6.19.4-rc1 review

This is the start of the stable review cycle for the 6.19.4 release. There are 781 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 27 Feb 2026 01:22:34 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.4-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.19.4-rc1

Huacai Chen <[email protected]>
net: stmmac: dwmac-loongson: Set clk_csr_i to 100-150MHz

Jan Kiszka <[email protected]>
Drivers: hv: vmbus: Use kthread for vmbus interrupts on PREEMPT_RT

Jeongjun Park <[email protected]>
drm/exynos: vidi: fix to avoid directly dereferencing user pointer

Jeongjun Park <[email protected]>

    drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()

Lewis Mason <[email protected]>
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book3 Pro 360 (NP965QFG)

Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix headphone jack handling on Acer Swift SF314

Eric Naim <[email protected]>
ALSA: hda/realtek: Add quirk for Gigabyte G5 KF5 (2023)

Shengjiu Wang <[email protected]>
ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names

Shengjiu Wang <[email protected]>
ASoC: dt-bindings: asahi-kasei,ak4458: Fix the supply names

Shengjiu Wang <[email protected]>
ASoC: dt-bindings: asahi-kasei,ak4458: set unevaluatedProperties:false

Vikram Sharma <[email protected]>
dt-bindings: media: qcom,qcs8300-camss: Add missing power supplies

Abel Vesa <[email protected]>
dt-bindings: phy: qcom-edp: Add missing clock for X Elite

Daniel Hodges <[email protected]>
SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path

Chuck Lever <[email protected]>
SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths

Damien Le Moal <[email protected]>
ata: libata-scsi: avoid Non-NCQ command starvation

Damien Le Moal <[email protected]>
ata: libata-scsi: refactor ata_scsi_translate()

Linus Walleij <[email protected]>
ata: pata_ftide010: Fix some DMA timings

Jan Kara <[email protected]>
ext4: use optimized mballoc scanning regardless of inode format

Jan Kara <[email protected]>
ext4: always allocate blocks only from groups inode can use

Brian Foster <[email protected]>
ext4: fix dirtyclusters double decrement on fs shutdown

Yongjian Sun <[email protected]>
ext4: fix e4b bitmap inconsistency reports

Zilin Guan <[email protected]>
ext4: fix memory leak in ext4_ext_shift_extents()

Zhang Yi <[email protected]>
ext4: drop extent cache when splitting extent fails

Zhang Yi <[email protected]>
ext4: drop extent cache after doing PARTIAL_VALID1 zeroout

Zhang Yi <[email protected]>
ext4: don't cache extent during splitting extent

Zhang Yi <[email protected]>
ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1

Zhang Yi <[email protected]>
ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O

Zhang Yi <[email protected]>
ext4: subdivide EXT4_EXT_DATA_VALID1

Fedor Pchelkin <[email protected]>
ksmbd: call ksmbd_vfs_kern_path_end_removing() on some error paths

Yao Zi <[email protected]>
MIPS: Work around LLVM bug when gp is used as global register variable

Thomas Richard (TI) <[email protected]>
usb: cdns3: fix role switching during resume

Koichiro Den <[email protected]>
PCI: dwc: ep: Always clear IB maps on BAR update

Timur Kristóf <[email protected]>
drm/amd/display: Enable DAC in DCE link encoder

Timur Kristóf <[email protected]>
drm/amd/display: Set CRTC source for DAC using registers

Timur Kristóf <[email protected]>
drm/amd/display: Initialize DAC in DCE link encoder using VBIOS

Timur Kristóf <[email protected]>
drm/amd/display: Turn off DAC in DCE link encoder using VBIOS

Timur Kristóf <[email protected]>
drm/amd/display: Don't call find_analog_engine() twice

Mario Kleiner <[email protected]>
drm/amd/display: Use same max plane scaling limits for all 64 bpp formats

Detlev Casanova <[email protected]>
ASoC: rockchip: i2s-tdm: Use param rate if not provided by set_sysclk

Ethan Tidmore <[email protected]>
x86/hyperv: Fix error pointer dereference

Timur Kristóf <[email protected]>
drm/amd/display: Only use analog stream encoder with analog engine

Timur Kristóf <[email protected]>
drm/amd/display: Only use analog link encoder with analog engine

Timur Kristóf <[email protected]>
drm/amd/display: Use DCE 6 link encoder for DCE 6 analog connectors

Filipe Manana <[email protected]>
btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found

Filipe Manana <[email protected]>
btrfs: use the correct type to initialize block reserve for delayed refs

Jiasheng Jiang <[email protected]>
btrfs: reset block group size class when it becomes empty

Kiryl Shutsemau (Meta) <[email protected]>
efi: Fix reservation of unaccepted memory table

Dmitry Torokhov <[email protected]>
gpio: amd-fch: ionly return allowed values from amd_fch_gpio_get()

Raag Jadav <[email protected]>
drm/xe/bo: Redirect faults to dummy page for wedged device

Shuicheng Lin <[email protected]>
drm/xe: Make xe_modparam.force_vram_bar_size signed

Piotr Piórkowski <[email protected]>
drm/xe/vf: Avoid reading media version when media GT is disabled

Matt Roper <[email protected]>

    drm/xe/xe2_hpg: Fix handling of Wa_14019988906 & Wa_14019877138

Shuicheng Lin <[email protected]>
drm/xe/mmio: Avoid double-adjust in 64-bit reads

Michal Wajdeczko <[email protected]>
drm/xe/configfs: Fix 'parameter name omitted' errors

Michal Wajdeczko <[email protected]>
drm/xe/pf: Fix sysfs initialization

Alexander Egorenkov <[email protected]>
s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n

Douglas Anderson <[email protected]>
gpio: cdev: Avoid NULL dereference in linehandle_create()

Felix Gu <[email protected]>
spi: wpcm-fiu: Fix potential NULL pointer dereference in wpcm_fiu_probe()

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix out-of-bounds stream encoder index v3

Timur Kristóf <[email protected]>
drm/amd/display: Reject cursor plane on DCE when scaled differently than primary

Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix watch_id bounds checking in debug address watch v2

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Fix missing unwind in amdgpu_ib_schedule() error path

Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix dc_link NULL handling in HPD init

Kai-Heng Feng <[email protected]>
PCI: Validate window resource type in pbus_select_window_for_type()

Alexandre Ferrieux <[email protected]>
ASoC: codecs: aw88261: Fix erroneous bitmask logic in Awinic init

Kaushlendra Kumar <[email protected]>
drm/i915/acpi: free _DSM package when no connectors

Ziyi Guo <[email protected]>
ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put()

Adam Ford <[email protected]>
regulator: mt6363: Fix interrmittent timeout

Li RongQing <[email protected]>
mshv: fix SRCU protection in irqfd resampler ack handler

Sunil Khatri <[email protected]>
drm/amdgpu: clean up the amdgpu_cs_parser_bos

Alex Deucher <[email protected]>
drm/amdgpu/sdma6: enable queue resets unconditionally

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: enable queue resets unconditionally

Alex Deucher <[email protected]>
drm/amdgpu/sdma5: enable queue resets unconditionally

Zilin Guan <[email protected]>
drm/amdgpu: Fix memory leak in amdgpu_ras_init()

Zilin Guan <[email protected]>
drm/amdgpu: Use kvfree instead of kfree in amdgpu_gmc_get_nps_memranges()

Zilin Guan <[email protected]>
drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

John Johansen <[email protected]>
apparmor: fix aa_label to return state from compount and component match

Georgia Garcia <[email protected]>
apparmor: fix invalid deref of rawdata when export_binary is unset

Zhengmian Hu <[email protected]>
apparmor: avoid per-cpu hold underflow in aa_get_buffer

John Johansen <[email protected]>
apparmor: make label_match return a consistent value

John Johansen <[email protected]>
apparmor: remove apply_modes_to_perms from label_match

John Johansen <[email protected]>
apparmor: fix rlimit for posix cpu timers

John Johansen <[email protected]>
apparmor: move check for aa_null file to cover all cases

Ryan Lee <[email protected]>
apparmor: account for in_atomic removal in common_file_perm

John Johansen <[email protected]>
apparmor: drop in_atomic flag in common_mmap, and common_file_perm

Ryan Lee <[email protected]>
apparmor: fix boolean argument in apparmor_mmap_file

Ryan Lee <[email protected]>
apparmor: return -ENOMEM in unpack_perms_table upon alloc failure

Helge Deller <[email protected]>
apparmor: Fix & Optimize table creation from possibly unaligned memory

Helge Deller <[email protected]>
AppArmor: Allow apparmor to handle unaligned dfa tables

John Johansen <[email protected]>
apparmor: fix NULL sock in aa_sock_file_perm

System Administrator <root@localhost>
apparmor: fix NULL pointer dereference in __unix_needs_revalidation

Cosmin Ratiu <[email protected]>
net/mlx5e: Use unsigned for mlx5e_get_max_num_channels

Cosmin Ratiu <[email protected]>
net/mlx5e: Fix deadlocks between devlink and netdev instance locks

Gal Pressman <[email protected]>
net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event

Gal Pressman <[email protected]>
net/mlx5: Fix misidentification of write combining CQE during poll loop

Gal Pressman <[email protected]>
net/mlx5e: Fix misidentification of ASO CQE during poll loop

Shay Drory <[email protected]>
net/mlx5: Fix multiport device check over light SFs

Hangbin Liu <[email protected]>
bonding: alb: fix UAF in rlb_arp_recv during bond up/down

Vikas Gupta <[email protected]>
bnge: fix reserving resources from FW

Dimitri Daskalakis <[email protected]>
eth: fbnic: Advertise supported XDP features.

Hariprasad Kelam <[email protected]>
octeontx2-af: Fix default entries mcam entry action

Eric Dumazet <[email protected]>
ipv6: icmp: remove obsolete code in icmpv6_xrlim_allow()

Eric Dumazet <[email protected]>
inet: move icmp_global_{credit,stamp} to a separate cache line

Eric Dumazet <[email protected]>
icmp: prevent possible overflow in icmp_global_allow()

Dimitri Daskalakis <[email protected]>
eth: fbnic: Add validation for MTU changes

Eric Dumazet <[email protected]>
macvlan: observe an RCU grace period in macvlan_common_newlink() error path

Jakub Kicinski <[email protected]>
selftests: tc_actions: don't dump 2MB of \0 to stdout

Eric Dumazet <[email protected]>
ping: annotate data-races in ping_lookup()

Ivan Vecera <[email protected]>
dpll: zl3073x: Fix ref frequency setting

Eric Dumazet <[email protected]>
net: do not delay zero-copy skbs in skb_attempt_defer_free()

Arnd Bergmann <[email protected]>
net: psp: select CONFIG_SKB_EXTENSIONS

Jakub Kicinski <[email protected]>
bpftool: Fix truncated netlink dumps

Eric Dumazet <[email protected]>
ipv6: fix a race in ip6_sock_set_v6only()

Inseo An <[email protected]>
netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

Pablo Neira Ayuso <[email protected]>
net: remove WARN_ON_ONCE when accessing forward path array

Julian Anastasov <[email protected]>
ipvs: do not keep dest_dst if dev is going down

Julian Anastasov <[email protected]>
ipvs: skip ipv6 extension headers for csum checks

Florian Westphal <[email protected]>
netfilter: nf_conntrack_h323: don't pass uninitialised l3num value

Brian Witte <[email protected]>
netfilter: nf_tables: revert commit_mutex usage in reset path

Brian Witte <[email protected]>
netfilter: nft_quota: use atomic64_xchg for reset

Brian Witte <[email protected]>
netfilter: nft_counter: serialize reset with spinlock

Aleksei Oladko <[email protected]>
selftests: forwarding: fix pedit tests failure with br_netfilter enabled

Aleksei Oladko <[email protected]>
selftests: forwarding: vxlan_bridge_1d_ipv6: fix test failure with br_netfilter enabled

Aleksei Oladko <[email protected]>
selftests: forwarding: vxlan_bridge_1d: fix test failure with br_netfilter enabled

Nikolay Aleksandrov <[email protected]>
net: bridge: mcast: always update mdb_n_entries for vlan contexts

Allison Henderson <[email protected]>
net/rds: rds_sendmsg should not discard payload_len

Ziyi Guo <[email protected]>
xen-netback: reject zero-queue configuration from guest

Ziyi Guo <[email protected]>
net: usb: catc: enable basic endpoint checking

Antonio Quartulli <[email protected]>
ovpn: tcp - don't deref NULL sk_socket member after tcp_close()

Bobby Eshleman <[email protected]>
eth: fbnic: set DMA_HINT_L4 for all flows

Bobby Eshleman <[email protected]>
eth: fbnic: increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes

Bobby Eshleman <[email protected]>
eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0

Anton Protopopov <[email protected]>
bpf: Add a map/btf from a fd array more consistently

Anton Protopopov <[email protected]>
bpf: Fix a potential use-after-free of BTF object

Amery Hung <[email protected]>
libbpf: Fix invalid write loop logic in bpf_linker__add_buf()

Chengfeng Ye <[email protected]>
fbnic: close fw_log race between users and teardown

Daniel Machon <[email protected]>
net: sparx5/lan969x: fix PTP clock max_adj value

Kuniyuki Iwashima <[email protected]>
ipv6: Fix out-of-bound access in fib6_add_rt2node().

Pin-yen Lin <[email protected]>
selftests: netconsole: Increase port listening timeout

Ziyi Guo <[email protected]>
net: mscc: ocelot: add missing lock protection in ocelot_port_xmit_inj()

Ziyi Guo <[email protected]>
net: mscc: ocelot: split xmit into FDMA and register injection paths

Ziyi Guo <[email protected]>
net: mscc: ocelot: extract ocelot_xmit_timestamp() helper

Daniel Machon <[email protected]>
net: sparx5/lan969x: fix DWRR cost max to match hardware register width

Jie Zhang <[email protected]>
net: stmmac: fix oops when split header is enabled

Yue Haibing <[email protected]>
selftests: net: lib: Fix jq parsing error

Ido Schimmel <[email protected]>
selftests: mlxsw: tc_restrictions: Fix test failure with new iproute2

Jeremy Kerr <[email protected]>
net: mctp: ensure our nlmsg responses are initialised

Ralf Lici <[email protected]>
ovpn: fix VPN TX bytes counting

Ralf Lici <[email protected]>
ovpn: fix possible use-after-free in ovpn_net_xmit

Ralf Lici <[email protected]>
ovpn: set sk_user_data before overriding callbacks

Aboorva Devarajan <[email protected]>
cpuidle: Skip governor when only one idle state is available

Zhai Can <[email protected]>
ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZERO

zhouwenhao <[email protected]>
objpool: fix the overestimation of object pooling metadata size

Aristeu Rozanski <[email protected]>
selftests/memfd: use IPC semaphore instead of SIGSTOP/SIGCONT

Paulo Alcantara <[email protected]>
smb: client: fix regression with mount options parsing

Josh Poimboeuf <[email protected]>
kbuild: Add objtool to top-level clean target

Kuppuswamy Sathyanarayanan <[email protected]>
powercap: intel_rapl_tpmi: Remove FW_BUG from invalid version check

Sean V Kelley <[email protected]>
ACPI: CPPC: Fix remaining for_each_possible_cpu() to use online CPUs

Kuppuswamy Sathyanarayanan <[email protected]>
powercap: intel_rapl: Remove incorrect CPU check in PMU context

Len Brown <[email protected]>
tools/power turbostat: Harden against unexpected values

Len Brown <[email protected]>

    tools/power turbostat: AMD: msr offset 0x611 read failed: Input/output error

Jiasheng Jiang <[email protected]>
fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot

Edward Adam Davis <[email protected]>
fs/ntfs3: prevent infinite loops caused by the next valid being the same

Szymon Wilczek <[email protected]>
fs/ntfs3: fix deadlock in ni_read_folio_cmpr

Konstantin Komarov <[email protected]>
fs/ntfs3: rename ni_readpage_cmpr into ni_read_folio_cmpr

Baokun Li <[email protected]>
fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()

Bartlomiej Kubik <[email protected]>
fs/ntfs3: Initialize new folios before use

Jens Axboe <[email protected]>
io_uring/cancel: de-unionize file and user_data in struct io_cancel_data

Pavel Begunkov <[email protected]>
io_uring: delay sqarray static branch disablement

Stefan Hajnoczi <[email protected]>
block: allow IOC_PR_READ_* ioctls with BLK_OPEN_READ

Christoph Böhmwalder <[email protected]>
drbd: always set BLK_FEAT_STABLE_WRITES

Jared Kangas <[email protected]>
dmaengine: fsl-edma: don't explicitly disable clocks in .remove()

Barnabás Czémán <[email protected]>
backlight: qcom-wled: Change PM8950 WLED configurations

Barnabás Czémán <[email protected]>
backlight: qcom-wled: Support ovp values for PMI8994

Haotian Zhang <[email protected]>
leds: qcom-lpg: Check the return value of regmap_bulk_write()

Duje Mihanović <[email protected]>
leds: expresswire: Fix chip state breakage

Jiayu Du <[email protected]>
pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree

Wei Li <[email protected]>
pinctrl: single: fix refcount leak in pcs_add_gpio_func()

Felix Gu <[email protected]>
pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers

Luca Weiss <[email protected]>
pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition

Luca Boccassi <[email protected]>
pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns

Randy Dunlap <[email protected]>
mips: LOONGSON32: drop a dangling Kconfig symbol

Harshit Mogalapalli <[email protected]>
iio: sca3000: Fix a resource leak in sca3000_probe()

Amir Goldstein <[email protected]>
nfsd: do not allow exporting of special kernel filesystems

Qing Wang <[email protected]>
ovl: Fix uninit-value in ovl_fill_real

Felix Gu <[email protected]>
pinctrl: equilibrium: Fix device node reference leak in pinbank_init()

Jose Javier Rodriguez Barbarin <[email protected]>
mcb: fix incorrect sanity check

Randy Dunlap <[email protected]>
nvmem: an8855: drop an unused Kconfig symbol

Justin Chen <[email protected]>
usb: bdc: fix sleep during atomic

Svyatoslav Ryhel <[email protected]>
drivers: iio: mpu3050: use dev_err_probe for regulator request

André Draszik <[email protected]>
mfd: sec: Fix IRQ domain names duplication

Robert Marko <[email protected]>
mfd: simple-mfd-i2c: Add Delta TN48M CPLD support

Haotian Zhang <[email protected]>
mfd: arizona: Fix regulator resource leak on wm5102_clear_write_sequencer() failure

Greg Kroah-Hartman <[email protected]>
Revert "mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms"

Yicong Yang <[email protected]>
coresight: tmc-etr: Fix race condition between sysfs and perf mode

Raviteja Laggyshetty <[email protected]>
interconnect: qcom: qcs8300: fix the num_links for nsp icc node

Thomas Richard <[email protected]>
phy: freescale: imx8qm-hsio: fix NULL pointer dereference

Junjie Cao <[email protected]>
backlight: aw99706: Fix build errors caused by wrong gpio header

Antonio Borneo <[email protected]>
coresight: etm3x: Fix cpulocked warning on cpuhp

Kery Qi <[email protected]>
watchdog: starfive-wdt: Fix PM reference leak in probe error path

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix pressure calculation

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix scan_type struct

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix interrupt flag

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix SPI CS delay violation

Petre Rodan <[email protected]>
iio: pressure: mprls0025pa: fix spi_transfer struct initialisation

Matthew Schwartz <[email protected]>
mmc: rtsx_pci_sdmmc: increase power-on settling delay to 5ms

Randy Dunlap <[email protected]>
stm class: Kconfig: correct symbol name

Zilin Guan <[email protected]>
gpib: Fix memory leak in ni_usb_init()

Dan Carpenter <[email protected]>
gpib: Fix error code in ni_usb_write_registers()

Dan Carpenter <[email protected]>
gpib: Fix error code in ibonline()

Randy Dunlap <[email protected]>
serial: SH_SCI: improve "DMA support" prompt

Randy Dunlap <[email protected]>
serial: imx: change SERIAL_IMX_CONSOLE to bool

Chaitanya Mishra <[email protected]>
staging: greybus: lights: avoid NULL deref

Randy Dunlap <[email protected]>
usb: typec: ucsi: drop an unused Kconfig symbol

Randy Dunlap <[email protected]>
iio: test: drop dangling symbol in gain-time-scale helpers

Arnd Bergmann <[email protected]>
soundwire: intel_ace2x: add SND_HDA_CORE dependency

Alper Ak <[email protected]>
char: misc: Use IS_ERR() for filp_open() return value

Cristian Ciocaltea <[email protected]>
phy: rockchip: samsung-hdptx: Pre-compute HDMI PLL config for 461.10125 MHz output

Nuno Sá <[email protected]>
dma: dma-axi-dmac: fix HW scatter-gather not looking at the queue

Nuno Sá <[email protected]>
dma: dma-axi-dmac: fix SW cyclic transfers

AngeloGioacchino Del Regno <[email protected]>
dmaengine: mediatek: uart-apdma: Fix above 4G addressing TX/RX

Nicolas Frattaroli <[email protected]>
interconnect: mediatek: Aggregate bandwidth with saturating add

Nicolas Frattaroli <[email protected]>
interconnect: mediatek: Don't hijack parent device

Krzysztof Kozlowski <[email protected]>
clk: zynqmp: pll: Fix zynqmp_clk_divider_determine_rate kerneldoc

Krzysztof Kozlowski <[email protected]>
clk: zynqmp: divider: Fix zynqmp_clk_divider_determine_rate kerneldoc

Haotian Zhang <[email protected]>
clk: mediatek: Fix error handling in runtime PM setup

Nicolas Frattaroli <[email protected]>
clk: mediatek: Add mfg_eb as parent to mt8196 mfgpll clocks

Sjoerd Simons <[email protected]>
clk: mediatek: Drop __initconst from gates

Brian Masney <[email protected]>
clk: zynqmp: divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: x86: cgu: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: versaclock3: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: stm32: stm32-core: convert from divider_round_rate_parent() to divider_determine_rate()

Brian Masney <[email protected]>
clk: stm32: stm32-core: convert from divider_ro_round_rate() to divider_ro_determine_rate()

Brian Masney <[email protected]>
clk: sprd: div: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: sophgo: sg2042-clkgen: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: nxp: lpc32xx: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: nuvoton: ma35d1-divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: milbeaut: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: loongson1: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: hisilicon: clkdivider-hi6220: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: bm1880: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: actions: owl-divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: actions: owl-composite: convert from owl_divider_helper_round_rate() to divider_determine_rate()

Dmitry Baryshkov <[email protected]>
clk: qcom: gfx3d: add parent to parent request map

David Heidelberg <[email protected]>
clk: qcom: dispcc-sm7150: Fix dispcc_mdss_pclk1_clk_src

Petr Hodina <[email protected]>
clk: qcom: dispcc-sdm845: Enable parents for pixel clocks

Brian Masney <[email protected]>
clk: qcom: regmap-divider: convert from divider_round_rate() to divider_determine_rate()

Brian Masney <[email protected]>
clk: qcom: regmap-divider: convert from divider_ro_round_rate() to divider_ro_determine_rate()

Geert Uytterhoeven <[email protected]>
clk: Move clk_{save,restore}_context() to COMMON_CLK section

Vladimir Zapolskiy <[email protected]>
Input: adp5589 - remove a leftover header file

Brian Masney <[email protected]>
clk: microchip: core: remove duplicate determine_rate on pic32_sclk_ops

Miaoqian Lin <[email protected]>
clk: rockchip: Fix error pointer check after rockchip_clk_register_gate_link()

Brian Masney <[email protected]>
clk: qcom: alpha-pll: convert from divider_round_rate() to divider_determine_rate()

George Moussalem <[email protected]>
clk: qcom: gcc-ipq5018: flag sleep clock as critical

Barnabás Czémán <[email protected]>
clk: qcom: gcc-msm8917: Remove ALWAYS_ON flag from cpp_gdsc

Barnabás Czémán <[email protected]>
clk: qcom: gcc-msm8953: Remove ALWAYS_ON flag from cpp_gdsc

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-glymur: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-qdu1000: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-x1e80100: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-milos: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sdx75: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sm4450: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sm8750: Update the SDCC RCGs to use shared_floor_ops

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-sm8450: Update the SDCC RCGs to use shared_floor_ops

Martin Blumenstingl <[email protected]>
clk: meson: g12a: Limit the HDMI PLL OD to /4

Martin Blumenstingl <[email protected]>
clk: meson: gxbb: Limit the HDMI PLL OD to /4 on GXL/GXM SoCs

Taniya Das <[email protected]>
clk: qcom: rcg2: compute 2d using duty fraction directly

Vladimir Zapolskiy <[email protected]>
clk: qcom: gcc-sm8650: Use floor ops for SDCC RCGs

Vladimir Zapolskiy <[email protected]>
clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs

Inochi Amaoto <[email protected]>
clk: spacemit: Respect Kconfig setting when building modules

Yao Zi <[email protected]>
clk: thead: th1520-ap: Poll for PLL lock and wait for stability

Felix Gu <[email protected]>
fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()

Felix Gu <[email protected]>
fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings()

Sudeep Holla <[email protected]>
Revert "mailbox/pcc: support mailbox management of the shared buffer"

Shengjiu Wang <[email protected]>
remoteproc: imx_dsp_rproc: Only reset carveout memory at RPROC_OFFLINE state

Daniel Baluta <[email protected]>
remoteproc: imx_dsp_rproc: Fix multiple start/stop operations

Shenwei Wang <[email protected]>
remoteproc: imx_rproc: Use strstarts for "rsc-table" check

Steven Rostedt <[email protected]>
tracing: Remove duplicate ENABLE_EVENT_STR and DISABLE_EVENT_STR macros

Miaoqian Lin <[email protected]>
tracing: Properly process error handling in event_hist_trigger_parse()

Sagi Grimberg <[email protected]>
fs/nfs: Fix readdir slow-start regression

Li Chen <[email protected]>
nvdimm: virtio_pmem: serialize flush requests

Colin Ian King <[email protected]>
scsi: csiostor: Fix dereference of null pointer rn

Arnd Bergmann <[email protected]>
scsi: ufs: host: mediatek: Require CONFIG_PM

Zilin Guan <[email protected]>
scsi: smartpqi: Fix memory leak in pqi_report_phys_luns()

Olga Kornievskaia <[email protected]>
pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN

Yi Liu <[email protected]>
RDMA/uverbs: Add __GFP_NOWARN to ib_uverbs_unmarshall_recv() kmalloc

Val Packett <[email protected]>
power: supply: qcom_battmgr: Recognize "LiP" as lithium-polymer

Waqar Hameed <[email protected]>
power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler

Weili Qian <[email protected]>
hisi_acc_vfio_pci: fix VF reset timeout issue

Miquel Raynal <[email protected]>
mtd: spinand: Fix kernel doc

Weigang He <[email protected]>
mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()

Yuxiong Wang <[email protected]>
cxl: Fix premature commit_end increment on decoder commit failure

Chuck Lever <[email protected]>
RDMA/core: add rdma_rw_max_sge() helper for SQ sizing

Li Zhijian <[email protected]>
RDMA/rxe: Fix race condition in QP timer handlers

Zilin Guan <[email protected]>
RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler

Yi Liu <[email protected]>
RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send

Niklas Cassel <[email protected]>
ata: libata-core: Quirk INTEL SSDSC2KG480G8 max_sectors

Niklas Cassel <[email protected]>
ata: libata: Add ATA_QUIRK_MAX_SEC and convert all device quirks

Li Zhijian <[email protected]>

    RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

Cheatham, Benjamin <[email protected]>
cxl/core: Fix cxl_dport debugfs EINJ entries

Robert Richter <[email protected]>
cxl/hdm: Fix newline character in dev_err() messages

Mike Snitzer <[email protected]>
NFS/localio: remove -EAGAIN handling in nfs_local_doio()

Mike Snitzer <[email protected]>
NFS/localio: use GFP_NOIO and non-memreclaim workqueue in nfs_local_commit

Mike Snitzer <[email protected]>
NFS/localio: prevent direct reclaim recursion into NFS via nfs_writepages

Trond Myklebust <[email protected]>
NFS/localio: Handle short writes by retrying

Zilin Guan <[email protected]>
mtd: parsers: Fix memory leak in mtd_parser_tplink_safeloader_parse()

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Send PSP_CMD_TEE_RING_DESTROY when PSP_CMD_TEE_RING_INIT fails

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Factor out ring destroy handling to a helper

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Add an S4 restore flow

Mario Limonciello (AMD) <[email protected]>
crypto: ccp - Declare PSP dead if PSP_CMD_TEE_RING_INIT fails

Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Prevent TEE errors after hibernate

Anthony Pighin (Nokia) <[email protected]>
vfio/pci: Lock upstream bridge for vfio_pci_core_disable()

Alexander Usyskin <[email protected]>
mtd: intel-dg: Fix accessing regions before setting nregions

Alok Tiwari <[email protected]>
mtd: rawnand: cadence: Fix return type of CDMA send-and-wait helper

Or Har-Toov <[email protected]>
IB/mlx5: Fix port speed query for representors

Chiara Meiohas <[email protected]>
RDMA/mlx5: Fix UMR hang in LAG error state unload

Malaya Kumar Rout <[email protected]>
tools/power/x86/intel-speed-select: Fix file descriptor leak in isolate_cpus()

Krishna Chomal <[email protected]>
platform/x86: hp-wmi: fix platform profile values for Omen 16-wf1xxx

Jacob Moroni <[email protected]>
RDMA/iwcm: Fix workqueue list corruption by removing work_list

Jiasheng Jiang <[email protected]>
RDMA/rxe: Fix double free in rxe_srq_from_init

Roman Penyaev <[email protected]>
RDMA/rtrs-srv: fix SG mapping

Waqar Hameed <[email protected]>
power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()

Haotian Zhang <[email protected]>
power: supply: bq27xxx: fix wrong errno when bus ops are unsupported

Alexander Koskovich <[email protected]>
power: reset: nvmem-reboot-mode: respect cell size for nvmem_cell_write

Waqar Hameed <[email protected]>
power: supply: sbs-battery: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: rt9455: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: pm8916_lbc: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: pm8916_bms_vm: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: pf1550: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: goldfish: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: cpcap-battery: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: bq25980: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: bq256xx: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: act8945a: Fix use-after-free in power_supply_changed()

Waqar Hameed <[email protected]>
power: supply: ab8500: Fix use-after-free in power_supply_changed()

Dan Williams <[email protected]>
cxl/mem: Fix devm_cxl_memdev_edac_release() confusion

Maher Sanalla <[email protected]>
RDMA/mlx5: Fix ucaps init error flow

Chengchang Tang <[email protected]>
RDMA/hns: Notify ULP of remaining soft-WCs during reset

Junxian Huang <[email protected]>
RDMA/hns: Fix RoCEv1 failure due to DSCP

Junxian Huang <[email protected]>
RDMA/hns: Return actual error code instead of fixed EINVAL

Chengchang Tang <[email protected]>
RDMA/hns: Fix WQ_MEM_RECLAIM warning

Etienne AUJAMES <[email protected]>
IB/cache: update gid cache on client reregister event

Honggang LI <[email protected]>
RDMA/rtrs: server: remove dead code

Kuniyuki Iwashima <[email protected]>
af_unix: Fix memleak of newsk in unix_stream_connect().

Hariprasad Kelam <[email protected]>
octeontx2-pf: Unregister devlink on probe failure

Michael Dege <[email protected]>
net: renesas: rswitch: fix forwarding offload statemachine

Eric Joyner <[email protected]>
ionic: Rate limit unknown xcvr type messages

Vimlesh Kumar <[email protected]>
octeon_ep_vf: ensure dbell BADDR updation

Vimlesh Kumar <[email protected]>
octeon_ep: ensure dbell BADDR updation

Vimlesh Kumar <[email protected]>
octeon_ep: disable per ring interrupts

Jiayuan Chen <[email protected]>
serial: caif: fix use-after-free in caif_serial ldisc_close()

Jiayuan Chen <[email protected]>
xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path

René Rebe <[email protected]>
net: sunhme: Fix sbus regression

Jiayuan Chen <[email protected]>
net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

Stefan Metzmacher <[email protected]>
smb: client: correct value for smbd_max_fragmented_recv_size

Jinliang Zheng <[email protected]>
procfs: fix missing RCU protection when reading real_parent in do_task_stat()

Jian Shen <[email protected]>
net: hns3: fix double free issue for tx spare buffer

Ivan Vecera <[email protected]>
dpll: zl3073x: Fix output pin phase adjustment sign

Danilo Krummrich <[email protected]>
rust: devres: fix race condition due to nesting

Danilo Krummrich <[email protected]>
rust: driver-core: use "kernel vertical" style for imports

Nicolas Cavallari <[email protected]>

    PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]

Felix Gu <[email protected]>
PCI: rzg3s-host: Fix device node reference leak in rzg3s_pcie_host_parse_port()

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: validate open interval overlap

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: validate element belonging to interval

Florian Westphal <[email protected]>
netfilter: nft_set_rbtree: don't gc elements on insert

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: remove seqcount_rwlock_t

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: use binary search array in get command

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: translate rbtree to array for binary search

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets

Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: fix bogus EEXIST with NLM_F_CREATE with null interval

Anders Grahn <[email protected]>
netfilter: nft_counter: fix reset of counters on 32bit archs

Florian Westphal <[email protected]>
netfilter: nft_set_hash: fix get operation on big endian

Florian Westphal <[email protected]>
netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

Scott Mitchell <[email protected]>
netfilter: nfnetlink_queue: optimize verdict lookup with hash table

Raju Rangoju <[email protected]>
amd-xgbe: do not select NET_SELFTESTS when INET is disabled

Votokina Victoria <[email protected]>
nfc: hci: shdlc: Stop timers and work before freeing context

Eric Dumazet <[email protected]>
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

Thomas Bogendoerfer <[email protected]>
bonding: only set speed/duplex to unknown, if getting speed failed

Anshumali Gaur <[email protected]>
octeontx2-af: Fix PF driver crash with kexec kernel booting

Paolo Abeni <[email protected]>
mptcp: fix receive space timestamp initialization

Paolo Abeni <[email protected]>
mptcp: do not account for OoO in mptcp_rcvbuf_grow()

Tuo Li <[email protected]>
of: unittest: fix possible null-pointer dereferences in of_unittest_property_copy()

Aksh Garg <[email protected]>
PCI: dwc: ep: Add per-PF BAR and inbound ATU mapping support

Aksh Garg <[email protected]>
PCI: dwc: ep: Fix resizable BAR support for multi-PF configurations

Koichiro Den <[email protected]>
PCI: dwc: ep: Support BAR subrange inbound mapping via Address Match Mode iATU

Koichiro Den <[email protected]>
PCI: dwc: Advertise dynamic inbound mapping support

Koichiro Den <[email protected]>
PCI: endpoint: Add BAR subrange mapping support

Koichiro Den <[email protected]>
PCI: endpoint: Add dynamic_inbound_mapping EPC feature

Qiang Yu <[email protected]>
PCI: dwc: Remove duplicate dw_pcie_ep_hide_ext_capability() function

Koichiro Den <[email protected]>
PCI: dwc: ep: Cache MSI outbound iATU mapping

Qiang Yu <[email protected]>
PCI: dwc: Add new APIs to remove standard and extended Capability

Qiang Yu <[email protected]>
PCI: Add preceding capability position support in PCI_FIND_NEXT_*_CAP macros

Chia-Yu Chang <[email protected]>
tcp: accecn: handle unexpected AccECN negotiation feedback

Chia-Yu Chang <[email protected]>
tcp: disable RFC3168 fallback identifier for CC modules

Chia-Yu Chang <[email protected]>
tcp: ECT_1_NEGOTIATION and NEEDS_ACCECN identifiers

Vincent Guittot <[email protected]>
PCI: s32g: Skip Root Port removal during success

Arnd Bergmann <[email protected]>
jfs: avoid -Wtautological-constant-out-of-range-compare warning

Ondrej Mosnacek <[email protected]>
ucount: check for CAP_SYS_RESOURCE using ns_capable_noaudit()

Ondrej Mosnacek <[email protected]>
ipc: don't audit capability check in ipc_permissions()

Kevin Brodsky <[email protected]>
selftests/mm: fix faulting-in code in pagemap_ioctl test

Kevin Brodsky <[email protected]>
selftests/mm: fix usage of FORCE_READ() in cow tests

D. Wythe <[email protected]>
Revert "net/smc: Introduce TCP ULP support"

Håkon Bugge <[email protected]>
PCI/ACPI: Restrict program_hpx_type2() to AER bits

Håkon Bugge <[email protected]>
PCI: Initialize RCB from pci_configure_device()

Aaradhana Sahu <[email protected]>

    wifi: ath12k: clear stale link mapping of ahvif->links_map

Aaradhana Sahu <[email protected]>
wifi: ath12k: Fix index decrement when array_len is zero

Miaoqing Pan <[email protected]>
wifi: ath11k: add usecase firmware handling based on device compatible

Ziyi Guo <[email protected]>
wifi: ath10k: sdio: add missing lock protection in ath10k_sdio_fw_crashed_dump()

Sergey Shtylyov <[email protected]>
PCI: Check parent for NULL in of_pci_bus_release_domain_nr()

Luiz Augusto von Dentz <[email protected]>

    Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs

Eric Dumazet <[email protected]>
tcp: tcp_tx_timestamp() must look at the rtx queue

Ilpo Järvinen <[email protected]>
PCI: Remove old_size limit from bridge window sizing

Ilpo Järvinen <[email protected]>
PCI: Stop over-estimating bridge window size

Ilpo Järvinen <[email protected]>
PCI: Rewrite bridge window head alignment function

Zhiyu Zhang <[email protected]>
fat: avoid parent link count underflow in rmdir

Alice Ryhl <[email protected]>
rust: task: restrict Task::group_leader() to current

Tomas Glozar <[email protected]>
lib/Kconfig.debug: fix BOOTPARAM_HUNG_TASK_PANIC comment

Chaitanya Mishra <[email protected]>
lib/kstrtox: fix kstrtobool() docstring to mention enabled/disabled

Anthony Iliopoulos <[email protected]>
nfsd: never defer requests during idmap lookup

Chuck Lever <[email protected]>
xdrgen: Remove inclusion of nlm4.h header

Chuck Lever <[email protected]>
xdrgen: Initialize data pointer for zero-length items

Chuck Lever <[email protected]>
NFS: NFSERR_INVAL is not defined by NFSv2

Chuck Lever <[email protected]>
xdrgen: Fix struct prefix for typedef types in program wrappers

Mikulas Patocka <[email protected]>
dm: use bio_clone_blkg_association

Lu Baolu <[email protected]>
iommu/vt-d: Fix race condition during PASID entry replacement

Lu Baolu <[email protected]>
iommu/vt-d: Clear Present bit before tearing down context entry

Lu Baolu <[email protected]>
iommu/vt-d: Clear Present bit before tearing down PASID entry

Dmytro Maluka <[email protected]>
iommu/vt-d: Flush cache for PASID table before using it

Zilin Guan <[email protected]>
wifi: rtw89: debug: Fix memory leak in __print_txpwr_map()

Jörg Wedekind <[email protected]>
PCI: Mark 3ware-9650SA Root Port Extended Tags as broken

Petr Mladek <[email protected]>
kallsyms/ftrace: set module buildid in ftrace_mod_address_lookup()

Petr Mladek <[email protected]>
module: add helper function for reading module_buildid()

Petr Mladek <[email protected]>
kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup()

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: fix tracking of connections from localhost

Florian Westphal <[email protected]>
netfilter: nft_compat: add more restrictions on netlink attributes

Fernando Fernandez Mancera <[email protected]>
netfilter: nf_conncount: increase the connection clean up limit to 64

Florian Westphal <[email protected]>
netfilter: nf_tables: reset table validation state on abort

Li Chen <[email protected]>
ext4: fast commit: make s_fc_lock reclaim-safe

Wei Wang <[email protected]>
iommupt: Do not set C-bit on MMIO backed PTEs

Miri Korenblit <[email protected]>

    wifi: cfg80211: stop NAN and P2P in cfg80211_leave

Matt Johnston <[email protected]>
mctp i2c: initialise event handler read bytes

Jian Zhang <[email protected]>
net: mctp-i2c: fix duplicate reception of old data

Manivannan Sadhasivam <[email protected]>
PCI/pwrctrl: tc9563: Use put_device() instead of i2c_put_adapter()

Abhishek Bapat <[email protected]>
quota: fix livelock between quotactl and freeze_super

Baochen Qiang <[email protected]>
wifi: ath12k: do WoW offloads only on primary link

Rosen Penev <[email protected]>
wifi: ath9k: add OF dependency to AHB

Randy Dunlap <[email protected]>
wifi: ath9k: fix kernel-doc warnings in common-debug.h

Randy Dunlap <[email protected]>
wifi: ath9k: debug.h: fix kernel-doc bad lines and struct ath_tx_stats

Alistair Popple <[email protected]>
PCI/P2PDMA: Reset page reference count when page mapping fails

Aadityarangan Shridhar Iyengar <[email protected]>
PCI/PTM: Fix pcie_ptm_create_debugfs() memory leak

Mikulas Patocka <[email protected]>
dm: use READ_ONCE in dm_blk_report_zones

Mikulas Patocka <[email protected]>
dm: fix unlocked test for dm_suspended_md

Uwe Kleine-König <[email protected]>
PCI/portdrv: Fix potential resource leak

Inochi Amaoto <[email protected]>
PCI: sophgo: Disable L0s and L1 on Sophgo 2044 PCIe Root Ports

Håkon Bugge <[email protected]>
PCI: Do not attempt to set ExtTag for VFs

Shuai Xue <[email protected]>
Documentation: tracing: Add PCI tracepoint documentation

Hou Tao <[email protected]>
PCI/P2PDMA: Fix p2pmem_alloc_mmap() warning condition

Hou Tao <[email protected]>
PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails

Huang Chenming <[email protected]>
wifi: cfg80211: Fix use_for flag update on BSS refresh

Brian Norris <[email protected]>

    PCI/PM: Avoid redundant delays on D3hot->D3cold

Claudiu Beznea <[email protected]>
PCI: rzg3s-host: Use pci_generic_config_write() for the root bus

Haotian Zhang <[email protected]>
PCI: endpoint: Add missing NULL check for alloc_workqueue()

Marco Crivellari <[email protected]>
PCI: Add WQ_PERCPU to alloc_workqueue() users

Baruch Siach <[email protected]>
Documentation: PCI: endpoint: Fix ntb/vntb copy & paste errors

Haotian Zhang <[email protected]>
PCI: xilinx: Fix INTx IRQ domain leak in error paths

Ping-Ke Shih <[email protected]>

    wifi: rtw89: correct use sequence of driver_data in skb->info

Haotian Zhang <[email protected]>
PCI: mediatek: Fix IRQ domain leak when MSI allocation fails

Carl Lee <[email protected]>
hwmon: (pmbus/mpq8785) fix VOUT_MODE mismatch during identification

Guenter Roeck <[email protected]>
Revert "hwmon: (ibmpex) fix use-after-free in high/low store"

Francesco Lavra <[email protected]>
spi: tools: Add include folder to .gitignore

Dan Carpenter <[email protected]>
ALSA: oss: delete self assignment

Arnd Bergmann <[email protected]>
vsnprintf: drop __printf() attributes on binary printing functions

Harshit Mogalapalli <[email protected]>

    ASoC: cs4271: Fix resource leak in cs4271_soc_resume()

Lizhi Hou <[email protected]>
accel/amdxdna: Move RPM resume into job run function

Lizhi Hou <[email protected]>
accel/amdxdna: Fix incorrect DPM level after suspend/resume

Charles Keepax <[email protected]>
ASoC: SDCA: Still process most of the jack detect if control is missing

Charles Keepax <[email protected]>
ASoC: SDCA: Add ability to connect SDCA jacks to ASoC jacks

Charles Keepax <[email protected]>
ASoC: SDCA: Factor out jack handling into new c file

Charles Keepax <[email protected]>
ASoC: SDCA: Handle volatile controls correctly

Charles Keepax <[email protected]>
ASoC: SDCA: Remove outdated todo comment

Lizhi Hou <[email protected]>
accel/amdxdna: Fix incorrect error code returned for failed chain command

Lizhi Hou <[email protected]>
accel/amdxdna: Remove hardware context status

Lizhi Hou <[email protected]>
accel/amdxdna: Enable temporal sharing only mode

Even Xu <[email protected]>
HID: Intel-thc-hid: Intel-thc: Fix wrong register fields updating

Ryan Lin <[email protected]>
HID: intel-ish-hid: fix NULL-ptr-deref in ishtp_bus_remove_all_clients

Vinod Govindapillai <[email protected]>
drm/i915/display: fix the pixel normalization handling for xe3p_lpd

Zishun Yi <[email protected]>
accel/amdxdna: Fix memory leak in amdxdna_ubuf_map

Lizhi Hou <[email protected]>
accel/amdxdna: Stop job scheduling across aie2_release_resource()

Lizhi Hou <[email protected]>
accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()

Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_lightbar: Fix response size initialization

Sheetal <[email protected]>
ASoC: tegra: Add AHUB writeable_reg for RX holes

Harry Yoo <[email protected]>
mm/slab: fix false lockdep warning in __kfree_rcu_sheaf()

Shuicheng Lin <[email protected]>
drm/xe: Unregister drm device on probe error

Vinay Belgaumkar <[email protected]>
drm/xe/ptl: Disable DCC on PTL

Roberto Sassu <[email protected]>
evm: Use ordered xattrs list to calculate HMAC in evm_init_hmac()

Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix allocation for small frame sizes

Timur Kristóf <[email protected]>
drm/amd/pm: Return -EOPNOTSUPP when can't read power limit

Gokul Praveen <[email protected]>
pwm: tiehrpwm: Enable pwmchip's parent device before setting configuration

Andy Shevchenko <[email protected]>
platform/chrome: cros_typec_switch: Don't touch struct fwnode_handle::dev

Nathan Chancellor <[email protected]>
drm/msm/dp: Avoid division by zero in msm_dp_ctrl_config_msa()

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: fix SSPP_UBWC_STATIC_CTRL programming on UBWC 5.x+

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: program correct register for UBWC config on DPU 8.x+

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: offset HBB values written to DPU by -13

Dmitry Baryshkov <[email protected]>
drm/msm/mdss: correct HBB programmed on UBWC 5.x and 6.x devices

Lijo Lazar <[email protected]>
drm/amd/pm: Fix unneeded semicolon warning

Kari Argillander <[email protected]>
rust: pwm: Fix potential memory leak on init error

Cristian Ciocaltea <[email protected]>
drm/rockchip: dw_hdmi_qp: Fix RK3576 HPD interrupt handling

Baihan Li <[email protected]>
drm/hisilicon/hibmc: Adding reset colorbar cfg in dp init.

Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix no showing problem with loading hibmc manually

Baihan Li <[email protected]>
drm/hisilicon/hibmc: add dp mode valid check

Baihan Li <[email protected]>
drm/hisilicon/hibmc: fix dp probabilistical detect errors after HPD irq

Michał Grzelak <[email protected]>
drm/buddy: release free_trees array on buddy mm teardown

Dmitry Baryshkov <[email protected]>
drm/msm/a2xx: fix pixel shader start on A225

David Heidelberg <[email protected]>
media: ccs: Accommodate C-PHY into the calculation

Rob Clark <[email protected]>
drm/msm: Fix GMEM_BASE for gen8

Rob Clark <[email protected]>

    drm/msm: Fix x2-85 TPL1_DBG_ECO_CNTL1

Lizhi Hou <[email protected]>
accel/amdxdna: Fix notifier_wq flushing warning

Brian Masney <[email protected]>
drm/msm/dsi_phy_14nm: convert from divider_round_rate() to divider_determine_rate()

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: fix CMD panels on DPU 1.x - 3.x

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: drop intr_start from DPU 3.x catalog files

Dmitry Baryshkov <[email protected]>
drm/msm/disp: set num_planes to 1 for interleaved YUV formats

Timur Tabi <[email protected]>
gpu: nova-core: check for overflow to DMATRFBASE1

Christian König <[email protected]>
drm/amdgpu: Drop MMIO_REMAP domain bit and keep it Internal

Srinivasan Shanmugam <[email protected]>
drm/amdgpu/ttm: Pin 4K MMIO_REMAP Singleton BO at Init v2

Haotian Zhang <[email protected]>
HID: playstation: Add missing check for input_ff_create_memless

André Draszik <[email protected]>
regulator: core: don't ignore errors from event forwarding setup

André Draszik <[email protected]>
regulator: core: move supply check earlier in set_machine_constraints()

André Draszik <[email protected]>
regulator: core: fix locking in regulator_resolve_supply() error path

Andy Shevchenko <[email protected]>
spi: microchip-core: use XOR instead of ANDNOT to fix the logic

Jani Nikula <[email protected]>
mei: late_bind: fix struct intel_lb_component_ops kernel-doc

Randy Dunlap <[email protected]>
ALSA: hda - fix function names & missing function parameter

Mani Chandana Ballary Kuntumalla <[email protected]>
drm/msm/dp: Update msm_dp_controller IDs for sa8775p

Dmitry Baryshkov <[email protected]>
drm/msm/dpu: fix WD timer handling on DPU 8.x

Teguh Sobirin <[email protected]>
drm/msm/dpu: Set vsync source irrespective of mdp top support

Mahadevan P <[email protected]>
drm/msm/disp/dpu: add merge3d support for sc7280

Timur Kristóf <[email protected]>
drm/amd/display: Don't repeat DAC load detection

Alex Hung <[email protected]>
drm/amd/display: Update dc_connection_dac_load to dc_connection_analog_load

Timur Kristóf <[email protected]>
drm/amd/display: Pass proper DAC encoder ID to VBIOS

Ivan Lipski <[email protected]>
drm/amd/display: Use local variable for analog_engine initialization

Ivan Lipski <[email protected]>
drm/amd/display: Remove unused encoder types

Srinivasan Shanmugam <[email protected]>
drm/amdgpu: Use explicit VCN instance 0 in SR-IOV init

Srinivasan Shanmugam <[email protected]>
drm/amdkfd: Fix signal_eviction_fence() bool return value

Mario Limonciello (AMD) <[email protected]>
drm/amd: Drop "amdgpu kernel modesetting enabled" message

Bagas Sanjaya <[email protected]>
drm/amdgpu: Describe @AMD_IP_BLOCK_TYPE_RAS in amd_ip_block_type enum

Bagas Sanjaya <[email protected]>
drm/amd/display: Don't use kernel-doc comment in dc_register_software_state struct

Zilin Guan <[email protected]>
media: chips-media: wave5: Fix memory leak on codec_info allocation failure

Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Cancel pending work before suspend

Cristian Ciocaltea <[email protected]>
ASoC: nau8821: Cancel delayed work on component remove

Cristian Ciocaltea <[email protected]>

    ASoC: nau8821: Fixup nau8821_enable_jack_detect()

Konstantin Andreev <[email protected]>
smack: /smack/doi: accept previously used values

Konstantin Andreev <[email protected]>
smack: /smack/doi must be > 0

Chris J Arges <[email protected]>
ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()

Jani Nikula <[email protected]>
drm/atomic: convert drm_atomic_get_{old, new}_colorop_state() into proper functions

Suraj Kandpal <[email protected]>
drm/display/dp_mst: Add protection against 0 vcpi

Ketil Johnsen <[email protected]>
drm/panthor: Evict groups before VM termination

Jani Nikula <[email protected]>
drm/i915/colorop: do not include headers from headers

Karunika Choo <[email protected]>
drm/panthor: Fix NULL pointer dereference on panthor_fw_unplug

Simon Trimmer <[email protected]>
ASoC: SDCA: Allow sample width wild cards in set_usage()

Takashi Iwai <[email protected]>
ALSA: usb-audio: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: usx2y: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: hda: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: vmaster: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: timer: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: seq: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: seq: oss: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: oss: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: pcm: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: control: Relax __free() variable declarations

Takashi Iwai <[email protected]>
ALSA: compress_offload: Relax __free() variable declarations

David Heidelberg <[email protected]>
drm/panel: sw43408: Remove manual invocation of unprepare at remove

Lizhi Hou <[email protected]>
accel/amdxdna: Fix potential NULL pointer dereference in context cleanup

Akif Ejaz <[email protected]>
spi: cadence-qspi: Remove redundant pm_runtime_mark_last_busy call

Richard Fitzgerald <[email protected]>
firmware: cs_dsp: Don't use __free() in cs_dsp_load() and cs_dsp_load_coeff()

Richard Fitzgerald <[email protected]>
firmware: cs_dsp: Remove __free() from cs_dsp_debugfs_string_read()

Lizhi Hou <[email protected]>
accel/amdxdna: Fix race where send ring appears full due to delayed head update

Dan Carpenter <[email protected]>
drm/plane: Fix IS_ERR() vs NULL bug drm_plane_create_color_pipeline_property()

Lizhi Hou <[email protected]>
accel/amdxdna: Fix cu_idx being cleared by memset() during command setup

Lizhi Hou <[email protected]>
accel/amdxdna: Fix race condition when checking rpm_on

Boris Brezillon <[email protected]>
drm/panthor: Fix panthor_gpu_coherency_set()

Alex Deucher <[email protected]>
drm/amdgpu: don't attach the tlb fence for SI

Lai Jiangshan <[email protected]>
workqueue: Process rescuer work items one-by-one using a cursor

Chia-I Wu <[email protected]>
drm/panthor: fix queue_reset_timeout_locked

Akash Goel <[email protected]>
drm/panthor: Remove redundant call to disable the MCU

Boris Brezillon <[email protected]>
drm/panthor: Make sure we resume the tick when new jobs are submitted

Boris Brezillon <[email protected]>
drm/panthor: Fix the logic that decides when to stop ticking

Boris Brezillon <[email protected]>
drm/panthor: Fix immediate ticking on a disabled tick

Boris Brezillon <[email protected]>
drm/panthor: Fix the group priority rotation logic

Boris Brezillon <[email protected]>
drm/panthor: Fix the full_tick check

Boris Brezillon <[email protected]>
drm/panthor: Recover from panthor_gpu_flush_caches() failures

Michal Wajdeczko <[email protected]>
drm/xe/pf: Fix .bulk_profile/sched_priority description

Junhui Liu <[email protected]>
reset: canaan: k230: drop OF dependency and enable by default

Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm6115: Add CX_MEM/DBGC GPU regions

Konrad Dybcio <[email protected]>
arm64: dts: qcom: agatti: Add CX_MEM/DBGC GPU regions

Eric Neulight <[email protected]>
arm64: dts: amlogic: meson-sm1-odroid: Eliminate Odroid HC4 power glitches during boot.

Viken Dadhaniya <[email protected]>
arm64: dts: qcom: talos: Drop opp-shared from QUP OPP table

Marek Vasut <[email protected]>
arm64: dts: imx95: Use GPU_CGC as core clock for GPU

Jonathan Marek <[email protected]>

    arm64: dts: qcom: x1e: bus is 40-bits (fix 64GB models)

Michael Walle <[email protected]>
arm64: dts: ti: k3-am67a-kontron-sa67-base: Fix SD card regulator

Michael Walle <[email protected]>

    arm64: dts: ti: k3-am67a-kontron-sa67-base: Fix CMA node

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm845-db845c: specify power for WiFi CH1

Dmitry Baryshkov <[email protected]>

    arm64: dts: qcom: sdm845-db845c: drop CS from SPIO0

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qrb4210-rb2: Fix UART3 wakeup IRQ storm

Jerome Brunet <[email protected]>
arm64: dts: amlogic: g12: assign the MMC A signal clock

Jerome Brunet <[email protected]>
arm64: dts: amlogic: g12: assign the MMC B and C signal clocks

Jerome Brunet <[email protected]>
arm64: dts: amlogic: gx: assign the MMC signal clocks

Jerome Brunet <[email protected]>
arm64: dts: amlogic: axg: assign the MMC signal clocks

Jerome Brunet <[email protected]>
arm64: dts: amlogic: c3: assign the MMC signal clocks

Haotian Zhang <[email protected]>
hwspinlock: omap: Handle devm_pm_runtime_enable() errors

Dmitry Baryshkov <[email protected]>
soc: qcom: ubwc: add missing include

Abhash Kumar Jha <[email protected]>

    arm64: dts: ti: k3-j784s4-j742s2-main-common.dtsi: Refactor watchdog instances for j784s4

Abhash Kumar Jha <[email protected]>
arm64: dts: ti: k3-j784s4-main.dtsi: Move c71_3 node to appropriate order

Jerome Brunet <[email protected]>
arm64: dts: amlogic: s4: fix mmc clock assignment

Jerome Brunet <[email protected]>
arm64: dts: amlogic: s4: assign mmc b clock to 24MHz

AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt8183-jacuzzi-pico6: Fix typo in pinmux node

Vladimir Zapolskiy <[email protected]>
arm: dts: lpc32xx: add clocks property to Motor Control PWM device tree node

Lad Prabhakar <[email protected]>
arm64: dts: renesas: rzt2h-n2h-evk-common: Use GPIO for SD0 write protect

Narayana Murty N <[email protected]>
powerpc/eeh: fix recursive pci_lock_rescan_remove locking in EEH event handling

Zilin Guan <[email protected]>
soc: mediatek: svs: Fix memory leak in svs_enable_debug_write()

Haotian Zhang <[email protected]>
soc: qcom: cmd-db: Use devm_memremap() to fix memory leak in cmd_db_dev_probe

Christophe Leroy <[email protected]>
powerpc/uaccess: Move barrier_nospec() out of allow_read_{from/write}_user()

Chen-Yu Tsai <[email protected]>
ARM: dts: allwinner: sun5i-a13-utoo-p66: delete "power-gpios" property

Vladimir Zapolskiy <[email protected]>
arm64: dts: qcom: msm8994-octagon: Fix Analog Devices vendor prefix of AD7147

Geert Uytterhoeven <[email protected]>

    arm64: dts: renesas: r9a09g047e57-smarc: Remove duplicate SW_LCD_EN

Abel Vesa <[email protected]>
arm64: dts: qcom: x1e80100: Fix USB combo PHYs SS1 and SS2 ref clocks

Casey Connolly <[email protected]>
arm64: dts: qcom: sdm845-oneplus: Mark l14a regulator as boot-on

Casey Connolly <[email protected]>
arm64: dts: qcom: sdm845-oneplus: Don't keep panel regulator always on

Casey Connolly <[email protected]>
arm64: dts: qcom: sdm845-oneplus: Don't mark ts supply boot-on

Jingzhou Zhu <[email protected]>
arm64: dts: qcom: sdm850-huawei-matebook-e-2019: Correct ipa_fw_mem for the driver to load successfully

Jingzhou Zhu <[email protected]>
arm64: dts: qcom: sdm850-huawei-matebook-e-2019: Remove duplicate reserved-memroy nodes

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8250-hdk: specify ZAP firmware name

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sm8150-hdk,mtp: specify ZAP firmware name

Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: sdm630: fix gpu_speed_bin size

Haotian Zhang <[email protected]>
clk: qcom: Return correct error code in qcom_cc_probe_by_index()

Arnd Bergmann <[email protected]>
EDAC/amd64: Avoid a -Wformat-security warning

Alexander Stein <[email protected]>
arm64: dts: tqma8mpql-mba8mp-ras314: Fix HDMI CEC pad control settings

Alexander Stein <[email protected]>
arm64: dts: tqma8mpql-mba8mpxl: Fix HDMI CEC pad control settings

Anton D. Stavinskii <[email protected]>

    riscv: dts: sophgo: cv180x: fix USB dwc2 FIFO sizes

Sudeep Holla <[email protected]>
firmware: arm_ffa: Correct 32-bit response handling in NOTIFICATION_INFO_GET

Dan Carpenter <[email protected]>
EDAC/i5400: Fix snprintf() limit calculation in calculate_dimm_size()

Dan Carpenter <[email protected]>
EDAC/i5000: Fix snprintf() size calculation in calculate_dimm_size()

Jorge Ramirez-Ortiz <[email protected]>
soc: qcom: smem: handle ENOMEM error during probe

Francesco Dolcini <[email protected]>
arm64: dts: ti: k3-am69-aquila-clover: Fix USB-C Sink PDO

Francesco Dolcini <[email protected]>
arm64: dts: ti: k3-am69-aquila-dev: Fix USB-C Sink PDO

Sai Ritvik Tanksalkar <[email protected]>
pstore/ram: fix buffer overflow in persistent_ram_save_old()

Larysa Zaremba <[email protected]>
selftests/xsk: fix number of Tx frags in invalid packet

Larysa Zaremba <[email protected]>
selftests/xsk: properly handle batch ending in the middle of a packet

Lianjie Wang <[email protected]>
hwrng: core - use RCU and work_struct to fix race condition

Zilin Guan <[email protected]>
crypto: starfive - Fix memory leak in starfive_aes_aead_do_one_req()

KP Singh <[email protected]>
bpf: Require frozen map for calculating map hash

KP Singh <[email protected]>
bpf: Limit bpf program signature size

Thomas Gleixner <[email protected]>
irqchip/sifive-plic: Handle number of hardware interrupts correctly

Titouan Ameline de Cadeville <[email protected]>
fs/tests: exec: drop duplicate bprm_stack_limits test vectors

Zicheng Qu <[email protected]>
sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups

Chen Jinghuang <[email protected]>
sched/rt: Skip currently executing CPU in rto_next_cpu()

Joel Fernandes <[email protected]>
sched/deadline: Clear the defer params

Sebastian Andrzej Siewior <[email protected]>
media: pci: mg4b: Use IRQF_NO_THREAD

Sebastian Andrzej Siewior <[email protected]>
mfd: wm8350-core: Use IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
rtc: amlogic-a4: Remove IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
usb: typec: fusb302: Remove IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
EDAC/altera: Remove IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
scsi: efct: Use IRQF_ONESHOT and default primary handler

Sebastian Andrzej Siewior <[email protected]>
Bluetooth: btintel_pcie: Use IRQF_ONESHOT and default primary handler

Sebastian Andrzej Siewior <[email protected]>
iommu/amd: Use core's primary handler and set IRQF_ONESHOT

Sebastian Andrzej Siewior <[email protected]>
platform/x86: int0002: Remove IRQF_ONESHOT from request_irq()

Sebastian Andrzej Siewior <[email protected]>
genirq: Set IRQF_COND_ONESHOT in devm_request_irq().

Paul Chaignon <[email protected]>
bpf: Fix bpf_xdp_store_bytes proto for read-only arg

Jianpeng Chang <[email protected]>
crypto: caam - fix netdev memory leak in dpaa2_caam_probe

Weili Qian <[email protected]>
crypto: hisilicon/trng - support tfms sharing the device

Jiri Olsa <[email protected]>
selftests/bpf: Fix kprobe multi stacktrace_ips test

Jiri Olsa <[email protected]>
x86/fgraph,bpf: Switch kprobe_multi program stack unwind to hw_regs path

Jiri Olsa <[email protected]>
x86/fgraph: Fix return_to_handler regs.rsp value

Aleksander Jan Bajkowski <[email protected]>
crypto: inside-secure/eip93 - unregister only available algorithm

Ella Ma <[email protected]>
crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

Luis Gerhorst <[email protected]>
bpf: Fix verifier_bug_if to account for BPF_CALL

Jiri Olsa <[email protected]>
ftrace,bpf: Remove FTRACE_OPS_FL_JMP ftrace_ops flag

Ingo Molnar <[email protected]>
x86/hyperv: Fix smp_ops build failure on UP kernels

Randy Dunlap <[email protected]>
seqlock: fix scoped_seqlock_read kernel-doc

Guillaume Gonnet <[email protected]>
bpf: Fix tcx/netkit detach permissions when prog fd isn't given

Jiayuan Chen <[email protected]>
bpf, sockmap: Fix FIONREAD for sockmap

Jiayuan Chen <[email protected]>
bpf, sockmap: Fix incorrect copied_seq calculation

Kumar Kartikeya Dwivedi <[email protected]>
rqspinlock: Fix TAS fallback lock entry creation

Aleksander Jan Bajkowski <[email protected]>
hwrng: airoha - set rng quality to 900

Tycho Andersen (AMD) <[email protected]>
crypto: ccp - narrow scope of snp_range_list

Tom Lendacky <[email protected]>
crypto: ccp - Fix a case where SNP_SHUTDOWN is missed

Aleksander Jan Bajkowski <[email protected]>
crypto: inside-secure/eip93 - fix kernel panic in driver detach

Thomas Gleixner <[email protected]>
hrtimer: Fix trace oddity

Kery Qi <[email protected]>
selftests/bpf: Fix resource leak in serial_test_wq on attach failure

Zesen Liu <[email protected]>
bpf: Fix memory access flags in helper prototypes

Stephen Eta Zhou <[email protected]>
clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.

Puranjay Mohan <[email protected]>
bpf: Preserve id of register in sync_linked_regs()

Chenghai Huang <[email protected]>
crypto: hisilicon/sgl - fix inconsistent map/unmap direction issue

Qi Tao <[email protected]>
crypto: hisilicon/sec2 - support skcipher/aead fallback for hardware queue unavailable

Weili Qian <[email protected]>
crypto: hisilicon/hpre - support the hpre algorithm fallback

Chenghai Huang <[email protected]>
crypto: hisilicon - consolidate qp creation and start in hisi_qm_alloc_qps_node

Chenghai Huang <[email protected]>
crypto: hisilicon/zip - support fallback for zip

Chenghai Huang <[email protected]>
crypto: hisilicon/qm - centralize the sending locks of each module into qm

Chenghai Huang <[email protected]>
crypto: hisilicon/qm - enhance the configuration of req_type in queue attributes

lizhi <[email protected]>
crypto: hisilicon/hpre: extend tag field to 64 bits for better performance

Chenghai Huang <[email protected]>
crypto: hisilicon/sec - move backlog management to qp and store sqe in qp for callback

Chenghai Huang <[email protected]>
crypto: hisilicon/zip - adjust the way to obtain the req in the callback function

Thomas Fourier <[email protected]>
crypto: octeontx - fix dma_free_coherent() size

Thomas Fourier <[email protected]>
crypto: cavium - fix dma_free_coherent() size

Gabriele Monaco <[email protected]>
sched: Fix build for modules using set_tsk_need_resched()

Anton Protopopov <[email protected]>
bpf: Return proper address for non-zero offsets in insn array

Thomas Gleixner <[email protected]>
time/sched_clock: Use ACCESS_PRIVATE() to evaluate hrtimer::function

Thomas Weißschuh <[email protected]>
ARM: VDSO: Patch out __vdso_clock_getres() if unavailable

Gabriele Monaco <[email protected]>
sched: Export hidden tracepoints to modules

Varun R Mallya <[email protected]>
libbpf: Fix OOB read in btf_dump_get_bitfield_value

Puranjay Mohan <[email protected]>
selftests/bpf: veristat: fix printing order in output_stats()

Eduard Zingerman <[email protected]>
bpf: bpf_scc_visit instance and backedges accumulation for bpf_loop()

Giovanni Cabiddu <[email protected]>
crypto: qat - fix warning on adf_pfvf_pf_proto.c

Giovanni Cabiddu <[email protected]>
crypto: qat - fix parameter order used in ICP_QAT_FW_COMN_FLAGS_BUILD

Sandipan Das <[email protected]>
perf/x86/core: Do not set bit width for unavailable counters

Andrew Cooper <[email protected]>
x86/cpu/amd: Correct the microcode table for Zenbleed

Jens Axboe <[email protected]>
io_uring/kbuf: fix memory leak if io_buffer_add_list fails

Salah Triki <[email protected]>
s390/cio: Fix device lifecycle handling in css_alloc_subchannel()

Gui-Dong Han <[email protected]>
PM: sleep: wakeirq: harden dev_pm_clear_wake_irq() against races

Yaxiong Tian <[email protected]>
cpufreq: intel_pstate: Enable asym capacity only when CPU SMT is not possible

Leo Yan <[email protected]>
perf: arm_spe: Properly set hw.state on failures

Johannes Thumshirn <[email protected]>
block: don't use strcpy to copy blockdev name

Breno Leitao <[email protected]>
arm64/gcs: Fix error handling in arch_set_shadow_stack_status()

Samuel Wu <[email protected]>
PM: wakeup: Handle empty list in wakeup_sources_walk_start()

Xiao Ni <[email protected]>
md: fix return value of mddev_trylock

Zilin Guan <[email protected]>
md/raid1: fix memory leak in raid1_run()

Roger Pau Monne <[email protected]>
Partial revert "x86/xen: fix balloon target initialization for PVH dom0"

Caleb Sander Mateos <[email protected]>
ublk: use READ_ONCE() to read struct ublksrv_ctrl_cmd

Govindarajulu Varadarajan <[email protected]>
ublk: Validate SQE128 flag before accessing the cmd

Caleb Sander Mateos <[email protected]>
ublk: restore auto buf unregister refcount optimization

Felix Gu <[email protected]>
thermal/of: Fix reference leak in thermal_of_cm_lookup()

Christoph Hellwig <[email protected]>
iomap: fix submission side handling of completion side errors

Felix Gu <[email protected]>
cpufreq: scmi: Fix device_node reference leak in scmi_cpu_domain_id()

Aleks Todorov <[email protected]>
OPP: Return correct value in dev_pm_opp_get_level

Yu Kuai <[email protected]>
md/md-llbitmap: fix percpu_ref not resurrected on suspend timeout

Yu Kuai <[email protected]>
md/raid5: fix IO hang with degraded array with llbitmap

Li Nan <[email protected]>
md/raid10: fix any_working flag handling in raid10_sync_request

Yu Kuai <[email protected]>
md/raid5: fix raid5_run() to return error when log_init() fails

Rafael J. Wysocki <[email protected]>
thermal: intel: x86_pkg_temp_thermal: Handle invalid temperature

Rafael J. Wysocki <[email protected]>
cpuidle: governors: menu: Always check timers with tick stopped

Jens Axboe <[email protected]>
io_uring/sync: validate passed in offset

Jens Axboe <[email protected]>

    io_uring/eventfd: remove unused ctx->evfd_last_cq_tail member

Alexey Simakov <[email protected]>
ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch()

Caleb Sander Mateos <[email protected]>
io_uring: use release-acquire ordering for IORING_SETUP_R_DISABLED

Teddy Astie <[email protected]>
xen/virtio: Don't use grant-dma-ops when running as Dom0

Rafael J. Wysocki <[email protected]>
ACPI: processor: Update cpuidle driver check in __acpi_processor_start()

Randy Dunlap <[email protected]>
docs: find-unused-docs.sh: fixup directory usage

Florian-Ewald Mueller <[email protected]>
rnbd-srv: Fix server side setting of bi_size for special IOs

Thomas Weißschuh <[email protected]>
tools/nolibc: always use 64-bit mode for s390 header checks

Shyam Prasad N <[email protected]>
netfs: avoid double increment of retry_count in subreq

Paulo Alcantara <[email protected]>
smb: client: fix potential UAF and double free in smb2_open_file()

Gao Xiang <[email protected]>
erofs: fix inline data read failure for ztailpacking pclusters

Deepanshu Kartikey <[email protected]>
gfs2: fix memory leaks in gfs2_fill_super error path

Boris Burkov <[email protected]>
btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation

Boris Burkov <[email protected]>
btrfs: fix block_group_tree dirty_list corruption

Filipe Manana <[email protected]>
btrfs: qgroup: return correct error when deleting qgroup relation item

Johannes Thumshirn <[email protected]>
btrfs: zoned: don't zone append to conventional zone

Gao Xiang <[email protected]>
erofs: handle end of filesystem properly for file-backed mounts

Alper Ak <[email protected]>
tpm: st33zp24: Fix missing cleanup on get_burstcount() error

Alper Ak <[email protected]>
tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure

Zilin Guan <[email protected]>
i3c: dw: Fix memory leak in dw_i3c_master_i2c_xfers()

Fredrik Markstrom <[email protected]>
i3c: dw: Initialize spinlock to avoid upsetting lockdep

Deepanshu Kartikey <[email protected]>
gfs2: Fix use-after-free in iomap inline data write path

Joanne Koong <[email protected]>
iomap: fix invalid folio access after folio_end_read()

Andreas Gruenbacher <[email protected]>
gfs2: Fix slab-use-after-free in qd_put

Andreas Gruenbacher <[email protected]>

    gfs2: Initialize bio->bi_opf early

Andreas Gruenbacher <[email protected]>

    gfs2: Rename gfs2_log_submit_{bio -> write}

Andreas Gruenbacher <[email protected]>

    gfs2: Retries missing in gfs2_{rename,exchange}

Gao Xiang <[email protected]>
erofs: avoid noisy messages for transient -ENOMEM

Ferry Meng <[email protected]>
erofs: Use %pe format specifier for error pointers

Adrian Hunter <[email protected]>
i3c: master: Update hot-join flag only on success

Ben Dooks <[email protected]>
fs: add <linux/init_task.h> for 'init_fs'

Amir Goldstein <[email protected]>
fs: move initializing f_mode before file_ref_init()

Breno Leitao <[email protected]>
device_cgroup: remove branch hint after code refactor

Billy Tsai <[email protected]>
i3c: Move device name assignment after i3c_bus_init

Xiaochen Shen <[email protected]>
selftests/resctrl: Fix a division by zero error on Hygon

Ben Dooks <[email protected]>

    audit: move the compat_xxx_class[] extern declarations to audit_arch.h

Yao Kai <[email protected]>
rcu: Fix rcu_read_unlock() deadloop due to softirq

Paul E. McKenney <[email protected]>

    rcutorture: Correctly compute probability to invoke ->exp_current()

Shardul Bankar <[email protected]>
hfsplus: return error when node already exists in hfs_bnode_create

Thomas Fourier <[email protected]>
auxdisplay: arm-charlcd: fix release_mem_region() size

YunJe Shin <[email protected]>
RDMA/umad: Reject negative data_len in ib_umad_write

YunJe Shin <[email protected]>
RDMA/siw: Fix potential NULL pointer dereference in header processing

-------------

Diffstat:

 .../ABI/testing/sysfs-driver-intel-xe-sriov        |   2 +-
 Documentation/PCI/endpoint/pci-vntb-howto.rst      |  14 +-
 .../bindings/media/qcom,qcs8300-camss.yaml         |  13 +
 .../devicetree/bindings/phy/qcom,edp-phy.yaml      |  28 +-
 .../bindings/sound/asahi-kasei,ak4458.yaml         |   6 +-
 .../bindings/sound/asahi-kasei,ak5558.yaml         |   4 +-
 Documentation/networking/ip-sysctl.rst             |   7 +-
 Documentation/trace/events-pci.rst                 |  74 ++
 Documentation/trace/index.rst                      |   1 +
 Makefile                                           |  15 +-
 arch/arm/boot/dts/allwinner/sun5i-a13-utoo-p66.dts |   1 +
 arch/arm/boot/dts/nxp/lpc/lpc32xx.dtsi             |   1 +
 arch/arm/kernel/vdso.c                             |   1 +
 arch/arm64/boot/dts/amlogic/amlogic-c3.dtsi        |   7 +
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi         |   6 +
 arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi  |   9 +
 arch/arm64/boot/dts/amlogic/meson-gxbb.dtsi        |   9 +
 arch/arm64/boot/dts/amlogic/meson-gxl.dtsi         |   9 +
 arch/arm64/boot/dts/amlogic/meson-s4.dtsi          |  13 +-
 .../boot/dts/amlogic/meson-sm1-odroid-hc4.dts      |   2 +
 arch/arm64/boot/dts/amlogic/meson-sm1-odroid.dtsi  |   3 +
 .../freescale/imx8mp-tqma8mpql-mba8mp-ras314.dts   |   2 +-
 .../dts/freescale/imx8mp-tqma8mpql-mba8mpxl.dts    |   2 +-
 arch/arm64/boot/dts/freescale/imx95-clock.h        |   1 +
 arch/arm64/boot/dts/freescale/imx95.dtsi           |   2 +-
 .../dts/mediatek/mt8183-kukui-jacuzzi-pico6.dts    |   2 +-
 arch/arm64/boot/dts/qcom/agatti.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/hamoa.dtsi                |   8 +-
 .../boot/dts/qcom/msm8994-msft-lumia-octagon.dtsi  |   2 +-
 arch/arm64/boot/dts/qcom/qrb4210-rb2.dts           |   2 +-
 arch/arm64/boot/dts/qcom/sdm630.dtsi               |   4 +-
 arch/arm64/boot/dts/qcom/sdm845-db845c.dts         |   8 +-
 .../arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi |   3 +-
 .../dts/qcom/sdm850-huawei-matebook-e-2019.dts     |  17 +-
 arch/arm64/boot/dts/qcom/sm6115.dtsi               |   8 +-
 arch/arm64/boot/dts/qcom/sm8150-hdk.dts            |   4 +
 arch/arm64/boot/dts/qcom/sm8150-mtp.dts            |   4 +
 arch/arm64/boot/dts/qcom/sm8250-hdk.dts            |   4 +
 arch/arm64/boot/dts/qcom/talos.dtsi                |   1 -
 arch/arm64/boot/dts/renesas/r9a09g047e57-smarc.dts |   1 -
 .../boot/dts/renesas/rzt2h-n2h-evk-common.dtsi     |   4 +-
 .../boot/dts/ti/k3-am67a-kontron-sa67-base.dts     |   4 +-
 arch/arm64/boot/dts/ti/k3-am69-aquila-clover.dts   |   4 +-
 arch/arm64/boot/dts/ti/k3-am69-aquila-dev.dts      |   4 +-
 .../boot/dts/ti/k3-j784s4-j742s2-main-common.dtsi  |  36 -
 arch/arm64/boot/dts/ti/k3-j784s4-main.dtsi         |  58 +-
 arch/arm64/mm/gcs.c                                |   4 +-
 arch/arm64/net/bpf_jit_comp.c                      |   2 +-
 arch/loongarch/net/bpf_jit.c                       |   2 +-
 arch/mips/Kconfig                                  |   1 -
 arch/mips/kernel/relocate.c                        |  13 +
 arch/powerpc/include/asm/eeh.h                     |   2 +
 arch/powerpc/include/asm/kup.h                     |   2 -
 arch/powerpc/include/asm/uaccess.h                 |   4 +
 arch/powerpc/kernel/eeh_driver.c                   |  11 +-
 arch/powerpc/kernel/eeh_pe.c                       |  74 +-
 arch/powerpc/net/bpf_jit_comp.c                    |   2 +-
 arch/riscv/boot/dts/sophgo/cv180x.dtsi             |   4 +-
 arch/s390/Kconfig                                  |   3 +-
 arch/x86/events/core.c                             |   4 +-
 arch/x86/hyperv/hv_crash.c                         |   2 +
 arch/x86/hyperv/hv_vtl.c                           |   8 +-
 arch/x86/include/asm/ftrace.h                      |   2 +-
 arch/x86/kernel/cpu/amd.c                          |  30 +-
 arch/x86/kernel/ftrace_64.S                        |   5 +-
 arch/x86/xen/enlighten.c                           |   2 +-
 block/ioctl.c                                      |  34 +-
 drivers/accel/amdxdna/aie2_ctx.c                   |  66 +-
 drivers/accel/amdxdna/aie2_message.c               |  63 +-
 drivers/accel/amdxdna/aie2_msg_priv.h              |   3 +-
 drivers/accel/amdxdna/aie2_pci.c                   |   2 +-
 drivers/accel/amdxdna/aie2_pci.h                   |   2 +
 drivers/accel/amdxdna/aie2_pm.c                    |  20 +-
 drivers/accel/amdxdna/aie2_smu.c                   |  29 +-
 drivers/accel/amdxdna/amdxdna_ctx.h                |   6 +-
 drivers/accel/amdxdna/amdxdna_mailbox.c            |  27 +-
 drivers/accel/amdxdna/amdxdna_pci_drv.c            |   5 +-
 drivers/accel/amdxdna/amdxdna_pci_drv.h            |   2 +-
 drivers/accel/amdxdna/amdxdna_pm.c                 |  22 +-
 drivers/accel/amdxdna/amdxdna_ubuf.c               |  10 +-
 drivers/accel/amdxdna/npu4_regs.c                  |   1 +
 drivers/acpi/acpica/evregion.c                     |   4 +-
 drivers/acpi/cppc_acpi.c                           |   4 +-
 drivers/acpi/power.c                               |  13 +
 drivers/acpi/processor_driver.c                    |   2 +-
 drivers/ata/libata-core.c                          |  76 +-
 drivers/ata/libata-eh.c                            |   6 +
 drivers/ata/libata-scsi.c                          | 174 ++++-
 drivers/ata/libata.h                               |   2 +
 drivers/ata/pata_ftide010.c                        |   6 +-
 drivers/auxdisplay/arm-charlcd.c                   |   2 +-
 drivers/base/power/wakeirq.c                       |  11 +-
 drivers/base/power/wakeup.c                        |   4 +-
 drivers/block/drbd/drbd_main.c                     |   3 -
 drivers/block/drbd/drbd_nl.c                       |  20 +-
 drivers/block/rnbd/rnbd-srv.c                      |  33 +-
 drivers/block/ublk_drv.c                           |  64 +-
 drivers/bluetooth/btintel_pcie.c                   |   9 +-
 drivers/char/hw_random/airoha-trng.c               |   1 +
 drivers/char/hw_random/core.c                      | 168 +++--
 drivers/char/misc_minor_kunit.c                    |   2 +-
 drivers/char/tpm/st33zp24/st33zp24.c               |   6 +-
 drivers/char/tpm/tpm_i2c_infineon.c                |   6 +-
 drivers/clk/actions/owl-composite.c                |  11 +-
 drivers/clk/actions/owl-divider.c                  |  17 +-
 drivers/clk/actions/owl-divider.h                  |   5 -
 drivers/clk/clk-bm1880.c                           |   5 +-
 drivers/clk/clk-loongson1.c                        |   5 +-
 drivers/clk/clk-milbeaut.c                         |   5 +-
 drivers/clk/clk-versaclock3.c                      |   7 +-
 drivers/clk/hisilicon/clkdivider-hi6220.c          |   6 +-
 drivers/clk/mediatek/clk-mt7981-eth.c              |   6 +-
 drivers/clk/mediatek/clk-mt8196-mfg.c              |  13 +-
 drivers/clk/mediatek/clk-mt8516.c                  |   2 +-
 drivers/clk/mediatek/clk-mtk.c                     |  12 +-
 drivers/clk/mediatek/clk-pll.c                     |   3 +
 drivers/clk/mediatek/clk-pll.h                     |   1 +
 drivers/clk/meson/g12a.c                           |  17 +-
 drivers/clk/meson/gxbb.c                           |  17 +-
 drivers/clk/microchip/clk-core.c                   |  10 -
 drivers/clk/nuvoton/clk-ma35d1-divider.c           |   7 +-
 drivers/clk/nxp/clk-lpc32xx.c                      |   6 +-
 drivers/clk/qcom/clk-alpha-pll.c                   |  21 +-
 drivers/clk/qcom/clk-rcg2.c                        |   7 +-
 drivers/clk/qcom/clk-regmap-divider.c              |  16 +-
 drivers/clk/qcom/common.c                          |   2 +-
 drivers/clk/qcom/dispcc-sdm845.c                   |   4 +-
 drivers/clk/qcom/dispcc-sm7150.c                   |   2 +-
 drivers/clk/qcom/gcc-glymur.c                      |   4 +-
 drivers/clk/qcom/gcc-ipq5018.c                     |   1 +
 drivers/clk/qcom/gcc-milos.c                       |   6 +-
 drivers/clk/qcom/gcc-msm8917.c                     |   1 -
 drivers/clk/qcom/gcc-msm8953.c                     |   1 -
 drivers/clk/qcom/gcc-qdu1000.c                     |   4 +-
 drivers/clk/qcom/gcc-sdx75.c                       |   4 +-
 drivers/clk/qcom/gcc-sm4450.c                      |   6 +-
 drivers/clk/qcom/gcc-sm8450.c                      |   4 +-
 drivers/clk/qcom/gcc-sm8550.c                      |   4 +-
 drivers/clk/qcom/gcc-sm8650.c                      |   4 +-
 drivers/clk/qcom/gcc-sm8750.c                      |   4 +-
 drivers/clk/qcom/gcc-x1e80100.c                    |   4 +-
 drivers/clk/rockchip/clk.c                         |   2 +-
 drivers/clk/sophgo/clk-sg2042-clkgen.c             |  15 +-
 drivers/clk/spacemit/Makefile                      |   9 +-
 drivers/clk/spacemit/ccu-k1.c                      |   1 +
 drivers/clk/spacemit/ccu_common.c                  |   6 +
 drivers/clk/spacemit/ccu_ddn.c                     |   1 +
 drivers/clk/spacemit/ccu_mix.c                     |   9 +
 drivers/clk/spacemit/ccu_pll.c                     |   1 +
 drivers/clk/sprd/div.c                             |   6 +-
 drivers/clk/stm32/clk-stm32-core.c                 |  42 +-
 drivers/clk/thead/clk-th1520-ap.c                  |  34 +-
 drivers/clk/x86/clk-cgu.c                          |   6 +-
 drivers/clk/zynqmp/divider.c                       |  10 +-
 drivers/clk/zynqmp/pll.c                           |   5 +-
 drivers/clocksource/timer-sp804.c                  |  14 +-
 drivers/cpufreq/intel_pstate.c                     |   2 +-
 drivers/cpufreq/scmi-cpufreq.c                     |   1 +
 drivers/cpuidle/cpuidle.c                          |  10 +
 drivers/cpuidle/governors/menu.c                   |  22 +-
 drivers/crypto/caam/caamalg_qi2.c                  |  27 +-
 drivers/crypto/caam/caamalg_qi2.h                  |   2 +
 drivers/crypto/cavium/cpt/cptvf_main.c             |   3 +-
 drivers/crypto/ccp/ccp-ops.c                       |   2 +-
 drivers/crypto/ccp/psp-dev.c                       |  11 +
 drivers/crypto/ccp/sev-dev.c                       |  59 +-
 drivers/crypto/ccp/sp-dev.c                        |  12 +
 drivers/crypto/ccp/sp-dev.h                        |   3 +
 drivers/crypto/ccp/sp-pci.c                        |  16 +-
 drivers/crypto/ccp/tee-dev.c                       |  56 +-
 drivers/crypto/ccp/tee-dev.h                       |   1 +
 drivers/crypto/hisilicon/Kconfig                   |   1 +
 drivers/crypto/hisilicon/hpre/hpre.h               |   5 +-
 drivers/crypto/hisilicon/hpre/hpre_crypto.c        | 418 ++++++-----
 drivers/crypto/hisilicon/hpre/hpre_main.c          |   2 +-
 drivers/crypto/hisilicon/qm.c                      | 112 ++-
 drivers/crypto/hisilicon/sec2/sec.h                |   7 -
 drivers/crypto/hisilicon/sec2/sec_crypto.c         | 163 +++--
 drivers/crypto/hisilicon/sec2/sec_main.c           |  21 +-
 drivers/crypto/hisilicon/sgl.c                     |   2 +-
 drivers/crypto/hisilicon/trng/trng.c               | 123 +++-
 drivers/crypto/hisilicon/zip/zip.h                 |   2 +-
 drivers/crypto/hisilicon/zip/zip_crypto.c          | 133 ++--
 drivers/crypto/hisilicon/zip/zip_main.c            |   4 +-
 drivers/crypto/inside-secure/eip93/eip93-main.c    |  94 +--
 .../intel/qat/qat_common/adf_pfvf_pf_proto.c       |  10 +
 .../crypto/intel/qat/qat_common/qat_asym_algs.c    |  12 +-
 drivers/crypto/marvell/octeontx/otx_cptvf_main.c   |   3 +-
 drivers/crypto/starfive/jh7110-aes.c               |   9 +-
 drivers/cxl/core/edac.c                            |  64 +-
 drivers/cxl/core/hdm.c                             |   7 +-
 drivers/cxl/core/memdev.c                          |   1 -
 drivers/cxl/core/port.c                            |   8 +-
 drivers/cxl/cxlmem.h                               |   5 +-
 drivers/dma/dma-axi-dmac.c                         |  11 +-
 drivers/dma/fsl-edma-main.c                        |   1 -
 drivers/dma/mediatek/mtk-uart-apdma.c              |  10 +-
 drivers/dpll/zl3073x/dpll.c                        |  12 +-
 drivers/dpll/zl3073x/ref.h                         |   2 +
 drivers/edac/altera_edac.c                         |  11 +-
 drivers/edac/amd64_edac.c                          |   2 +-
 drivers/edac/i5000_edac.c                          |   1 +
 drivers/edac/i5400_edac.c                          |   2 +-
 drivers/firmware/arm_ffa/driver.c                  |  33 +-
 drivers/firmware/cirrus/cs_dsp.c                   |  31 +-
 drivers/firmware/efi/efi.c                         |   8 +-
 drivers/gpib/common/iblib.c                        |   5 +-
 drivers/gpib/ni_usb/ni_usb_gpib.c                  |  14 +-
 drivers/gpio/gpio-amd-fch.c                        |   7 +-
 drivers/gpio/gpiolib-cdev.c                        |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c           |   4 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c            |   1 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |   3 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c             |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  21 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.h         |   2 -
 drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c            |   2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  81 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c             |  15 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c             |  22 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c             |  15 +-
 drivers/gpu/drm/amd/amdgpu/vcn_v2_0.c              |  45 +-
 drivers/gpu/drm/amd/amdkfd/kfd_debug.c             |  20 +-
 drivers/gpu/drm/amd/amdkfd/kfd_process.c           |   2 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  13 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c    |   3 +
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c  |   9 +-
 .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c    |   5 +
 .../gpu/drm/amd/display/dc/bios/command_table.c    |   3 +-
 drivers/gpu/drm/amd/display/dc/dc.h                |   2 +-
 drivers/gpu/drm/amd/display/dc/dc_types.h          |   2 +-
 .../gpu/drm/amd/display/dc/dce/dce_link_encoder.c  |  60 +-
 .../gpu/drm/amd/display/dc/dce/dce_link_encoder.h  |   5 +
 .../drm/amd/display/dc/dce/dce_stream_encoder.c    |  23 +-
 .../drm/amd/display/dc/dce/dce_stream_encoder.h    |  12 +-
 .../drm/amd/display/dc/hwss/dce110/dce110_hwseq.c  |  55 +-
 drivers/gpu/drm/amd/display/dc/hwss/hw_sequencer.h |   2 +
 .../gpu/drm/amd/display/dc/inc/hw/link_encoder.h   |   4 +
 .../gpu/drm/amd/display/dc/link/link_detection.c   |  13 +-
 drivers/gpu/drm/amd/display/dc/link/link_dpms.c    |  14 +-
 drivers/gpu/drm/amd/display/dc/link/link_factory.c |  61 +-
 .../display/dc/resource/dce100/dce100_resource.c   |  14 +-
 .../display/dc/resource/dce110/dce110_resource.c   |   2 +
 .../amd/display/dc/resource/dce60/dce60_resource.c |  12 +-
 .../amd/display/dc/resource/dce80/dce80_resource.c |   9 +-
 .../display/dc/resource/dcn315/dcn315_resource.c   |   8 +-
 .../display/dc/resource/dcn316/dcn316_resource.c   |   8 +-
 .../amd/display/dc/resource/dcn32/dcn32_resource.c |   8 +-
 .../display/dc/resource/dcn321/dcn321_resource.c   |   8 +-
 .../amd/display/dc/resource/dcn35/dcn35_resource.c |   8 +-
 .../display/dc/resource/dcn351/dcn351_resource.c   |   8 +-
 drivers/gpu/drm/amd/include/amd_shared.h           |   1 +
 drivers/gpu/drm/amd/pm/amdgpu_dpm.c                |   2 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_12_ppt.c  |   2 +-
 drivers/gpu/drm/display/drm_dp_mst_topology.c      |   3 +-
 drivers/gpu/drm/drm_atomic.c                       |  32 +
 drivers/gpu/drm/drm_atomic_helper.c                |   1 +
 drivers/gpu/drm/drm_buddy.c                        |   1 +
 drivers/gpu/drm/drm_plane.c                        |   4 +-
 drivers/gpu/drm/exynos/exynos_drm_drv.h            |   1 +
 drivers/gpu/drm/exynos/exynos_drm_vidi.c           |  36 +-
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h       |   4 +
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h     |   2 +
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c         |  38 +-
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h         |   8 +
 drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h        |   3 +
 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c     |  71 +-
 drivers/gpu/drm/i915/display/intel_acpi.c          |   1 +
 drivers/gpu/drm/i915/display/intel_colorop.c       |   2 +
 drivers/gpu/drm/i915/display/intel_colorop.h       |   4 +-
 .../gpu/drm/i915/display/intel_display_device.h    |   1 +
 drivers/gpu/drm/i915/display/intel_display_types.h |   1 +
 drivers/gpu/drm/i915/display/intel_fbc.c           |  10 +-
 drivers/gpu/drm/i915/display/intel_fbc.h           |   3 +-
 drivers/gpu/drm/i915/display/skl_universal_plane.c |  36 +-
 drivers/gpu/drm/msm/adreno/a2xx_gpu.c              |   5 +-
 drivers/gpu/drm/msm/adreno/a6xx_catalog.c          |   2 +-
 drivers/gpu/drm/msm/adreno/adreno_gpu.c            |   3 +-
 .../drm/msm/disp/dpu1/catalog/dpu_3_0_msm8998.h    |   5 -
 .../gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h |   5 -
 .../gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h |   5 -
 .../gpu/drm/msm/disp/dpu1/catalog/dpu_7_2_sc7280.h |  14 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c        |  18 +-
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c   |   7 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c        |  49 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.h        |   3 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_sspp.c        |  66 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_top.c         |   7 -
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_util.h        |   7 +
 drivers/gpu/drm/msm/disp/mdp_format.c              |   8 +-
 drivers/gpu/drm/msm/dp/dp_ctrl.c                   |  24 +-
 drivers/gpu/drm/msm/dp/dp_display.c                |   4 +-
 drivers/gpu/drm/msm/dsi/phy/dsi_phy_14nm.c         |   7 +-
 drivers/gpu/drm/msm/msm_mdss.c                     |   2 +-
 drivers/gpu/drm/panel/panel-lg-sw43408.c           |   4 -
 drivers/gpu/drm/panthor/panthor_fw.c               |   5 -
 drivers/gpu/drm/panthor/panthor_gpu.c              |  21 +-
 drivers/gpu/drm/panthor/panthor_mmu.c              |   4 +
 drivers/gpu/drm/panthor/panthor_sched.c            | 193 +++--
 drivers/gpu/drm/panthor/panthor_sched.h            |   1 +
 drivers/gpu/drm/rockchip/dw_hdmi_qp-rockchip.c     |   7 +-
 drivers/gpu/drm/vkms/vkms_composer.c               |   1 +
 drivers/gpu/drm/vkms/vkms_drv.c                    |   1 +
 drivers/gpu/drm/xe/xe_bo.c                         |   2 +-
 drivers/gpu/drm/xe/xe_configfs.h                   |  12 +-
 drivers/gpu/drm/xe/xe_device.c                     |   1 +
 drivers/gpu/drm/xe/xe_guc_pc.c                     |  34 +
 drivers/gpu/drm/xe/xe_mmio.c                       |  10 +-
 drivers/gpu/drm/xe/xe_module.h                     |   2 +-
 drivers/gpu/drm/xe/xe_pci.c                        |   6 +
 drivers/gpu/drm/xe/xe_sriov_pf_sysfs.c             |  54 +-
 drivers/gpu/drm/xe/xe_wa.c                         |  18 +-
 drivers/gpu/nova-core/falcon.rs                    |  11 +-
 drivers/hid/hid-playstation.c                      |   4 +-
 drivers/hid/intel-ish-hid/ishtp/bus.c              |   2 +-
 .../hid/intel-thc-hid/intel-thc/intel-thc-dev.c    |   2 +
 drivers/hv/mshv_eventfd.c                          |   5 +-
 drivers/hv/vmbus_drv.c                             |  66 +-
 drivers/hwmon/ibmpex.c                             |   9 +-
 drivers/hwmon/pmbus/mpq8785.c                      |  28 +
 drivers/hwspinlock/omap_hwspinlock.c               |   4 +-
 drivers/hwtracing/coresight/coresight-etm3x-core.c |  12 +-
 drivers/hwtracing/coresight/coresight-tmc-etr.c    |  13 +
 drivers/hwtracing/stm/Kconfig                      |   4 +-
 drivers/i3c/master.c                               |   6 +-
 drivers/i3c/master/dw-i3c-master.c                 |   3 +
 drivers/iio/accel/sca3000.c                        |   6 +-
 drivers/iio/gyro/mpu3050-core.c                    |   6 +-
 drivers/iio/pressure/mprls0025pa.c                 |  36 +-
 drivers/iio/pressure/mprls0025pa.h                 |   2 -
 drivers/iio/pressure/mprls0025pa_spi.c             |  19 +-
 drivers/iio/test/Kconfig                           |   1 -
 drivers/infiniband/core/cache.c                    |   3 +-
 drivers/infiniband/core/iwcm.c                     |  56 +-
 drivers/infiniband/core/iwcm.h                     |   1 -
 drivers/infiniband/core/rw.c                       |  53 +-
 drivers/infiniband/core/user_mad.c                 |   8 +-
 drivers/infiniband/core/uverbs_cmd.c               |   7 +-
 drivers/infiniband/hw/hns/hns_roce_ah.c            |  23 +-
 drivers/infiniband/hw/hns/hns_roce_hw_v2.c         |  54 +-
 drivers/infiniband/hw/hns/hns_roce_restrack.c      |   4 +-
 drivers/infiniband/hw/mlx5/main.c                  | 101 ++-
 drivers/infiniband/hw/mlx5/mlx5_ib.h               |   2 +
 drivers/infiniband/hw/mlx5/std_types.c             |   4 +-
 drivers/infiniband/sw/rxe/rxe_comp.c               |   3 +
 drivers/infiniband/sw/rxe/rxe_mr.c                 | 285 +++++---
 drivers/infiniband/sw/rxe/rxe_req.c                |   3 +
 drivers/infiniband/sw/rxe/rxe_srq.c                |   6 +-
 drivers/infiniband/sw/rxe/rxe_verbs.h              |  10 +-
 drivers/infiniband/sw/siw/siw_qp_rx.c              |   3 +-
 drivers/infiniband/ulp/rtrs/rtrs-srv.c             |  33 +-
 drivers/interconnect/mediatek/icc-emi.c            |   9 +-
 drivers/interconnect/qcom/qcs8300.c                |   2 +-
 drivers/iommu/amd/amd_iommu.h                      |   1 -
 drivers/iommu/amd/init.c                           |  12 +-
 drivers/iommu/amd/iommu.c                          |   5 -
 drivers/iommu/generic_pt/fmt/amdv1.h               |   3 +-
 drivers/iommu/generic_pt/fmt/x86_64.h              |   3 +-
 drivers/iommu/intel/iommu.c                        |  33 +-
 drivers/iommu/intel/iommu.h                        |  21 +-
 drivers/iommu/intel/nested.c                       |   9 +-
 drivers/iommu/intel/pasid.c                        | 202 +-----
 drivers/iommu/intel/pasid.h                        |  28 +-
 drivers/irqchip/irq-sifive-plic.c                  |  82 ++-
 drivers/leds/leds-expresswire.c                    |  24 +-
 drivers/leds/rgb/leds-qcom-lpg.c                   |   8 +-
 drivers/mailbox/pcc.c                              | 102 +--
 drivers/mcb/mcb-core.c                             |   9 +-
 drivers/md/dm-zone.c                               |  11 +-
 drivers/md/dm.c                                    |   2 +
 drivers/md/md-llbitmap.c                           |   4 +-
 drivers/md/md.h                                    |   4 +-
 drivers/md/raid1.c                                 |   1 +
 drivers/md/raid10.c                                |   2 +-
 drivers/md/raid5.c                                 |  10 +-
 drivers/media/i2c/ccs/ccs-core.c                   |  16 +-
 drivers/media/pci/mgb4/mgb4_trigger.c              |   2 +-
 .../platform/chips-media/wave5/wave5-vpu-dec.c     |   4 +-
 .../platform/chips-media/wave5/wave5-vpu-enc.c     |   4 +-
 drivers/media/usb/uvc/uvc_video.c                  |   3 +-
 drivers/mfd/Kconfig                                |  11 +
 drivers/mfd/arizona-core.c                         |   2 +-
 drivers/mfd/sec-irq.c                              |   1 +
 drivers/mfd/simple-mfd-i2c.c                       |   1 +
 drivers/mtd/devices/mtd_intel_dg.c                 |   9 +-
 drivers/mtd/nand/raw/cadence-nand-controller.c     |   2 +-
 drivers/mtd/parsers/ofpart_core.c                  |  16 +-
 drivers/mtd/parsers/tplink_safeloader.c            |   1 +
 drivers/net/bonding/bond_main.c                    |  21 +-
 drivers/net/caif/caif_serial.c                     |   5 +-
 drivers/net/ethernet/amd/Kconfig                   |   2 +-
 drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c |   2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |  11 +-
 .../net/ethernet/marvell/octeon_ep/octep_cn9k_pf.c |  21 +-
 .../net/ethernet/marvell/octeon_ep/octep_cnxk_pf.c |  64 +-
 .../net/ethernet/marvell/octeon_ep/octep_main.h    |   2 +-
 .../marvell/octeon_ep/octep_regs_cn9k_pf.h         |   1 +
 .../marvell/octeon_ep/octep_regs_cnxk_pf.h         |   1 +
 drivers/net/ethernet/marvell/octeon_ep/octep_rx.c  |   8 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_cn9k.c  |   3 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_cnxk.c  |  39 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_main.h  |   2 +-
 .../ethernet/marvell/octeon_ep_vf/octep_vf_rx.c    |   8 +-
 drivers/net/ethernet/marvell/octeontx2/af/rvu.c    |  11 +
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |  41 +-
 .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c   |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |   3 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c   |  14 -
 .../ethernet/mellanox/mlx5/core/en/reporter_rx.c   |  13 +
 .../ethernet/mellanox/mlx5/core/en/reporter_tx.c   |  52 +-
 .../net/ethernet/mellanox/mlx5/core/en/tc/meter.c  |  10 +-
 .../ethernet/mellanox/mlx5/core/en_accel/macsec.c  |  13 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  40 --
 drivers/net/ethernet/mellanox/mlx5/core/wc.c       |  14 +-
 drivers/net/ethernet/meta/fbnic/fbnic_ethtool.c    |   3 +
 drivers/net/ethernet/meta/fbnic/fbnic_fw_log.c     |   3 -
 drivers/net/ethernet/meta/fbnic/fbnic_netdev.c     |  20 +
 drivers/net/ethernet/meta/fbnic/fbnic_pci.c        |  19 +-
 drivers/net/ethernet/meta/fbnic/fbnic_rpc.c        |   5 +-
 drivers/net/ethernet/meta/fbnic/fbnic_txrx.c       |  25 +-
 drivers/net/ethernet/meta/fbnic/fbnic_txrx.h       |   2 +-
 drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c |   2 +-
 drivers/net/ethernet/microchip/sparx5/sparx5_qos.h |   2 +-
 drivers/net/ethernet/mscc/ocelot_net.c             |  89 ++-
 .../net/ethernet/pensando/ionic/ionic_ethtool.c    |   7 +-
 drivers/net/ethernet/renesas/rswitch_l2.c          |  15 +-
 .../net/ethernet/stmicro/stmmac/dwmac-loongson.c   |   4 +-
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  20 +-
 drivers/net/ethernet/sun/sunhme.c                  |   3 +
 drivers/net/macvlan.c                              |   5 +
 drivers/net/mctp/mctp-i2c.c                        |   9 +
 drivers/net/ovpn/io.c                              |  57 +-
 drivers/net/ovpn/socket.c                          |  41 +-
 drivers/net/ovpn/tcp.c                             |  23 +-
 drivers/net/ovpn/udp.c                             |   1 +
 drivers/net/usb/catc.c                             |  37 +-
 drivers/net/wireless/ath/ath10k/sdio.c             |   6 +
 drivers/net/wireless/ath/ath11k/core.c             |  27 +
 drivers/net/wireless/ath/ath11k/core.h             |   4 +
 .../net/wireless/ath/ath12k/debugfs_htt_stats.c    |   8 +-
 drivers/net/wireless/ath/ath12k/mac.c              |   4 +-
 drivers/net/wireless/ath/ath12k/wow.c              |  16 +
 drivers/net/wireless/ath/ath9k/Kconfig             |   2 +-
 drivers/net/wireless/ath/ath9k/common-debug.h      |   8 +-
 drivers/net/wireless/ath/ath9k/debug.h             |  15 +-
 drivers/net/wireless/realtek/rtw89/core.c          |   6 +-
 drivers/net/wireless/realtek/rtw89/core.h          |   2 +
 drivers/net/wireless/realtek/rtw89/debug.c         |   8 +-
 drivers/net/xen-netback/xenbus.c                   |   5 +-
 drivers/nvdimm/nd_virtio.c                         |   3 +-
 drivers/nvdimm/virtio_pmem.c                       |   1 +
 drivers/nvdimm/virtio_pmem.h                       |   4 +
 drivers/nvmem/Kconfig                              |   2 +-
 drivers/of/unittest.c                              |   6 +-
 drivers/opp/core.c                                 |   2 +-
 drivers/pci/controller/cadence/pcie-cadence.c      |   4 +-
 drivers/pci/controller/dwc/pci-dra7xx.c            |   1 +
 drivers/pci/controller/dwc/pci-imx6.c              |   3 +
 drivers/pci/controller/dwc/pci-keystone.c          |   1 +
 drivers/pci/controller/dwc/pcie-artpec6.c          |   1 +
 drivers/pci/controller/dwc/pcie-designware-ep.c    | 395 +++++++---
 drivers/pci/controller/dwc/pcie-designware-plat.c  |   1 +
 drivers/pci/controller/dwc/pcie-designware.c       |  59 +-
 drivers/pci/controller/dwc/pcie-designware.h       |  26 +-
 drivers/pci/controller/dwc/pcie-dw-rockchip.c      |   6 +-
 drivers/pci/controller/dwc/pcie-keembay.c          |   1 +
 drivers/pci/controller/dwc/pcie-nxp-s32g.c         |   8 +-
 drivers/pci/controller/dwc/pcie-qcom-ep.c          |   1 +
 drivers/pci/controller/dwc/pcie-rcar-gen4.c        |   1 +
 drivers/pci/controller/dwc/pcie-sophgo.c           |  18 +
 drivers/pci/controller/dwc/pcie-stm32-ep.c         |   1 +
 drivers/pci/controller/dwc/pcie-tegra194.c         |   1 +
 drivers/pci/controller/dwc/pcie-uniphier-ep.c      |   2 +
 drivers/pci/controller/pcie-mediatek.c             |   4 +-
 drivers/pci/controller/pcie-rzg3s-host.c           |  30 +-
 drivers/pci/controller/pcie-xilinx.c               |   9 +-
 drivers/pci/endpoint/functions/pci-epf-mhi.c       |   2 +-
 drivers/pci/endpoint/functions/pci-epf-ntb.c       |   9 +-
 drivers/pci/endpoint/functions/pci-epf-test.c      |   2 +-
 drivers/pci/endpoint/functions/pci-epf-vntb.c      |   9 +-
 drivers/pci/endpoint/pci-epc-core.c                |   8 +
 drivers/pci/hotplug/pnv_php.c                      |   2 +-
 drivers/pci/hotplug/shpchp_core.c                  |   3 +-
 drivers/pci/p2pdma.c                               |  10 +-
 drivers/pci/pci-acpi.c                             |  59 +-
 drivers/pci/pci.c                                  |  13 +-
 drivers/pci/pci.h                                  |  26 +-
 drivers/pci/pcie/aer.c                             |   3 -
 drivers/pci/pcie/portdrv.c                         |   6 +-
 drivers/pci/pcie/ptm.c                             |   5 +-
 drivers/pci/probe.c                                |  35 +-
 drivers/pci/pwrctrl/pci-pwrctrl-tc9563.c           |   6 +-
 drivers/pci/quirks.c                               |   5 +
 drivers/pci/setup-bus.c                            | 138 ++--
 drivers/perf/arm_spe_pmu.c                         |  18 +-
 drivers/phy/freescale/phy-fsl-imx8qm-hsio.c        |   2 +-
 drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c  |   2 +
 drivers/pinctrl/meson/pinctrl-amlogic-a4.c         |  10 +-
 drivers/pinctrl/pinctrl-equilibrium.c              |   1 +
 drivers/pinctrl/pinctrl-k230.c                     |   7 +-
 drivers/pinctrl/pinctrl-single.c                   |   2 +
 drivers/pinctrl/qcom/pinctrl-sm8250-lpass-lpi.c    |   2 +-
 drivers/platform/chrome/cros_ec_lightbar.c         |   2 +-
 drivers/platform/chrome/cros_typec_switch.c        |   6 +-
 drivers/platform/x86/amd/pmf/core.c                |  62 +-
 drivers/platform/x86/amd/pmf/pmf.h                 |  10 +
 drivers/platform/x86/amd/pmf/tee-if.c              |  12 +-
 drivers/platform/x86/hp/hp-wmi.c                   | 179 +++--
 drivers/platform/x86/intel/int0002_vgpio.c         |   4 +-
 drivers/power/reset/nvmem-reboot-mode.c            |  15 +-
 drivers/power/supply/ab8500_charger.c              |  40 +-
 drivers/power/supply/act8945a_charger.c            |  16 +-
 drivers/power/supply/bq256xx_charger.c             |  12 +-
 drivers/power/supply/bq25980_charger.c             |  12 +-
 drivers/power/supply/bq27xxx_battery.c             |   6 +-
 drivers/power/supply/cpcap-battery.c               |   8 +-
 drivers/power/supply/goldfish_battery.c            |  12 +-
 drivers/power/supply/pf1550-charger.c              |  32 +-
 drivers/power/supply/pm8916_bms_vm.c               |  18 +-
 drivers/power/supply/pm8916_lbc.c                  |  18 +-
 drivers/power/supply/qcom_battmgr.c                |   3 +-
 drivers/power/supply/rt9455_charger.c              |  17 +-
 drivers/power/supply/sbs-battery.c                 |  36 +-
 drivers/power/supply/wm97xx_battery.c              |  34 +-
 drivers/powercap/intel_rapl_common.c               |   6 +-
 drivers/powercap/intel_rapl_msr.c                  |  12 +-
 drivers/powercap/intel_rapl_tpmi.c                 |   2 +-
 drivers/pwm/pwm-tiehrpwm.c                         |   6 +-
 drivers/regulator/core.c                           |  78 +-
 drivers/regulator/mt6363-regulator.c               |   9 +-
 drivers/remoteproc/imx_dsp_rproc.c                 |  58 +-
 drivers/remoteproc/imx_rproc.c                     |   2 +-
 drivers/reset/Kconfig                              |   2 +-
 drivers/rtc/rtc-amlogic-a4.c                       |   2 +-
 drivers/s390/cio/css.c                             |   2 +-
 drivers/scsi/csiostor/csio_scsi.c                  |   3 +-
 drivers/scsi/elx/efct/efct_driver.c                |   8 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |  13 +-
 drivers/soc/mediatek/mtk-svs.c                     |   5 +-
 drivers/soc/qcom/cmd-db.c                          |   7 +-
 drivers/soc/qcom/smem.c                            |   4 +-
 drivers/soundwire/Kconfig                          |   1 +
 drivers/spi/spi-cadence-quadspi.c                  |   4 +-
 drivers/spi/spi-microchip-core-spi.c               |   2 +-
 drivers/spi/spi-wpcm-fiu.c                         |   2 +-
 drivers/staging/greybus/light.c                    |   8 +-
 drivers/thermal/intel/x86_pkg_temp_thermal.c       |   3 +
 drivers/thermal/thermal_of.c                       |   4 +-
 drivers/tty/serial/Kconfig                         |   8 +-
 drivers/ufs/host/Kconfig                           |   1 +
 drivers/ufs/host/ufs-mediatek.c                    |  12 +-
 drivers/usb/cdns3/core.c                           |   2 +-
 drivers/usb/gadget/udc/bdc/bdc_core.c              |   4 +-
 drivers/usb/typec/tcpm/fusb302.c                   |   3 +-
 drivers/usb/typec/ucsi/Kconfig                     |   1 -
 drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c     |  24 +
 drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.h     |   2 +
 drivers/vfio/pci/vfio_pci_core.c                   |  17 +-
 drivers/video/backlight/aw99706.c                  |   2 +-
 drivers/video/backlight/qcom-wled.c                |  42 +-
 drivers/video/fbdev/au1200fb.c                     |   6 +-
 drivers/video/of_display_timing.c                  |   6 +-
 drivers/watchdog/starfive-wdt.c                    |   2 +-
 drivers/xen/balloon.c                              |  19 +-
 drivers/xen/grant-dma-ops.c                        |   3 +-
 drivers/xen/unpopulated-alloc.c                    |   3 +
 fs/btrfs/bio.c                                     |  19 +-
 fs/btrfs/bio.h                                     |   3 +
 fs/btrfs/block-group.c                             |  10 +
 fs/btrfs/block-rsv.c                               |   7 +-
 fs/btrfs/qgroup.c                                  |  15 +-
 fs/btrfs/transaction.c                             |   9 +-
 fs/btrfs/volumes.c                                 | 243 +++++--
 fs/erofs/fileio.c                                  |  20 +-
 fs/erofs/zdata.c                                   |  37 +-
 fs/ext4/ext4.h                                     |  16 +
 fs/ext4/extents.c                                  |  66 +-
 fs/ext4/fast_commit.c                              |  51 +-
 fs/ext4/mballoc-test.c                             |   2 +-
 fs/ext4/mballoc.c                                  |  73 +-
 fs/fat/namei_msdos.c                               |   7 +-
 fs/fat/namei_vfat.c                                |   7 +-
 fs/file_table.c                                    |  10 +-
 fs/fs_struct.c                                     |   1 +
 fs/gfs2/bmap.c                                     |  13 +-
 fs/gfs2/glock.c                                    |  36 +-
 fs/gfs2/glock.h                                    |   3 +-
 fs/gfs2/inode.c                                    |  18 +-
 fs/gfs2/log.c                                      |   7 +-
 fs/gfs2/lops.c                                     |  39 +-
 fs/gfs2/lops.h                                     |   4 +-
 fs/gfs2/ops_fstype.c                               |   2 +-
 fs/gfs2/quota.c                                    |   1 +
 fs/gfs2/super.c                                    |   4 +-
 fs/hfsplus/bnode.c                                 |   2 +-
 fs/iomap/buffered-io.c                             |  51 +-
 fs/iomap/direct-io.c                               |  10 +-
 fs/jfs/jfs_dtree.c                                 |   4 +-
 fs/netfs/write_retry.c                             |   1 -
 fs/nfs/dir.c                                       |   4 +-
 fs/nfs/localio.c                                   |  92 ++-
 fs/nfs/pnfs.c                                      |   3 +-
 fs/nfsd/export.c                                   |   8 +-
 fs/nfsd/nfs2acl.c                                  |   2 +-
 fs/nfsd/nfs4idmap.c                                |  48 +-
 fs/nfsd/nfs4proc.c                                 |   2 -
 fs/nfsd/nfs4xdr.c                                  |  16 +
 fs/nfsd/nfsproc.c                                  |   2 +-
 fs/ntfs3/file.c                                    |  10 +-
 fs/ntfs3/frecord.c                                 |  10 +-
 fs/ntfs3/fslog.c                                   |   3 +
 fs/ntfs3/inode.c                                   |   5 +-
 fs/ntfs3/ntfs_fs.h                                 |   2 +-
 fs/ntfs3/super.c                                   |   9 +-
 fs/overlayfs/readdir.c                             |   2 +-
 fs/pidfs.c                                         |   2 +-
 fs/proc/array.c                                    |   2 +-
 fs/pstore/ram_core.c                               |  11 +
 fs/quota/quota.c                                   |   1 +
 fs/smb/client/fs_context.c                         |   4 +-
 fs/smb/client/smb2file.c                           |   2 +
 fs/smb/client/smbdirect.c                          |  19 +-
 fs/smb/server/smb2pdu.c                            |   4 +-
 fs/tests/exec_kunit.c                              |   6 -
 include/acpi/pcc.h                                 |  29 -
 include/asm-generic/rqspinlock.h                   |   2 +-
 include/drm/drm_atomic.h                           |  39 +-
 include/drm/intel/intel_lb_mei_interface.h         |   3 +-
 include/linux/ata.h                                |   1 -
 include/linux/audit.h                              |   6 -
 include/linux/audit_arch.h                         |   7 +
 include/linux/bpf.h                                |   5 +
 include/linux/bpf_mprog.h                          |  10 +
 include/linux/capability.h                         |   6 +
 include/linux/clk.h                                |  48 +-
 include/linux/device_cgroup.h                      |   2 +-
 include/linux/exportfs.h                           |   9 +
 include/linux/filter.h                             |  26 +-
 include/linux/ftrace.h                             |   7 +-
 include/linux/hisi_acc_qm.h                        |  13 +-
 include/linux/hw_random.h                          |   2 +
 include/linux/input/adp5589.h                      | 180 -----
 include/linux/intel_rapl.h                         |   2 +-
 include/linux/interrupt.h                          |   2 +-
 include/linux/io_uring_types.h                     |   7 +-
 include/linux/leds-expresswire.h                   |   3 -
 include/linux/libata.h                             |   7 +-
 include/linux/mfd/wm8350/core.h                    |   2 +-
 include/linux/mlx5/driver.h                        |   4 +-
 include/linux/module.h                             |   9 +
 include/linux/mtd/spinand.h                        |   2 +-
 include/linux/pci-epc.h                            |   9 +
 include/linux/pci-epf.h                            |  23 +
 include/linux/psp.h                                |   1 +
 include/linux/seq_file.h                           |   1 -
 include/linux/seqlock.h                            |  15 +-
 include/linux/skmsg.h                              |  70 +-
 include/linux/soc/qcom/ubwc.h                      |   1 +
 include/linux/string.h                             |   4 +-
 include/linux/sunrpc/xdrgen/_builtins.h            |  20 +-
 include/linux/u64_stats_sync.h                     |  10 +
 include/net/bluetooth/hci_core.h                   |   2 +
 include/net/inet_ecn.h                             |  20 +-
 include/net/ipv6.h                                 |  11 +-
 include/net/netfilter/nf_conntrack_count.h         |   1 +
 include/net/netfilter/nf_queue.h                   |   4 +
 include/net/netfilter/nf_tables.h                  |   4 +
 include/net/netns/ipv4.h                           |   9 +-
 include/net/tcp.h                                  |  31 +-
 include/net/tcp_ecn.h                              |  66 +-
 include/rdma/rw.h                                  |   2 +
 include/sound/sdca_jack.h                          |  32 +
 include/uapi/drm/amdgpu_drm.h                      |   6 +-
 include/uapi/linux/nfs.h                           |   2 +-
 include/ufs/ufshcd.h                               |   4 -
 include/xen/xen.h                                  |   2 +
 io_uring/cancel.h                                  |   6 +-
 io_uring/io_uring.c                                |  14 +-
 io_uring/kbuf.c                                    |   5 +-
 io_uring/msg_ring.c                                |  12 +-
 io_uring/register.c                                |   3 +-
 io_uring/sync.c                                    |   2 +
 ipc/ipc_sysctl.c                                   |   2 +-
 kernel/bpf/bpf_insn_array.c                        |   2 +-
 kernel/bpf/core.c                                  |   4 +-
 kernel/bpf/helpers.c                               |   2 +-
 kernel/bpf/rqspinlock.c                            |   7 +-
 kernel/bpf/syscall.c                               |  19 +-
 kernel/bpf/trampoline.c                            |  32 +-
 kernel/bpf/verifier.c                              |  79 +-
 kernel/kallsyms.c                                  |   9 +-
 kernel/module/kallsyms.c                           |   9 +-
 kernel/rcu/rcutorture.c                            |   4 +-
 kernel/rcu/tree.h                                  |   2 +-
 kernel/rcu/tree_plugin.h                           |  15 +-
 kernel/sched/core.c                                |   8 +
 kernel/sched/deadline.c                            |   3 +
 kernel/sched/rt.c                                  |   5 +
 kernel/time/hrtimer.c                              |   2 +-
 kernel/time/sched_clock.c                          |   2 +-
 kernel/trace/blktrace.c                            |   2 +-
 kernel/trace/bpf_trace.c                           |   6 +-
 kernel/trace/ftrace.c                              |  19 +-
 kernel/trace/trace_events.c                        |   5 -
 kernel/trace/trace_events_hist.c                   |   2 +-
 kernel/ucount.c                                    |   2 +-
 kernel/workqueue.c                                 |  75 +-
 lib/Kconfig.debug                                  |   2 +-
 lib/kstrtox.c                                      |   4 +-
 lib/objpool.c                                      |   2 +-
 mm/slub.c                                          |  20 +
 net/atm/signaling.c                                |  56 +-
 net/bluetooth/hci_conn.c                           |  17 +-
 net/bluetooth/hci_event.c                          |  30 +-
 net/bridge/br_multicast.c                          |  45 +-
 net/core/dev.c                                     |   2 +-
 net/core/filter.c                                  |  22 +-
 net/core/skbuff.c                                  |   7 +-
 net/core/skmsg.c                                   |  30 +-
 net/ipv4/icmp.c                                    |  32 +-
 net/ipv4/ping.c                                    |  33 +-
 net/ipv4/tcp.c                                     |   3 +
 net/ipv4/tcp_bpf.c                                 |  25 +-
 net/ipv4/tcp_cong.c                                |   5 +-
 net/ipv4/tcp_input.c                               |   5 +-
 net/ipv4/tcp_minisocks.c                           |   7 +-
 net/ipv4/udp_bpf.c                                 |  23 +-
 net/ipv6/af_inet6.c                                |   2 +-
 net/ipv6/icmp.c                                    |  13 +-
 net/ipv6/ip6_fib.c                                 |   2 +-
 net/mctp/device.c                                  |   1 +
 net/mctp/neigh.c                                   |   1 +
 net/mctp/route.c                                   |   1 +
 net/mptcp/protocol.c                               |  14 +-
 net/mptcp/protocol.h                               |   5 +
 net/netfilter/ipvs/ip_vs_proto_sctp.c              |  18 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  21 +-
 net/netfilter/ipvs/ip_vs_proto_udp.c               |  20 +-
 net/netfilter/ipvs/ip_vs_xmit.c                    |  46 +-
 net/netfilter/nf_conncount.c                       |  30 +-
 net/netfilter/nf_conntrack_h323_main.c             |  10 +-
 net/netfilter/nf_tables_api.c                      | 282 ++------
 net/netfilter/nfnetlink_queue.c                    | 267 +++++--
 net/netfilter/nft_compat.c                         |  13 +-
 net/netfilter/nft_counter.c                        |  24 +-
 net/netfilter/nft_quota.c                          |  13 +-
 net/netfilter/nft_set_hash.c                       |   9 +-
 net/netfilter/nft_set_rbtree.c                     | 794 +++++++++++++++------
 net/nfc/hci/llc_shdlc.c                            |   8 +
 net/psp/Kconfig                                    |   1 +
 net/rds/send.c                                     |   6 +-
 net/smc/af_smc.c                                   |  91 +--
 net/sunrpc/auth_gss/auth_gss.c                     |   3 +
 net/sunrpc/auth_gss/gss_rpc_xdr.c                  |  82 ++-
 net/sunrpc/xprtrdma/svc_rdma_transport.c           |   8 +-
 net/unix/af_unix.c                                 |  11 +-
 net/wireless/core.c                                |   4 +-
 net/wireless/scan.c                                |   2 +-
 rust/kernel/device.rs                              |  14 +-
 rust/kernel/devres.rs                              | 164 ++---
 rust/kernel/driver.rs                              |  12 +-
 rust/kernel/pwm.rs                                 |   6 +-
 rust/kernel/task.rs                                |  24 +-
 security/apparmor/apparmorfs.c                     |   9 +
 security/apparmor/file.c                           |  15 +-
 security/apparmor/include/match.h                  |  12 +-
 security/apparmor/label.c                          |  33 +-
 security/apparmor/lsm.c                            |  33 +-
 security/apparmor/match.c                          |  22 +-
 security/apparmor/net.c                            |   6 +-
 security/apparmor/policy_unpack.c                  |   6 +-
 security/apparmor/resource.c                       |   5 +
 security/integrity/evm/evm_crypto.c                |  14 +-
 security/integrity/ima/ima.h                       |   6 +-
 security/integrity/ima/ima_appraise.c              |  16 +-
 security/integrity/ima/ima_main.c                  |  22 +-
 security/smack/smackfs.c                           |  79 +-
 sound/core/compress_offload.c                      |  28 +-
 sound/core/control.c                               |  12 +-
 sound/core/control_compat.c                        |  21 +-
 sound/core/control_led.c                           |  12 +-
 sound/core/oss/mixer_oss.c                         |  64 +-
 sound/core/oss/pcm_oss.c                           |  19 +-
 sound/core/pcm.c                                   |   4 +-
 sound/core/pcm_compat.c                            |   9 +-
 sound/core/pcm_native.c                            |  50 +-
 sound/core/seq/oss/seq_oss_init.c                  |   4 +-
 sound/core/seq/oss/seq_oss_midi.c                  |  45 +-
 sound/core/seq/oss/seq_oss_synth.c                 |  23 +-
 sound/core/seq/seq_clientmgr.c                     | 171 ++---
 sound/core/seq/seq_compat.c                        |   4 +-
 sound/core/seq/seq_midi.c                          |  10 +-
 sound/core/seq/seq_ports.c                         |  11 +-
 sound/core/seq/seq_queue.c                         |  32 +-
 sound/core/seq/seq_ump_client.c                    |  16 +-
 sound/core/seq/seq_virmidi.c                       |   4 +-
 sound/core/timer.c                                 |  12 +-
 sound/core/vmaster.c                               |  12 +-
 sound/hda/codecs/conexant.c                        |  10 +
 sound/hda/codecs/generic.c                         |   4 +-
 sound/hda/codecs/realtek/alc269.c                  |   6 +-
 sound/hda/codecs/realtek/realtek.c                 |   5 +-
 sound/hda/common/codec.c                           |   4 +-
 sound/hda/common/hda_jack.h                        |   4 +-
 sound/hda/common/hda_local.h                       |   2 +-
 sound/hda/common/sysfs.c                           |   5 +-
 sound/soc/codecs/aw88261.c                         |   3 +-
 sound/soc/codecs/cs4271.c                          |  12 +-
 sound/soc/codecs/nau8821.c                         |  18 +
 sound/soc/codecs/nau8821.h                         |   1 +
 sound/soc/fsl/fsl_xcvr.c                           |   3 -
 sound/soc/rockchip/rockchip_i2s_tdm.c              |  10 +
 sound/soc/sdca/Makefile                            |   2 +-
 sound/soc/sdca/sdca_asoc.c                         |  54 +-
 sound/soc/sdca/sdca_functions.c                    |   4 -
 sound/soc/sdca/sdca_interrupts.c                   |  83 +--
 sound/soc/sdca/sdca_jack.c                         | 248 +++++++
 sound/soc/tegra/tegra210_ahub.c                    |  57 ++
 sound/soc/tegra/tegra210_ahub.h                    |  30 +
 sound/usb/fcp.c                                    |  36 +-
 sound/usb/mixer_scarlett2.c                        |  21 +-
 sound/usb/quirks.c                                 |  13 +-
 sound/usb/usx2y/us144mkii.c                        |   4 +-
 sound/usb/usx2y/us144mkii_controls.c               |   4 +-
 sound/usb/usx2y/us144mkii_pcm.c                    |   4 +-
 tools/bpf/bpftool/net.c                            |   5 +-
 tools/docs/find-unused-docs.sh                     |   2 +-
 tools/include/nolibc/Makefile                      |   5 +-
 tools/lib/bpf/btf_dump.c                           |   9 +
 tools/lib/bpf/linker.c                             |   2 +-
 tools/lib/bpf/netlink.c                            |   4 +-
 tools/net/sunrpc/xdrgen/generators/__init__.py     |   3 +-
 .../xdrgen/templates/C/program/decoder/argument.j2 |   4 +
 .../xdrgen/templates/C/program/encoder/result.j2   |   6 +
 .../sunrpc/xdrgen/templates/C/source_top/client.j2 |   1 -
 tools/objtool/Makefile                             |   2 +
 tools/power/x86/intel-speed-select/isst-config.c   |   2 +
 tools/power/x86/turbostat/turbostat.c              |  96 +--
 tools/spi/.gitignore                               |   1 +
 .../selftests/bpf/prog_tests/stacktrace_ips.c      |  19 +-
 tools/testing/selftests/bpf/prog_tests/test_xsk.c  |   4 +-
 tools/testing/selftests/bpf/prog_tests/wq.c        |   5 +-
 tools/testing/selftests/bpf/veristat.c             |   2 +-
 .../selftests/drivers/net/lib/sh/lib_netcons.sh    |   4 +-
 .../selftests/drivers/net/mlxsw/tc_restrictions.sh |   4 +-
 tools/testing/selftests/memfd/memfd_test.c         | 113 ++-
 tools/testing/selftests/mm/cow.c                   |  16 +-
 tools/testing/selftests/mm/pagemap_ioctl.c         |   9 +-
 .../selftests/net/forwarding/pedit_dsfield.sh      |   8 +
 tools/testing/selftests/net/forwarding/pedit_ip.sh |   8 +
 .../testing/selftests/net/forwarding/tc_actions.sh |   2 +-
 .../selftests/net/forwarding/vxlan_bridge_1d.sh    |  26 +-
 .../net/forwarding/vxlan_bridge_1d_ipv6.sh         |   2 +-
 tools/testing/selftests/net/lib.sh                 |   2 +-
 tools/testing/selftests/resctrl/resctrlfs.c        |  10 +
 858 files changed, 9934 insertions(+), 5921 deletions(-)

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: YunJe Shin <[email protected]>

commit 14ab3da122bd18920ad57428f6cf4fade8385142 upstream.

If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present.

KASAN splat:

[  101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
[  101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

---
 drivers/infiniband/sw/siw/siw_qp_rx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -1435,7 +1435,8 @@ int siw_tcp_rx_data(read_descriptor_t *r
 		}
 		if (unlikely(rv != 0 && rv != -EAGAIN)) {
 			if ((srx->state > SIW_GET_HDR ||
-			     qp->rx_fpdu->more_ddp_segs) && run_completion)
+			     (qp->rx_fpdu && qp->rx_fpdu->more_ddp_segs)) &&
+			    run_completion)
 				siw_rdmap_complete(qp, rv);
 
 			siw_dbg_qp(qp, "rx error %d, rx state %d\n", rv,

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: YunJe Shin <[email protected]>

commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2 upstream.

ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list().

Add an explicit check to reject negative data_len before creating the send buffer.

KASAN splat:

[  211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0
[  211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102
[  211.365867] ib_create_send_mad+0xa01/0x11b0
[  211.365887] ib_umad_write+0x853/0x1c80

---
 drivers/infiniband/core/user_mad.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

@@ -514,7 +514,8 @@ static ssize_t ib_umad_write(struct file
 	struct rdma_ah_attr ah_attr;
 	struct ib_ah *ah;
 	__be64 *tid;
-	int ret, data_len, hdr_len, copy_offset, rmpp_active;
+	int ret, hdr_len, copy_offset, rmpp_active;
+	size_t data_len;
 	u8 base_version;
 
 	if (count < hdr_size(file) + IB_MGMT_RMPP_HDR)

@@ -588,7 +589,10 @@ static ssize_t ib_umad_write(struct file
 	}
 
 	base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version;
-	data_len = count - hdr_size(file) - hdr_len;
+	if (check_sub_overflow(count, hdr_size(file) + hdr_len, &data_len)) {
+		ret = -EINVAL;
+		goto err_ah;
+	}
 	packet->msg = ib_create_send_mad(agent,
 					 be32_to_cpu(packet->mad.hdr.qpn),
 					 packet->mad.hdr.pkey_index, rmpp_active,

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Fourier <[email protected]>

[ Upstream commit b5c23a4d291d2ac1dfdd574a68a3a68c8da3069e ]

It seems like, after the request_mem_region(), the corresponding release_mem_region() must take the same size. This was done in (now removed due to previous refactoring) charlcd_remove() but not in the error path in charlcd_probe().

---
 drivers/auxdisplay/arm-charlcd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index a7eae99a48f77..4e22882f57c9c 100644
@@ -323,7 +323,7 @@ static int __init charlcd_probe(struct platform_device *pdev)
 out_no_irq:
 	iounmap(lcd->virtbase);
 out_no_memregion:
-	release_mem_region(lcd->phybase, SZ_4K);
+	release_mem_region(lcd->phybase, lcd->physize);
 out_no_resource:
 	kfree(lcd);
 	return ret;

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Shardul Bankar <[email protected]>

[ Upstream commit d8a73cc46c8462a969a7516131feb3096f4c49d3 ]

When hfs_bnode_create() finds that a node is already hashed (which should not happen in normal operation), it currently returns the existing node without incrementing its reference count. This causes a reference count inconsistency that leads to a kernel panic when the node is later freed in hfs_bnode_put():

kernel BUG at fs/hfsplus/bnode.c:676!
BUG_ON(!atomic_read(&node->refcnt))

This scenario can occur when hfs_bmap_alloc() attempts to allocate a node that is already in use (e.g., when node 0's bitmap bit is incorrectly unset), or due to filesystem corruption.

Returning an existing node from a create path is not normal operation.

Fix this by returning ERR_PTR(-EEXIST) instead of the node when it's already hashed. This properly signals the error condition to callers, which already check for IS_ERR() return values.

---
 fs/hfsplus/bnode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 191661af96778..250a226336ea7 100644
@@ -629,7 +629,7 @@ struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num)
 	if (node) {
 		pr_crit("new node %u already hashed?\n", num);
 		WARN_ON(1);
-		return node;
+		return ERR_PTR(-EEXIST);
 	}
 	node = __hfs_bnode_create(tree, num);
 	if (!node)

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Paul E. McKenney <[email protected]>

[ Upstream commit 37d9b475077b5096d41ebdc416a9019bd4fcfdb9 ]

Lack of parentheses causes the ->exp_current() function, for example, srcu_expedite_current(), to be called only once in four billion times instead of the intended once in 256 times. This commit therefore adds the needed parentheses.

---
 kernel/rcu/rcutorture.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 07e51974b06bc..83934402a287b 100644
@@ -1750,7 +1750,7 @@ rcu_torture_writer(void *arg)
 					ulo[i] = cur_ops->get_comp_state();
 				gp_snap = cur_ops->start_gp_poll();
 				rcu_torture_writer_state = RTWS_POLL_WAIT;
-				if (cur_ops->exp_current && !torture_random(&rand) % 0xff)
+				if (cur_ops->exp_current && !(torture_random(&rand) & 0xff))
 					cur_ops->exp_current();
 				while (!cur_ops->poll_gp_state(gp_snap)) {
 					gp_snap1 = cur_ops->get_gp_state();

@@ -1772,7 +1772,7 @@ rcu_torture_writer(void *arg)
 					cur_ops->get_comp_state_full(&rgo[i]);
 				cur_ops->start_gp_poll_full(&gp_snap_full);
 				rcu_torture_writer_state = RTWS_POLL_WAIT_FULL;
-				if (cur_ops->exp_current && !torture_random(&rand) % 0xff)
+				if (cur_ops->exp_current && !(torture_random(&rand) & 0xff))
 					cur_ops->exp_current();
 				while (!cur_ops->poll_gp_state_full(&gp_snap_full)) {
 					cur_ops->get_gp_state_full(&gp_snap1_full);

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yao Kai <[email protected]>

[ Upstream commit d41e37f26b3157b3f1d10223863519a943aa239b ]

Commit 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") removes the recursion-protection code from __rcu_read_unlock(). Therefore, we could invoke the deadloop in raise_softirq_irqoff() with ftrace enabled as follows:

WARNING: CPU: 0 PID: 0 at kernel/trace/trace.c:3021 __ftrace_trace_stack.constprop.0+0x172/0x180
Modules linked in: my_irq_work(O)
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G O 6.18.0-rc7-dirty #23 PREEMPT(full)
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:__ftrace_trace_stack.constprop.0+0x172/0x180
RSP: 0018:ffffc900000034a8 EFLAGS: 00010002
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000000000003 RSI: ffffffff826d7b87 RDI: ffffffff826e9329
RBP: 0000000000090009 R08: 0000000000000005 R09: ffffffff82afbc4c
R10: 0000000000000008 R11: 0000000000011d7a R12: 0000000000000000
R13: ffff888003874100 R14: 0000000000000003 R15: ffff8880038c1054
FS:  0000000000000000(0000) GS:ffff8880fa8ea000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b31fa7f540 CR3: 00000000078f4005 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
 <IRQ>
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 unwind_next_frame+0x203/0x9b0
 __unwind_start+0x15d/0x1c0
 arch_stack_walk+0x62/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 unwind_next_frame+0x203/0x9b0
 __unwind_start+0x15d/0x1c0
 arch_stack_walk+0x62/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 unwind_next_frame+0x203/0x9b0
 __unwind_start+0x15d/0x1c0
 arch_stack_walk+0x62/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 raise_softirq_irqoff+0x6e/0xa0
 rcu_read_unlock_special+0xb1/0x160
 __is_insn_slot_addr+0x54/0x70
 kernel_text_address+0x48/0xc0
 __kernel_text_address+0xd/0x40
 unwind_get_return_address+0x1e/0x40
 arch_stack_walk+0x9c/0xf0
 stack_trace_save+0x48/0x70
 __ftrace_trace_stack.constprop.0+0x144/0x180
 trace_buffer_unlock_commit_regs+0x6d/0x220
 trace_event_buffer_commit+0x5c/0x260
 trace_event_raw_event_softirq+0x47/0x80
 __raise_softirq_irqoff+0x61/0x80
 __flush_smp_call_function_queue+0x115/0x420
 __sysvec_call_function_single+0x17/0xb0
 sysvec_call_function_single+0x8c/0xc0
 </IRQ>

Commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work") fixed the infinite loop in rcu_read_unlock_special() for IRQ work by setting a flag before calling irq_work_queue_on(). We fix this issue by setting the same flag before calling raise_softirq_irqoff() and rename the flag to defer_qs_pending for more common.

---
 kernel/rcu/tree.h        |  2 +-
 kernel/rcu/tree_plugin.h | 15 +++++++++------
 2 files changed, 10 insertions(+), 7 deletions(-)

index b8bbe7960cda7..2265b9c2906e1 100644
@@ -203,7 +203,7 @@ struct rcu_data {
 					/*  during and after the last grace */
 					/* period it is aware of. */
 	struct irq_work defer_qs_iw;	/* Obtain later scheduler attention. */
-	int defer_qs_iw_pending;	/* Scheduler attention pending? */
+	int defer_qs_pending;		/* irqwork or softirq pending? */
 	struct work_struct strict_work;	/* Schedule readers for strict GPs. */
 
 	/* 2) batch handling */

index dbe2d02be824a..95ad967adcf3c 100644
@@ -487,8 +487,8 @@ rcu_preempt_deferred_qs_irqrestore(struct task_struct *t, unsigned long flags)
 	union rcu_special special;
 
 	rdp = this_cpu_ptr(&rcu_data);
-	if (rdp->defer_qs_iw_pending == DEFER_QS_PENDING)
-		rdp->defer_qs_iw_pending = DEFER_QS_IDLE;
+	if (rdp->defer_qs_pending == DEFER_QS_PENDING)
+		rdp->defer_qs_pending = DEFER_QS_IDLE;
 
 	/*
 	 * If RCU core is waiting for this CPU to exit its critical section,

@@ -645,7 +645,7 @@ static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp)
 	 * 5. Deferred QS reporting does not happen.
 	 */
 	if (rcu_preempt_depth() > 0)
-		WRITE_ONCE(rdp->defer_qs_iw_pending, DEFER_QS_IDLE);
+		WRITE_ONCE(rdp->defer_qs_pending, DEFER_QS_IDLE);
 }
 
 /*

@@ -747,7 +747,10 @@ static void rcu_read_unlock_special(struct task_struct *t)
 			// Using softirq, safe to awaken, and either the
 			// wakeup is free or there is either an expedited
 			// GP in flight or a potential need to deboost.
-			raise_softirq_irqoff(RCU_SOFTIRQ);
+			if (rdp->defer_qs_pending != DEFER_QS_PENDING) {
+				rdp->defer_qs_pending = DEFER_QS_PENDING;
+				raise_softirq_irqoff(RCU_SOFTIRQ);
+			}
 		} else {
 			// Enabling BH or preempt does reschedule, so...
 			// Also if no expediting and no possible deboosting,

@@ -755,11 +758,11 @@ static void rcu_read_unlock_special(struct task_struct *t)
 			// tick enabled.
 			set_need_resched_current();
 			if (IS_ENABLED(CONFIG_IRQ_WORK) && irqs_were_disabled &&
-			    needs_exp && rdp->defer_qs_iw_pending != DEFER_QS_PENDING &&
+			    needs_exp && rdp->defer_qs_pending != DEFER_QS_PENDING &&
 			    cpu_online(rdp->cpu)) {
 				// Get scheduler to re-evaluate and call hooks.
 				// If !IRQ_WORK, FQS scan will eventually IPI.
-				rdp->defer_qs_iw_pending = DEFER_QS_PENDING;
+				rdp->defer_qs_pending = DEFER_QS_PENDING;
 				irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu);
 			}
 		}

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Dooks <[email protected]>

[ Upstream commit 76489955c6d4a065ca69dc88faf7a50a59b66f35 ]

The comapt_xxx_class symbols aren't declared in anything that lib/comapt_audit.c is including (arm64 build) which is causing the following sparse warnings:

lib/compat_audit.c:7:10: warning: symbol 'compat_dir_class'
was not declared. Should it be static?
lib/compat_audit.c:12:10: warning: symbol 'compat_read_class'
was not declared. Should it be static?
lib/compat_audit.c:17:10: warning: symbol 'compat_write_class'
was not declared. Should it be static?
lib/compat_audit.c:22:10: warning: symbol 'compat_chattr_class'
was not declared. Should it be static?
lib/compat_audit.c:27:10: warning: symbol 'compat_signal_class'
was not declared. Should it be static?

Trying to fix this by chaning compat_audit.c to inclde <linux/audit.h> does not work on arm64 due to compile errors with the extra includes that changing this header makes. The simpler thing would be just to move the definitons of these symbols out of <linux/audit.h> into <linux/audit_arch.h> which is included.

---
 include/linux/audit.h      | 6 ------
 include/linux/audit_arch.h | 7 +++++++
 2 files changed, 7 insertions(+), 6 deletions(-)

index 536f8ee8da818..b8d8029c6c480 100644
@@ -128,12 +128,6 @@ enum audit_nfcfgop {
 extern int __init audit_register_class(int class, unsigned *list);
 extern int audit_classify_syscall(int abi, unsigned syscall);
 extern int audit_classify_arch(int arch);
-/* only for compat system calls */
-extern unsigned compat_write_class[];
-extern unsigned compat_read_class[];
-extern unsigned compat_dir_class[];
-extern unsigned compat_chattr_class[];
-extern unsigned compat_signal_class[];
 
 /* audit_names->type values */
 #define	AUDIT_TYPE_UNKNOWN	0	/* we don't know yet */

index 0e34d673ef171..2b8153791e6a5 100644
@@ -23,4 +23,11 @@ enum auditsc_class_t {
 
 extern int audit_classify_compat_syscall(int abi, unsigned syscall);
 
+/* only for compat system calls */
+extern unsigned compat_write_class[];
+extern unsigned compat_read_class[];
+extern unsigned compat_dir_class[];
+extern unsigned compat_chattr_class[];
+extern unsigned compat_signal_class[];
+
 #endif

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiaochen Shen <[email protected]>

[ Upstream commit 671ef08d9455f5754d1fc96f5a14e357d6b80936 ]

Change to adjust effective L3 cache size with SNC enabled change introduced the snc_nodes_per_l3_cache() function to detect the Intel Sub-NUMA Clustering (SNC) feature by comparing #CPUs in node0 with #CPUs sharing LLC with CPU0. The function was designed to return:
(1) >1: SNC mode is enabled.
(2) 1: SNC mode is not enabled or not supported.

However, on certain Hygon CPUs, #CPUs sharing LLC with CPU0 is actually less than #CPUs in node0. This results in snc_nodes_per_l3_cache() returning 0 (calculated as cache_cpus / node_cpus).

This leads to a division by zero error in get_cache_size():
*cache_size /= snc_nodes_per_l3_cache();

Causing the resctrl selftest to fail with:
"Floating point exception (core dumped)"

Fix the issue by ensuring snc_nodes_per_l3_cache() returns 1 when SNC mode is not supported on the platform.

Updated commit log to fix commit has issues:
Shuah Khan <[email protected]>

---
 tools/testing/selftests/resctrl/resctrlfs.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

index 195f04c4d1586..b9c1bfb6cc029 100644
@@ -243,6 +243,16 @@ int snc_nodes_per_l3_cache(void)
 		}
 		snc_mode = cache_cpus / node_cpus;
 
+		/*
+		 * On some platforms (e.g. Hygon),
+		 * cache_cpus < node_cpus, the calculated snc_mode is 0.
+		 *
+		 * Set snc_mode = 1 to indicate that SNC mode is not
+		 * supported on the platform.
+		 */
+		if (!snc_mode)
+			snc_mode = 1;
+
 		if (snc_mode > 1)
 			ksft_print_msg("SNC-%d mode discovered.\n", snc_mode);
 	}

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Billy Tsai <[email protected]>

[ Upstream commit 3502cea99c7ceb331458cbd34ef6792c83144687 ]

Move device name initialization to occur after i3c_bus_init() so that i3cbus->id is guaranteed to be assigned before it is used.

---
 drivers/i3c/master.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 7f606c8716480..1bc3c90684028 100644
@@ -2881,7 +2881,6 @@ int i3c_master_register(struct i3c_master_controller *master,
 	INIT_LIST_HEAD(&master->boardinfo.i3c);
 
 	device_initialize(&master->dev);
-	dev_set_name(&master->dev, "i3c-%d", i3cbus->id);
 
 	master->dev.dma_mask = parent->dma_mask;
 	master->dev.coherent_dma_mask = parent->coherent_dma_mask;

@@ -2891,6 +2890,8 @@ int i3c_master_register(struct i3c_master_controller *master,
 	if (ret)
 		goto err_put_dev;
 
+	dev_set_name(&master->dev, "i3c-%d", i3cbus->id);
+
 	ret = of_populate_i3c_bus(master);
 	if (ret)
 		goto err_put_dev;

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Breno Leitao <[email protected]>

[ Upstream commit 6784f274722559c0cdaaa418bc8b7b1d61c314f9 ]

commit 4ef4ac360101 ("device_cgroup: avoid access to ->i_rdev in the common case in devcgroup_inode_permission()") reordered the checks in devcgroup_inode_permission() to check the inode mode before checking i_rdev, for better cache behavior.

However, the likely() annotation on the i_rdev check was not updated to reflect the new code flow. Originally, when i_rdev was checked first, likely(!inode->i_rdev) made sense because most inodes were(?) regular files/directories, thus i_rdev == 0.

After the reorder, by the time we reach the i_rdev check, we have already confirmed the inode IS a block or character device. Block and character special files are precisely defined by having a device number (i_rdev), so !inode->i_rdev is now the rare edge case, not the common case.

Branch profiling confirmed this is 100% mispredicted:

  correct incorrect  %    Function                      File              Line
  ------- ---------  -    --------                      ----              ----
        0   2631904 100   devcgroup_inode_permission    device_cgroup.h   24

Remove likely() to avoid giving the wrong hint to the CPU.

---
 include/linux/device_cgroup.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 0864773a57e8f..822085bc2d202 100644
@@ -21,7 +21,7 @@ static inline int devcgroup_inode_permission(struct inode *inode, int mask)
 	if (likely(!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode)))
 		return 0;
 
-	if (likely(!inode->i_rdev))
+	if (!inode->i_rdev)
 		return 0;
 
 	if (S_ISBLK(inode->i_mode))

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Amir Goldstein <[email protected]>

[ Upstream commit 1219e0feaefc9697f738b223540e8e8906291cb3 ]

The comment above file_ref_init() says:
"We're SLAB_TYPESAFE_BY_RCU so initialize f_ref last." but file_set_fsnotify_mode() was added after file_ref_init().

Move it right after setting f_mode, where it makes more sense.

---
 fs/file_table.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

index cd4a3db4659ac..34244fccf2edf 100644
@@ -176,6 +176,11 @@ static int init_file(struct file *f, int flags, const struct cred *cred)
 
 	f->f_flags	= flags;
 	f->f_mode	= OPEN_FMODE(flags);
+	/*
+	 * Disable permission and pre-content events for all files by default.
+	 * They may be enabled later by fsnotify_open_perm_and_set_mode().
+	 */
+	file_set_fsnotify_mode(f, FMODE_NONOTIFY_PERM);
 
 	f->f_op		= NULL;
 	f->f_mapping	= NULL;

@@ -197,11 +202,6 @@ static int init_file(struct file *f, int flags, const struct cred *cred)
 	 * refcount bumps we should reinitialize the reused file first.
 	 */
 	file_ref_init(&f->f_ref, 1);
-	/*
-	 * Disable permission and pre-content events for all files by default.
-	 * They may be enabled later by fsnotify_open_perm_and_set_mode().
-	 */
-	file_set_fsnotify_mode(f, FMODE_NONOTIFY_PERM);
 	return 0;
 }
 

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ben Dooks <[email protected]>

[ Upstream commit 589cff4975afe1a4eaaa1d961652f50b1628d78d ]

The init_fs symbol is defined in <linux/init_task.h> but was not included in fs/fs_struct.c so fix by adding the include.

Fixes the following sparse warning:
fs/fs_struct.c:150:18: warning: symbol 'init_fs' was not declared. Should it be static?

---
 fs/fs_struct.c | 1 +
 1 file changed, 1 insertion(+)

index b8c46c5a38a05..394875d06fd60 100644
@@ -6,6 +6,7 @@
 #include <linux/path.h>
 #include <linux/slab.h>
 #include <linux/fs_struct.h>
+#include <linux/init_task.h>
 #include "internal.h"
 
 /*

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Adrian Hunter <[email protected]>

[ Upstream commit f0775157b9f9a28ae3eabc8d05b0bc52e8056c80 ]

To prevent inconsistent state when an error occurs, ensure the hot-join flag is updated only when enabling or disabling hot-join succeeds.

---
 drivers/i3c/master.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 1bc3c90684028..5408332861a1b 100644
@@ -618,7 +618,8 @@ static int i3c_set_hotjoin(struct i3c_master_controller *master, bool enable)
 	else
 		ret = master->ops->disable_hotjoin(master);
 
-	master->hotjoin = enable;
+	if (!ret)
+		master->hotjoin = enable;
 
 	i3c_bus_normaluse_unlock(&master->bus);
 

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ferry Meng <[email protected]>

[ Upstream commit 19bfef0178c64a6281a44687380b082e69215e06 ]

%pe will print a symbolic error name (e.g,. -ENOMEM), opposed to the raw errno (e.g,. -12) produced by PTR_ERR().

Stable-dep-of: 9aa64b62a73c ("erofs: avoid noisy messages for transient -ENOMEM")

---
 fs/erofs/zdata.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 3d31f7840ca04..70e1597dec8a6 100644
@@ -1324,8 +1324,8 @@ static int z_erofs_decompress_pcluster(struct z_erofs_backend *be, bool eio)
 						GFP_NOWAIT | __GFP_NORETRY
 				 }, be->pagepool);
 		if (IS_ERR(reason)) {
-			erofs_err(be->sb, "failed to decompress (%s) %ld @ pa %llu size %u => %u",
-				  alg->name, PTR_ERR(reason), pcl->pos,
+			erofs_err(be->sb, "failed to decompress (%s) %pe @ pa %llu size %u => %u",
+				  alg->name, reason, pcl->pos,
 				  pcl->pclustersize, pcl->length);
 			err = PTR_ERR(reason);
 		} else if (unlikely(reason)) {

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

[ Upstream commit 9aa64b62a73cbca226c0144dcf3cdf97294e0641 ]

EROFS may allocate temporary pages using GFP_NOWAIT | GFP_NORETRY when pcl->besteffort is off (e.g., for readahead requests).

If the allocation fails, the original request will fall back to synchronous read, so the failure is transient.

Such fallback can frequently happen in low memory scenarios, but since these failures are expected and temporary, avoid printing error messages like below:

[ 7425.184264] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 148447232 size 28672 => 26788
[ 7426.244267] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 149422080 size 28672 => 15903
[ 7426.245508] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 138440704 size 28672 => 39294
...
[ 7504.258373] erofs (device sr0): failed to decompress (lz4) -ENOMEM @ pa 93581312 size 20480 => 47366

---
 fs/erofs/zdata.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

index 70e1597dec8a6..c62908f1ce478 100644
@@ -1324,9 +1324,10 @@ static int z_erofs_decompress_pcluster(struct z_erofs_backend *be, bool eio)
 						GFP_NOWAIT | __GFP_NORETRY
 				 }, be->pagepool);
 		if (IS_ERR(reason)) {
-			erofs_err(be->sb, "failed to decompress (%s) %pe @ pa %llu size %u => %u",
-				  alg->name, reason, pcl->pos,
-				  pcl->pclustersize, pcl->length);
+			if (pcl->besteffort || reason != ERR_PTR(-ENOMEM))
+				erofs_err(be->sb, "failed to decompress (%s) %pe @ pa %llu size %u => %u",
+					  alg->name, reason, pcl->pos,
+					  pcl->pclustersize, pcl->length);
 			err = PTR_ERR(reason);
 		} else if (unlikely(reason)) {
 			erofs_err(be->sb, "failed to decompress (%s) %s @ pa %llu size %u => %u",

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email protected]>

[ Upstream commit 11d763f0b0afc2cf5f92f4adae5dbbbbef712f8f ]

Fix a bug in gfs2's asynchronous glock handling for rename and exchange operations. The original async implementation from commit ad26967b9afa ("gfs2: Use async glocks for rename") mentioned that retries were needed but never implemented them, causing operations to fail with -ESTALE instead of retrying on timeout.

Also makes the waiting interruptible.

In addition, the timeouts used were too high for situations in which timing out is a rare but expected scenario. Switch to shorter timeouts with randomization and exponentional backoff.

---
 fs/gfs2/glock.c | 36 +++++++++++++++++++++++++++---------
 fs/gfs2/glock.h |  3 ++-
 fs/gfs2/inode.c | 18 ++++++++++++++----
 3 files changed, 43 insertions(+), 14 deletions(-)

index 92e029104d8a4..289851d70130b 100644
@@ -1284,31 +1284,45 @@ static int glocks_pending(unsigned int num_gh, struct gfs2_holder *ghs)
  * gfs2_glock_async_wait - wait on multiple asynchronous glock acquisitions
  * @num_gh: the number of holders in the array
  * @ghs: the glock holder array
+ * @retries: number of retries attempted so far
  *
  * Returns: 0 on success, meaning all glocks have been granted and are held.
  *          -ESTALE if the request timed out, meaning all glocks were released,
  *          and the caller should retry the operation.
  */
 
-int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs)
+int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs,
+			  unsigned int retries)
 {
 	struct gfs2_sbd *sdp = ghs[0].gh_gl->gl_name.ln_sbd;
-	int i, ret = 0, timeout = 0;
 	unsigned long start_time = jiffies;
+	int i, ret = 0;
+	long timeout;
 
 	might_sleep();
-	/*
-	 * Total up the (minimum hold time * 2) of all glocks and use that to
-	 * determine the max amount of time we should wait.
-	 */
-	for (i = 0; i < num_gh; i++)
-		timeout += ghs[i].gh_gl->gl_hold_time << 1;
 
-	if (!wait_event_timeout(sdp->sd_async_glock_wait,
+	timeout = GL_GLOCK_MIN_HOLD;
+	if (retries) {
+		unsigned int max_shift;
+		long incr;
+
+		/* Add a random delay and increase the timeout exponentially. */
+		max_shift = BITS_PER_LONG - 2 - __fls(GL_GLOCK_HOLD_INCR);
+		incr = min(GL_GLOCK_HOLD_INCR << min(retries - 1, max_shift),
+			   10 * HZ - GL_GLOCK_MIN_HOLD);
+		schedule_timeout_interruptible(get_random_long() % (incr / 3));
+		if (signal_pending(current))
+			goto interrupted;
+		timeout += (incr / 3) + get_random_long() % (incr / 3);
+	}
+
+	if (!wait_event_interruptible_timeout(sdp->sd_async_glock_wait,
 				!glocks_pending(num_gh, ghs), timeout)) {
 		ret = -ESTALE; /* request timed out. */
 		goto out;
 	}
+	if (signal_pending(current))
+		goto interrupted;
 
 	for (i = 0; i < num_gh; i++) {
 		struct gfs2_holder *gh = &ghs[i];

@@ -1332,6 +1346,10 @@ int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs)
 		}
 	}
 	return ret;
+
+interrupted:
+	ret = -EINTR;
+	goto out;
 }
 
 /**

index 55d5985f32a08..dccbf36b8cb10 100644
@@ -204,7 +204,8 @@ int gfs2_glock_poll(struct gfs2_holder *gh);
 int gfs2_instantiate(struct gfs2_holder *gh);
 int gfs2_glock_holder_ready(struct gfs2_holder *gh);
 int gfs2_glock_wait(struct gfs2_holder *gh);
-int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs);
+int gfs2_glock_async_wait(unsigned int num_gh, struct gfs2_holder *ghs,
+			  unsigned int retries);
 void gfs2_glock_dq(struct gfs2_holder *gh);
 void gfs2_glock_dq_wait(struct gfs2_holder *gh);
 void gfs2_glock_dq_uninit(struct gfs2_holder *gh);

index 36618e3531996..b6ed069b34872 100644
@@ -1495,7 +1495,7 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
 	unsigned int num_gh;
 	int dir_rename = 0;
 	struct gfs2_diradd da = { .nr_blocks = 0, .save_loc = 0, };
-	unsigned int x;
+	unsigned int retries = 0, x;
 	int error;
 
 	gfs2_holder_mark_uninitialized(&r_gh);

@@ -1545,12 +1545,17 @@ static int gfs2_rename(struct inode *odir, struct dentry *odentry,
 		num_gh++;
 	}
 
+again:
 	for (x = 0; x < num_gh; x++) {
 		error = gfs2_glock_nq(ghs + x);
 		if (error)
 			goto out_gunlock;
 	}
-	error = gfs2_glock_async_wait(num_gh, ghs);
+	error = gfs2_glock_async_wait(num_gh, ghs, retries);
+	if (error == -ESTALE) {
+		retries++;
+		goto again;
+	}
 	if (error)
 		goto out_gunlock;
 

@@ -1739,7 +1744,7 @@ static int gfs2_exchange(struct inode *odir, struct dentry *odentry,
 	struct gfs2_sbd *sdp = GFS2_SB(odir);
 	struct gfs2_holder ghs[4], r_gh;
 	unsigned int num_gh;
-	unsigned int x;
+	unsigned int retries = 0, x;
 	umode_t old_mode = oip->i_inode.i_mode;
 	umode_t new_mode = nip->i_inode.i_mode;
 	int error;

@@ -1783,13 +1788,18 @@ static int gfs2_exchange(struct inode *odir, struct dentry *odentry,
 	gfs2_holder_init(nip->i_gl, LM_ST_EXCLUSIVE, GL_ASYNC, ghs + num_gh);
 	num_gh++;
 
+again:
 	for (x = 0; x < num_gh; x++) {
 		error = gfs2_glock_nq(ghs + x);
 		if (error)
 			goto out_gunlock;
 	}
 
-	error = gfs2_glock_async_wait(num_gh, ghs);
+	error = gfs2_glock_async_wait(num_gh, ghs, retries);
+	if (error == -ESTALE) {
+		retries++;
+		goto again;
+	}
 	if (error)
 		goto out_gunlock;
 

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email protected]>

[ Upstream commit 59d81037d32ff1e415dcaa359c238c9ca730932d ]

Rename gfs2_log_submit_bio() to gfs2_log_submit_write(): this function isn't used for submitting log reads.

Stable-dep-of: 4a94f052e098 ("gfs2: Initialize bio->bi_opf early")

---
 fs/gfs2/log.c  | 4 ++--
 fs/gfs2/lops.c | 6 +++---
 fs/gfs2/lops.h | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

index 8312cd2cdae47..2a3b9d10eba78 100644
@@ -889,7 +889,7 @@ void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
 	lh->lh_crc = cpu_to_be32(crc);
 
 	gfs2_log_write(sdp, jd, page, sb->s_blocksize, 0, dblock);
-	gfs2_log_submit_bio(&jd->jd_log_bio, REQ_OP_WRITE | op_flags);
+	gfs2_log_submit_write(&jd->jd_log_bio, REQ_OP_WRITE | op_flags);
 }
 
 /**

@@ -1096,7 +1096,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
 	if (gfs2_withdrawn(sdp))
 		goto out_withdraw;
 	if (sdp->sd_jdesc)
-		gfs2_log_submit_bio(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE);
+		gfs2_log_submit_write(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE);
 	if (gfs2_withdrawn(sdp))
 		goto out_withdraw;
 

index d27a0b1080a97..aa9e9fe25c2f7 100644
@@ -229,7 +229,7 @@ static void gfs2_end_log_write(struct bio *bio)
 }
 
 /**
- * gfs2_log_submit_bio - Submit any pending log bio
+ * gfs2_log_submit_write - Submit a pending log write bio
  * @biop: Address of the bio pointer
  * @opf: REQ_OP | op_flags
  *

@@ -237,7 +237,7 @@ static void gfs2_end_log_write(struct bio *bio)
  * there is no pending bio, then this is a no-op.
  */
 
-void gfs2_log_submit_bio(struct bio **biop, blk_opf_t opf)
+void gfs2_log_submit_write(struct bio **biop, blk_opf_t opf)
 {
 	struct bio *bio = *biop;
 	if (bio) {

@@ -303,7 +303,7 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno,
 		nblk >>= sdp->sd_fsb2bb_shift;
 		if (blkno == nblk && !flush)
 			return bio;
-		gfs2_log_submit_bio(biop, op);
+		gfs2_log_submit_write(biop, op);
 	}
 
 	*biop = gfs2_log_alloc_bio(sdp, blkno, end_io);

index be740bf336664..010a4696406bb 100644
@@ -17,7 +17,7 @@ u64 gfs2_log_bmap(struct gfs2_jdesc *jd, unsigned int lbn);
 void gfs2_log_write(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
 		    struct page *page, unsigned size, unsigned offset,
 		    u64 blkno);
-void gfs2_log_submit_bio(struct bio **biop, blk_opf_t opf);
+void gfs2_log_submit_write(struct bio **biop, blk_opf_t opf);
 void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh);
 int gfs2_find_jhead(struct gfs2_jdesc *jd,
 		    struct gfs2_log_header_host *head);

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email protected]>

[ Upstream commit 4a94f052e0982794aa65312fe8b69999e4494a20 ]

Pass the right blk_opf_t value to bio_alloc() so that ->bi_ops is initialized correctly and doesn't have to be changed later. Adjust the call chain to pass that value through to where it is needed (and only there).

Add a separate blk_opf_t argument to gfs2_chain_bio() instead of copying the value from the previous bio.

---
 fs/gfs2/log.c  |  7 ++++---
 fs/gfs2/lops.c | 37 ++++++++++++++++++++-----------------
 fs/gfs2/lops.h |  4 ++--
 3 files changed, 26 insertions(+), 22 deletions(-)

index 2a3b9d10eba78..347df29d610e6 100644
@@ -888,8 +888,9 @@ void gfs2_write_log_header(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
 		     sb->s_blocksize - LH_V1_SIZE - 4);
 	lh->lh_crc = cpu_to_be32(crc);
 
-	gfs2_log_write(sdp, jd, page, sb->s_blocksize, 0, dblock);
-	gfs2_log_submit_write(&jd->jd_log_bio, REQ_OP_WRITE | op_flags);
+	gfs2_log_write(sdp, jd, page, sb->s_blocksize, 0, dblock,
+		       REQ_OP_WRITE | op_flags);
+	gfs2_log_submit_write(&jd->jd_log_bio);
 }
 
 /**

@@ -1096,7 +1097,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags)
 	if (gfs2_withdrawn(sdp))
 		goto out_withdraw;
 	if (sdp->sd_jdesc)
-		gfs2_log_submit_write(&sdp->sd_jdesc->jd_log_bio, REQ_OP_WRITE);
+		gfs2_log_submit_write(&sdp->sd_jdesc->jd_log_bio);
 	if (gfs2_withdrawn(sdp))
 		goto out_withdraw;
 

index aa9e9fe25c2f7..c3317432a25b3 100644
@@ -231,19 +231,17 @@ static void gfs2_end_log_write(struct bio *bio)
 /**
  * gfs2_log_submit_write - Submit a pending log write bio
  * @biop: Address of the bio pointer
- * @opf: REQ_OP | op_flags
  *
  * Submit any pending part-built or full bio to the block device. If
  * there is no pending bio, then this is a no-op.
  */
 
-void gfs2_log_submit_write(struct bio **biop, blk_opf_t opf)
+void gfs2_log_submit_write(struct bio **biop)
 {
 	struct bio *bio = *biop;
 	if (bio) {
 		struct gfs2_sbd *sdp = bio->bi_private;
 		atomic_inc(&sdp->sd_log_in_flight);
-		bio->bi_opf = opf;
 		submit_bio(bio);
 		*biop = NULL;
 	}

@@ -254,6 +252,7 @@ void gfs2_log_submit_write(struct bio **biop, blk_opf_t opf)
  * @sdp: The super block
  * @blkno: The device block number we want to write to
  * @end_io: The bi_end_io callback
+ * @opf: REQ_OP | op_flags
  *
  * Allocate a new bio, initialize it with the given parameters and return it.
  *

@@ -261,10 +260,10 @@ void gfs2_log_submit_write(struct bio **biop, blk_opf_t opf)
  */
 
 static struct bio *gfs2_log_alloc_bio(struct gfs2_sbd *sdp, u64 blkno,
-				      bio_end_io_t *end_io)
+				      bio_end_io_t *end_io, blk_opf_t opf)
 {
 	struct super_block *sb = sdp->sd_vfs;
-	struct bio *bio = bio_alloc(sb->s_bdev, BIO_MAX_VECS, 0, GFP_NOIO);
+	struct bio *bio = bio_alloc(sb->s_bdev, BIO_MAX_VECS, opf, GFP_NOIO);
 
 	bio->bi_iter.bi_sector = blkno << sdp->sd_fsb2bb_shift;
 	bio->bi_end_io = end_io;

@@ -303,10 +302,10 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno,
 		nblk >>= sdp->sd_fsb2bb_shift;
 		if (blkno == nblk && !flush)
 			return bio;
-		gfs2_log_submit_write(biop, op);
+		gfs2_log_submit_write(biop);
 	}
 
-	*biop = gfs2_log_alloc_bio(sdp, blkno, end_io);
+	*biop = gfs2_log_alloc_bio(sdp, blkno, end_io, op);
 	return *biop;
 }
 

@@ -318,6 +317,7 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno,
  * @size: the size of the data to write
  * @offset: the offset within the page 
  * @blkno: block number of the log entry
+ * @opf: REQ_OP | op_flags
  *
  * Try and add the page segment to the current bio. If that fails,
  * submit the current bio to the device and create a new one, and

@@ -326,17 +326,17 @@ static struct bio *gfs2_log_get_bio(struct gfs2_sbd *sdp, u64 blkno,
 
 void gfs2_log_write(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
 		    struct page *page, unsigned size, unsigned offset,
-		    u64 blkno)
+		    u64 blkno, blk_opf_t opf)
 {
 	struct bio *bio;
 	int ret;
 
-	bio = gfs2_log_get_bio(sdp, blkno, &jd->jd_log_bio, REQ_OP_WRITE,
+	bio = gfs2_log_get_bio(sdp, blkno, &jd->jd_log_bio, opf,
 			       gfs2_end_log_write, false);
 	ret = bio_add_page(bio, page, size, offset);
 	if (ret == 0) {
 		bio = gfs2_log_get_bio(sdp, blkno, &jd->jd_log_bio,
-				       REQ_OP_WRITE, gfs2_end_log_write, true);
+				       opf, gfs2_end_log_write, true);
 		ret = bio_add_page(bio, page, size, offset);
 		WARN_ON(ret == 0);
 	}

@@ -359,7 +359,7 @@ static void gfs2_log_write_bh(struct gfs2_sbd *sdp, struct buffer_head *bh)
 	dblock = gfs2_log_bmap(sdp->sd_jdesc, sdp->sd_log_flush_head);
 	gfs2_log_incr_head(sdp);
 	gfs2_log_write(sdp, sdp->sd_jdesc, folio_page(bh->b_folio, 0),
-			bh->b_size, bh_offset(bh), dblock);
+			bh->b_size, bh_offset(bh), dblock, REQ_OP_WRITE);
 }
 
 /**

@@ -380,7 +380,8 @@ static void gfs2_log_write_page(struct gfs2_sbd *sdp, struct page *page)
 
 	dblock = gfs2_log_bmap(sdp->sd_jdesc, sdp->sd_log_flush_head);
 	gfs2_log_incr_head(sdp);
-	gfs2_log_write(sdp, sdp->sd_jdesc, page, sb->s_blocksize, 0, dblock);
+	gfs2_log_write(sdp, sdp->sd_jdesc, page, sb->s_blocksize, 0, dblock,
+		       REQ_OP_WRITE);
 }
 
 /**

@@ -477,11 +478,12 @@ static void gfs2_jhead_process_page(struct gfs2_jdesc *jd, unsigned long index,
 	folio_put_refs(folio, 2);
 }
 
-static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs)
+static struct bio *gfs2_chain_bio(struct bio *prev, unsigned int nr_iovecs,
+				  blk_opf_t opf)
 {
 	struct bio *new;
 
-	new = bio_alloc(prev->bi_bdev, nr_iovecs, prev->bi_opf, GFP_NOIO);
+	new = bio_alloc(prev->bi_bdev, nr_iovecs, opf, GFP_NOIO);
 	bio_clone_blkg_association(new, prev);
 	new->bi_iter.bi_sector = bio_end_sector(prev);
 	bio_chain(new, prev);

@@ -546,7 +548,8 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
 					unsigned int blocks =
 						(PAGE_SIZE - off) >> bsize_shift;
 
-					bio = gfs2_chain_bio(bio, blocks);
+					bio = gfs2_chain_bio(bio, blocks,
+							     REQ_OP_READ);
 					goto add_block_to_new_bio;
 				}
 			}

@@ -556,8 +559,8 @@ int gfs2_find_jhead(struct gfs2_jdesc *jd, struct gfs2_log_header_host *head)
 				submit_bio(bio);
 			}
 
-			bio = gfs2_log_alloc_bio(sdp, dblock, gfs2_end_log_read);
-			bio->bi_opf = REQ_OP_READ;
+			bio = gfs2_log_alloc_bio(sdp, dblock, gfs2_end_log_read,
+						 REQ_OP_READ);
 add_block_to_new_bio:
 			bio_add_folio_nofail(bio, folio, bsize, off);
 block_added:

index 010a4696406bb..772557b63b48b 100644
@@ -16,8 +16,8 @@ void gfs2_log_incr_head(struct gfs2_sbd *sdp);
 u64 gfs2_log_bmap(struct gfs2_jdesc *jd, unsigned int lbn);
 void gfs2_log_write(struct gfs2_sbd *sdp, struct gfs2_jdesc *jd,
 		    struct page *page, unsigned size, unsigned offset,
-		    u64 blkno);
-void gfs2_log_submit_write(struct bio **biop, blk_opf_t opf);
+		    u64 blkno, blk_opf_t opf);
+void gfs2_log_submit_write(struct bio **biop);
 void gfs2_pin(struct gfs2_sbd *sdp, struct buffer_head *bh);
 int gfs2_find_jhead(struct gfs2_jdesc *jd,
 		    struct gfs2_log_header_host *head);

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Andreas Gruenbacher <[email protected]>

[ Upstream commit 22150a7d401d9e9169b9b68e05bed95f7f49bf69 ]

Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list.

Fix this by removing qd objects from the LRU list before freeing them in qd_put().

Initial fix from Deepanshu Kartikey <[email protected]>.

---
 fs/gfs2/quota.c | 1 +
 1 file changed, 1 insertion(+)

index b1692f12a602a..2b499b554e876 100644
@@ -334,6 +334,7 @@ static void qd_put(struct gfs2_quota_data *qd)
 		lockref_mark_dead(&qd->qd_lockref);
 		spin_unlock(&qd->qd_lockref.lock);
 
+		list_lru_del_obj(&gfs2_qd_lru, &qd->qd_lru);
 		gfs2_qd_dispose(qd);
 		return;
 	}

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Joanne Koong <[email protected]>

[ Upstream commit aa35dd5cbc060bc3e28ad22b1d76eefa3f024030 ]

If the folio does not have an iomap_folio_state (ifs) attached and the folio gets read in by the filesystem's IO helper, folio_end_read() will be called by the IO helper at any time. For this case, we cannot access the folio after dispatching it to the IO helper, eg subsequent accesses like

        if (ctx->cur_folio &&
                    offset_in_folio(ctx->cur_folio, iter->pos) == 0) {

are incorrect.

Fix these invalid accesses by invalidating ctx->cur_folio if all bytes of the folio have been read in by the IO helper.

This allows us to also remove the +1 bias added for the ifs case. The bias was previously added to ensure that if all bytes are read in, the IO helper does not end the read on the folio until iomap has decremented the bias.

---
 fs/iomap/buffered-io.c | 51 ++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 24 deletions(-)

index 6beb876658c09..e3bedcbb5f1ea 100644
@@ -409,8 +409,6 @@ static void iomap_read_init(struct folio *folio)
 	struct iomap_folio_state *ifs = folio->private;
 
 	if (ifs) {
-		size_t len = folio_size(folio);
-
 		/*
 		 * ifs->read_bytes_pending is used to track how many bytes are
 		 * read in asynchronously by the IO helper. We need to track

@@ -418,23 +416,19 @@ static void iomap_read_init(struct folio *folio)
 		 * reading in all the necessary ranges of the folio and can end
 		 * the read.
 		 *
-		 * Increase ->read_bytes_pending by the folio size to start, and
-		 * add a +1 bias. We'll subtract the bias and any uptodate /
-		 * zeroed ranges that did not require IO in iomap_read_end()
-		 * after we're done processing the folio.
+		 * Increase ->read_bytes_pending by the folio size to start.
+		 * We'll subtract any uptodate / zeroed ranges that did not
+		 * require IO in iomap_read_end() after we're done processing
+		 * the folio.
 		 *
 		 * We do this because otherwise, we would have to increment
 		 * ifs->read_bytes_pending every time a range in the folio needs
 		 * to be read in, which can get expensive since the spinlock
 		 * needs to be held whenever modifying ifs->read_bytes_pending.
-		 *
-		 * We add the bias to ensure the read has not been ended on the
-		 * folio when iomap_read_end() is called, even if the IO helper
-		 * has already finished reading in the entire folio.
 		 */
 		spin_lock_irq(&ifs->state_lock);
 		WARN_ON_ONCE(ifs->read_bytes_pending != 0);
-		ifs->read_bytes_pending = len + 1;
+		ifs->read_bytes_pending = folio_size(folio);
 		spin_unlock_irq(&ifs->state_lock);
 	}
 }

@@ -465,11 +459,9 @@ static void iomap_read_end(struct folio *folio, size_t bytes_submitted)
 
 		/*
 		 * Subtract any bytes that were initially accounted to
-		 * read_bytes_pending but skipped for IO. The +1 accounts for
-		 * the bias we added in iomap_read_init().
+		 * read_bytes_pending but skipped for IO.
 		 */
-		ifs->read_bytes_pending -=
-			(folio_size(folio) + 1 - bytes_submitted);
+		ifs->read_bytes_pending -= folio_size(folio) - bytes_submitted;
 
 		/*
 		 * If !ifs->read_bytes_pending, this means all pending reads by

@@ -483,14 +475,16 @@ static void iomap_read_end(struct folio *folio, size_t bytes_submitted)
 		spin_unlock_irq(&ifs->state_lock);
 		if (end_read)
 			folio_end_read(folio, uptodate);
-	} else if (!bytes_submitted) {
+	} else {
 		/*
-		 * If there were no bytes submitted, this means we are
-		 * responsible for unlocking the folio here, since no IO helper
-		 * has taken ownership of it. If there were bytes submitted,
-		 * then the IO helper will end the read via
-		 * iomap_finish_folio_read().
+		 * If a folio without an ifs is submitted to the IO helper, the
+		 * read must be on the entire folio and the IO helper takes
+		 * ownership of the folio. This means we should only enter
+		 * iomap_read_end() for the !ifs case if no bytes were submitted
+		 * to the IO helper, in which case we are responsible for
+		 * unlocking the folio here.
 		 */
+		WARN_ON_ONCE(bytes_submitted);
 		folio_unlock(folio);
 	}
 }

@@ -502,6 +496,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
 	loff_t pos = iter->pos;
 	loff_t length = iomap_length(iter);
 	struct folio *folio = ctx->cur_folio;
+	size_t folio_len = folio_size(folio);
 	size_t poff, plen;
 	loff_t pos_diff;
 	int ret;

@@ -515,8 +510,7 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
 
 	ifs_alloc(iter->inode, folio, iter->flags);
 
-	length = min_t(loff_t, length,
-			folio_size(folio) - offset_in_folio(folio, pos));
+	length = min_t(loff_t, length, folio_len - offset_in_folio(folio, pos));
 	while (length) {
 		iomap_adjust_read_range(iter->inode, folio, &pos, length, &poff,
 				&plen);

@@ -542,7 +536,15 @@ static int iomap_read_folio_iter(struct iomap_iter *iter,
 			ret = ctx->ops->read_folio_range(iter, ctx, plen);
 			if (ret)
 				return ret;
+
 			*bytes_submitted += plen;
+			/*
+			 * If the entire folio has been read in by the IO
+			 * helper, then the helper owns the folio and will end
+			 * the read on it.
+			 */
+			if (*bytes_submitted == folio_len)
+				ctx->cur_folio = NULL;
 		}
 
 		ret = iomap_iter_advance(iter, plen);

@@ -575,7 +577,8 @@ void iomap_read_folio(const struct iomap_ops *ops,
 	if (ctx->ops->submit_read)
 		ctx->ops->submit_read(ctx);
 
-	iomap_read_end(folio, bytes_submitted);
+	if (ctx->cur_folio)
+		iomap_read_end(ctx->cur_folio, bytes_submitted);
 }
 EXPORT_SYMBOL_GPL(iomap_read_folio);
 

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deepanshu Kartikey <[email protected]>

[ Upstream commit faddeb848305e79db89ee0479bb0e33380656321 ]

The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area.

The bug sequence:
1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode metadata into dibh
2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)
3. Calls release_metapath() which calls brelse(dibh), dropping refcount to 0
4. kswapd reclaims the page (~39ms later in the syzbot report)
5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data
6. KASAN detects use-after-free write to freed memory

Fix by storing dibh in iomap->private and incrementing its refcount with get_bh() in gfs2_iomap_begin(). The buffer is then properly released in gfs2_iomap_end() after the inline write completes, ensuring the page stays alive for the entire iomap operation.

Note: A C reproducer is not available for this issue. The fix is based on analysis of the KASAN report and code review showing the buffer head is freed before use.

[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid leaks in gfs2_iomap_get() and gfs2_iomap_alloc().]

---
 fs/gfs2/bmap.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

index 131091520de6b..fdcac8e3f2ba2 100644
@@ -1127,10 +1127,18 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length,
 			goto out_unlock;
 		break;
 	default:
-		goto out_unlock;
+		goto out;
 	}
 
 	ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp);
+	if (ret)
+		goto out_unlock;
+
+out:
+	if (iomap->type == IOMAP_INLINE) {
+		iomap->private = metapath_dibh(&mp);
+		get_bh(iomap->private);
+	}
 
 out_unlock:
 	release_metapath(&mp);

@@ -1144,6 +1152,9 @@ static int gfs2_iomap_end(struct inode *inode, loff_t pos, loff_t length,
 	struct gfs2_inode *ip = GFS2_I(inode);
 	struct gfs2_sbd *sdp = GFS2_SB(inode);
 
+	if (iomap->private)
+		brelse(iomap->private);
+
 	switch (flags & (IOMAP_WRITE | IOMAP_ZERO)) {
 	case IOMAP_WRITE:
 		if (flags & IOMAP_DIRECT)

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Fredrik Markstrom <[email protected]>

[ Upstream commit b58eaa4761ab02fc38c39d674a6bcdd55e00f388 ]

The devs_lock spinlock introduced when adding support for ibi:s was never initialized.

---
 drivers/i3c/master/dw-i3c-master.c | 2 ++
 1 file changed, 2 insertions(+)

index 889e2ed5bc830..d5b0704040562 100644
@@ -1570,6 +1570,8 @@ int dw_i3c_common_probe(struct dw_i3c_master *master,
 	spin_lock_init(&master->xferqueue.lock);
 	INIT_LIST_HEAD(&master->xferqueue.list);
 
+	spin_lock_init(&master->devs_lock);
+
 	writel(INTR_ALL, master->regs + INTR_STATUS);
 	irq = platform_get_irq(pdev, 0);
 	ret = devm_request_irq(&pdev->dev, irq,

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zilin Guan <[email protected]>

[ Upstream commit 2537089413514caaa9a5fdeeac3a34d45100f747 ]

The dw_i3c_master_i2c_xfers() function allocates memory for the xfer structure using dw_i3c_master_alloc_xfer(). If pm_runtime_resume_and_get() fails, the function returns without freeing the allocated xfer, resulting in a memory leak.

Add a dw_i3c_master_free_xfer() call to the error path to ensure the allocated memory is properly freed.

Compile tested only. Issue found using a prototype static analysis tool and code review.

---
 drivers/i3c/master/dw-i3c-master.c | 1 +
 1 file changed, 1 insertion(+)

index d5b0704040562..4033bc16677ff 100644
@@ -1099,6 +1099,7 @@ static int dw_i3c_master_i2c_xfers(struct i2c_dev_desc *dev,
 		dev_err(master->dev,
 			"<%s> cannot resume i3c bus master, err: %d\n",
 			__func__, ret);
+		dw_i3c_master_free_xfer(xfer);
 		return ret;
 	}
 

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alper Ak <[email protected]>

[ Upstream commit bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713 ]

get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send().

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

---
 drivers/char/tpm/tpm_i2c_infineon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index bdf1f329a6794..8b7d32de0b2ef 100644
@@ -544,8 +544,10 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz,
 		burstcnt = get_burstcount(chip);
 
 		/* burstcnt < 0 = TPM is busy */
-		if (burstcnt < 0)
-			return burstcnt;
+		if (burstcnt < 0) {
+			rc = burstcnt;
+			goto out_err;
+		}
 
 		if (burstcnt > (len - 1 - count))
 			burstcnt = len - 1 - count;

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Alper Ak <[email protected]>

[ Upstream commit 3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9 ]

get_burstcount() can return -EBUSY on timeout. When this happens, st33zp24_send() returns directly without releasing the locality acquired earlier.

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

---
 drivers/char/tpm/st33zp24/st33zp24.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

index 2ed7815e4899b..e2b7451ea7ccd 100644
@@ -328,8 +328,10 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf,
 
 	for (i = 0; i < len - 1;) {
 		burstcnt = get_burstcount(chip);
-		if (burstcnt < 0)
-			return burstcnt;
+		if (burstcnt < 0) {
+			ret = burstcnt;
+			goto out_err;
+		}
 		size = min_t(int, len - i - 1, burstcnt);
 		ret = tpm_dev->ops->send(tpm_dev->phy_id, TPM_DATA_FIFO,
 					 buf + i, size);

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

[ Upstream commit bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc ]

I/O requests beyond the end of the filesystem should be zeroed out, similar to loopback devices and that is what we expect.

---
 fs/erofs/fileio.c | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

index 1673c5416fba1..2a778a02681a0 100644
@@ -25,21 +25,17 @@ static void erofs_fileio_ki_complete(struct kiocb *iocb, long ret)
 			container_of(iocb, struct erofs_fileio_rq, iocb);
 	struct folio_iter fi;
 
-	if (ret > 0) {
-		if (ret != rq->bio.bi_iter.bi_size) {
-			bio_advance(&rq->bio, ret);
-			zero_fill_bio(&rq->bio);
-		}
-		ret = 0;
+	if (ret >= 0 && ret != rq->bio.bi_iter.bi_size) {
+		bio_advance(&rq->bio, ret);
+		zero_fill_bio(&rq->bio);
 	}
-	if (rq->bio.bi_end_io) {
-		if (ret < 0 && !rq->bio.bi_status)
-			rq->bio.bi_status = errno_to_blk_status(ret);
-	} else {
+	if (!rq->bio.bi_end_io) {
 		bio_for_each_folio_all(fi, &rq->bio) {
 			DBG_BUGON(folio_test_uptodate(fi.folio));
-			erofs_onlinefolio_end(fi.folio, ret, false);
+			erofs_onlinefolio_end(fi.folio, ret < 0, false);
 		}
+	} else if (ret < 0 && !rq->bio.bi_status) {
+		rq->bio.bi_status = errno_to_blk_status(ret);
 	}
 	bio_endio(&rq->bio);
 	bio_uninit(&rq->bio);

@@ -50,7 +46,7 @@ static void erofs_fileio_ki_complete(struct kiocb *iocb, long ret)
 static void erofs_fileio_rq_submit(struct erofs_fileio_rq *rq)
 {
 	struct iov_iter iter;
-	int ret;
+	ssize_t ret;
 
 	if (!rq)
 		return;

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Johannes Thumshirn <[email protected]>

[ Upstream commit b39b26e017c7889181cb84032e22bef72e81cf29 ]

In case of a zoned RAID, it can happen that a data write is targeting a sequential write required zone and a conventional zone. In this case the bio will be marked as REQ_OP_ZONE_APPEND but for the conventional zone, this needs to be REQ_OP_WRITE.

The setting of REQ_OP_ZONE_APPEND is deferred to the last possible time in btrfs_submit_dev_bio(), but the decision if we can use zone append is cached in btrfs_bio.

---
 fs/btrfs/bio.c | 19 +++++++++----------
 fs/btrfs/bio.h |  3 +++
 2 files changed, 12 insertions(+), 10 deletions(-)

index fa1d321a2fb83..e4d382d3a7aea 100644
@@ -480,6 +480,8 @@ static void btrfs_clone_write_end_io(struct bio *bio)
 
 static void btrfs_submit_dev_bio(struct btrfs_device *dev, struct bio *bio)
 {
+	u64 physical = bio->bi_iter.bi_sector << SECTOR_SHIFT;
+
 	if (!dev || !dev->bdev ||
 	    test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state) ||
 	    (btrfs_op(bio) == BTRFS_MAP_WRITE &&

@@ -494,12 +496,13 @@ static void btrfs_submit_dev_bio(struct btrfs_device *dev, struct bio *bio)
 	 * For zone append writing, bi_sector must point the beginning of the
 	 * zone
 	 */
-	if (bio_op(bio) == REQ_OP_ZONE_APPEND) {
-		u64 physical = bio->bi_iter.bi_sector << SECTOR_SHIFT;
+	if (btrfs_bio(bio)->can_use_append && btrfs_dev_is_sequential(dev, physical)) {
 		u64 zone_start = round_down(physical, dev->fs_info->zone_size);
 
 		ASSERT(btrfs_dev_is_sequential(dev, physical));
 		bio->bi_iter.bi_sector = zone_start >> SECTOR_SHIFT;
+		bio->bi_opf &= ~REQ_OP_WRITE;
+		bio->bi_opf |= REQ_OP_ZONE_APPEND;
 	}
 	btrfs_debug(dev->fs_info,
 	"%s: rw %d 0x%x, sector=%llu, dev=%lu (%s id %llu), size=%u",

@@ -747,7 +750,6 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 	u64 logical = bio->bi_iter.bi_sector << SECTOR_SHIFT;
 	u64 length = bio->bi_iter.bi_size;
 	u64 map_length = length;
-	bool use_append = btrfs_use_zone_append(bbio);
 	struct btrfs_io_context *bioc = NULL;
 	struct btrfs_io_stripe smap;
 	blk_status_t status;

@@ -775,8 +777,10 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 	if (bio_op(bio) == REQ_OP_WRITE && is_data_bbio(bbio))
 		bbio->orig_logical = logical;
 
+	bbio->can_use_append = btrfs_use_zone_append(bbio);
+
 	map_length = min(map_length, length);
-	if (use_append)
+	if (bbio->can_use_append)
 		map_length = btrfs_append_map_length(bbio, map_length);
 
 	if (map_length < length) {

@@ -805,11 +809,6 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 	}
 
 	if (btrfs_op(bio) == BTRFS_MAP_WRITE) {
-		if (use_append) {
-			bio->bi_opf &= ~REQ_OP_WRITE;
-			bio->bi_opf |= REQ_OP_ZONE_APPEND;
-		}
-
 		if (is_data_bbio(bbio) && bioc && bioc->use_rst) {
 			/*
 			 * No locking for the list update, as we only add to

@@ -836,7 +835,7 @@ static bool btrfs_submit_chunk(struct btrfs_bio *bbio, int mirror_num)
 			status = errno_to_blk_status(ret);
 			if (status)
 				goto fail;
-		} else if (use_append ||
+		} else if (bbio->can_use_append ||
 			   (btrfs_is_zoned(fs_info) && inode &&
 			    inode->flags & BTRFS_INODE_NODATASUM)) {
 			ret = btrfs_alloc_dummy_sum(bbio);

index 1be74209f0b8d..246c7519dff39 100644
@@ -92,6 +92,9 @@ struct btrfs_bio {
 	/* Whether the csum generation for data write is async. */
 	bool async_csum;
 
+	/* Whether the bio is written using zone append. */
+	bool can_use_append;
+
 	/*
 	 * This member must come last, bio_alloc_bioset will allocate enough
 	 * bytes for entire btrfs_bio but relies on bio being last.

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Filipe Manana <[email protected]>

[ Upstream commit 51b1fcf71c88c3c89e7dcf07869c5de837b1f428 ]

If we fail to delete the second qgroup relation item, we end up returning success or -ENOENT in case the first item does not exist, instead of returning the error from the second item deletion.

---
 fs/btrfs/qgroup.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

index 206587820fec0..c634e01140514 100644
@@ -1607,8 +1607,10 @@ static int __del_qgroup_relation(struct btrfs_trans_handle *trans, u64 src,
 	if (ret < 0 && ret != -ENOENT)
 		goto out;
 	ret2 = del_qgroup_relation_item(trans, dst, src);
-	if (ret2 < 0 && ret2 != -ENOENT)
+	if (ret2 < 0 && ret2 != -ENOENT) {
+		ret = ret2;
 		goto out;
+	}
 
 	/* At least one deletion succeeded, return 0 */
 	if (!ret || !ret2)

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris Burkov <[email protected]>

[ Upstream commit 3a1f4264daed4b419c325a7fe35e756cada3cf82 ]

When the incompat flag EXTENT_TREE_V2 is set, we unconditionally add the block group tree to the switch_commits list before calling switch_commit_roots, as we do for the tree root and the chunk root. However, the block group tree uses normal root dirty tracking and in any transaction that does an allocation and dirties a block group, the block group root will already be linked to a list by the dirty_list field and this use of list_add_tail() is invalid and corrupts the prev/next members of block_group_root->dirty_list.

This is apparent on a subsequent list_del on the prev if we enable CONFIG_DEBUG_LIST:

  [32.1571] ------------[ cut here ]------------
  [32.1572] list_del corruption. next->prev should beffff958890202538, but was ffff9588992bd538. (next=ffff958890201538)
  [32.1575] WARNING: lib/list_debug.c:65 at 0x0, CPU#3: sync/607
  [32.1583] CPU: 3 UID: 0 PID: 607 Comm: sync Not tainted 6.18.0 #24PREEMPT(none)
  [32.1585] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS1.17.0-4.fc41 04/01/2014
  [32.1587] RIP: 0010:__list_del_entry_valid_or_report+0x108/0x120
  [32.1593] RSP: 0018:ffffaa288287fdd0 EFLAGS: 00010202
  [32.1594] RAX: 0000000000000001 RBX: ffff95889326e800 RCX:ffff958890201538
  [32.1596] RDX: ffff9588992bd538 RSI: ffff958890202538 RDI:ffffffff82a41e00
  [32.1597] RBP: ffff958890202538 R08: ffffffff828fc1e8 R09:00000000ffffefff
  [32.1599] R10: ffffffff8288c200 R11: ffffffff828e4200 R12:ffff958890201538
  [32.1601] R13: ffff95889326e958 R14: ffff958895c24000 R15:ffff958890202538
  [32.1603] FS:  00007f0c28eb5740(0000) GS:ffff958af2bd2000(0000)knlGS:0000000000000000
  [32.1605] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [32.1607] CR2: 00007f0c28e8a3cc CR3: 0000000109942005 CR4:0000000000370ef0
  [32.1609] Call Trace:
  [32.1610]  <TASK>
  [32.1611]  switch_commit_roots+0x82/0x1d0 [btrfs]
  [32.1615]  btrfs_commit_transaction+0x968/0x1550 [btrfs]
  [32.1618]  ? btrfs_attach_transaction_barrier+0x23/0x60 [btrfs]
  [32.1621]  __iterate_supers+0xe8/0x190
  [32.1622]  ? __pfx_sync_fs_one_sb+0x10/0x10
  [32.1623]  ksys_sync+0x63/0xb0
  [32.1624]  __do_sys_sync+0xe/0x20
  [32.1625]  do_syscall_64+0x73/0x450
  [32.1626]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
  [32.1627] RIP: 0033:0x7f0c28d05d2b
  [32.1632] RSP: 002b:00007ffc9d988048 EFLAGS: 00000246 ORIG_RAX:00000000000000a2
  [32.1634] RAX: ffffffffffffffda RBX: 00007ffc9d988228 RCX:00007f0c28d05d2b
  [32.1636] RDX: 00007f0c28e02301 RSI: 00007ffc9d989b21 RDI:00007f0c28dba90d
  [32.1637] RBP: 0000000000000001 R08: 0000000000000001 R09:0000000000000000
  [32.1639] R10: 0000000000000000 R11: 0000000000000246 R12:000055b96572cb80
  [32.1641] R13: 000055b96572b19f R14: 00007f0c28dfa434 R15:000055b96572b034
  [32.1643]  </TASK>
  [32.1644] irq event stamp: 0
  [32.1644] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
  [32.1646] hardirqs last disabled at (0): [<ffffffff81298817>]copy_process+0xb37/0x2260
  [32.1648] softirqs last  enabled at (0): [<ffffffff81298817>]copy_process+0xb37/0x2260
  [32.1650] softirqs last disabled at (0): [<0000000000000000>] 0x0
  [32.1652] ---[ end trace 0000000000000000 ]---

Furthermore, this list corruption eventually (when we happen to add a new block group) results in getting the switch_commits and dirty_cowonly_roots lists mixed up and attempting to call update_root on the tree root which can't be found in the tree root, resulting in a transaction abort:

  [87.8269] BTRFS critical (device nvme1n1): unable to find root key (1 0 0) in tree 1
  [87.8272] ------------[ cut here ]------------
  [87.8274] BTRFS: Transaction aborted (error -117)
  [87.8275] WARNING: fs/btrfs/root-tree.c:153 at 0x0, CPU#4: sync/703
  [87.8285] CPU: 4 UID: 0 PID: 703 Comm: sync Not tainted 6.18.0 #25 PREEMPT(none)
  [87.8287] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-4.fc41 04/01/2014
  [87.8289] RIP: 0010:btrfs_update_root+0x296/0x790 [btrfs]
  [87.8295] RSP: 0018:ffffa58d035dfd60 EFLAGS: 00010282
  [87.8297] RAX: ffff9a59126ddb68 RBX: ffff9a59126dc000 RCX: 0000000000000000
  [87.8299] RDX: 0000000000000000 RSI: 00000000ffffff8b RDI: ffffffffc0b28270
  [87.8301] RBP: ffff9a5904aec000 R08: 0000000000000000 R09: 00000000ffffefff
  [87.8303] R10: ffffffff9ac8c200 R11: ffffffff9ace4200 R12: 0000000000000001
  [87.8305] R13: ffff9a59041740e8 R14: ffff9a5904aec1f7 R15: ffff9a590fdefaf0
  [87.8307] FS:  00007f54cde6b740(0000) GS:ffff9a5b5a81c000(0000) knlGS:0000000000000000
  [87.8309] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [87.8310] CR2: 00007f54cde403cc CR3: 0000000112902004 CR4: 0000000000370ef0
  [87.8312] Call Trace:
  [87.8313]  <TASK>
  [87.8314]  ? _raw_spin_unlock+0x23/0x40
  [87.8315]  commit_cowonly_roots+0x1ad/0x250 [btrfs]
  [87.8317]  ? btrfs_commit_transaction+0x79b/0x1560 [btrfs]
  [87.8320]  btrfs_commit_transaction+0x8aa/0x1560 [btrfs]
  [87.8322]  ? btrfs_attach_transaction_barrier+0x23/0x60 [btrfs]
  [87.8325]  __iterate_supers+0xf1/0x170
  [87.8326]  ? __pfx_sync_fs_one_sb+0x10/0x10
  [87.8327]  ksys_sync+0x63/0xb0
  [87.8328]  __do_sys_sync+0xe/0x20
  [87.8329]  do_syscall_64+0x73/0x450
  [87.8330]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
  [87.8331] RIP: 0033:0x7f54cdd05d2b
  [87.8336] RSP: 002b:00007fff1b58ff78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
  [87.8338] RAX: ffffffffffffffda RBX: 00007fff1b590158 RCX: 00007f54cdd05d2b
  [87.8340] RDX: 00007f54cde02301 RSI: 00007fff1b592b66 RDI: 00007f54cddba90d
  [87.8342] RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
  [87.8344] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e07ca96b80
  [87.8346] R13: 000055e07ca9519f R14: 00007f54cddfa434 R15: 000055e07ca95034
  [87.8348]  </TASK>
  [87.8348] irq event stamp: 0
  [87.8349] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
  [87.8351] hardirqs last disabled at (0): [<ffffffff99698797>] copy_process+0xb37/0x21e0
  [87.8353] softirqs last  enabled at (0): [<ffffffff99698797>] copy_process+0xb37/0x21e0
  [87.8355] softirqs last disabled at (0): [<0000000000000000>] 0x0
  [87.8357] ---[ end trace 0000000000000000 ]---
  [87.8358] BTRFS: error (device nvme1n1 state A) in btrfs_update_root:153: errno=-117 Filesystem corrupted
  [87.8360] BTRFS info (device nvme1n1 state EA): forced readonly
  [87.8362] BTRFS warning (device nvme1n1 state EA): Skipping commit of aborted transaction.
  [87.8364] BTRFS: error (device nvme1n1 state EA) in cleanup_transaction:2037: errno=-117 Filesystem corrupted

Since the block group tree was pulled out of the extent tree and uses normal root dirty tracking, remove the offending extra list_add. This fixes the list corruption and the resulting fs corruption.

---
 fs/btrfs/transaction.c | 7 -------
 1 file changed, 7 deletions(-)

index bd03f465e2d3e..e3e0d88d53476 100644
@@ -2500,13 +2500,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
 	list_add_tail(&fs_info->chunk_root->dirty_list,
 		      &cur_trans->switch_commits);
 
-	if (btrfs_fs_incompat(fs_info, EXTENT_TREE_V2)) {
-		btrfs_set_root_node(&fs_info->block_group_root->root_item,
-				    fs_info->block_group_root->node);
-		list_add_tail(&fs_info->block_group_root->dirty_list,
-			      &cur_trans->switch_commits);
-	}
-
 	switch_commit_roots(trans);
 
 	ASSERT(list_empty(&cur_trans->dirty_bgs));

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris Burkov <[email protected]>

[ Upstream commit b14c5e04bd0f722ed631845599d52d03fcae1bc1 ]

I have been observing a number of systems aborting at insert_dev_extents() in btrfs_create_pending_block_groups(). The following is a sample stack trace of such an abort coming from forced chunk allocation (typically behind CONFIG_BTRFS_EXPERIMENTAL) but this can theoretically happen to any DUP chunk allocation.

  [81.801] ------------[ cut here ]------------
  [81.801] BTRFS: Transaction aborted (error -17)
  [81.801] WARNING: fs/btrfs/block-group.c:2876 at btrfs_create_pending_block_groups+0x721/0x770 [btrfs], CPU#1: bash/319
  [81.802] Modules linked in: virtio_net btrfs xor zstd_compress raid6_pq null_blk
  [81.803] CPU: 1 UID: 0 PID: 319 Comm: bash Kdump: loaded Not tainted 6.19.0-rc6+ #319 NONE
  [81.803] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014
  [81.804] RIP: 0010:btrfs_create_pending_block_groups+0x723/0x770 [btrfs]
  [81.806] RSP: 0018:ffffa36241a6bce8 EFLAGS: 00010282
  [81.806] RAX: 000000000000000d RBX: ffff8e699921e400 RCX: 0000000000000000
  [81.807] RDX: 0000000002040001 RSI: 00000000ffffffef RDI: ffffffffc0608bf0
  [81.807] RBP: 00000000ffffffef R08: ffff8e69830f6000 R09: 0000000000000007
  [81.808] R10: ffff8e699921e5e8 R11: 0000000000000000 R12: ffff8e6999228000
  [81.808] R13: ffff8e6984d82000 R14: ffff8e69966a69c0 R15: ffff8e69aa47b000
  [81.809] FS:  00007fec6bdd9740(0000) GS:ffff8e6b1b379000(0000) knlGS:0000000000000000
  [81.809] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [81.810] CR2: 00005604833670f0 CR3: 0000000116679000 CR4: 00000000000006f0
  [81.810] Call Trace:
  [81.810]  <TASK>
  [81.810]  __btrfs_end_transaction+0x3e/0x2b0 [btrfs]
  [81.811]  btrfs_force_chunk_alloc_store+0xcd/0x140 [btrfs]
  [81.811]  kernfs_fop_write_iter+0x15f/0x240
  [81.812]  vfs_write+0x264/0x500
  [81.812]  ksys_write+0x6c/0xe0
  [81.812]  do_syscall_64+0x66/0x770
  [81.812]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
  [81.813] RIP: 0033:0x7fec6be66197
  [81.814] RSP: 002b:00007fffb159dd30 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
  [81.815] RAX: ffffffffffffffda RBX: 00007fec6bdd9740 RCX: 00007fec6be66197
  [81.815] RDX: 0000000000000002 RSI: 0000560483374f80 RDI: 0000000000000001
  [81.816] RBP: 0000560483374f80 R08: 0000000000000000 R09: 0000000000000000
  [81.816] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
  [81.817] R13: 00007fec6bfb85c0 R14: 00007fec6bfb5ee0 R15: 00005604833729c0
  [81.817]  </TASK>
  [81.817] irq event stamp: 20039
  [81.818] hardirqs last  enabled at (20047): [<ffffffff99a68302>] __up_console_sem+0x52/0x60
  [81.818] hardirqs last disabled at (20056): [<ffffffff99a682e7>] __up_console_sem+0x37/0x60
  [81.819] softirqs last  enabled at (19470): [<ffffffff999d2b46>] __irq_exit_rcu+0x96/0xc0
  [81.819] softirqs last disabled at (19463): [<ffffffff999d2b46>] __irq_exit_rcu+0x96/0xc0
  [81.820] ---[ end trace 0000000000000000 ]---
  [81.820] BTRFS: error (device dm-7 state A) in btrfs_create_pending_block_groups:2876: errno=-17 Object already exists

Inspecting these aborts with drgn, I observed a pattern of overlapping chunk_maps. Note how stripe 1 of the first chunk overlaps in physical address with stripe 0 of the second chunk.

Physical Start Physical End Length Logical Type Stripe
----------------------------------------------------------------------------------------------------

0x0000000102500000 0x0000000142500000 1.0G         0x0000000641d00000 META|DUP             0/2
0x0000000142500000 0x0000000182500000 1.0G         0x0000000641d00000 META|DUP             1/2
0x0000000142500000 0x0000000182500000 1.0G         0x0000000601d00000 META|DUP             0/2
0x0000000182500000 0x00000001c2500000 1.0G         0x0000000601d00000 META|DUP             1/2

Now how could this possibly happen? All chunk allocation is protected by the chunk_mutex so racing allocations should see a consistent view of the CHUNK_ALLOCATED bit in the chunk allocation extent-io-tree (device->alloc_state as set by chunk_map_device_set_bits()) The tree itself is protected by a spin lock, and clearing/setting the bits is always protected by fs_info->mapping_tree_lock, so no race is apparent.

It turns out that there is a subtle bug in the logic regarding chunk allocations that have happened in the current transaction, known as "pending extents". The chunk allocation as defined in find_free_dev_extent() is a loop which searches the commit root of the dev_root and looks for gaps between DEV_EXTENT items. For those gaps, it then checks alloc_state bitmap for any pending extents and adjusts the hole that it finds accordingly. However, the logic in that adjustment assumes that the first pending extent is the only one in that range.

e.g., given a layout with two non-consecutive pending extents in a hole passed to dev_extent_hole_check() via *hole_start and *hole_size:

  |----pending A----|    real hole     |----pending B----|
           |           candidate hole        |
      *hole_start                         *hole_start + *hole_size

the code incorrectly returns a "hole" from the end of pending extent A until the passed in hole end, failing to account for pending B.

However, it is not entirely obvious that it is actually possible to produce such a layout. I was able to reproduce it, but with some
contortions: I continued to use the force chunk allocation sysfs file and I introduced a long delay (10 seconds) into the start of the cleaner thread. I also prevented the unused bgs cleaning logic from ever deleting metadata bgs. These help make it easier to deterministically produce the condition but shouldn't really matter if you imagine the conditions happening by race/luck. Allocations/frees can happen concurrently with the cleaner thread preparing to process an unused extent and both create some used chunks with an unused chunk interleaved, all during one transaction. Then btrfs_delete_unused_bgs() sees the unused one and clears it, leaving a range with several pending chunk allocations and a gap in the middle.

The basic idea is that the unused_bgs cleanup work happens on a worker so if we allocate 3 block groups in one transaction, then the cleaner work kicked off by the previous transaction comes through and deletes the middle one of the 3, then the commit root shows no dev extents and we have the bad pattern in the extent-io-tree. One final consideration is that the code happens to loop to the next hole if there are no more extents at all, so we need one more dev extent way past the area we are working in. Something like the following demonstrates the technique:

  # push the BG frontier out to 20G
  fallocate -l 20G $mnt/foo
  # allocate one more that will prevent the "no more dev extents" luck
  fallocate -l 1G $mnt/sticky
  # sync
  sync
  # clear out the allocation area
  rm $mnt/foo
  sync
  _cleaner
  # let everything quiesce
  sleep 20
  sync

  # dev tree should have one bg 20G out and the rest at the beginning..
  # sort of like an empty FS but with a random sticky chunk.

  # kick off the cleaner in the background, remember it will sleep 10s
  # before doing interesting work
  _cleaner &

sleep 3

  # create 3 trivial block groups, all empty, all immediately marked as unused.
  echo 1 > "$(_btrfs_sysfs_space_info $dev metadata)/force_chunk_alloc"
  echo 1 > "$(_btrfs_sysfs_space_info $dev data)/force_chunk_alloc"
  echo 1 > "$(_btrfs_sysfs_space_info $dev metadata)/force_chunk_alloc"

  # let the cleaner thread definitely finish, it will remove the data bg
  sleep 10

  # this allocation sees the non-consecutive pending metadata chunks with
  # data chunk gap of 1G and allocates a 2G extent in that hole. ENOSPC!
  echo 1 > "$(_btrfs_sysfs_space_info $dev metadata)/force_chunk_alloc"

As for the fix, it is not that obvious. I could not see a trivial way to do it even by adding backup loops into find_free_dev_extent(), so I opted to change the semantics of dev_extent_hole_check() to not stop looping until it finds a sufficiently big hole. For clarity, this also required changing the helper function contains_pending_extent() into two new helpers which find the first pending extent and the first suitable hole in a range.

I attempted to clean up the documentation and range calculations to be as consistent and clear as possible for the future.

I also looked at the zoned case and concluded that the loop there is different and not to be unified with this one. As far as I can tell, the zoned check will only further constrain the hole so looping back to find more holes is acceptable. Though given that zoned really only appends, I find it highly unlikely that it is susceptible to this bug.

---
 fs/btrfs/volumes.c | 243 ++++++++++++++++++++++++++++++++++-----------
 1 file changed, 183 insertions(+), 60 deletions(-)

index 8a08412f3529a..99e167a697ba8 100644
@@ -1505,30 +1505,158 @@ struct btrfs_device *btrfs_scan_one_device(const char *path,
 }
 
 /*
- * Try to find a chunk that intersects [start, start + len] range and when one
- * such is found, record the end of it in *start
+ * Find the first pending extent intersecting a range.
+ *
+ * @device:         the device to search
+ * @start:          start of the range to check
+ * @len:            length of the range to check
+ * @pending_start:  output pointer for the start of the found pending extent
+ * @pending_end:    output pointer for the end of the found pending extent (inclusive)
+ *
+ * Search for a pending chunk allocation that intersects the half-open range
+ * [start, start + len).
+ *
+ * Return: true if a pending extent was found, false otherwise.
+ * If the return value is true, store the first pending extent in
+ * [*pending_start, *pending_end]. Otherwise, the two output variables
+ * may still be modified, to something outside the range and should not
+ * be used.
  */
-static bool contains_pending_extent(struct btrfs_device *device, u64 *start,
-				    u64 len)
+static bool first_pending_extent(struct btrfs_device *device, u64 start, u64 len,
+				 u64 *pending_start, u64 *pending_end)
 {
-	u64 physical_start, physical_end;
-
 	lockdep_assert_held(&device->fs_info->chunk_mutex);
 
-	if (btrfs_find_first_extent_bit(&device->alloc_state, *start,
-					&physical_start, &physical_end,
+	if (btrfs_find_first_extent_bit(&device->alloc_state, start,
+					pending_start, pending_end,
 					CHUNK_ALLOCATED, NULL)) {
 
-		if (in_range(physical_start, *start, len) ||
-		    in_range(*start, physical_start,
-			     physical_end + 1 - physical_start)) {
-			*start = physical_end + 1;
+		if (in_range(*pending_start, start, len) ||
+		    in_range(start, *pending_start, *pending_end + 1 - *pending_start)) {
 			return true;
 		}
 	}
 	return false;
 }
 
+/*
+ * Find the first real hole accounting for pending extents.
+ *
+ * @device:         the device containing the candidate hole
+ * @start:          input/output pointer for the hole start position
+ * @len:            input/output pointer for the hole length
+ * @min_hole_size:  the size of hole we are looking for
+ *
+ * Given a potential hole specified by [*start, *start + *len), check for pending
+ * chunk allocations within that range. If pending extents are found, the hole is
+ * adjusted to represent the first true free space that is large enough when
+ * accounting for pending chunks.
+ *
+ * Note that this function must handle various cases involving non consecutive
+ * pending extents.
+ *
+ * Returns: true if a suitable hole was found and false otherwise.
+ * If the return value is true, then *start and *len are set to represent the hole.
+ * If the return value is false, then *start is set to the largest hole we
+ * found and *len is set to its length.
+ * If there are no holes at all, then *start is set to the end of the range and
+ * *len is set to 0.
+ */
+static bool find_hole_in_pending_extents(struct btrfs_device *device, u64 *start,
+					 u64 *len, u64 min_hole_size)
+{
+	u64 pending_start, pending_end;
+	u64 end;
+	u64 max_hole_start = 0;
+	u64 max_hole_len = 0;
+
+	lockdep_assert_held(&device->fs_info->chunk_mutex);
+
+	if (*len == 0)
+		return false;
+
+	end = *start + *len - 1;
+
+	/*
+	 * Loop until we either see a large enough hole or check every pending
+	 * extent overlapping the candidate hole.
+	 * At every hole that we observe, record it if it is the new max.
+	 * At the end of the iteration, set the output variables to the max hole.
+	 */
+	while (true) {
+		if (first_pending_extent(device, *start, *len, &pending_start, &pending_end)) {
+			/*
+			 * Case 1: the pending extent overlaps the start of
+			 * candidate hole. That means the true hole is after the
+			 * pending extent, but we need to find the next pending
+			 * extent to properly size the hole. In the next loop,
+			 * we will reduce to case 2 or 3.
+			 * e.g.,
+			 *
+			 *   |----pending A----|    real hole     |----pending B----|
+			 *            |           candidate hole        |
+			 *         *start                              end
+			 */
+			if (pending_start <= *start) {
+				*start = pending_end + 1;
+				goto next;
+			}
+			/*
+			 * Case 2: The pending extent starts after *start (and overlaps
+			 * [*start, end), so the first hole just goes up to the start
+			 * of the pending extent.
+			 * e.g.,
+			 *
+			 *   |    real hole    |----pending A----|
+			 *   |       candidate hole     |
+			 * *start                      end
+			 */
+			*len = pending_start - *start;
+			if (*len > max_hole_len) {
+				max_hole_start = *start;
+				max_hole_len = *len;
+			}
+			if (*len >= min_hole_size)
+				break;
+			/*
+			 * If the hole wasn't big enough, then we advance past
+			 * the pending extent and keep looking.
+			 */
+			*start = pending_end + 1;
+			goto next;
+		} else {
+			/*
+			 * Case 3: There is no pending extent overlapping the
+			 * range [*start, *start + *len - 1], so the only remaining
+			 * hole is the remaining range.
+			 * e.g.,
+			 *
+			 *   |       candidate hole           |
+			 *   |          real hole             |
+			 * *start                            end
+			 */
+
+			if (*len > max_hole_len) {
+				max_hole_start = *start;
+				max_hole_len = *len;
+			}
+			break;
+		}
+next:
+		if (*start > end)
+			break;
+		*len = end - *start + 1;
+	}
+	if (max_hole_len) {
+		*start = max_hole_start;
+		*len = max_hole_len;
+	} else {
+		*start = end + 1;
+		*len = 0;
+	}
+	return max_hole_len >= min_hole_size;
+}
+
 static u64 dev_extent_search_start(struct btrfs_device *device)
 {
 	switch (device->fs_devices->chunk_alloc_policy) {

@@ -1593,59 +1721,57 @@ static bool dev_extent_hole_check_zoned(struct btrfs_device *device,
 }
 
 /*
- * Check if specified hole is suitable for allocation.
+ * Validate and adjust a hole for chunk allocation
+ *
+ * @device:      the device containing the candidate hole
+ * @hole_start:  input/output pointer for the hole start position
+ * @hole_size:   input/output pointer for the hole size
+ * @num_bytes:   minimum allocation size required
  *
- * @device:	the device which we have the hole
- * @hole_start: starting position of the hole
- * @hole_size:	the size of the hole
- * @num_bytes:	the size of the free space that we need
+ * Check if the specified hole is suitable for allocation and adjust it if
+ * necessary. The hole may be modified to skip over pending chunk allocations
+ * and to satisfy stricter zoned requirements on zoned filesystems.
  *
- * This function may modify @hole_start and @hole_size to reflect the suitable
- * position for allocation. Returns 1 if hole position is updated, 0 otherwise.
+ * For regular (non-zoned) allocation, if the hole after adjustment is smaller
+ * than @num_bytes, the search continues past additional pending extents until
+ * either a sufficiently large hole is found or no more pending extents exist.
+ *
+ * Return: true if a suitable hole was found and false otherwise.
+ * If the return value is true, then *hole_start and *hole_size are set to
+ * represent the hole we found.
+ * If the return value is false, then *hole_start is set to the largest
+ * hole we found and *hole_size is set to its length.
+ * If there are no holes at all, then *hole_start is set to the end of the range
+ * and *hole_size is set to 0.
  */
 static bool dev_extent_hole_check(struct btrfs_device *device, u64 *hole_start,
 				  u64 *hole_size, u64 num_bytes)
 {
-	bool changed = false;
-	u64 hole_end = *hole_start + *hole_size;
+	bool found = false;
+	const u64 hole_end = *hole_start + *hole_size - 1;
 
-	for (;;) {
-		/*
-		 * Check before we set max_hole_start, otherwise we could end up
-		 * sending back this offset anyway.
-		 */
-		if (contains_pending_extent(device, hole_start, *hole_size)) {
-			if (hole_end >= *hole_start)
-				*hole_size = hole_end - *hole_start;
-			else
-				*hole_size = 0;
-			changed = true;
-		}
+	ASSERT(*hole_size > 0);
 
-		switch (device->fs_devices->chunk_alloc_policy) {
-		default:
-			btrfs_warn_unknown_chunk_allocation(device->fs_devices->chunk_alloc_policy);
-			fallthrough;
-		case BTRFS_CHUNK_ALLOC_REGULAR:
-			/* No extra check */
-			break;
-		case BTRFS_CHUNK_ALLOC_ZONED:
-			if (dev_extent_hole_check_zoned(device, hole_start,
-							hole_size, num_bytes)) {
-				changed = true;
-				/*
-				 * The changed hole can contain pending extent.
-				 * Loop again to check that.
-				 */
-				continue;
-			}
-			break;
-		}
+again:
+	*hole_size = hole_end - *hole_start + 1;
+	found = find_hole_in_pending_extents(device, hole_start, hole_size, num_bytes);
+	if (!found)
+		return found;
+	ASSERT(*hole_size >= num_bytes);
 
+	switch (device->fs_devices->chunk_alloc_policy) {
+	default:
+		btrfs_warn_unknown_chunk_allocation(device->fs_devices->chunk_alloc_policy);
+		fallthrough;
+	case BTRFS_CHUNK_ALLOC_REGULAR:
+		return found;
+	case BTRFS_CHUNK_ALLOC_ZONED:
+		if (dev_extent_hole_check_zoned(device, hole_start, hole_size, num_bytes))
+			goto again;
 		break;
 	}
 
-	return changed;
+	return found;
 }
 
 /*

@@ -1704,7 +1830,7 @@ static int find_free_dev_extent(struct btrfs_device *device, u64 num_bytes,
 		ret = -ENOMEM;
 		goto out;
 	}
-again:
+
 	if (search_start >= search_end ||
 		test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state)) {
 		ret = -ENOSPC;

@@ -1791,11 +1917,7 @@ static int find_free_dev_extent(struct btrfs_device *device, u64 num_bytes,
 	 */
 	if (search_end > search_start) {
 		hole_size = search_end - search_start;
-		if (dev_extent_hole_check(device, &search_start, &hole_size,
-					  num_bytes)) {
-			btrfs_release_path(path);
-			goto again;
-		}
+		dev_extent_hole_check(device, &search_start, &hole_size, num_bytes);
 
 		if (hole_size > max_hole_size) {
 			max_hole_start = search_start;

@@ -4844,6 +4966,7 @@ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size)
 	u64 diff;
 	u64 start;
 	u64 free_diff = 0;
+	u64 pending_start, pending_end;
 
 	new_size = round_down(new_size, fs_info->sectorsize);
 	start = new_size;

@@ -4889,7 +5012,7 @@ int btrfs_shrink_device(struct btrfs_device *device, u64 new_size)
 	 * in-memory chunks are synced to disk so that the loop below sees them
 	 * and relocates them accordingly.
 	 */
-	if (contains_pending_extent(device, &start, diff)) {
+	if (first_pending_extent(device, start, diff, &pending_start, &pending_end)) {
 		mutex_unlock(&fs_info->chunk_mutex);
 		ret = btrfs_commit_transaction(trans);
 		if (ret)

2.51.0

6.19-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deepanshu Kartikey <[email protected]>

[ Upstream commit da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102 ]

Fix two memory leaks in the gfs2_fill_super() error handling path when transitioning a filesystem to read-write mode fails.

First leak: kthread objects (thread_struct, task_struct, etc.) When gfs2_freeze_lock_shared() fails after init_threads() succeeds, the created kernel threads (logd and quotad) are never destroyed. This occurs because the fail_per_node label doesn't call gfs2_destroy_threads().

Second leak: quota bitmap buffer (8192 bytes)
When gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but before other operations complete, the allocated quota bitmap is never freed.

The fix moves thread cleanup to the fail_per_node label to handle all error paths uniformly. gfs2_destroy_threads() is safe to call unconditionally as it checks for NULL pointers. Quota cleanup is added in gfs2_make_fs_rw() to properly handle the withdrawal case where quota initialization succeeds but the filesystem is then withdrawn.

Thread leak backtrace (gfs2_freeze_lock_shared failure):
unreferenced object 0xffff88801d7bca80 (size 4480):

    copy_process+0x3a1/0x4670 kernel/fork.c:2422
    kernel_clone+0xf3/0x6e0 kernel/fork.c:2779
    kthread_create_on_node+0x100/0x150 kernel/kthread.c:478
    init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611
    gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265

Quota leak backtrace (gfs2_make_fs_rw failure):
unreferenced object 0xffff88812de7c000 (size 8192):

    gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409
    gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149
    gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275