io);
 }

@@ -216,7 +216,7 @@ void erofs_fscache_submit_bio(struct bio *bio)
 	if (!ret)
 		return;
 	bio->bi_status = errno_to_blk_status(ret);
-	bio->bi_end_io(bio);
+	bio_endio(bio);
 }
 
 static int erofs_fscache_meta_read_folio(struct file *data, struct folio *folio)

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

[ Upstream commit bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc ]

I/O requests beyond the end of the filesystem should be zeroed out, similar to loopback devices and that is what we expect.

---
 fs/erofs/fileio.c | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

index e2eaa7119bd4f..5b77ee8cc99f4 100644
@@ -25,21 +25,17 @@ static void erofs_fileio_ki_complete(struct kiocb *iocb, long ret)
 			container_of(iocb, struct erofs_fileio_rq, iocb);
 	struct folio_iter fi;
 
-	if (ret > 0) {
-		if (ret != rq->bio.bi_iter.bi_size) {
-			bio_advance(&rq->bio, ret);
-			zero_fill_bio(&rq->bio);
-		}
-		ret = 0;
+	if (ret >= 0 && ret != rq->bio.bi_iter.bi_size) {
+		bio_advance(&rq->bio, ret);
+		zero_fill_bio(&rq->bio);
 	}
-	if (rq->bio.bi_end_io) {
-		if (ret < 0 && !rq->bio.bi_status)
-			rq->bio.bi_status = errno_to_blk_status(ret);
-	} else {
+	if (!rq->bio.bi_end_io) {
 		bio_for_each_folio_all(fi, &rq->bio) {
 			DBG_BUGON(folio_test_uptodate(fi.folio));
-			erofs_onlinefolio_end(fi.folio, ret, false);
+			erofs_onlinefolio_end(fi.folio, ret < 0, false);
 		}
+	} else if (ret < 0 && !rq->bio.bi_status) {
+		rq->bio.bi_status = errno_to_blk_status(ret);
 	}
 	bio_endio(&rq->bio);
 	bio_uninit(&rq->bio);

@@ -51,7 +47,7 @@ static void erofs_fileio_rq_submit(struct erofs_fileio_rq *rq)
 {
 	const struct cred *old_cred;
 	struct iov_iter iter;
-	int ret;
+	ssize_t ret;
 
 	if (!rq)
 		return;

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email protected]>

[ Upstream commit c5667f9c8eb90293dfa4e52c65eb89fe39f5652d ]

[BUG]
When I tried to remove btrfs_bio::fs_info and use btrfs_bio::inode to grab the fs_info, the header "btrfs_inode.h" is needed to access the full btrfs_inode structure.

Then btrfs will fail to compile.

[CAUSE]
There is a recursive including chain:

"bio.h" -> "btrfs_inode.h" -> "extent_map.h" -> "compression.h" -> "bio.h"

That recursive including is causing problems for btrfs.

[ENHANCEMENT]
To reduce the risk of recursive including:

- Remove unnecessary local includes from btrfs headers Either the included header is pulled in by other headers, or is completely unnecessary.

- Remove btrfs local includes if the header only requires a pointer In that case let the implementing C file to pull the required header.

This is especially important for headers like "btrfs_inode.h" which pulls in a lot of other btrfs headers, thus it's a mine field of recursive including.

- Remove unnecessary temporary structure definition Either if we have included the header defining the structure, or completely unused.

Now including "btrfs_inode.h" inside "bio.h" is completely fine, although "btrfs_inode.h" still includes "extent_map.h", but that header only includes "fs.h", no more chain back to "bio.h".

Stable-dep-of: b39b26e017c7 ("btrfs: zoned: don't zone append to conventional zone")

---
 fs/btrfs/accessors.h   | 1 +
 fs/btrfs/btrfs_inode.h | 8 ++++----
 fs/btrfs/compression.h | 3 ---
 fs/btrfs/ctree.h       | 2 --
 fs/btrfs/defrag.c      | 1 +
 fs/btrfs/dir-item.c    | 1 +
 fs/btrfs/direct-io.c   | 2 ++
 fs/btrfs/disk-io.c     | 1 +
 fs/btrfs/disk-io.h     | 3 ++-
 fs/btrfs/extent-tree.c | 1 +
 fs/btrfs/extent_io.h   | 1 -
 fs/btrfs/extent_map.h  | 3 +--
 fs/btrfs/file-item.h   | 2 +-
 fs/btrfs/inode.c       | 1 +
 fs/btrfs/space-info.c  | 1 +
 fs/btrfs/subpage.h     | 1 -
 fs/btrfs/transaction.c | 2 ++
 fs/btrfs/transaction.h | 4 ----
 fs/btrfs/tree-log.c    | 1 +
 fs/btrfs/tree-log.h    | 3 +--
 fs/btrfs/zoned.h       | 1 -
 21 files changed, 21 insertions(+), 22 deletions(-)

index 99b3ced12805b..78721412951c5 100644
@@ -12,6 +12,7 @@
 #include <linux/string.h>
 #include <linux/mm.h>
 #include <uapi/linux/btrfs_tree.h>
+#include "fs.h"
 #include "extent_io.h"
 
 struct extent_buffer;

index af373d50a901f..a66ca5531b5c5 100644
@@ -18,20 +18,20 @@
 #include <linux/lockdep.h>
 #include <uapi/linux/btrfs_tree.h>
 #include <trace/events/btrfs.h>
+#include "ctree.h"
 #include "block-rsv.h"
 #include "extent_map.h"
-#include "extent_io.h"
 #include "extent-io-tree.h"
-#include "ordered-data.h"
-#include "delayed-inode.h"
 
-struct extent_state;
 struct posix_acl;
 struct iov_iter;
 struct writeback_control;
 struct btrfs_root;
 struct btrfs_fs_info;
 struct btrfs_trans_handle;
+struct btrfs_bio;
+struct btrfs_file_extent;
+struct btrfs_delayed_node;
 
 /*
  * Since we search a directory based on f_pos (struct dir_context::pos) we have

index eba188a9e3bb5..c6812d5fcab79 100644
@@ -14,14 +14,11 @@
 #include <linux/pagemap.h>
 #include "bio.h"
 #include "fs.h"
-#include "messages.h"
 
 struct address_space;
-struct page;
 struct inode;
 struct btrfs_inode;
 struct btrfs_ordered_extent;
-struct btrfs_bio;
 
 /*
  * We want to make sure that amount of RAM required to uncompress an extent is

index fe70b593c7cd9..16dd11c485313 100644
@@ -17,9 +17,7 @@
 #include <linux/refcount.h>
 #include <uapi/linux/btrfs_tree.h>
 #include "locking.h"
-#include "fs.h"
 #include "accessors.h"
-#include "extent-io-tree.h"
 
 struct extent_buffer;
 struct btrfs_block_rsv;

index 7b277934f66f9..a4cc1bc635622 100644
@@ -15,6 +15,7 @@
 #include "defrag.h"
 #include "file-item.h"
 #include "super.h"
+#include "compression.h"
 
 static struct kmem_cache *btrfs_inode_defrag_cachep;
 

index 69863e398e223..77e1bcb2a74bf 100644
@@ -9,6 +9,7 @@
 #include "transaction.h"
 #include "accessors.h"
 #include "dir-item.h"
+#include "delayed-inode.h"
 
 /*
  * insert a name into a directory, doing overflow properly if there is a hash

index 802d4dbe5b381..8888ef4ae6064 100644
@@ -10,6 +10,8 @@
 #include "fs.h"
 #include "transaction.h"
 #include "volumes.h"
+#include "bio.h"
+#include "ordered-data.h"
 
 struct btrfs_dio_data {
 	ssize_t submitted;

index 745ae698bbc8a..3fd5d6a27d4c0 100644
@@ -50,6 +50,7 @@
 #include "relocation.h"
 #include "scrub.h"
 #include "super.h"
+#include "delayed-inode.h"
 
 #define BTRFS_SUPER_FLAG_SUPP	(BTRFS_HEADER_FLAG_WRITTEN |\
 				 BTRFS_HEADER_FLAG_RELOC |\

index 57920f2c6fe4e..5320da83d0cf8 100644
@@ -9,7 +9,8 @@
 #include <linux/sizes.h>
 #include <linux/compiler_types.h>
 #include "ctree.h"
-#include "fs.h"
+#include "bio.h"
+#include "ordered-data.h"
 
 struct block_device;
 struct super_block;

index dc4ca98c37800..01337e3f2879c 100644
@@ -40,6 +40,7 @@
 #include "orphan.h"
 #include "tree-checker.h"
 #include "raid-stripe-tree.h"
+#include "delayed-inode.h"
 
 #undef SCRAMBLE_DELAYED_REFS
 

index 559bec44a7a8e..73571d5d3d5ad 100644
@@ -12,7 +12,6 @@
 #include <linux/rwsem.h>
 #include <linux/list.h>
 #include <linux/slab.h>
-#include "compression.h"
 #include "messages.h"
 #include "ulist.h"
 #include "misc.h"

index d4b81ee4d97bd..6f685f3c93272 100644
@@ -8,8 +8,7 @@
 #include <linux/rbtree.h>
 #include <linux/list.h>
 #include <linux/refcount.h>
-#include "misc.h"
-#include "compression.h"
+#include "fs.h"
 
 struct btrfs_inode;
 struct btrfs_fs_info;

index 63216c43676de..0d59e830018a6 100644
@@ -7,7 +7,7 @@
 #include <linux/list.h>
 #include <uapi/linux/btrfs_tree.h>
 #include "ctree.h"
-#include "accessors.h"
+#include "ordered-data.h"
 
 struct extent_map;
 struct btrfs_file_extent_item;

index 76a66c74249a2..b261dbeb29040 100644
@@ -71,6 +71,7 @@
 #include "backref.h"
 #include "raid-stripe-tree.h"
 #include "fiemap.h"
+#include "delayed-inode.h"
 
 #define COW_FILE_RANGE_KEEP_LOCKED	(1UL << 0)
 #define COW_FILE_RANGE_NO_INLINE	(1UL << 1)

index a6f94e9f55915..e5c18a29eb7e6 100644
@@ -15,6 +15,7 @@
 #include "accessors.h"
 #include "extent-tree.h"
 #include "zoned.h"
+#include "delayed-inode.h"
 
 /*
  * HOW DOES SPACE RESERVATION WORK

index ad0552db7c7dc..d81a0ade559fd 100644
@@ -7,7 +7,6 @@
 #include <linux/atomic.h>
 #include <linux/sizes.h>
 #include "btrfs_inode.h"
-#include "fs.h"
 
 struct address_space;
 struct folio;

index c457316c2788b..041f4781956cf 100644
@@ -32,6 +32,8 @@
 #include "ioctl.h"
 #include "relocation.h"
 #include "scrub.h"
+#include "ordered-data.h"
+#include "delayed-inode.h"
 
 static struct kmem_cache *btrfs_trans_handle_cachep;
 

index 9f7c777af6356..18ef069197e5b 100644
@@ -14,10 +14,6 @@
 #include <linux/wait.h>
 #include "btrfs_inode.h"
 #include "delayed-ref.h"
-#include "extent-io-tree.h"
-#include "block-rsv.h"
-#include "messages.h"
-#include "misc.h"
 
 struct dentry;
 struct inode;

index ae2e035d013e2..6c5db73c3e85f 100644
@@ -29,6 +29,7 @@
 #include "orphan.h"
 #include "print-tree.h"
 #include "tree-checker.h"
+#include "delayed-inode.h"
 
 #define MAX_CONFLICT_INODES 10
 

index dc313e6bb2faa..4f149d7d4fdee 100644
@@ -8,8 +8,7 @@
 
 #include <linux/list.h>
 #include <linux/fs.h>
-#include "messages.h"
-#include "ctree.h"
+#include <linux/fscrypt.h>
 #include "transaction.h"
 
 struct inode;

index 17c5656580dd9..2b807a02d1a8a 100644
@@ -15,7 +15,6 @@
 #include "disk-io.h"
 #include "block-group.h"
 #include "btrfs_inode.h"
-#include "fs.h"
 
 struct block_device;
 struct extent_buffer;

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email protected]>

[ Upstream commit 81cea6cd7041ebd42281e0517f856d88527d3326 ]

Currently there is only one caller which doesn't populate btrfs_bio::inode, and that's scrub.

The idea is scrub doesn't want any automatic csum verification nor read-repair, as everything will be handled by scrub itself.

However that behavior is really no different than metadata inode, thus we can reuse btree_inode as btrfs_bio::inode for scrub.

The only exception is in btrfs_submit_chunk() where if a bbio is from scrub or data reloc inode, we set rst_search_commit_root to true. This means we still need a way to distinguish scrub from metadata, but that can be done by a new flag inside btrfs_bio.

Now btrfs_bio::inode is a mandatory parameter, we can extract fs_info from that inode thus can remove btrfs_bio::fs_info to save 8 bytes from btrfs_bio structure.

Stable-dep-of: b39b26e017c7 ("btrfs: zoned: don't zone append to conventional zone")

---
 fs/btrfs/bio.c         | 53 ++++++++++++++++++++++--------------------
 fs/btrfs/bio.h         | 18 +++++++++-----
 fs/btrfs/compression.c |  6 ++---
 fs/btrfs/compression.h |  3 ++-
 fs/btrfs/direct-io.c   |  4 +---
 fs/btrfs/extent_io.c   | 22 +++++++-----------
 fs/btrfs/inode.c       |  7 ++----
 fs/btrfs/scrub.c       | 51 ++++++++++++++++++++++------------------
 fs/btrfs/zoned.c       |  4 ++--
 9 files changed, 87 insertions(+), 81 deletions(-)

index 21df48e6c4fa2..b85b6b21b5450 100644
@@ -41,13 +41,17 @@ static bool bbio_has_ordered_extent(const struct btrfs_bio *bbio)
  * Initialize a btrfs_bio structure.  This skips the embedded bio itself as it
  * is already initialized by the block layer.
  */
-void btrfs_bio_init(struct btrfs_bio *bbio, struct btrfs_fs_info *fs_info,
+void btrfs_bio_init(struct btrfs_bio *bbio, struct btrfs_inode *inode, u64 file_offset,
 		    btrfs_bio_end_io_t end_io, void *private)
 {
+	/* @inode parameter is mandatory. */
+	ASSERT(inode);
+
 	memset(bbio, 0, offsetof(struct btrfs_bio, bio));
-	bbio->fs_info = fs_info;
+	bbio->inode = inode;
 	bbio->end_io = end_io;
 	bbio->private = private;
+	bbio->file_offset = file_offset;
 	atomic_set(&bbio->pending_ios, 1);
 	WRITE_ONCE(bbio->status, BLK_STS_OK);
 }

@@ -60,7 +64,7 @@ void btrfs_bio_init(struct btrfs_bio *bbio, struct btrfs_fs_info *fs_info,
  * a mempool.
  */
 struct btrfs_bio *btrfs_bio_alloc(unsigned int nr_vecs, blk_opf_t opf,
-				  struct btrfs_fs_info *fs_info,
+				  struct btrfs_inode *inode, u64 file_offset,
 				  btrfs_bio_end_io_t end_io, void *private)
 {
 	struct btrfs_bio *bbio;

@@ -68,7 +72,7 @@ struct btrfs_bio *btrfs_bio_alloc(unsigned int nr_vecs, blk_opf_t opf,
 
 	bio = bio_alloc_bioset(NULL, nr_vecs, opf, GFP_NOFS, &btrfs_bioset);
 	bbio = btrfs_bio(bio);
-	btrfs_bio_init(bbio, fs_info, end_io, private);
+	btrfs_bio_init(bbio, inode, file_offset, end_io, private);
 	return bbio;
 }
 

@@ -85,9 +89,7 @@ static struct btrfs_bio *btrfs_split_bio(struct btrfs_fs_info *fs_info,
 		return ERR_CAST(bio);
 
 	bbio = btrfs_bio(bio);
-	btrfs_bio_init(bbio, fs_info, NULL, orig_bbio);
-	bbio->inode = orig_bbio->inode;
-	bbio->file_offset = orig_bbio->file_offset;
+	btrfs_bio_init(bbio, orig_bbio->inode, orig_bbio->file_offset, NULL, orig_bbio);
 	orig_bbio->file_offset += map_length;
 	if (bbio_has_ordered_extent(bbio)) {
 		refcount_inc(&orig_bbio->ordered->refs);

@@ -244,9 +246,8 @@ static struct btrfs_failed_bio *repair_one_sector(struct btrfs_bio *failed_bbio,
 	bio_add_folio_nofail(repair_bio, folio, sectorsize, foff);
 
 	repair_bbio = btrfs_bio(repair_bio);
-	btrfs_bio_init(repair_bbio, fs_info, NULL, fbio);
-	repair_bbio->inode = failed_bbio->inode;
-	repair_bbio->file_offset = failed_bbio->file_offset + bio_offset;
+	btrfs_bio_init(repair_bbio, failed_bbio->inode, failed_bbio->file_offset + bio_offset,
+		       NULL, fbio);
 
 	mirror = next_repair_mirror(fbio, failed_bbio->mirror_num);
 	btrfs_debug(fs_info, "submitting repair read to mirror %d", mirror);

@@ -332,7 +333,7 @@ static void btrfs_simple_end_io(struct bio *bio)
 {
 	struct btrfs_bio *bbio = btrfs_bio(bio);
 	struct btrfs_device *dev = bio->bi_private;
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 
 	btrfs_bio_counter_dec(fs_info);
 

@@ -581,10 +582,11 @@ static void run_one_async_done(struct btrfs_work *work, bool do_free)
 
 static bool should_async_write(struct btrfs_bio *bbio)
 {
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 	bool auto_csum_mode = true;
 
 #ifdef CONFIG_BTRFS_EXPERIMENTAL
-	struct btrfs_fs_devices *fs_devices = bbio->fs_info->fs_devices;
+	struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
 	enum btrfs_offload_csum_mode csum_mode = READ_ONCE(fs_devices->offload_csum_mode);
 
 	if (csum_mode == BTRFS_OFFLOAD_CSUM_FORCE_OFF)

@@ -594,7 +596,7 @@ static bool should_async_write(struct btrfs_bio *bbio)
 #endif
 
 	/* Submit synchronously if the checksum implementation is fast. */
-	if (auto_csum_mode && test_bit(BTRFS_FS_CSUM_IMPL_FAST, &bbio->fs_info->flags))
+	if (auto_csum_mode && test_bit(BTRFS_FS_CSUM_IMPL_FAST, &fs_info->flags))
 		return false;
 
 	/*

@@ -605,7 +607,7 @@ static bool should_async_write(struct btrfs_bio *bbio)
 		return false;
 
 	/* Zoned devices require I/O to be submitted in order. */
-	if ((bbio->bio.bi_opf & REQ_META) && btrfs_is_zoned(bbio->fs_info))
+	if ((bbio->bio.bi_opf & REQ_META) && btrfs_is_zoned(fs_info))
 		return false;
 
 	return true;

@@ -620,7 +622,7 @@ static bool btrfs_wq_submit_bio(struct btrfs_bio *bbio,
 				struct btrfs_io_context *bioc,
 				struct btrfs_io_stripe *smap, int mirror_num)
 {
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 	struct async_submit_bio *async;
 
 	async = kmalloc(sizeof(*async), GFP_NOFS);

@@ -639,11 +641,12 @@ static bool btrfs_wq_submit_bio(struct btrfs_bio *bbio,
 
 static u64 btrfs_append_map_length(struct btrfs_bio *bbio, u64 map_length)
 {
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 	unsigned int nr_segs;
 	int sector_offset;
 
-	map_length = min(map_length, bbio->fs_info->max_zone_append_size);
-	sector_offset = bio_split_rw_at(&bbio->bio, &bbio->fs_info->limits,
+	map_length = min(map_length, fs_info->max_zone_append_size);
+	sector_offset = bio_split_rw_at(&bbio->bio, &fs_info->limits,
 					&nr_segs, map_length);
 	if (sector_offset) {
 		/*

@@ -651,7 +654,7 @@ static u64 btrfs_append_map_length(struct btrfs_bio *bbio, u64 map_length)
 		 * sectorsize and thus cause unaligned I/Os.  Fix that by
 		 * always rounding down to the nearest boundary.
 		 */
-		return ALIGN_DOWN(sector_offset << SECTOR_SHIFT, bbio->fs_info->sectorsize);
+		return ALIGN_DOWN(sector_offset << SECTOR_SHIFT, fs_info->sectorsize);
 	}
 	return map_length;
 }

@@ -659,7 +662,7 @@ static u64 btrfs_append_map_length(struct btrfs_bio *bbio, u64 map_length)
 static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 {
 	struct btrfs_inode *inode = bbio->inode;
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct bio *bio = &bbio->bio;
 	u64 logical = bio->bi_iter.bi_sector << SECTOR_SHIFT;
 	u64 length = bio->bi_iter.bi_size;

@@ -670,7 +673,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 	blk_status_t status;
 	int ret;
 
-	if (!bbio->inode || btrfs_is_data_reloc_root(inode->root))
+	if (bbio->is_scrub || btrfs_is_data_reloc_root(inode->root))
 		smap.rst_search_commit_root = true;
 	else
 		smap.rst_search_commit_root = false;

@@ -734,7 +737,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 		 * Csum items for reloc roots have already been cloned at this
 		 * point, so they are handled as part of the no-checksum case.
 		 */
-		if (inode && !(inode->flags & BTRFS_INODE_NODATASUM) &&
+		if (!(inode->flags & BTRFS_INODE_NODATASUM) &&
 		    !test_bit(BTRFS_FS_STATE_NO_DATA_CSUMS, &fs_info->fs_state) &&
 		    !btrfs_is_data_reloc_root(inode->root)) {
 			if (should_async_write(bbio) &&

@@ -782,7 +785,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 static void assert_bbio_alignment(struct btrfs_bio *bbio)
 {
 #ifdef CONFIG_BTRFS_ASSERT
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 	struct bio_vec bvec;
 	struct bvec_iter iter;
 	const u32 blocksize = fs_info->sectorsize;

@@ -885,16 +888,16 @@ int btrfs_repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 start,
  */
 void btrfs_submit_repair_write(struct btrfs_bio *bbio, int mirror_num, bool dev_replace)
 {
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 	u64 logical = bbio->bio.bi_iter.bi_sector << SECTOR_SHIFT;
 	u64 length = bbio->bio.bi_iter.bi_size;
 	struct btrfs_io_stripe smap = { 0 };
 	int ret;
 
-	ASSERT(fs_info);
 	ASSERT(mirror_num > 0);
 	ASSERT(btrfs_op(&bbio->bio) == BTRFS_MAP_WRITE);
-	ASSERT(!bbio->inode);
+	ASSERT(!is_data_inode(bbio->inode));
+	ASSERT(bbio->is_scrub);
 
 	btrfs_bio_counter_inc_blocked(fs_info);
 	ret = btrfs_map_repair_block(fs_info, &smap, logical, length, mirror_num);

index 00883aea55d70..b7a0de6f97840 100644
@@ -34,7 +34,10 @@ typedef void (*btrfs_bio_end_io_t)(struct btrfs_bio *bbio);
 struct btrfs_bio {
 	/*
 	 * Inode and offset into it that this I/O operates on.
-	 * Only set for data I/O.
+	 *
+	 * If the inode is a data one, csum verification and read-repair
+	 * will be done automatically.
+	 * If the inode is a metadata one, everything is handled by the caller.
 	 */
 	struct btrfs_inode *inode;
 	u64 file_offset;

@@ -76,14 +79,17 @@ struct btrfs_bio {
 	atomic_t pending_ios;
 	struct work_struct end_io_work;
 
-	/* File system that this I/O operates on. */
-	struct btrfs_fs_info *fs_info;
-
 	/* Save the first error status of split bio. */
 	blk_status_t status;
 
 	/* Use the commit root to look up csums (data read bio only). */
 	bool csum_search_commit_root;
+
+	/*
+	 * Since scrub will reuse btree inode, we need this flag to distinguish
+	 * scrub bios.
+	 */
+	bool is_scrub;
 	/*
 	 * This member must come last, bio_alloc_bioset will allocate enough
 	 * bytes for entire btrfs_bio but relies on bio being last.

@@ -99,10 +105,10 @@ static inline struct btrfs_bio *btrfs_bio(struct bio *bio)
 int __init btrfs_bioset_init(void);
 void __cold btrfs_bioset_exit(void);
 
-void btrfs_bio_init(struct btrfs_bio *bbio, struct btrfs_fs_info *fs_info,
+void btrfs_bio_init(struct btrfs_bio *bbio, struct btrfs_inode *inode, u64 file_offset,
 		    btrfs_bio_end_io_t end_io, void *private);
 struct btrfs_bio *btrfs_bio_alloc(unsigned int nr_vecs, blk_opf_t opf,
-				  struct btrfs_fs_info *fs_info,
+				  struct btrfs_inode *inode, u64 file_offset,
 				  btrfs_bio_end_io_t end_io, void *private);
 void btrfs_bio_end_io(struct btrfs_bio *bbio, blk_status_t status);
 

index bacad18357b33..8c3899832a1aa 100644
@@ -67,9 +67,7 @@ static struct compressed_bio *alloc_compressed_bio(struct btrfs_inode *inode,
 
 	bbio = btrfs_bio(bio_alloc_bioset(NULL, BTRFS_MAX_COMPRESSED_PAGES, op,
 					  GFP_NOFS, &btrfs_compressed_bioset));
-	btrfs_bio_init(bbio, inode->root->fs_info, end_io, NULL);
-	bbio->inode = inode;
-	bbio->file_offset = start;
+	btrfs_bio_init(bbio, inode, start, end_io, NULL);
 	return to_compressed_bio(bbio);
 }
 

@@ -354,7 +352,7 @@ static void end_bbio_compressed_write(struct btrfs_bio *bbio)
 
 static void btrfs_add_compressed_bio_folios(struct compressed_bio *cb)
 {
-	struct btrfs_fs_info *fs_info = cb->bbio.fs_info;
+	struct btrfs_fs_info *fs_info = cb->bbio.inode->root->fs_info;
 	struct bio *bio = &cb->bbio.bio;
 	u32 offset = 0;
 

index c6812d5fcab79..062ebd9c2d32d 100644
@@ -14,6 +14,7 @@
 #include <linux/pagemap.h>
 #include "bio.h"
 #include "fs.h"
+#include "btrfs_inode.h"
 
 struct address_space;
 struct inode;

@@ -74,7 +75,7 @@ struct compressed_bio {
 
 static inline struct btrfs_fs_info *cb_to_fs_info(const struct compressed_bio *cb)
 {
-	return cb->bbio.fs_info;
+	return cb->bbio.inode->root->fs_info;
 }
 
 /* @range_end must be exclusive. */

index 8888ef4ae6064..e29ea28ce90b9 100644
@@ -715,10 +715,8 @@ static void btrfs_dio_submit_io(const struct iomap_iter *iter, struct bio *bio,
 		container_of(bbio, struct btrfs_dio_private, bbio);
 	struct btrfs_dio_data *dio_data = iter->private;
 
-	btrfs_bio_init(bbio, BTRFS_I(iter->inode)->root->fs_info,
+	btrfs_bio_init(bbio, BTRFS_I(iter->inode), file_offset,
 		       btrfs_dio_end_io, bio->bi_private);
-	bbio->inode = BTRFS_I(iter->inode);
-	bbio->file_offset = file_offset;
 
 	dip->file_offset = file_offset;
 	dip->bytes = bio->bi_iter.bi_size;

index e6ffa12f57535..c3524401ff03e 100644
@@ -518,7 +518,7 @@ static void end_folio_read(struct folio *folio, bool uptodate, u64 start, u32 le
  */
 static void end_bbio_data_write(struct btrfs_bio *bbio)
 {
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 	struct bio *bio = &bbio->bio;
 	int error = blk_status_to_errno(bio->bi_status);
 	struct folio_iter fi;

@@ -574,7 +574,7 @@ static void begin_folio_read(struct btrfs_fs_info *fs_info, struct folio *folio)
  */
 static void end_bbio_data_read(struct btrfs_bio *bbio)
 {
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = bbio->inode->root->fs_info;
 	struct bio *bio = &bbio->bio;
 	struct folio_iter fi;
 

@@ -739,12 +739,10 @@ static void alloc_new_bio(struct btrfs_inode *inode,
 	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct btrfs_bio *bbio;
 
-	bbio = btrfs_bio_alloc(BIO_MAX_VECS, bio_ctrl->opf, fs_info,
-			       bio_ctrl->end_io_func, NULL);
+	bbio = btrfs_bio_alloc(BIO_MAX_VECS, bio_ctrl->opf, inode,
+			       file_offset, bio_ctrl->end_io_func, NULL);
 	bbio->bio.bi_iter.bi_sector = disk_bytenr >> SECTOR_SHIFT;
 	bbio->bio.bi_write_hint = inode->vfs_inode.i_write_hint;
-	bbio->inode = inode;
-	bbio->file_offset = file_offset;
 	bio_ctrl->bbio = bbio;
 	bio_ctrl->len_to_oe_boundary = U32_MAX;
 	bio_ctrl->next_file_offset = file_offset;

@@ -2223,12 +2221,11 @@ static noinline_for_stack void write_one_eb(struct extent_buffer *eb,
 
 	bbio = btrfs_bio_alloc(INLINE_EXTENT_BUFFER_PAGES,
 			       REQ_OP_WRITE | REQ_META | wbc_to_write_flags(wbc),
-			       eb->fs_info, end_bbio_meta_write, eb);
+			       BTRFS_I(fs_info->btree_inode), eb->start,
+			       end_bbio_meta_write, eb);
 	bbio->bio.bi_iter.bi_sector = eb->start >> SECTOR_SHIFT;
 	bio_set_dev(&bbio->bio, fs_info->fs_devices->latest_dev->bdev);
 	wbc_init_bio(wbc, &bbio->bio);
-	bbio->inode = BTRFS_I(eb->fs_info->btree_inode);
-	bbio->file_offset = eb->start;
 	for (int i = 0; i < num_extent_folios(eb); i++) {
 		struct folio *folio = eb->folios[i];
 		u64 range_start = max_t(u64, eb->start, folio_pos(folio));

@@ -3842,6 +3839,7 @@ static void end_bbio_meta_read(struct btrfs_bio *bbio)
 int read_extent_buffer_pages_nowait(struct extent_buffer *eb, int mirror_num,
 				    const struct btrfs_tree_parent_check *check)
 {
+	struct btrfs_fs_info *fs_info = eb->fs_info;
 	struct btrfs_bio *bbio;
 
 	if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))

@@ -3875,11 +3873,9 @@ int read_extent_buffer_pages_nowait(struct extent_buffer *eb, int mirror_num,
 	refcount_inc(&eb->refs);
 
 	bbio = btrfs_bio_alloc(INLINE_EXTENT_BUFFER_PAGES,
-			       REQ_OP_READ | REQ_META, eb->fs_info,
-			       end_bbio_meta_read, eb);
+			       REQ_OP_READ | REQ_META, BTRFS_I(fs_info->btree_inode),
+			       eb->start, end_bbio_meta_read, eb);
 	bbio->bio.bi_iter.bi_sector = eb->start >> SECTOR_SHIFT;
-	bbio->inode = BTRFS_I(eb->fs_info->btree_inode);
-	bbio->file_offset = eb->start;
 	memcpy(&bbio->parent_check, check, sizeof(*check));
 	for (int i = 0; i < num_extent_folios(eb); i++) {
 		struct folio *folio = eb->folios[i];

index b261dbeb29040..47e762856521d 100644
@@ -9423,7 +9423,6 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
 					  u64 disk_bytenr, u64 disk_io_size,
 					  struct page **pages, void *uring_ctx)
 {
-	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct btrfs_encoded_read_private *priv, sync_priv;
 	struct completion sync_reads;
 	unsigned long i = 0;

@@ -9448,10 +9447,9 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
 	priv->status = 0;
 	priv->uring_ctx = uring_ctx;
 
-	bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, fs_info,
+	bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, inode, 0,
 			       btrfs_encoded_read_endio, priv);
 	bbio->bio.bi_iter.bi_sector = disk_bytenr >> SECTOR_SHIFT;
-	bbio->inode = inode;
 
 	do {
 		size_t bytes = min_t(u64, disk_io_size, PAGE_SIZE);

@@ -9460,10 +9458,9 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
 			refcount_inc(&priv->pending_refs);
 			btrfs_submit_bbio(bbio, 0);
 
-			bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, fs_info,
+			bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, inode, 0,
 					       btrfs_encoded_read_endio, priv);
 			bbio->bio.bi_iter.bi_sector = disk_bytenr >> SECTOR_SHIFT;
-			bbio->inode = inode;
 			continue;
 		}
 

index d1db7fa1fe583..3afc9c0c22287 100644
@@ -1809,14 +1809,14 @@ bool btrfs_use_zone_append(struct btrfs_bio *bbio)
 {
 	u64 start = (bbio->bio.bi_iter.bi_sector << SECTOR_SHIFT);
 	struct btrfs_inode *inode = bbio->inode;
-	struct btrfs_fs_info *fs_info = bbio->fs_info;
+	struct btrfs_fs_info *fs_info = inode->root->fs_info;
 	struct btrfs_block_group *cache;
 	bool ret = false;
 
 	if (!btrfs_is_zoned(fs_info))
 		return false;
 
-	if (!inode || !is_data_inode(inode))
+	if (!is_data_inode(inode))
 		return false;
 
 	if (btrfs_op(&bbio->bio) != BTRFS_MAP_WRITE)

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email protected]>

[ Upstream commit 4591c3ef751d861d7dd95ff4d2aadb1b5e95854e ]

[BACKGROUND]
Btrfs has a lot of different bi_end_io functions, to handle different raid profiles. But they introduced a lot of different contexts for btrfs_bio::end_io() calls:

- Simple read bios
Run in task context, backed by either endio_meta_workers or endio_workers.

- Simple write bios
Run in IRQ context.

- RAID56 write or rebuild bios
Run in task context, backed by rmw_workers.

- Mirrored write bios
Run in irq context.

This is inconsistent, and contributes to the number of workqueues used in btrfs.

[ENHANCEMENT]
Make all the above bios call their btrfs_bio::end_io() in task context, backed by either endio_meta_workers for metadata, or endio_workers for data.

For simple write bios, merge the handling into simple_end_io_work().

For mirrored write bios, it will be a little more complex, since both the original or the cloned bios can run the final btrfs_bio::end_io().

Here we make sure the cloned bios are using btrfs_bioset, to reuse the end_io_work, and run both original and cloned work inside the workqueue.

Add extra ASSERT()s to make sure btrfs_bio_end_io() is running in task context.

This not only unifies the context for btrfs_bio::end_io() functions, but also opens a new door for further btrfs_bio::end_io() related cleanups.

Stable-dep-of: b39b26e017c7 ("btrfs: zoned: don't zone append to conventional zone")

---
 fs/btrfs/bio.c | 64 ++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 46 insertions(+), 18 deletions(-)

index b85b6b21b5450..52b8893f26f16 100644
@@ -102,6 +102,9 @@ static struct btrfs_bio *btrfs_split_bio(struct btrfs_fs_info *fs_info,
 
 void btrfs_bio_end_io(struct btrfs_bio *bbio, blk_status_t status)
 {
+	/* Make sure we're already in task context. */
+	ASSERT(in_task());
+
 	bbio->bio.bi_status = status;
 	if (bbio->bio.bi_pool == &btrfs_clone_bioset) {
 		struct btrfs_bio *orig_bbio = bbio->private;

@@ -318,15 +321,20 @@ static struct workqueue_struct *btrfs_end_io_wq(const struct btrfs_fs_info *fs_i
 	return fs_info->endio_workers;
 }
 
-static void btrfs_end_bio_work(struct work_struct *work)
+static void simple_end_io_work(struct work_struct *work)
 {
 	struct btrfs_bio *bbio = container_of(work, struct btrfs_bio, end_io_work);
+	struct bio *bio = &bbio->bio;
 
-	/* Metadata reads are checked and repaired by the submitter. */
-	if (is_data_bbio(bbio))
-		btrfs_check_read_bio(bbio, bbio->bio.bi_private);
-	else
-		btrfs_bio_end_io(bbio, bbio->bio.bi_status);
+	if (bio_op(bio) == REQ_OP_READ) {
+		/* Metadata reads are checked and repaired by the submitter. */
+		if (is_data_bbio(bbio))
+			return btrfs_check_read_bio(bbio, bbio->bio.bi_private);
+		return btrfs_bio_end_io(bbio, bbio->bio.bi_status);
+	}
+	if (bio_is_zone_append(bio) && !bio->bi_status)
+		btrfs_record_physical_zoned(bbio);
+	btrfs_bio_end_io(bbio, bbio->bio.bi_status);
 }
 
 static void btrfs_simple_end_io(struct bio *bio)

@@ -340,14 +348,8 @@ static void btrfs_simple_end_io(struct bio *bio)
 	if (bio->bi_status)
 		btrfs_log_dev_io_error(bio, dev);
 
-	if (bio_op(bio) == REQ_OP_READ) {
-		INIT_WORK(&bbio->end_io_work, btrfs_end_bio_work);
-		queue_work(btrfs_end_io_wq(fs_info, bio), &bbio->end_io_work);
-	} else {
-		if (bio_is_zone_append(bio) && !bio->bi_status)
-			btrfs_record_physical_zoned(bbio);
-		btrfs_bio_end_io(bbio, bbio->bio.bi_status);
-	}
+	INIT_WORK(&bbio->end_io_work, simple_end_io_work);
+	queue_work(btrfs_end_io_wq(fs_info, bio), &bbio->end_io_work);
 }
 
 static void btrfs_raid56_end_io(struct bio *bio)

@@ -355,6 +357,9 @@ static void btrfs_raid56_end_io(struct bio *bio)
 	struct btrfs_io_context *bioc = bio->bi_private;
 	struct btrfs_bio *bbio = btrfs_bio(bio);
 
+	/* RAID56 endio is always handled in workqueue. */
+	ASSERT(in_task());
+
 	btrfs_bio_counter_dec(bioc->fs_info);
 	bbio->mirror_num = bioc->mirror_num;
 	if (bio_op(bio) == REQ_OP_READ && is_data_bbio(bbio))

@@ -365,11 +370,12 @@ static void btrfs_raid56_end_io(struct bio *bio)
 	btrfs_put_bioc(bioc);
 }
 
-static void btrfs_orig_write_end_io(struct bio *bio)
+static void orig_write_end_io_work(struct work_struct *work)
 {
+	struct btrfs_bio *bbio = container_of(work, struct btrfs_bio, end_io_work);
+	struct bio *bio = &bbio->bio;
 	struct btrfs_io_stripe *stripe = bio->bi_private;
 	struct btrfs_io_context *bioc = stripe->bioc;
-	struct btrfs_bio *bbio = btrfs_bio(bio);
 
 	btrfs_bio_counter_dec(bioc->fs_info);
 

@@ -394,8 +400,18 @@ static void btrfs_orig_write_end_io(struct bio *bio)
 	btrfs_put_bioc(bioc);
 }
 
-static void btrfs_clone_write_end_io(struct bio *bio)
+static void btrfs_orig_write_end_io(struct bio *bio)
+{
+	struct btrfs_bio *bbio = btrfs_bio(bio);
+
+	INIT_WORK(&bbio->end_io_work, orig_write_end_io_work);
+	queue_work(btrfs_end_io_wq(bbio->inode->root->fs_info, bio), &bbio->end_io_work);
+}
+
+static void clone_write_end_io_work(struct work_struct *work)
 {
+	struct btrfs_bio *bbio = container_of(work, struct btrfs_bio, end_io_work);
+	struct bio *bio = &bbio->bio;
 	struct btrfs_io_stripe *stripe = bio->bi_private;
 
 	if (bio->bi_status) {

@@ -410,6 +426,14 @@ static void btrfs_clone_write_end_io(struct bio *bio)
 	bio_put(bio);
 }
 
+static void btrfs_clone_write_end_io(struct bio *bio)
+{
+	struct btrfs_bio *bbio = btrfs_bio(bio);
+
+	INIT_WORK(&bbio->end_io_work, clone_write_end_io_work);
+	queue_work(btrfs_end_io_wq(bbio->inode->root->fs_info, bio), &bbio->end_io_work);
+}
+
 static void btrfs_submit_dev_bio(struct btrfs_device *dev, struct bio *bio)
 {
 	if (!dev || !dev->bdev ||

@@ -456,6 +480,7 @@ static void btrfs_submit_dev_bio(struct btrfs_device *dev, struct bio *bio)
 static void btrfs_submit_mirrored_bio(struct btrfs_io_context *bioc, int dev_nr)
 {
 	struct bio *orig_bio = bioc->orig_bio, *bio;
+	struct btrfs_bio *orig_bbio = btrfs_bio(orig_bio);
 
 	ASSERT(bio_op(orig_bio) != REQ_OP_READ);
 

@@ -464,8 +489,11 @@ static void btrfs_submit_mirrored_bio(struct btrfs_io_context *bioc, int dev_nr)
 		bio = orig_bio;
 		bio->bi_end_io = btrfs_orig_write_end_io;
 	} else {
-		bio = bio_alloc_clone(NULL, orig_bio, GFP_NOFS, &fs_bio_set);
+		/* We need to use endio_work to run end_io in task context. */
+		bio = bio_alloc_clone(NULL, orig_bio, GFP_NOFS, &btrfs_bioset);
 		bio_inc_remaining(orig_bio);
+		btrfs_bio_init(btrfs_bio(bio), orig_bbio->inode,
+			       orig_bbio->file_offset, NULL, NULL);
 		bio->bi_end_io = btrfs_clone_write_end_io;
 	}
 

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Qu Wenruo <[email protected]>

[ Upstream commit dd57c78aec398717a2fa6488d87b1a6cd43c7d0d ]

[ENHANCEMENT]
Btrfs currently calculates data checksums then submits the bio.

But after commit 968f19c5b1b7 ("btrfs: always fallback to buffered write if the inode requires checksum"), any writes with data checksum will fallback to buffered IO, meaning the content will not change during writeback.

This means we're safe to calculate the data checksum and submit the bio in parallel, and only need the following new behavior:

- Wait the csum generation to finish before calling btrfs_bio::end_io() Or this can lead to use-after-free for the csum generation worker.

- Save the current bi_iter for csum_one_bio()
As the submission part can advance btrfs_bio::bio.bi_iter, if not saved csum_one_bio() may got an empty bi_iter and do not generate any checksum.

Unfortunately this means we have to increase the size of btrfs_bio for 16 bytes, but this is still acceptable.

As usual, such new feature is hidden behind the experimental flag.

[THEORETIC ANALYZE]
Consider the following theoretic hardware performance, which should be more or less close to modern mainstream hardware:

Memory bandwidth: 50GiB/s
CRC32C bandwidth: 45GiB/s
SSD bandwidth: 8GiB/s

Then write bandwidth with data checksum before the patch is:

	1 / ( 1 / 50 + 1 / 45 + 1 / 8) = 5.98 GiB/s

After the patch, the bandwidth is:

	1 / ( 1 / 50 + max( 1 / 45 + 1 / 8)) = 6.90 GiB/s

The difference is 15.32% improvement.

[REAL WORLD BENCHMARK]
I'm using a Zen5 (HX 370) as the host, the VM has 4GiB memory, 10 vCPUs, the storage is backed by a PCIe gen3 x4 NVMe.

The test is a direct IO write, with 1MiB block size, write 7GiB data into a btrfs mount with data checksum. Thus the direct write will fallback to buffered one:

Vanilla Datasum: 1619.97 GiB/s
Patched Datasum: 1792.26 GiB/s
Diff +10.6 %

In my case, the bottleneck is the storage, thus the improvement is not reaching the theoretic one, but still some observable improvement.

Stable-dep-of: b39b26e017c7 ("btrfs: zoned: don't zone append to conventional zone")

---
 fs/btrfs/bio.c       | 21 ++++++++++++----
 fs/btrfs/bio.h       |  7 ++++++
 fs/btrfs/file-item.c | 60 +++++++++++++++++++++++++++++++-------------
 fs/btrfs/file-item.h |  2 +-
 4 files changed, 67 insertions(+), 23 deletions(-)

index 52b8893f26f16..1286c1ac19404 100644
@@ -105,6 +105,9 @@ void btrfs_bio_end_io(struct btrfs_bio *bbio, blk_status_t status)
 	/* Make sure we're already in task context. */
 	ASSERT(in_task());
 
+	if (bbio->async_csum)
+		wait_for_completion(&bbio->csum_done);
+
 	bbio->bio.bi_status = status;
 	if (bbio->bio.bi_pool == &btrfs_clone_bioset) {
 		struct btrfs_bio *orig_bbio = bbio->private;

@@ -538,7 +541,11 @@ static int btrfs_bio_csum(struct btrfs_bio *bbio)
 {
 	if (bbio->bio.bi_opf & REQ_META)
 		return btree_csum_one_bio(bbio);
-	return btrfs_csum_one_bio(bbio);
+#ifdef CONFIG_BTRFS_EXPERIMENTAL
+	return btrfs_csum_one_bio(bbio, true);
+#else
+	return btrfs_csum_one_bio(bbio, false);
+#endif
 }
 
 /*

@@ -617,10 +624,14 @@ static bool should_async_write(struct btrfs_bio *bbio)
 	struct btrfs_fs_devices *fs_devices = fs_info->fs_devices;
 	enum btrfs_offload_csum_mode csum_mode = READ_ONCE(fs_devices->offload_csum_mode);
 
-	if (csum_mode == BTRFS_OFFLOAD_CSUM_FORCE_OFF)
-		return false;
-
-	auto_csum_mode = (csum_mode == BTRFS_OFFLOAD_CSUM_AUTO);
+	if (csum_mode == BTRFS_OFFLOAD_CSUM_FORCE_ON)
+		return true;
+	/*
+	 * Write bios will calculate checksum and submit bio at the same time.
+	 * Unless explicitly required don't offload serial csum calculate and bio
+	 * submit into a workqueue.
+	 */
+	return false;
 #endif
 
 	/* Submit synchronously if the checksum implementation is fast. */

index b7a0de6f97840..9a44b86d561b1 100644
@@ -63,6 +63,9 @@ struct btrfs_bio {
 		struct {
 			struct btrfs_ordered_extent *ordered;
 			struct btrfs_ordered_sum *sums;
+			struct work_struct csum_work;
+			struct completion csum_done;
+			struct bvec_iter csum_saved_iter;
 			u64 orig_physical;
 		};
 

@@ -90,6 +93,10 @@ struct btrfs_bio {
 	 * scrub bios.
 	 */
 	bool is_scrub;
+
+	/* Whether the csum generation for data write is async. */
+	bool async_csum;
+
 	/*
 	 * This member must come last, bio_alloc_bioset will allocate enough
 	 * bytes for entire btrfs_bio but relies on bio being last.

index 0d59e830018a6..5645c5e3abdb7 100644
@@ -64,7 +64,7 @@ int btrfs_lookup_file_extent(struct btrfs_trans_handle *trans,
 int btrfs_csum_file_blocks(struct btrfs_trans_handle *trans,
 			   struct btrfs_root *root,
 			   struct btrfs_ordered_sum *sums);
-int btrfs_csum_one_bio(struct btrfs_bio *bbio);
+int btrfs_csum_one_bio(struct btrfs_bio *bbio, bool async);
 int btrfs_alloc_dummy_sum(struct btrfs_bio *bbio);
 int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
 			     struct list_head *list, int search_commit,

2.51.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josef Bacik <[email protected]>

[ Upstream commit bd45e9e3f6232f76fa9bd0e40c1e3409e4449f5e ]

When checksumming the encrypted bio on writes we need to know which logical address this checksum is for. At the point where we get the encrypted bio the bi_sector is the physical location on the target disk, so we need to save the original logical offset in the btrfs_bio. Then we can use this when checksumming the bio instead of the bio->iter.bi_sector.

Note: The patch was taken from v5 of fscrypt patchset
(https://lore.kernel.org/linux-btrfs/[email protected]/)
which was handled over time by various people: Omar Sandoval, Sweet Tea Dorminy, Josef Bacik.

Stable-dep-of: b39b26e017c7 ("btrfs: zoned: don't zone append to conventional zone")

---
 fs/btrfs/bio.c       | 10 ++++++++++
 fs/btrfs/bio.h       |  2 ++
 fs/btrfs/file-item.c |  2 +-
 3 files changed, 13 insertions(+), 1 deletion(-)

index 1286c1ac19404..c3d860a2bca42 100644
@@ -94,6 +94,8 @@ static struct btrfs_bio *btrfs_split_bio(struct btrfs_fs_info *fs_info,
 	if (bbio_has_ordered_extent(bbio)) {
 		refcount_inc(&orig_bbio->ordered->refs);
 		bbio->ordered = orig_bbio->ordered;
+		bbio->orig_logical = orig_bbio->orig_logical;
+		orig_bbio->orig_logical += map_length;
 	}
 	bbio->csum_search_commit_root = orig_bbio->csum_search_commit_root;
 	atomic_inc(&orig_bbio->pending_ios);

@@ -726,6 +728,14 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 		goto end_bbio;
 	}
 
+	/*
+	 * For fscrypt writes we will get the encrypted bio after we've remapped
+	 * our bio to the physical disk location, so we need to save the
+	 * original bytenr so we know what we're checksumming.
+	 */
+	if (bio_op(bio) == REQ_OP_WRITE && is_data_bbio(bbio))
+		bbio->orig_logical = logical;
+
 	map_length = min(map_length, length);
 	if (use_append)
 		map_length = btrfs_append_map_length(bbio, map_length);

index 9a44b86d561b1..488cdbdd9e2f8 100644
@@ -59,6 +59,7 @@ struct btrfs_bio {
 		 * - pointer to the checksums for this bio
 		 * - original physical address from the allocator
 		 *   (for zone append only)
+		 * - original logical address, used for checksumming fscrypt bios
 		 */
 		struct {
 			struct btrfs_ordered_extent *ordered;

@@ -67,6 +68,7 @@ struct btrfs_bio {
 			struct completion csum_done;
 			struct bvec_iter csum_saved_iter;
 			u64 orig_physical;
+			u64 orig_logical;
 		};
 
 		/* For metadata reads: parentness verification. */

index 4b7c40f05e8f9..48f444bde5fa9 100644
@@ -815,7 +815,7 @@ int btrfs_csum_one_bio(struct btrfs_bio *bbio, bool async)
 	if (!sums)
 		return -ENOMEM;
 
-	sums->logical = bio->bi_iter.bi_sector << SECTOR_SHIFT;
+	sums->logical = bbio->orig_logical;
 	sums->len = bio->bi_iter.bi_size;
 	INIT_LIST_HEAD(&sums->list);
 	bbio->sums = sums;

2.51.0

Hi Greg,

This one is a preparation for new feature development, it's not really worth the stable branch. Backporting it makes no sense.

Have a nice day,
Daniel