7.1.6-rc1 review

This is the start of the stable review cycle for the 7.1.6 release. There are 744 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 01 Aug 2026 14:13:38 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v7.x/stable-review/patch-7.1.6-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-7.1.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 7.1.6-rc1

Nikunj A Dadhania <[email protected]>
KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug

Willem de Bruijn <[email protected]>
selftests: drv-net: so_txtime: relax variance bounds

Willem de Bruijn <[email protected]>
selftests: drv-net: cope with slow env in so_txtime.py test

Andrea Righi <[email protected]>
sched_ext: Preserve rq tracking across local DSQ dispatch

Tejun Heo <[email protected]>
sched_ext: Move shared helpers from ext.c into internal.h and cid.h

Breno Leitao <[email protected]>
bootconfig: fix NULL-pointer arithmetic in xbc_snprint_cmdline()

Breno Leitao <[email protected]>
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c

Shradha Gupta <[email protected]>
net: mana: Optimize irq affinity for low vcpu configs

Michael Bommarito <[email protected]>
thunderbolt: Prevent XDomain delayed work use-after-free on disconnect

Mika Westerberg <[email protected]>

    thunderbolt: Remove XDomain from the bus without holding tb->lock

Mika Westerberg <[email protected]>
thunderbolt: Remove service debugfs entries during unregister

Mika Westerberg <[email protected]>
thunderbolt: Keep XDomain reference during the lifetime of a service

Muchun Song <[email protected]>
mm/sparse-vmemmap: fix DAX vmemmap accounting with optimization

Muchun Song <[email protected]>
mm/sparse-vmemmap: pass @pgmap argument to memory deactivation paths

Chuck Lever <[email protected]>
SUNRPC: Return an error from xdr_buf_to_bvec() on overflow

Chuck Lever <[email protected]>
SUNRPC: Add helpers to convert xdr_buf byte ranges to scatterlists

Darrick J. Wong <[email protected]>
xfs: don't replace the wrong part of the cow fork

Joanne Koong <[email protected]>
fuse-uring: fix race between registration and connection abortion

Ricardo Robaina <[email protected]>
audit: fix recursive locking deadlock in audit_dupe_exe()

Ricardo Robaina <[email protected]>
audit: use 'unsigned int' instead of 'unsigned'

Harry Wentland <[email protected]>
drm/amd/display: Fix DTB DTO updates breaking live pixel rate sources

Namjae Jeon <[email protected]>
ksmbd: validate ACE size against SID sub-authorities

Namjae Jeon <[email protected]>
ksmbd: bound DACL dedup walk to copied ACEs

Wentao Guan <[email protected]>
ksmbd: restore DACL size on check_add_overflow() to avoid malformed ACL

Haofeng Li <[email protected]>
ksmbd: validate num_subauth when copying ACE in set_ntacl_dacl

Matthieu Baerts (NGI0) <[email protected]>
selftests: drv-net: add missing kconfig for psp.py

Christian König <[email protected]>
drm/amdgpu: fix check in amdgpu_hmm_invalidate_gfx

Yang Wang <[email protected]>
drm/amd/pm: fix smu13 power limit range calculation

Asad Kamal <[email protected]>
drm/amdgpu: fix aperture mapping leak

Zhu Lingshan <[email protected]>
drm/amdgpu: reject mapping a reserved doorbell to a new queue

Ce Sun <[email protected]>
drm/amdgpu: invoke pm_genpd_remove() before freeing genpd

Ce Sun <[email protected]>
drm/amdgpu: fix resource leak on ACP reset timeout

Harish Kasiviswanathan <[email protected]>
drm/amdgpu: Fix kernel panic during driver load failure

Boyuan Zhang <[email protected]>
drm/amdgpu: fix division by zero with invalid uvd dimensions

Luca Coelho <[email protected]>
drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()

Boyuan Zhang <[email protected]>
drm/amdgpu/vcn4: avoid rereading IB param length

Boyuan Zhang <[email protected]>
drm/amdgpu/vce: fix integer overflow in image size

Alex Deucher <[email protected]>
drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>

    drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON()

Prike Liang <[email protected]>
drm/amdgpu/mes11: set doorbell offset for suspending userq

Boyuan Zhang <[email protected]>
drm/amdgpu/jpeg: fix jpeg_v5_0_1_is_idle detection

Boyuan Zhang <[email protected]>
drm/amdgpu/jpeg: fix jpeg_v4_0_3_is_idle detection

Alex Deucher <[email protected]>
drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>

    drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx8: drop unecessary BUG_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON()

Jesse Zhang <[email protected]>
drm/amdgpu/gfx12: fix EOP interrupt routing for KQ and userq

Jesse Zhang <[email protected]>
drm/amdgpu/gfx11: fix EOP interrupt routing for KQ and userq

Alex Deucher <[email protected]>

    drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON()

Yang Wang <[email protected]>
drm/amd/pm: make pp_features read-only when scpm is enabled

Yang Wang <[email protected]>
drm/amd/pm: fix amdgpu_pm_info power display units

Ethan Nelson-Moore <[email protected]>
watchdog: s32g_wdt: remove incorrect options in watchdog_info struct

James Raphael Tiovalen <[email protected]>
vxlan: mdb: Fix source list corruption on a failed replace

Stefano Garzarella <[email protected]>
vsock/virtio: collapse receive queue under memory pressure

Daehyeon Ko <[email protected]>

    tipc: clear sock->sk on the failed-insert path in tipc_sk_create()

Yuxiang Yang <[email protected]>
tcp: challenge ACK for non-exact RST in SYN-RECEIVED

Yizhou Zhao <[email protected]>
tcp: initialize standalone TCP-AO response padding

Justin Lai <[email protected]>
rtase: Workaround for TX hang caused by hardware packet parsing

Asim Viladi Oglu Manizada <[email protected]>
pppoe: reload header pointer after dev_hard_header()

Shuvam Pandey <[email protected]>
ovpn: hold peer before scheduling keepalive work

Pavitra Jha <[email protected]>
ovpn: fix peer refcount leak in TCP error paths

Kyle Zeng <[email protected]>
openvswitch: fix GSO userspace truncation underflow

Doruk Tan Ozturk <[email protected]>
mctp: serial: handle zero-length frames to prevent rx buffer overflow

Doruk Tan Ozturk <[email protected]>
mac802154: llsec: reject frames shorter than the authentication tag

Ibrahim Hashimov <[email protected]>
mac802154: hold an interface reference across the scan worker

Michael Bommarito <[email protected]>
ila: reload IPv6 header after pskb_may_pull in checksum adjust

Sergey Temerkhanov <[email protected]>
ice: use READ_ONCE() to access cached PHC time

Aleksandr Loktionov <[email protected]>
ice: reject out-of-range ptype in ice_parser_profile_init

Eddie Phillips <[email protected]>
gve: fix Rx queue stall on alloc failure

Namjae Jeon <[email protected]>
ksmbd: validate minimum PDU size for transform requests

James Montgomery <[email protected]>
ksmbd: defer destroy_previous_session() until after NTLM authentication

Carl Johnson <[email protected]>
smb: client: handle STATUS_STOPPED_ON_SYMLINK responses without a symlink target

Raphael Zimmer <[email protected]>
rbd: Reset positive result codes to zero in object map update path

Christian Brauner <[email protected]>
super: fix emergency thaw deadlock on frozen block devices

Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Reset triggers at top level before instance loop

Paul Greenwalt <[email protected]>
ice: fix PTP Call Trace during PTP release

Sven Schnelle <[email protected]>
ptp: ptp_s390: Add missing facility check

Jann Horn <[email protected]>
proc: Fix broken error paths for namespace links

Youssef Samir <[email protected]>
net: qrtr: ns: Raise node count limit to 512

Coia Prant <[email protected]>
net: pcs: xpcs: fix SGMII state reading

Fan Wu <[email protected]>
net: hip04: fix RX buffer leak on build_skb failure

Shiming Cheng <[email protected]>
net: gro: fix double aggregation of flush-marked skbs

David Lee <[email protected]>

    net/x25: fix use-after-free in x25_kill_by_neigh()

Aldo Ariel Panzardo <[email protected]>
net/sched: serialize qdisc_rtab_list against concurrent get/put

Manjunath Patil <[email protected]>
net/mlx5e: Use sender devcom for MPV master-up

Bryam Vargas <[email protected]>
net/iucv: fix use-after-free of a severed iucv_path

Hidayath Khan <[email protected]>
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

Doruk Tan Ozturk <[email protected]>
geneve: require CAP_NET_ADMIN in the device netns for changelink

Sungmin Kang <[email protected]>
net: slip: serialize receive against buffer reallocation

Doruk Tan Ozturk <[email protected]>
vxlan: require CAP_NET_ADMIN in the device netns for changelink

Breno Leitao <[email protected]>
phonet: pep: fix use-after-free in pep_get_sb()

Markus Breitenberger <[email protected]>
net: stmmac: intel: skip SerDes reconfig when rate is unchanged

Harry Yoo (Oracle) <[email protected]>
mm/slab: fix a memory leak due to bootstrapping sheaves twice

Shengming Hu <[email protected]>
mm/slub: fix lost local objects when bulk remote free batch fills

Lu Baolu <[email protected]>
iommu/vt-d: Disallow SVA if page walk is not coherent

Zhang Yi <[email protected]>
iomap: fix out-of-bounds bitmap_set() with zero-length range

Yitang Yang <[email protected]>
io_uring/rw: fix missing ERESTARTSYS conversion in read paths

Tengda Wu <[email protected]>
ftrace: Add global mutex to serialize trace_parser access

Eric Biggers <[email protected]>
fscrypt: Avoid dynamic allocation in fscrypt_get_devices()

Eric Biggers <[email protected]>
fscrypt: Add missing superblock check in find_or_insert_direct_key()

Amir Goldstein <[email protected]>
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()

Chen Changcheng <[email protected]>
fs/super: fix emergency thaw double-unlock of s_umount

Christian Brauner <[email protected]>
binfmt_elf_fdpic: only honour the first PT_INTERP

Chancel Liu <[email protected]>
ASoC: fsl_sai: Fix spurious BCLK on resume by clearing BYP

Chancel Liu <[email protected]>
ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown

Shihuang Liu <[email protected]>
amt: fix use-after-free in AMT delayed works

Douya Le <[email protected]>
libceph: remove debugfs files before client teardown

Douya Le <[email protected]>
libceph: reject zero bucket types in crush_decode

Raphael Zimmer <[email protected]>
libceph: Reject monmaps advertising zero monitors

Shuangpeng Bai <[email protected]>

    libceph: refresh auth->authorizer_buf{,_len} after authorizer update

Zhao Zhang <[email protected]>
libceph: guard missing CRUSH type name lookup

Pavitra Jha <[email protected]>
libceph: fix two unsafe bare decodes in decode_lockers()

Raphael Zimmer <[email protected]>
libceph: Fix multiplication overflow in decode_new_up_state_weight()

Xiang Mei <[email protected]>
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE

Douya Le <[email protected]>
libceph: bound get_version reply decode to front len

Wentao Liang <[email protected]>
ceph: fix writeback_count leak in write_folio_nounlock()

WenTao Liang <[email protected]>
ceph: fix refcount leak in ceph_readdir()

Bryam Vargas <[email protected]>
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()

Max Kellermann <[email protected]>
ceph: add owner/capability checks for CEPH_IOC_SET_LAYOUT*

Zhiling Zou <[email protected]>
sctp: close UDP tunnel sockets during netns teardown

Zhiling Zou <[email protected]>
sctp: avoid auth_enable sysctl UAF during netns teardown

Jun Yang <[email protected]>
sctp: don't free the ASCONF's own transport in DEL-IP processing

Rik van Riel <[email protected]>
mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established

Wei Yang <[email protected]>
mm/page_vma_mapped: fix device-private PMD handling

Xie Yuanbin <[email protected]>
mm/memory-failure: trace: change memory_failure_event to ras subsystem

Breno Leitao <[email protected]>
mm/kmemleak: fix checksum computation for per-cpu objects

SJ Park <[email protected]>
mm/damon/core: disallow overlapping input ranges for damon_set_regions()

Thomas Weißschuh <[email protected]>
m68k: avoid -Wunused-but-set-parameter in clear_user_page()

SJ Park <[email protected]>
mm/damon/core: validate ranges in damon_set_regions()

Mike Rapoport (Microsoft) <[email protected]>
userfaultfd: prevent registration of special VMAs

Qu Wenruo <[email protected]>
btrfs: do not try compression for data reloc inodes

David Howells <[email protected]>
afs: Fix afs_edit_dir_remove() to get, not find, block 0

Geliang Tang <[email protected]>
selftests: mptcp: userspace_pm: fix undefined variable port

Geliang Tang <[email protected]>
mptcp: pm: userspace: fix use-after-free in get_local_id

Michael Bommarito <[email protected]>
mptcp: only set DATA_FIN when a mapping is present

Kalpan Jani <[email protected]>

    mptcp: fix stale skb->sk reference on subflow close

Matthieu Baerts (NGI0) <[email protected]>
mptcp: fix BUILD_BUG_ON on legacy ARM config

Chenguang Zhao <[email protected]>
mptcp: decrement subflows counter on failed passive join

Will Deacon <[email protected]>
Revert "arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates"

Will Deacon <[email protected]>
arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates

Dev Jain <[email protected]>
arm64: make huge_ptep_get handled unaligned addresses

Fuad Tabba <[email protected]>

    tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro

Masami Hiramatsu (Google) <[email protected]>
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()

Masami Hiramatsu (Google) <[email protected]>
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()

Ming Lei <[email protected]>

    ublk: wait on ublk_dev_ready() instead of ub->completion

Jackie Liu <[email protected]>
tracing: Propagate errors from remote event bulk updates

Steven Rostedt <[email protected]>
tracing: perf: Fix stale head for perf syscall tracing

Masami Hiramatsu (Google) <[email protected]>
tracing: Fix union collision of module and refcnt for dynamic events

deepakraog <[email protected]>
tracing: Fix resource leak on mmiotrace trace_pipe close

Steven Rostedt <[email protected]>

    tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev

Usama Arif <[email protected]>
tracing: Fix context switch counter truncation

Steven Rostedt <[email protected]>
tracing: Delay module ref count for "enable_event" trigger

Xu Rao <[email protected]>
misc: nsm: pin the module while the device is open

Runyu Xiao <[email protected]>
misc: nsm: only unlock nsm_dev on post-lock error paths

Guangshuo Li <[email protected]>
intel_th: fix MSC output device reference leak

Alexander Usyskin <[email protected]>
mei: bus: access mei_device under device_lock on cleanup

Ethan Nelson-Moore <[email protected]>
selftests: ntsync: correct CONFIG_NTSYNC name

Jiangshan Yi <[email protected]>
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms

Hugo Villeneuve <[email protected]>
serial: sc16is7xx: implement gpio get_direction() callback

Ben Hutchings <[email protected]>
uio_hv_generic: Bind to FCopy device by default

Ian Abbott <[email protected]>
comedi: comedi_parport: deal with premature interrupt

Nathan Chancellor <[email protected]>
x86/boot/compressed: Disable jump tables

Adrian Ng Ho Yin <[email protected]>
firmware: stratix10-svc: handle NO_RESPONSE in async poll

Adrian Ng Ho Yin <[email protected]>
firmware: stratix10-svc: fix teardown order in remove to prevent race

Tze Yee Ng <[email protected]>
firmware: stratix10-svc: fix memory leaks and list corruption bugs

Cen Zhang (Microsoft) <[email protected]>

    rhashtable: clear stale iter->p on table restart

Xu Rao <[email protected]>
cdrom: fix stack out-of-bounds read in CDROMVOLCTRL

Rong Bao <[email protected]>
LoongArch: Retrieve CPU package ID from PPTT when available

Kanglong Wang <[email protected]>
LoongArch: Move jump_label_init() before parse_early_param()

Huacai Chen <[email protected]>
LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT

Haoran Jiang <[email protected]>
LoongArch: Fix oops during single-step debugging

Huacai Chen <[email protected]>
LoongArch: Fix build errors due to wrong instructions for 32BIT

George Guo <[email protected]>
LoongArch: Fix address space mismatch in kexec command line lookup

Miguel Ojeda <[email protected]>
objtool/rust: add one more noreturn Rust function for Rust 1.99.0

Alexandre Courbot <[email protected]>
rust: allow clippy::unwrap_or_default globally

Miguel Ojeda <[email protected]>
rust: allow suspicious_runtime_symbol_definitions lint for Rust >= 1.98

Alice Ryhl <[email protected]>
rust: device: avoid trailing ; in printing macros

FUJITA Tomonori <[email protected]>
rust: time: fix as_micros_ceil() to round correctly for negative Delta

Alice Ryhl <[email protected]>
rust_binder: only print failure if error has source

Zixing Liu <[email protected]>
platform/loongarch: laptop: Explicitly reset bl_powered state when suspend

Christian Brauner <[email protected]>
binfmt_misc: set have_execfd only once the interpreter is opened

Christian Brauner <[email protected]>
exec: fix unsigned loop counter wrap in transfer_args_to_stack()

Chengfeng Ye <[email protected]>
Bluetooth: RFCOMM: Fix session UAF in set_termios

Chengfeng Ye <[email protected]>
Bluetooth: hci_sync: Protect UUID list traversal

MinJea Kim <[email protected]>
staging: rtl8723bs: fix inverted HT40 secondary channel offset

Moksh Panicker <[email protected]>
staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()

Jose Ignacio Tornos Martinez <[email protected]>
wifi: ath12k: fix NULL pointer dereference in rhash table destroy

Wentao Liang <[email protected]>
wifi: ath11k: fix refcount leak in ath11k_ahb_fw_resources_init()

LiangCheng Wang <[email protected]>
wifi: brcmfmac: set F2 blocksize to 256 for BCM43752

Fan Wu <[email protected]>
wifi: brcmfmac: make release_scratchbuffers idempotent

Fan Wu <[email protected]>
wifi: brcmfmac: drain bus_reset work on device removal

Devin Wittmayer <[email protected]>
wifi: mt76: restrict NPU/PPE active checks to MMIO devices

Devin Wittmayer <[email protected]>
wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses

Devin Wittmayer <[email protected]>
wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses

Devin Wittmayer <[email protected]>
wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses

Huihui Huang <[email protected]>
wifi: wilc1000: validate assoc response length before subtracting header

Doruk Tan Ozturk <[email protected]>
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

Daniel Hodges <[email protected]>
wifi: ath6kl: fix use-after-free in aggr_reset_state()

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB access from firmware ADDBA window size

Norbert Szetei <[email protected]>
ALSA: timer: don't re-enter an instance callback that is still running

Norbert Szetei <[email protected]>
ALSA: timer: drain a slave's callback before its master detaches it

Kai Vehmanen <[email protected]>
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change

Norbert Szetei <[email protected]>
ALSA: seq: close a re-opened queue timer in the destructor

Nikita Maksimov <[email protected]>
ALSA: hda/realtek: Fix speakers on Lunnen Ground 14

Johan Hovold <[email protected]>
media: vpif_capture: fix OF node reference imbalance

Guangshuo Li <[email protected]>
media: vivid: fix cleanup bugs in vivid_init()

Hans Verkuil <[email protected]>
media: vivid: check for vb2_is_busy() when toggling caps

Hans Verkuil <[email protected]>
media: vivid: add vivid_update_reduced_fps()

Guangshuo Li <[email protected]>
media: vimc: fix reference leak on failed device registration

Guangshuo Li <[email protected]>
media: vidtv: fix reference leak on failed device registration

Benjamin Gaignard <[email protected]>
media: verisilicon: Export only needed pixels formats

Zile Xiong <[email protected]>
media: vb2: use ssize_t for vb2_read/vb2_write

Sakari Ailus <[email protected]>
media: v4l2-subdev: Fail {enable,disable}_streams and s_streaming nicely

Mirela Rabulea <[email protected]>
media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()

Pengpeng Hou <[email protected]>
media: v4l2-ctrls: validate HEVC active reference counts

Sergey Shtylyov <[email protected]>
media: v4l2-ctrls-request: add NULL check in v4l2_ctrl_request_complete()

Niklas Söderlund <[email protected]>
media: uapi: rkisp: Correct name version enum

Myeonghun Pak <[email protected]>
media: ti: vpe: unwind v4l2 device registration on probe error

Felix Gu <[email protected]>
media: ti: vpe: Fix the error code of devm_request_irq()

Felix Gu <[email protected]>
media: ti: vpe: Fix the error code of devm_kzalloc() in vip_probe_slice()

Felix Gu <[email protected]>
media: ti: vpe: Fix fwnode_handle leak in vip_probe_complete()

Hungyu Lin <[email protected]>
media: tegra-video: vi: fix invalid u32 return value in format lookup

Dmitry Osipenko <[email protected]>
media: synopsys: hdmirx: Fix HPD lane hold time

Valery Borovsky <[email protected]>
media: sun4i-csi: Return queued buffers on start_streaming() failure

Myeonghun Pak <[email protected]>
media: stm32: dcmi: unregister notifier on probe failure

Valery Borovsky <[email protected]>
media: stm32-dcmipp: Return queued buffers on start_streaming() failure

Ma Ke <[email protected]>
media: saa7134: Fix a possible memory leak in saa7134_video_init1

Jacopo Mondi <[email protected]>
media: rzv2h-ivc: Wait for frame end in stop_streaming

Tommaso Merciai <[email protected]>
media: rzg2l-cru: Skip ICnMC configuration when ICnSVC is used

Valery Borovsky <[email protected]>
media: rtl2832_sdr: Return queued buffers on start_streaming() failure

Deepanshu Kartikey <[email protected]>

    media: rtl2832: fix use-after-free in rtl2832_remove()

Myeonghun Pak <[email protected]>
media: radio-si476x: Unregister v4l2_device on probe failure

Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix RDI streaming for CSID 340

Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix RDI streaming for CSID GEN3

Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix RDI streaming for CSID GEN2

Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix RDI streaming for CSID 680

Valery Borovsky <[email protected]>
media: pwc: Return queued buffers on start_streaming() failure

Valery Borovsky <[email protected]>
media: pwc: Drain fill_buf on start_streaming() failure

Krzysztof Kozlowski <[email protected]>
media: pci: dm1105: Free allocated workqueue

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix scale factor calculation for hardware rounding

Guoniu Zhou <[email protected]>
media: nxp: imx8-isi: Fix potential out-of-bounds issues

Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Fix missing v4l2_subdev_cleanup() in pipe init error path

Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Clean up already-initialized pipes on probe failure

Xiaolei Wang <[email protected]>
media: nxp: imx8-isi: Add missing v4l2_subdev_cleanup() in crossbar and pipe

David Carlier <[email protected]>
media: nuvoton: npcm-video: fix memory leaks in probe and remove

David Carlier <[email protected]>
media: nuvoton: npcm-video: fix error handling in npcm_video_init()

Valery Borovsky <[email protected]>
media: msi2500: Return queued buffers on start_streaming() failure

Anand Moon <[email protected]>
media: meson: vdec: Fix memory leak in error path of vdec_open

Guangshuo Li <[email protected]>
media: marvell-cam: fix missing pci_disable_device() on remove

David Carlier <[email protected]>
media: mali-c55: Power-off the peripheral in remove()

Alper Ak <[email protected]>
media: mali-c55: Fix possible ERR_PTR in enable_streams

David Carlier <[email protected]>
media: mali-c55: Disable pm_runtime on probe error

David Carlier <[email protected]>
media: mali-c55: Add missing of_reserved_mem_device_release()

Dmitry Baryshkov <[email protected]>
media: iris: Fix use IRQF_NO_AUTOEN when requesting the IRQ

Marco Nenciarini <[email protected]>
media: intel/ipu6: Improve DWC PHY HSFREQRANGE band selection for overlapping ranges

Sakari Ailus <[email protected]>
media: imx219: Fix maximum frame length in lines

Martin Hecht <[email protected]>
media: i2c: alvium: fix critical pointer access in alvium_ctrl_init

Sakari Ailus <[email protected]>
media: dw9719: Add back the I²C device id table

Wang Jun <[email protected]>
media: cx23885: add ioremap return check and cleanup

Johan Hovold <[email protected]>
media: cx231xx: fix devres lifetime

Brandon Brnich <[email protected]>
media: chips-media: wave5: Move src_buf Removal to finish_encode

Pengpeng Hou <[email protected]>
media: cedrus: skip invalid H.264 reference list entries

Samuel Holland <[email protected]>
media: cedrus: Fix missing cleanup in error path

Myeonghun Pak <[email protected]>
media: cedrus: clean up media device on probe failure

Myeonghun Pak <[email protected]>
media: cec: seco: unregister adapter on IR probe failure

David Carlier <[email protected]>
media: aspeed: fix missing of_reserved_mem_device_release() on probe failure

Ricardo Ribalda <[email protected]>
media: amlogic-c3: Add validations for ae and awb config

Valery Borovsky <[email protected]>
media: airspy: Return queued buffers on start_streaming() failure

Maíra Canal <[email protected]>
drm/v3d: Reach the GMP through the hub registers on V3D 7.x

Matthew Brost <[email protected]>
drm/gpusvm: Fix MM reference leak in drm_gpusvm_range_evict

Stanislav Kinsburskii <[email protected]>
drm/gpusvm: Zero HMM PFNs before scanning ranges

Matthew Brost <[email protected]>
drm/ttm/pool: back up at native page order

Matthew Brost <[email protected]>
drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION

Linmao Li <[email protected]>
drm/vc4: Prevent shader BO mappings from becoming writable

Ian Forbes <[email protected]>
drm/vmwgfx: Validate vmw_surface_metadata::array_size

Matthew Brost <[email protected]>
drm/pagemap: Clear driver-provided PFNs from migration PFN array

Leo Li <[email protected]>
drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()

Linmao Li <[email protected]>
drm/vc4: Shut down BO cache timer before teardown

Leo Li <[email protected]>
drm/amd/display: Fix flip-done timeouts on mode1 reset

Alex Deucher <[email protected]>
drm/amdgpu: always emit the job vm fence

Timur Kristóf <[email protected]>
drm/amdgpu: Print vmid, pasid and more task info in devcoredump

Zhu Lingshan <[email protected]>

    drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved

Mario Limonciello <[email protected]>
drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge

Mario Limonciello <[email protected]>
drm/amd/display: Fix backlight max_brightness to match exported range

Alessandro Rinaldi <[email protected]>
drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05

Andriy Korud <[email protected]>
drm/amd/display: dce100: skip non-DP stream encoders for DP MST

Leo Li <[email protected]>
drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock

WenTao Liang <[email protected]>
drm/amd/display: set new_stream to NULL after release

Timur Kristóf <[email protected]>

    drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)

Mario Limonciello <[email protected]>
drm/amd: Create a device link between APU display and XHCI devices

Jesse Zhang <[email protected]>
drm/amdgpu/userq: fix indefinite fence wait during GPU reset

Mario Limonciello <[email protected]>
drm/amdgpu: Fix VFCT bus number matching with soft filter

Mario Limonciello <[email protected]>
drm/amdgpu: Release VFCT ACPI table reference

Osama Abdelkader <[email protected]>
drm/panthor: return error on truncated firmware

Matthew Brost <[email protected]>
drm/ttm: Account for NULL and handle pages in ttm_pool_backup

Honglei Huang <[email protected]>
drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

Jason Macnak <[email protected]>
drm/virtio: Don't detach GEM from a non-created context

Alex Deucher <[email protected]>
drm/gfx10: Program DB_RING_CONTROL

Yang Wang <[email protected]>
drm/amd/pm: fix smu14 power limit range calculation

Jani Nikula <[email protected]>
drm/i915/mst: limit DP MST ESI service loop

Joonas Lahtinen <[email protected]>
drm/i915/gt: Fix NULL deref on sched_engine alloc failure

Joonas Lahtinen <[email protected]>
drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU

Joonas Lahtinen <[email protected]>

    drm/i915/gem: Do not leak siblings[] on proto context error

Jesse Zhang <[email protected]>
drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue

Shahyan Soltani <[email protected]>
drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()

Kenneth Feng <[email protected]>
drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled

Alex Deucher <[email protected]>
drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON()

Jakob Linke <[email protected]>
drm/amdgpu/soc24: reset dGPU if suspend got aborted

Jani Nikula <[email protected]>
drm/i915/bios: range check LFP Data Block panel_type2

Joonas Lahtinen <[email protected]>
drm/i915: Return NULL on error in active_instance

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()

Alex Deucher <[email protected]>
drm/amdgpu/sdma7.0: replace BUG_ON() with WARN_ON()

Prike Liang <[email protected]>
drm/amdgpu: add the doorbell index input for suspending userq

Jani Nikula <[email protected]>

    drm/i915/hdcp: check streams[] bounds before overflow

Jani Nikula <[email protected]>
drm/i915/hdcp: require monotonically increasing seq_num_v

Jani Nikula <[email protected]>
drm/i915/vrr: require valid min/max vfreq for VRR

Bryam Vargas <[email protected]>
drm/virtio: bound EDID block reads to the response buffer

Leo Li <[email protected]>
Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"

WenTao Liang <[email protected]>
drm/amd/display: detect_link_and_local_sink: DP alt mode timeout path leaks prev_sink reference

Honglei Huang <[email protected]>
drm/amd/display: use kvzalloc to allocate struct dc

Thomas Zimmermann <[email protected]>
drm/amd/display: Handle struct drm_plane_state.ignore_damage_clips

Leorize <[email protected]>
drm/amd/display: set MSA MISC1 bit 6 when using VSC SDP for DCE 11.x

Guangshuo Li <[email protected]>
drm/amdkfd: free MQD managers on DQM init failures

Yongqiang Sun <[email protected]>
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

David Francis <[email protected]>
drm/amdkfd: Check bounds on CRIU restore queue type and mqd size

David Francis <[email protected]>
drm/amdkfd: Check bounds in allocate_event_notification_slot

David Francis <[email protected]>
drm/amdkfd: Use kvcalloc to allocate arrays

Xiaogang Chen <[email protected]>

    drm/amdkfd: Guard m->cp_hqd_eop_control setting by q->eop_ring_buffer_size

Yongqiang Sun <[email protected]>
drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size

Icenowy Zheng <[email protected]>

    drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM

Luigi Santivetti <[email protected]>
drm/imagination: fix error checking of pvr_vm_context_lookup()

Shuvam Pandey <[email protected]>
drm/imagination: Fix user array stride in pvr_set_uobj_array()

Brajesh Gupta <[email protected]>
drm/imagination: Fix double call to drm_sched_entity_fini()

Arvind Yadav <[email protected]>
drm/xe/madvise: Skip invalidation for purgeable state updates

Alexander Usyskin <[email protected]>
drm/xe/nvm: fix writable override for CRI

Zongyao Bai <[email protected]>
drm/xe/pt: Reset current_op in xe_pt_update_ops_init()

Himal Prasad Ghimiray <[email protected]>
drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC

Nitin Gote <[email protected]>
drm/xe: Hold a dma-buf reference for imported BOs

Matthew Brost <[email protected]>
drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds

Ashutosh Dixit <[email protected]>
drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists

Ashutosh Dixit <[email protected]>
drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG

Matthew Brost <[email protected]>
drm/xe: Return error on non-migratable faults requiring devmem

Matthew Auld <[email protected]>
drm/xe/display: skip FORCE_WC and vm_bound check for external dma-bufs

Pavel Ondračka <[email protected]>
drm/radeon: fix r100_copy_blit for large BOs

Wentao Liang <[email protected]>
drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit()

Imre Deak <[email protected]>
drm/i915/mtl+: Enable PPS before PLL

Joonas Lahtinen <[email protected]>
drm/i915/gem: Add missing nospec on parallel submit slot

Jani Nikula <[email protected]>
drm/displayid: fix Tiled Display Topology ID size

Gerhard Schwanzer <[email protected]>
drm/amdkfd: Use exclusive bounds for SVM split alignment checks

Timur Kristóf <[email protected]>
drm/amdgpu: Respect placement requirements in amdgpu_gtt_mgr functions

Thomas Zimmermann <[email protected]>
drm/sysfb: Return errno code from drm_sysfb_get_visible_size()

Thomas Zimmermann <[email protected]>
drm/sysfb: Avoid possible truncation with calculating visible size

Junrui Luo <[email protected]>
drm/nouveau: fix reversed error cleanup order in ucopy functions

Mario Limonciello <[email protected]>
drm/amdgpu: validate CP_GFX_SHADOW chunk size in CS pass1

Tvrtko Ursulin <[email protected]>
drm/amdgpu: Fix context pstate override handling

Timur Kristóf <[email protected]>
drm/amdgpu: Fix amdgpu_bo_move() when old_mem and new_mem are both GTT

Jiqian Chen <[email protected]>
drm/amdgpu/gfx9: Fix Ring and IB test fail after mode2

Ivan Lipski <[email protected]>
drm/amd/display: Restore periodic detection for DCN35

Brian Nguyen <[email protected]>
drm/xe: Add compact-PT and addr mask handling for page reclaim

Tejas Upadhyay <[email protected]>
drm/xe/guc: Fix buffer overflow in steered register list allocation

Thomas Zimmermann <[email protected]>
drm/sysfb: Avoid truncating maximum stride

Thomas Zimmermann <[email protected]>
drm/sysfb: Do not page-align visible size of the framebuffer

Mario Limonciello <[email protected]>
drm/amdgpu: check amdgpu_vm_bo_find() result in GET_MAPPING_INFO

Timur Kristóf <[email protected]>
drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older

Timur Kristóf <[email protected]>
drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2)

Asad Kamal <[email protected]>
drm/amdgpu/gfx: fix cleaner shader IB buffer overflow

Shubhankar Milind Sardeshpande <[email protected]>
drm/amd/pm: re-enable MC access after PrepareMp1ForUnload on SMU V15 APUs

Ville Syrjälä <[email protected]>
drm/i915/cdclk: Fix up CDCLK_FREQ_DECIMAL without a full PLL re-enable

Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers

Alessio Belle <[email protected]>
drm/imagination: Fit paired fragment job in the correct CCCB

Thomas Zimmermann <[email protected]>
drm/tegra: fbdev: Remove offset into framebuffer memory

Ashutosh Desai <[email protected]>
drm/dp/mst: fix buffer overflows in sideband chunk accumulation

Ashutosh Desai <[email protected]>
drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers

Thomas Zimmermann <[email protected]>
drm/exynos: fbdev: Remove offset into screen_buffer

Vitor Soares <[email protected]>
drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS()

Alessio Belle <[email protected]>
drm/imagination: Count paired job fence as dependency in prepare_job()

Chen Ni <[email protected]>
drm/rockchip: analogix_dp: Add missing error check for platform_get_resource()

Sergey Shtylyov <[email protected]>
drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video()

Tomi Valkeinen <[email protected]>
drm/tidss: Fix missing drm_bridge_add() call

Biju Das <[email protected]>
drm: renesas: rzg2l_mipi_dsi: Move rzg2l_mipi_dsi_set_display_timing()

Biju Das <[email protected]>
drm: renesas: rzg2l_mipi_dsi: Increase reset deassertion delay

David Carlier <[email protected]>
tracing: Fix use-after-free freeing trigger private data

Chengfeng Ye <[email protected]>
bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

Pu Lehui <[email protected]>
LoongArch: BPF: Fix memory leak in bpf_jit_free()

Mateusz Guzik <[email protected]>
pidfs: make pidfs_ino_lock static

Eric Dumazet <[email protected]>
drop_monitor: perform u64_stats updates under IRQ-disabled section

Eric Dumazet <[email protected]>
drop_monitor: fix size calculations for 64-bit attributes

Yehyeong Lee <[email protected]>
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD

Vikas Gupta <[email protected]>
bnge/bng_re: fix ring ID widths

Cen Zhang (Microsoft) <[email protected]>
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()

Lorenzo Bianconi <[email protected]>
net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()

Minhong He <[email protected]>
mctp: check register_netdevice_notifier() error in mctp_device_init()

Clark Wang <[email protected]>
ptp: netc: explicitly clear TMR_OFF during initialization

Cen Zhang (Microsoft) <[email protected]>
rds: tcp: unregister sysctl before tearing down listen socket

Nikola Z. Ivanov <[email protected]>
ipv6: Change allocation flags to match rcu_read_lock section requirements

Emil Tantilov <[email protected]>
idpf: fix max_vport related crash on allocation error during init

Paul Greenwalt <[email protected]>
ice: prevent tstamp ring allocation for non-PF VSI types

Marcin Szycik <[email protected]>
ice: fix LAG recipe to profile association

Vincent Chen <[email protected]>
ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV

Li RongQing <[email protected]>
net: ipv6: fix dif and sdif mismatch in raw6_icmp_error

Hariprasad Kelam <[email protected]>
octeontx2-pf: tc: fix egress ratelimiting

Alexei Lazar <[email protected]>
net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation

Alexei Lazar <[email protected]>
net/mlx5e: Report zero bandwidth for non-ETS traffic classes

Yael Chemla <[email protected]>
net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule

Gal Pressman <[email protected]>
net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

Runyu Xiao <[email protected]>

    raw: annotate lockless match fields in raw_v4_match()

Aldo Ariel Panzardo <[email protected]>
net: qrtr: restrict socket creation to the initial network namespace

Nicholas Dudar <[email protected]>
LoongArch: BPF: Zero-extend signed ALU32 div/mod results

Chenguang Zhao <[email protected]>
hinic: remove unused ethtool RSS user configuration buffers

Eric Dumazet <[email protected]>
ppp: annotate data races in ppp_generic

Eric Dumazet <[email protected]>
ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup

Suman Ghosh <[email protected]>
octeontx2-vf: set TC flower flag on MCAM entry allocation

Kuniyuki Iwashima <[email protected]>

    mpls: Set rt->rt_nhn just before returning from mpls_nh_build_multi().

Yun Zhou <[email protected]>
net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM

vadik likholetov <[email protected]>
net: stmmac: enable the MAC on link up for all supported speeds

Nazim Amirul <[email protected]>
net: stmmac: reset residual action in L3L4 filters on delete

Nazim Amirul <[email protected]>
net: stmmac: fix l3l4 filter rejecting unsupported offload requests

Nazim Amirul <[email protected]>
net: stmmac: xgmac: fix l4 filter port overwrite on register update

Xiang Mei (Microsoft) <[email protected]>
bpf: tcp: fix double sock release on batch realloc

José Expósito <[email protected]>
drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem

Cen Zhang (Microsoft) <[email protected]>
tipc: fix u16 MTU truncation in media and bearer MTU validation

Zhang Yi <[email protected]>
iomap: fix incorrect did_zero setting in iomap_zero_iter()

Zhang Yi <[email protected]>
iomap: correct the range of a partial dirty clear

Shuicheng Lin <[email protected]>
drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()

Raag Jadav <[email protected]>
drm/xe/i2c: Allow per domain unique id

Harshaka Narayana <[email protected]>
vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets

Qing Luo <[email protected]>
sctp: auth: verify auth requirement when auth_chunk is NULL

Luis Lang <[email protected]>
net: stmmac: dwmac4: mask interrupts when stopping DMA in suspend

Michael Walle <[email protected]>
net: dpaa: fix mode setting

Chuyi Zhou <[email protected]>
smp: Make CSD lock acquisition atomic for debug mode

Chuyi Zhou <[email protected]>
smp: Avoid invalid per-CPU CSD lookup with CSD lock debug

Eric Dumazet <[email protected]>
net: hsr: fix memory leak on slave unregistration by removing synced VLANs

Nikolay Aleksandrov <[email protected]>
net: bridge: vlan: fix vlan range dumps starting with pvid

Michael Bommarito <[email protected]>
amt: make the head writable before rewriting the L2 header

Michael Bommarito <[email protected]>
amt: re-read skb header pointers after every pull

Amir Goldstein <[email protected]>
ovl: check access to copy_file_range source with src mounter creds

Gregor Herburger <[email protected]>
drm/vc4: hvs/v3d: Fix null dereference in unbind

Julian Braha <[email protected]>
drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A

Julian Braha <[email protected]>
drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER

Julian Braha <[email protected]>
drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T

Yichong Chen <[email protected]>
ovl: fix trusted xattr escape prefix matching

Shelley Yang <[email protected]>
wifi: brcmfmac: fix 802.1X-SHA256 call trace warning

Satyanarayana K V P <[email protected]>
drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()

Sean Wang <[email protected]>
wifi: mt76: mt7925: fix crash in reset link replay

Arnd Bergmann <[email protected]>
wifi: mt76: fix airoha_npu dependency tracking

Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()

Lorenzo Bianconi <[email protected]>

    wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()

Lorenzo Bianconi <[email protected]>
wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

Ruoyu Wang <[email protected]>
wifi: mt76: mt7915: guard HE capability lookups

Guangshuo Li <[email protected]>
wifi: mt76: mt7925: guard link STA in decap offload

Eric Dumazet <[email protected]>

    ppp: annotate concurrent dev->stats accesses

Frank Sorenson <[email protected]>
cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths

Frank Sorenson <[email protected]>
cifs: prevent readdir from changing file size due to stale directory metadata

Helen Koike <[email protected]>
tipc: fix infinite loop in __tipc_nl_compat_dumpit

Xiang Mei (Microsoft) <[email protected]>
nexthop: initialize extack in nh_res_bucket_migrate()

Xiang Mei (Microsoft) <[email protected]>
gtp: check skb_pull_data() return in gtp1u_send_echo_resp()

Willem de Bruijn <[email protected]>
selftests: drv-net: convert so_txtime to drv-net

Matthieu Baerts (NGI0) <[email protected]>
selftests: drv-net: increase timeout

Matthieu Baerts (NGI0) <[email protected]>
selftests: ovpn: increase timeout

Matthieu Baerts (NGI0) <[email protected]>
selftests: ovpn: add IPV6 and VETH configs

Matthieu Baerts (NGI0) <[email protected]>
selftests: openvswitch: add config file

Matthieu Baerts (NGI0) <[email protected]>
selftests: af_unix: add USER_NS config

Rishikesh Jethwani <[email protected]>
tls: device: push pending open record on splice EOF

Myeonghun Pak <[email protected]>
net: mctp i3c: clean up notifier and buses if driver register fails

Cen Zhang (Microsoft) <[email protected]>
sctp: validate stream count in sctp_process_strreset_inreq()

Rob Herring (Arm) <[email protected]>
accel: ethosu: Handle U85 internal chaining buffer

Rob Herring (Arm) <[email protected]>
accel: ethosu: Fix element size accounting for cmd stream validation

Nikhil P. Rao <[email protected]>
pds_core: check for workqueue allocation failure

Nikhil P. Rao <[email protected]>
pds_core: fix auxiliary device add/del races

Nikhil P. Rao <[email protected]>
pds_core: order completion reads after the ownership check

Nikhil P. Rao <[email protected]>
pds_core: yield the CPU while waiting for the adminq to drain

Nikhil P. Rao <[email protected]>
pds_core: fix use-after-free on workqueue during remove

Nikhil P. Rao <[email protected]>
pds_core: fix deadlock between reset thread and remove

HanQuan <[email protected]>
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid

Chenguang Zhao <[email protected]>
net: txgbe: fix FDIR filter leak on remove

Ilia Gavrilov <[email protected]>
rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled

Chenguang Zhao <[email protected]>
net: txgbe: fix heap overflow when reading module EEPROM

Weiming Shi <[email protected]>
tipc: serialize udp bearer replicast list updates

Antoine Tenart <[email protected]>
geneve: ensure the skb is writable before fixing its headers

Antoine Tenart <[email protected]>
geneve: fix hint header definition wrt endianness

Kuniyuki Iwashima <[email protected]>
net: Call net_enable_timestamp() before failure in sk_clone().

Kuniyuki Iwashima <[email protected]>
soreuseport: Clear sk_reuseport_cb before failure in sk_clone().

Prashanth Kumar KR <[email protected]>
amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

Richard Cheng <[email protected]>
arm64/mm: Check the requested PFN range during memory removal

Steven Price <[email protected]>
arm64: Correct value returned by ESR_ELx_FSC_ADDRSZ_nL()

Nikhil P. Rao <[email protected]>
pds_core: reject component parameter in legacy firmware update

Andrew Pope <[email protected]>
wifi: mac80211: recalculate TIM when a station enters power save

Li RongQing <[email protected]>
iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()

Pengpeng Hou <[email protected]>
iommu/amd: Bound the early ACPI HID map

HE WEI (ギカク) <[email protected]>
wifi: mwifiex: bound uAP association event IEs to the event buffer

Benjamin Berg <[email protected]>
wifi: mac80211: copy aggregation information

Enrico Zanda <[email protected]>
vhost-net: fix TX stall when vhost owns virtio-net header

Ruoyu Wang <[email protected]>
wan: wanxl: Only reset hardware after BAR mapping

Ruoyu Wang <[email protected]>
nfp: Check resource mutex allocation

Xiang Mei <[email protected]>
wifi: mac80211: tear down new links on vif update error path

Guanghui Feng <[email protected]>
iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()

Wayen Yan <[email protected]>
net: airoha: Fix DMA direction for NPU mailbox buffer

Guangshuo Li <[email protected]>
dpaa2-eth: put MAC endpoint device on disconnect

Wayen Yan <[email protected]>
net: airoha: Fix potential use-after-free in airoha_ppe_deinit()

Guangshuo Li <[email protected]>
dpaa2-switch: put MAC endpoint device on disconnect

Xuanqiang Luo <[email protected]>
rxrpc: fix io_thread race in rxrpc_wake_up_io_thread()

Zhixing Chen <[email protected]>
gtp: parse extension headers before reading inner protocol

Aldo Ariel Panzardo <[email protected]>
rds: drop incoming messages that cross network namespace boundaries

Zhaolong Zhang <[email protected]>
bonding: fix devconf_all NULL dereference when IPv6 is disabled

Jamal Hadi Salim <[email protected]>
net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains

Daniel Borkmann <[email protected]>
bpf: Reject redirect helpers without a bpf_net_context

David Lee <[email protected]>
net/packet: avoid fanout hook re-registration after unregister

Danielle Ratson <[email protected]>
netlink: specs: rt-link: convert bridge port flag attributes to u8

Ricardo B. Marlière <[email protected]>
selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range

Michael Walle <[email protected]>
net: phy: marvell: fix return code

Pengpeng Hou <[email protected]>
Bluetooth: btusb: validate Realtek vendor event length

Daniel Golle <[email protected]>
regulator: mt6358: use regmap helper to read fixed LDO calibration

Pengpeng Hou <[email protected]>
hwmon: occ: validate poll response sensor blocks

Marco Baffo <[email protected]>
ovpn: use monotonic clock for peer keepalive timeouts

Marco Baffo <[email protected]>
ovpn: fix use after free in unlock_ovpn()

longlong yan <[email protected]>
selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()

Qing Ming <[email protected]>
ovpn: avoid putting unrelated P2P peer on socket release

Suraj Kandpal <[email protected]>
drm/i915/backlight: Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight

Yichong Chen <[email protected]>
smb: client: validate DFS referral PathConsumed

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) add missed handle for ENOMEM

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix EC read intervals

Eugene Shalygin <[email protected]>
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC

Alexis Czezar Torreno <[email protected]>
hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers

Alexis Czezar Torreno <[email protected]>

    hwmon: (pmbus/max34440): add support adpm12250

Uwe Kleine-König (The Capable Hub) <[email protected]>
hwmon: Use named initializers for arrays of i2c_device_data

Uwe Kleine-König (The Capable Hub) <[email protected]>
hwmon: Drop unused i2c driver_data

Mostafa Saleh <[email protected]>
drivers/virt: pkvm: Fix end calculation in mmio_guard_ioremap_hook()

Diego Fernando Mancera Gomez <[email protected]>
usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect

Shahar Tzarfati <[email protected]>
wifi: iwlwifi: mvm: fix read in wake packet notification handler

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn

Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: fix pointer arithmetic in iwl_add_mcc_to_tas_block_list

Pagadala Yesu Anjaneyulu <[email protected]>
wifi: iwlwifi: mvm: validate SAR GEO response payload size

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Use complete_all() to signal init_completion

Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Fix potential probe() deadlock

Guangshuo Li <[email protected]>
arm_mpam: guard MBWU state before adding it to garbage

Fenghua Yu <[email protected]>
arm_mpam: Fix MPAMCFG_MBW_PBM register setting

Ben Horgan <[email protected]>
arm_mpam: Fix software reset values of MPAMCFG_PRI

Shengjiu Wang <[email protected]>
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI

Guangshuo Li <[email protected]>
ALSA: hda: cs35l41: validate and free ACPI mute object

Tycho Andersen (AMD) <[email protected]>
iommu/amd: Fix nested domain leak

Tycho Andersen (AMD) <[email protected]>
iommu/amd: Fix IRQ unsafe locking in gdom allocation

Chen-Yu Tsai <[email protected]>
ASoC: sun4i-codec: Set quirks.playback_only for H616 codec

Pengpeng Hou <[email protected]>
ASoC: tas2781: bound firmware description string parsing

Guanghui Yang <[email protected]>
btrfs: free mapping node on duplicate reloc root insert

Leo Martins <[email protected]>
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps

Dave Chen <[email protected]>
btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting

You-Kai Zheng <[email protected]>
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8

Tristan Madani <[email protected]>
wifi: carl9170: fix buffer overflow in rx_stream failover path

Tristan Madani <[email protected]>
wifi: carl9170: fix OOB read from off-by-two in TX status handler

Tristan Madani <[email protected]>
wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

Tristan Madani <[email protected]>
wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler

Yingying Tang <[email protected]>
wifi: ath12k: Fix low MLO RX throughput on WCN7850

Ruoyu Wang <[email protected]>
firewire: net: Fix fragmented datagram reassembly

Denis Benato <[email protected]>
platform/x86: asus-wmi: temporarily revert to setting a charge limit

Yousef Alhouseen <[email protected]>
platform/x86/intel/vsec: free ACPI discovery data on early errors

Rosen Penev <[email protected]>
platform/x86/intel/vsec: allocate res with intel_vsec_dev

Manivannan Sadhasivam <[email protected]>
wifi: ath12k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET

Manivannan Sadhasivam <[email protected]>
wifi: ath11k: Flush the posted write after writing to PCIE_SOC_GLOBAL_RESET

Dmitry Morgun <[email protected]>
wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get()

Manikanta Pubbisetty <[email protected]>
wifi: ath10k: fix skb leak on incomplete msdu during rx pop

Wayen Yan <[email protected]>
watchdog: airoha: Prevent division by zero when clock frequency is zero

Tzung-Bi Shih <[email protected]>
watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()

Guenter Roeck <[email protected]>
hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop

Guenter Roeck <[email protected]>
hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop

Guenter Roeck <[email protected]>
hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop

Guenter Roeck <[email protected]>
hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop

Edward Adam Davis <[email protected]>
hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop

Gaole Zhang <[email protected]>
wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin

Cheng Yongkang <[email protected]>
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request

Rafael J. Wysocki <[email protected]>
watchdog: ni903x_wdt: Check ACPI_COMPANION() against NULL

Daniel Borkmann <[email protected]>
selftests/bpf: Keep verifier_map_ptr exercising ops pointer access

KP Singh <[email protected]>
selftests/bpf: Adjust verifier_map_ptr for the map's excl field

Xincheng Zhang <[email protected]>
usb: xhci-pci: Limit VIA VL805 DMA addressing to 36 bits

Sasha Levin <[email protected]>
Revert "drm/amd/display: Add missing kdoc for ALLM parameters"

Xie Bo <[email protected]>
RISC-V: KVM: Serialize virtual interrupt pending state updates

Georgi Valkov <[email protected]>
wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware

Timur Kristóf <[email protected]>
drm/amd/display: Add dp_skip_rbr flag for NUTMEG

Timur Kristóf <[email protected]>
drm/amd/display: Fix preferred link rate for NUTMEG

Ray Wu <[email protected]>
drm/amd/display: Fix ISM dc_lock deadlock during suspend

Chia-Lin Kao (AceLan) <[email protected]>
usb: typec: ucsi: Add duplicate detection to nvidia registration path

Chia-Lin Kao (AceLan) <[email protected]>
usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware

Chukun Pan <[email protected]>
USB: serial: option: add TDTECH MT5710-CN

Johan Hovold <[email protected]>
USB: serial: keyspan_pda: fix data loss on receive throttling

Sunho Park <[email protected]>
USB: serial: io_edgeport: cap received transmit credits

Tim Pambor <[email protected]>
USB: serial: ftdi_sio: add support for E+H FXA291

Muhammad Bilal <[email protected]>
usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer

Fan Wu <[email protected]>
usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

Cen Zhang <[email protected]>
usb: gadget: f_tcm: synchronize delayed set_alt with teardown

Sonali Pradhan <[email protected]>
usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb()

Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix dev_printk() device

Johan Hovold <[email protected]>
USB: gadget: fsl-udc: fix device name leak on probe failure

Johan Hovold <[email protected]>
USB: gadget: snps-udc: fix device name leak on probe failure

Melbin K Mathew <[email protected]>
usb: gadget: printer: fix infinite loop in printer_read()

Fan Wu <[email protected]>
usb: gadget: f_midi: cancel pending IN work before freeing the midi object

Jinchao Wang <[email protected]>
usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback

Xu Yang <[email protected]>
usb: chipidea: fix usage_count leak when autosuspend_delay is negative

Huang Wei <[email protected]>
USB: storage: add NO_ATA_1X quirk for Longmai USB Key

Guangshuo Li <[email protected]>
usb: musb: omap2430: Do not put borrowed of_node in probe

Chia-Lin Kao (AceLan) <[email protected]>
usb: core: port: Deattach Type-C connector on component unbind

Huihui Huang <[email protected]>

    wifi: at76c50x-usb: avoid length underflow in at76_guess_freq()

Griffin Kroah-Hartman <[email protected]>
usb: core: sysfs: add lock to bos_descriptors_read()

Weiming Shi <[email protected]>
mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

Andre Carvalho <[email protected]>
selftests: netconsole: only restore MAC when it changed on resume

Ruoyu Wang <[email protected]>
bnxt_en: Handle partially initialized auxiliary devices

Xin Long <[email protected]>
sctp: fix auth_hmacs array size in struct sctp_cookie

Jamal Hadi Salim <[email protected]>
net/sched: act_tunnel_key: Defer dst_release to RCU callback

Ivan Vecera <[email protected]>
dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()

Eric Dumazet <[email protected]>
tcp: fix TIME_WAIT socket reference leak on PSP policy failure

Lizhi Hou <[email protected]>
accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

Emre Cecanpunar <[email protected]>
drm/i915/selftests: Fix GT PM sort comparators

Vinod Govindapillai <[email protected]>
drm/i915/wm: clear the plane ddb_y entries on plane disable

Xiang Mei (Microsoft) <[email protected]>
ksmbd: validate compound request size before reading StructureSize2

Qihang <[email protected]>
ksmbd: pin conn during async oplock break notification

Arvind Yadav <[email protected]>
drm/xe/guc: Hold device ref until queue teardown completes

Arvind Yadav <[email protected]>
drm/xe/guc: Keep scheduler timeline name alive

Tvrtko Ursulin <[email protected]>
drm/xe: Assign queue name in time for drm_sched_init

Daniele Ceraolo Spurio <[email protected]>
drm/xe/wopcm: fix WOPCM size for LNL+

Matthew Brost <[email protected]>
drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves

Shuhao Fu <[email protected]>
can: j1939: fix lockless local-destination check

Mark Harris <[email protected]>
riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()

Vasily Gorbik <[email protected]>
s390/checksum: Fix csum_partial() without vector facility

Linmao Li <[email protected]>
drm/panthor: Check debugfs GEM lock initialization

Michal Luczaj <[email protected]>
bpf, sockmap: Reject unhashed UDP sockets on sockmap update

Shrikanth Hegde <[email protected]>
powerpc/vtime: Initialize starttime at boot for native accounting

Frederic Weisbecker <[email protected]>
powerpc/time: Prepare to stop elapsing in dynticks-idle

Rosen Penev <[email protected]>
powerpc/85xx: Add fsl,ifc to common device ids

Srikanth Boyapally <[email protected]>
spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled

Oliver Hartkopp <[email protected]>
can: raw: add locking for raw flags bitfield

Pengpeng Hou <[email protected]>
drm/i915/gt: use correct selftest config symbol

Rui Qi <[email protected]>
riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE

Huiwen He <[email protected]>
smb/client: handle overlapping allocated ranges in fallocate

Mikhail Gavrilov <[email protected]>
Bluetooth: mgmt: Translate HCI reason in Device Disconnected event

Ruoyu Wang <[email protected]>
Bluetooth: hci_qca: Clear memdump state on invalid dump size

Pauli Virtanen <[email protected]>

    Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups

Pauli Virtanen <[email protected]>
Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds

Pauli Virtanen <[email protected]>
Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync

Pauli Virtanen <[email protected]>
Bluetooth: hci_sync: extend conn_hash lookup critical sections

Cen Zhang <[email protected]>
Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update

Xiang Mei <[email protected]>
Bluetooth: qca: fix NVM tag length underflow in TLV parser

Takashi Iwai <[email protected]>
ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC

Karol Wachowski <[email protected]>
accel/ivpu: Fix wrong register read in LNL failure diagnostics

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts

Rosen Penev <[email protected]>

    ata: sata_dwc_460ex: use platform_get_irq()

Rosen Penev <[email protected]>
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered

David Jeffery <[email protected]>
scsi: core: wake eh reliably when using scsi_schedule_eh

Robert Mader <[email protected]>
udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()

Bryam Vargas <[email protected]>
net/iucv: take a reference on the socket found in afiucv_hs_rcv()

Weiming Shi <[email protected]>
ipv4: fib: free fib_alias with kfree_rcu() on insert error path

Norbert Szetei <[email protected]>
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

Tejun Heo <[email protected]>
sched_ext: Record an error on errno-only sub-enable failure

Rafael J. Wysocki <[email protected]>
cpufreq: Make cpufreq_update_pressure() fall back to cpuinfo.max_freq

Matt Bobrowski <[email protected]>
bpf: Fix UAF in sock clone early bailouts

Pushpendra Singh <[email protected]>
firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context

Uday Khare <[email protected]>
ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup

Andrea Righi <[email protected]>
sched_ext: Enable tick for finite slices on nohz_full

Charles Keepax <[email protected]>
ASoC: cs42l43: Correct report for forced microphone jack

Gao Xiang <[email protected]>
erofs: relax sanity check for tail pclusters due to ztailpacking

Vijendar Mukunda <[email protected]>
ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check

Vijendar Mukunda <[email protected]>
ASoC: amd: ps: fix wrong ACP version string in pci_request_regions()

Vijendar Mukunda <[email protected]>
ASoC: amd: ps: disable MSI on resume in ACP PCI driver

Christian Hewitt <[email protected]>
ASoC: meson: aiu: fifo-spdif: soft reset the S/PDIF datapath on start/stop

Sebastian Ene <[email protected]>
firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation

Mostafa Saleh <[email protected]>
firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()

HE WEI (ギカク) <[email protected]>
wifi: cfg80211: bound element ID read when checking non-inheritance

Runyu Xiao <[email protected]>
wifi: brcmfmac: initialize SDIO data work before cleanup

Cen Zhang <[email protected]>
wifi: cfg80211: use wiphy work for socket owner autodisconnect

Cen Zhang <[email protected]>
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock

Syed Saba Kareem <[email protected]>
ASoC: amd: acp: Fix linker error with SDCA quirks

Zhao Li <[email protected]>
wifi: mac80211: avoid non-S1G AID fallback for S1G assoc

Zhao Li <[email protected]>
wifi: cfg80211: reject empty PMSR peer lists

Zhao Li <[email protected]>
wifi: cfg80211: reject unsupported PMSR FTM location requests

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR FTM preamble range

Zhao Li <[email protected]>
wifi: cfg80211: validate PMSR measurement type data

Zhao Li <[email protected]>
wifi: nl80211: constrain MBSSID TX link ID range

Zhao Li <[email protected]>
wifi: nl80211: validate nested MBSSID IE blobs

Zhao Li <[email protected]>
wifi: cfg80211: derive S1G beacon TSF from S1G fields

Zhao Li <[email protected]>
wifi: nl80211: free RNR data on MBSSID mismatch

Peddolla Harshavardhan Reddy <[email protected]>
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

Xiang Mei <[email protected]>
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

Maoyi Xie <[email protected]>
wifi: mac80211: defer link RX stats percpu free to RCU

Dawei Feng <[email protected]>
wifi: libertas: fix memory leak in helper_firmware_cb()

Xiang Mei <[email protected]>
wifi: mac80211: fix fils_discovery double free on alloc failure

Xiang Mei <[email protected]>
wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure

Bryam Vargas <[email protected]>
wifi: mac80211_hwsim: clamp virtio RX length before skb_put

Christophe JAILLET <[email protected]>
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

Abdun Nihaal <[email protected]>
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()

Cen Zhang <[email protected]>
wifi: cfg80211: cancel sched scan results work on unregister

Rong Zhang <[email protected]>
ALSA: usb-audio: Fix imbalance per-channel volume of sticky mixers

Arnd Bergmann <[email protected]>
wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack

Xiang Mei (Microsoft) <[email protected]>
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

Xiang Mei (Microsoft) <[email protected]>
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

Chen YanJun <[email protected]>
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()

Cen Zhang <[email protected]>
xfrm: clear mode callbacks after failed mode setup

Aleksandrova Alyona <[email protected]>
RDMA/irdma: Prevent overflows in memory contiguity checks

Malaya Kumar Rout <[email protected]>
selftests/alsa: Fix memory leak in find_controls error path

Xue Lei <[email protected]>
mtd: fix double free and WARN_ON in add_mtd_device() error paths

Ruoyu Wang <[email protected]>
RDMA/siw: publish QP after initialization

Danila Chernetsov <[email protected]>
RDMA/hns: Fix potential integer overflow in mhop hem cleanup

Chenguang Zhao <[email protected]>
RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe

Ruoyu Wang <[email protected]>
RDMA/mana_ib: initialize err for empty send WR lists

Ruoyu Wang <[email protected]>
RDMA/erdma: initialize ret for empty receive WR lists

Jacob Moroni <[email protected]>
RDMA/irdma: Prevent user-triggered null deref on QP create

Jacob Moroni <[email protected]>
RDMA/irdma: Remove redundant legacy_mode checks

Jacob Moroni <[email protected]>
RDMA/irdma: Prevent rereg_mr for non-mem regions

Or Gerlitz <[email protected]>
RDMA/cma: Fix hardware address comparison length in netevent callback

Antony Antony <[email protected]>
xfrm: reject optional IPTFS templates in outbound policies

Xiang Mei (Microsoft) <[email protected]>
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()

Yixun Lan <[email protected]>
reset: spacemit: k3: fix USB2 ahb reset

Tejun Heo <[email protected]>
sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()

Unnathi Chalicheemala <[email protected]>
firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()

Boris Burkov <[email protected]>
btrfs: fallback to transaction csum tree on a commit root csum miss

Filipe Manana <[email protected]>
btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()

Xiang Mei <[email protected]>
btrfs: reject free space cache with more entries than pages

Pengpeng Hou <[email protected]>
mtd: nand: mtk-ecc: stop on ECC idle timeouts

Pengpeng Hou <[email protected]>
mtd: mtdswap: remove debugfs stats file on teardown

Harshit Mogalapalli <[email protected]>
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()

Harshit Mogalapalli <[email protected]>
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()

Michael Bommarito <[email protected]>
IB/mad: Drop unmatched RMPP responses before reassembly

Seth Forshee <[email protected]>
firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits

Petr Wozniak <[email protected]>

    xfrm: fix stale skb->prev after async crypto steals a GSO segment

Petr Wozniak <[email protected]>
xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()

Sumit Gupta <[email protected]>
arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234

Tejun Heo <[email protected]>
sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()

Doehyun Baek <[email protected]>
Docs/admin-guide/cgroup-v2: fix memory.stat doc details

Akhil R <[email protected]>
arm64: tegra: Remove fallback compatible for GPCDMA

Chuck Lever <[email protected]>
xprtrdma: Clear receive-side ownership pointers on release

Mikko Perttunen <[email protected]>
crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin

Mikko Perttunen <[email protected]>
gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

Phil Rosenthal <[email protected]>
KVM: x86/mmu: Fix use-after-free on vendor module reload

Hyunwoo Kim <[email protected]>
KVM: nVMX: Hide shadow VMCS right after VMCLEAR

Venkatesh Srinivas <[email protected]>
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN

Sean Christopherson <[email protected]>
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available

Heiko Carstens <[email protected]>
seqlock: Allow UBSAN_ALIGNMENT to fail optimizing

Ryosuke Yasuoka <[email protected]>
drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker

Kuba Piecuch <[email protected]>
sched_ext: Skip ops.set_weight() for disabled tasks

Guixiong Wei <[email protected]>
platform/x86/intel-uncore-freq: Fix current_freq_khz after CPU hotplug

-------------

Diffstat:

 Documentation/admin-guide/cgroup-v2.rst            |   4 +-
 Documentation/hwmon/max34440.rst                   |  27 +-
 Documentation/netlink/specs/rt-link.yaml           |  40 +-
 Makefile                                           |   9 +-
 arch/arm64/boot/dts/nvidia/tegra234.dtsi           |  24 +-
 arch/arm64/boot/dts/nvidia/tegra264.dtsi           |   2 +-
 arch/arm64/include/asm/esr.h                       |   2 +-
 arch/arm64/mm/hugetlbpage.c                        |   2 +-
 arch/arm64/mm/mmu.c                                |   7 +-
 arch/loongarch/include/asm/asmmacro.h              |   2 +-
 arch/loongarch/kernel/acpi.c                       |  27 +-
 arch/loongarch/kernel/kgdb.c                       |   3 +-
 arch/loongarch/kernel/machine_kexec.c              |   5 +-
 arch/loongarch/kernel/rethook_trampoline.S         |  18 +-
 arch/loongarch/kernel/setup.c                      |   3 +-
 arch/loongarch/kernel/smp.c                        |   4 +-
 arch/loongarch/mm/init.c                           |   5 +-
 arch/loongarch/net/bpf_jit.c                       |   9 +-
 arch/m68k/include/asm/page_mm.h                    |   2 +
 arch/powerpc/kernel/time.c                         |  43 +++
 arch/powerpc/mm/mem.c                              |   5 +-
 arch/powerpc/platforms/85xx/common.c               |   2 +
 arch/riscv/Kconfig                                 |   2 +-
 arch/riscv/include/asm/kvm_host.h                  |  10 +-
 arch/riscv/kernel/sys_hwprobe.c                    |   1 +
 arch/riscv/kvm/aia.c                               |  35 +-
 arch/riscv/kvm/vcpu.c                              |  68 +++-
 arch/riscv/kvm/vcpu_onereg.c                       |   8 +-
 arch/riscv/mm/init.c                               |   5 +-
 arch/s390/lib/csum-partial.c                       |   2 +-
 arch/s390/mm/init.c                                |   5 +-
 arch/x86/boot/compressed/Makefile                  |   1 +
 arch/x86/kvm/lapic.c                               |   2 +-
 arch/x86/kvm/mmu/mmu.c                             |  11 +-
 arch/x86/kvm/mmu/paging_tmpl.h                     |  10 +-
 arch/x86/kvm/svm/svm.c                             |   7 +-
 arch/x86/kvm/vmx/nested.c                          |  11 +-
 arch/x86/mm/init_64.c                              |   5 +-
 drivers/accel/amdxdna/amdxdna_ctx.c                |   4 +
 drivers/accel/ethosu/ethosu_gem.c                  |  54 ++-
 drivers/accel/ivpu/ivpu_hw_btrs.c                  |   2 +-
 drivers/android/binder/thread.rs                   |  14 +-
 drivers/ata/sata_dwc_460ex.c                       |  38 +-
 drivers/block/rbd.c                                |   7 +-
 drivers/block/ublk_drv.c                           |  47 ++-
 drivers/bluetooth/btqca.c                          |   2 +-
 drivers/bluetooth/btusb.c                          |   4 +-
 drivers/bluetooth/hci_qca.c                        |   4 +
 drivers/cdrom/cdrom.c                              |   1 +
 drivers/comedi/drivers/comedi_parport.c            |  13 +-
 drivers/cpufreq/cpufreq.c                          |   3 +
 drivers/crypto/tegra/tegra-se-main.c               |   3 +-
 drivers/dma-buf/udmabuf.c                          |   9 +-
 drivers/dpll/dpll_netlink.c                        |   3 +
 drivers/firewire/net.c                             |  37 +-
 drivers/firmware/arm_ffa/driver.c                  |  54 ++-
 drivers/firmware/arm_scmi/notify.c                 |   6 +-
 drivers/firmware/stratix10-svc.c                   |  19 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c            |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c           |  62 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c             |   6 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c            |  73 ++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.c   |   7 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_dev_coredump.h   |   1 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c         |  14 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c            |   6 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c            |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c        |  30 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c            |   3 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.h            |   2 +
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c         |  13 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c            |  54 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c          |  34 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c            |  58 ++-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c            |  17 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |  35 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c             |  22 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c             |  56 +--
 drivers/gpu/drm/amd/amdgpu/gfx_v12_0.c             |  69 ++--
 drivers/gpu/drm/amd/amdgpu/gfx_v12_1.c             |  24 +-
 drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c              |   3 -
 drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c              |  49 ++-
 drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c            |  11 +-
 drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c           |   2 +-
 drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_1.c           |   2 +-
 drivers/gpu/drm/amd/amdgpu/mes_v11_0.c             |   2 +
 drivers/gpu/drm/amd/amdgpu/sdma_v4_4_2.c           |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v7_0.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c             |   4 +-
 drivers/gpu/drm/amd/amdgpu/soc24.c                 |  28 ++
 drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c              |  15 +-
 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c           |  12 +-
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c  |  10 +
 .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.h  |   2 +
 drivers/gpu/drm/amd/amdkfd/kfd_events.c            |   3 +
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h       |   1 +
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c   |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c   |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12.c   |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v12_1.c |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c    |  25 +-
 drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c    |   4 +-
 drivers/gpu/drm/amd/amdkfd/kfd_priv.h              |   3 +-
 .../gpu/drm/amd/amdkfd/kfd_process_queue_manager.c |  24 +-
 drivers/gpu/drm/amd/amdkfd/kfd_queue.c             |  23 +-
 drivers/gpu/drm/amd/amdkfd/kfd_svm.c               |   8 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  | 417 +++++++++++----------
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c |  81 ++--
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_ism.c  |  56 ++-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_ism.h  |   1 +
 .../amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c   |   2 -
 .../amd/display/dc/clk_mgr/dcn314/dcn314_clk_mgr.c |   2 -
 .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c   |   9 +-
 .../amd/display/dc/clk_mgr/dcn35/dcn35_clk_mgr.c   |  11 +-
 drivers/gpu/drm/amd/display/dc/core/dc.c           |   6 +-
 drivers/gpu/drm/amd/display/dc/dc.h                |   2 +
 .../drm/amd/display/dc/dce/dce_stream_encoder.c    |  15 +-
 .../drm/amd/display/dc/dce/dce_stream_encoder.h    |   3 +-
 .../gpu/drm/amd/display/dc/link/link_detection.c   |   7 +-
 .../display/dc/link/protocols/link_dp_capability.c |   6 +-
 .../display/dc/resource/dce100/dce100_resource.c   |   7 +-
 .../amd/display/modules/info_packet/info_packet.c  |   2 -
 drivers/gpu/drm/amd/include/mes_v11_api_def.h      |   2 +
 drivers/gpu/drm/amd/pm/amdgpu_pm.c                 |  26 +-
 drivers/gpu/drm/amd/pm/powerplay/hwmgr/hwmgr.c     |   7 +-
 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c          |  12 +
 drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h      |  12 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c   |  11 +-
 .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c   |  15 +-
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c   |  45 +++
 .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c   |  28 +-
 .../gpu/drm/amd/pm/swsmu/smu15/smu_v15_0_0_ppt.c   |   7 +-
 drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c     |  11 +-
 drivers/gpu/drm/display/drm_dp_mst_topology.c      |  36 +-
 drivers/gpu/drm/drm_connector.c                    |  12 +-
 drivers/gpu/drm/drm_displayid_internal.h           |   2 +-
 drivers/gpu/drm/drm_gpusvm.c                       |  22 +-
 drivers/gpu/drm/drm_pagemap.c                      |  24 +-
 drivers/gpu/drm/drm_panel_backlight_quirks.c       |   9 +
 drivers/gpu/drm/exynos/exynos_drm_fbdev.c          |   6 +-
 drivers/gpu/drm/i915/display/intel_bios.c          |  36 +-
 drivers/gpu/drm/i915/display/intel_cdclk.c         |  41 +-
 drivers/gpu/drm/i915/display/intel_ddi.c           |  11 +-
 drivers/gpu/drm/i915/display/intel_dp.c            |   8 +-
 .../gpu/drm/i915/display/intel_dp_aux_backlight.c  |   7 +-
 drivers/gpu/drm/i915/display/intel_hdcp.c          |  12 +-
 drivers/gpu/drm/i915/display/intel_vrr.c           |   4 +
 drivers/gpu/drm/i915/display/skl_watermark.c       |   2 +-
 drivers/gpu/drm/i915/gem/i915_gem_context.c        |  25 +-
 drivers/gpu/drm/i915/gt/intel_engine_user.c        |   2 +-
 .../gpu/drm/i915/gt/intel_execlists_submission.c   |  19 +-
 drivers/gpu/drm/i915/gt/selftest_gt_pm.c           |   8 +-
 drivers/gpu/drm/i915/i915_active.c                 |   7 +-
 drivers/gpu/drm/imagination/pvr_context.c          |  22 +-
 drivers/gpu/drm/imagination/pvr_drv.c              |  13 +-
 drivers/gpu/drm/imagination/pvr_queue.c            |  65 ++--
 drivers/gpu/drm/imagination/pvr_queue.h            |   2 +-
 drivers/gpu/drm/imagination/pvr_vm.c               |   2 +
 drivers/gpu/drm/nouveau/nouveau_exec.c             |   4 +-
 drivers/gpu/drm/nouveau/nouveau_uvmm.c             |   4 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c     |   1 +
 drivers/gpu/drm/panel/Kconfig                      |   3 +
 drivers/gpu/drm/panthor/panthor_device.c           |   5 +-
 drivers/gpu/drm/panthor/panthor_fw.c               |   1 +
 drivers/gpu/drm/radeon/r100.c                      |  13 +-
 drivers/gpu/drm/renesas/rz-du/rzg2l_mipi_dsi.c     |  18 +-
 drivers/gpu/drm/rockchip/analogix_dp-rockchip.c    |   2 +
 drivers/gpu/drm/rockchip/cdn-dp-reg.c              |   2 +
 drivers/gpu/drm/sysfb/drm_sysfb_helper.h           |   2 +-
 drivers/gpu/drm/sysfb/drm_sysfb_screen_info.c      |  13 +-
 drivers/gpu/drm/sysfb/efidrm.c                     |   7 +-
 drivers/gpu/drm/sysfb/vesadrm.c                    |   6 +-
 drivers/gpu/drm/tegra/fbdev.c                      |   8 +-
 drivers/gpu/drm/tests/drm_gem_shmem_test.c         |  16 +-
 drivers/gpu/drm/tidss/tidss_encoder.c              |   2 +
 drivers/gpu/drm/ttm/ttm_backup.c                   | 123 ++++--
 drivers/gpu/drm/ttm/ttm_pool.c                     | 123 +++++-
 drivers/gpu/drm/ttm/ttm_pool_internal.h            |   8 +
 drivers/gpu/drm/v3d/v3d_gem.c                      |  12 +
 drivers/gpu/drm/vc4/vc4_bo.c                       |  12 +-
 drivers/gpu/drm/vc4/vc4_hvs.c                      |   2 +-
 drivers/gpu/drm/vc4/vc4_v3d.c                      |   2 +-
 drivers/gpu/drm/virtio/virtgpu_gem.c               |  14 +-
 drivers/gpu/drm/virtio/virtgpu_kms.c               |   5 +-
 drivers/gpu/drm/virtio/virtgpu_vq.c                |   6 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c            |  22 +-
 drivers/gpu/drm/xe/display/xe_display_bo.c         |   3 +-
 drivers/gpu/drm/xe/display/xe_fb_pin.c             |   3 +-
 drivers/gpu/drm/xe/regs/xe_gtt_defs.h              |   6 +-
 drivers/gpu/drm/xe/xe_bo.c                         |  58 ++-
 drivers/gpu/drm/xe/xe_bo.h                         |   3 +-
 drivers/gpu/drm/xe/xe_bo_types.h                   |   2 +
 drivers/gpu/drm/xe/xe_device.c                     |   2 +-
 drivers/gpu/drm/xe/xe_device_types.h               |   2 +-
 drivers/gpu/drm/xe/xe_dma_buf.c                    |   2 +-
 drivers/gpu/drm/xe/xe_guc_capture.c                |  10 +-
 drivers/gpu/drm/xe/xe_guc_exec_queue_types.h       |   5 +
 drivers/gpu/drm/xe/xe_guc_submit.c                 | 140 ++++---
 drivers/gpu/drm/xe/xe_guc_types.h                  |   2 -
 drivers/gpu/drm/xe/xe_i2c.c                        |   5 +-
 drivers/gpu/drm/xe/xe_migrate.c                    |  21 +-
 drivers/gpu/drm/xe/xe_migrate.h                    |   4 +-
 drivers/gpu/drm/xe/xe_module.c                     |  49 +++
 drivers/gpu/drm/xe/xe_module.h                     |   5 +
 drivers/gpu/drm/xe/xe_nvm.c                        |   9 +-
 drivers/gpu/drm/xe/xe_pci.c                        |   6 +
 drivers/gpu/drm/xe/xe_pt.c                         | 148 +++++---
 drivers/gpu/drm/xe/xe_reg_whitelist.c              |  10 +-
 drivers/gpu/drm/xe/xe_sriov_vf_ccs.c               |  32 +-
 drivers/gpu/drm/xe/xe_sriov_vf_ccs.h               |   3 +-
 drivers/gpu/drm/xe/xe_svm.c                        |   6 +-
 drivers/gpu/drm/xe/xe_vm.c                         |  33 +-
 drivers/gpu/drm/xe/xe_vm_madvise.c                 |  19 +-
 drivers/gpu/drm/xe/xe_wopcm.c                      |  15 +-
 drivers/gpu/host1x/bus.c                           |   4 +-
 drivers/hwmon/ad7414.c                             |   4 +-
 drivers/hwmon/ad7418.c                             |   6 +-
 drivers/hwmon/adc128d818.c                         |   2 +-
 drivers/hwmon/adm1025.c                            |   4 +-
 drivers/hwmon/adm1026.c                            |   2 +-
 drivers/hwmon/adm1029.c                            |   2 +-
 drivers/hwmon/adm1031.c                            |   4 +-
 drivers/hwmon/adm1177.c                            |   4 +-
 drivers/hwmon/adm9240.c                            |   6 +-
 drivers/hwmon/ads7828.c                            |   4 +-
 drivers/hwmon/adt7410.c                            |   8 +-
 drivers/hwmon/adt7411.c                            |   2 +-
 drivers/hwmon/adt7462.c                            |   2 +-
 drivers/hwmon/adt7470.c                            |   2 +-
 drivers/hwmon/adt7475.c                            |   8 +-
 drivers/hwmon/aht10.c                              |   8 +-
 drivers/hwmon/amc6821.c                            |   2 +-
 drivers/hwmon/asb100.c                             |   2 +-
 drivers/hwmon/asc7621.c                            |   6 +-
 drivers/hwmon/asus-ec-sensors.c                    |  18 +-
 drivers/hwmon/atxp1.c                              |   2 +-
 drivers/hwmon/chipcap2.c                           |  16 +-
 drivers/hwmon/corsair-cpro.c                       |   1 +
 drivers/hwmon/corsair-psu.c                        |   1 +
 drivers/hwmon/dme1737.c                            |   4 +-
 drivers/hwmon/ds1621.c                             |  10 +-
 drivers/hwmon/ds620.c                              |   4 +-
 drivers/hwmon/emc1403.c                            |  24 +-
 drivers/hwmon/emc2103.c                            |   2 +-
 drivers/hwmon/emc2305.c                            |   8 +-
 drivers/hwmon/emc6w201.c                           |   2 +-
 drivers/hwmon/f75375s.c                            |   6 +-
 drivers/hwmon/fschmd.c                             |  14 +-
 drivers/hwmon/ftsteutates.c                        |   2 +-
 drivers/hwmon/g760a.c                              |   2 +-
 drivers/hwmon/g762.c                               |   6 +-
 drivers/hwmon/gigabyte_waterforce.c                |   4 +-
 drivers/hwmon/gl518sm.c                            |   2 +-
 drivers/hwmon/gl520sm.c                            |   2 +-
 drivers/hwmon/hih6130.c                            |   2 +-
 drivers/hwmon/hs3001.c                             |   4 +-
 drivers/hwmon/htu31.c                              |   2 +-
 drivers/hwmon/ina209.c                             |   2 +-
 drivers/hwmon/ina238.c                             |  12 +-
 drivers/hwmon/ina2xx.c                             |  16 +-
 drivers/hwmon/ina3221.c                            |   2 +-
 drivers/hwmon/isl28022.c                           |   2 +-
 drivers/hwmon/jc42.c                               |   2 +-
 drivers/hwmon/lineage-pem.c                        |   4 +-
 drivers/hwmon/lm63.c                               |   6 +-
 drivers/hwmon/lm73.c                               |   2 +-
 drivers/hwmon/lm75.c                               |  62 +--
 drivers/hwmon/lm77.c                               |   2 +-
 drivers/hwmon/lm78.c                               |   4 +-
 drivers/hwmon/lm80.c                               |   4 +-
 drivers/hwmon/lm83.c                               |   4 +-
 drivers/hwmon/lm85.c                               |  24 +-
 drivers/hwmon/lm87.c                               |   4 +-
 drivers/hwmon/lm90.c                               |  96 ++---
 drivers/hwmon/lm92.c                               |   6 +-
 drivers/hwmon/lm93.c                               |   4 +-
 drivers/hwmon/lm95234.c                            |   4 +-
 drivers/hwmon/lm95241.c                            |   4 +-
 drivers/hwmon/lm95245.c                            |   4 +-
 drivers/hwmon/ltc2945.c                            |   2 +-
 drivers/hwmon/ltc2947-i2c.c                        |   4 +-
 drivers/hwmon/ltc2990.c                            |   4 +-
 drivers/hwmon/ltc2991.c                            |   4 +-
 drivers/hwmon/ltc2992.c                            |   4 +-
 drivers/hwmon/ltc4151.c                            |   2 +-
 drivers/hwmon/ltc4215.c                            |   2 +-
 drivers/hwmon/ltc4222.c                            |   2 +-
 drivers/hwmon/ltc4245.c                            |   2 +-
 drivers/hwmon/ltc4260.c                            |   2 +-
 drivers/hwmon/ltc4261.c                            |   4 +-
 drivers/hwmon/max127.c                             |   2 +-
 drivers/hwmon/max16065.c                           |  12 +-
 drivers/hwmon/max1619.c                            |   2 +-
 drivers/hwmon/max1668.c                            |   6 +-
 drivers/hwmon/max31730.c                           |   2 +-
 drivers/hwmon/max31760.c                           |   2 +-
 drivers/hwmon/max31790.c                           |   2 +-
 drivers/hwmon/max31827.c                           |   6 +-
 drivers/hwmon/max6620.c                            |   2 +-
 drivers/hwmon/max6621.c                            |   2 +-
 drivers/hwmon/max6639.c                            |   2 +-
 drivers/hwmon/max6650.c                            |   4 +-
 drivers/hwmon/max6697.c                            |  20 +-
 drivers/hwmon/mc34vr500.c                          |   4 +-
 drivers/hwmon/mcp3021.c                            |   4 +-
 drivers/hwmon/nct6775-i2c.c                        |  26 +-
 drivers/hwmon/nct7802.c                            |   2 +-
 drivers/hwmon/nct7904.c                            |   4 +-
 drivers/hwmon/nzxt-kraken3.c                       |   6 +-
 drivers/hwmon/nzxt-smart2.c                        |   2 +-
 drivers/hwmon/occ/common.c                         |  38 +-
 drivers/hwmon/pcf8591.c                            |   2 +-
 drivers/hwmon/pmbus/acbel-fsg032.c                 |   4 +-
 drivers/hwmon/pmbus/adm1266.c                      |   2 +-
 drivers/hwmon/pmbus/adm1275.c                      |  20 +-
 drivers/hwmon/pmbus/aps-379.c                      |   4 +-
 drivers/hwmon/pmbus/bel-pfe.c                      |   6 +-
 drivers/hwmon/pmbus/bpa-rs600.c                    |   6 +-
 drivers/hwmon/pmbus/crps.c                         |   4 +-
 drivers/hwmon/pmbus/delta-ahe50dc-fan.c            |   2 +-
 drivers/hwmon/pmbus/dps920ab.c                     |   4 +-
 drivers/hwmon/pmbus/fsp-3y.c                       |   4 +-
 drivers/hwmon/pmbus/hac300s.c                      |   4 +-
 drivers/hwmon/pmbus/ibm-cffps.c                    |   8 +-
 drivers/hwmon/pmbus/ina233.c                       |   4 +-
 drivers/hwmon/pmbus/inspur-ipsps.c                 |   4 +-
 drivers/hwmon/pmbus/ir35221.c                      |   4 +-
 drivers/hwmon/pmbus/ir36021.c                      |   4 +-
 drivers/hwmon/pmbus/ir38064.c                      |  10 +-
 drivers/hwmon/pmbus/irps5401.c                     |   4 +-
 drivers/hwmon/pmbus/isl68137.c                     |  92 ++---
 drivers/hwmon/pmbus/lm25066.c                      |  10 +-
 drivers/hwmon/pmbus/lt3074.c                       |   4 +-
 drivers/hwmon/pmbus/lt7182s.c                      |   4 +-
 drivers/hwmon/pmbus/ltc2978.c                      |  60 +--
 drivers/hwmon/pmbus/ltc3815.c                      |   2 +-
 drivers/hwmon/pmbus/max15301.c                     |   8 +-
 drivers/hwmon/pmbus/max16064.c                     |   4 +-
 drivers/hwmon/pmbus/max16601.c                     |  10 +-
 drivers/hwmon/pmbus/max17616.c                     |   2 +-
 drivers/hwmon/pmbus/max20730.c                     |  10 +-
 drivers/hwmon/pmbus/max20751.c                     |   4 +-
 drivers/hwmon/pmbus/max31785.c                     |   8 +-
 drivers/hwmon/pmbus/max34440.c                     | 143 ++++++-
 drivers/hwmon/pmbus/max8688.c                      |   2 +-
 drivers/hwmon/pmbus/mp2856.c                       |   6 +-
 drivers/hwmon/pmbus/mp2888.c                       |   4 +-
 drivers/hwmon/pmbus/mp2891.c                       |   2 +-
 drivers/hwmon/pmbus/mp2925.c                       |   6 +-
 drivers/hwmon/pmbus/mp29502.c                      |   4 +-
 drivers/hwmon/pmbus/mp2975.c                       |   8 +-
 drivers/hwmon/pmbus/mp2993.c                       |   2 +-
 drivers/hwmon/pmbus/mp5920.c                       |   2 +-
 drivers/hwmon/pmbus/mp5926.c                       |   4 +-
 drivers/hwmon/pmbus/mp5990.c                       |   4 +-
 drivers/hwmon/pmbus/mp9941.c                       |   2 +-
 drivers/hwmon/pmbus/mp9945.c                       |   4 +-
 drivers/hwmon/pmbus/mpq7932.c                      |   6 +-
 drivers/hwmon/pmbus/mpq8785.c                      |  10 +-
 drivers/hwmon/pmbus/pim4328.c                      |  18 +-
 drivers/hwmon/pmbus/pli1209bc.c                    |   4 +-
 drivers/hwmon/pmbus/pm6764tr.c                     |   4 +-
 drivers/hwmon/pmbus/pmbus.c                        |  60 +--
 drivers/hwmon/pmbus/pxe1610.c                      |   8 +-
 drivers/hwmon/pmbus/q54sj108a2.c                   |   8 +-
 drivers/hwmon/pmbus/stef48h28.c                    |   4 +-
 drivers/hwmon/pmbus/stpddc60.c                     |   6 +-
 drivers/hwmon/pmbus/tda38640.c                     |   4 +-
 drivers/hwmon/pmbus/tps25990.c                     |   4 +-
 drivers/hwmon/pmbus/tps40422.c                     |   4 +-
 drivers/hwmon/pmbus/tps53679.c                     |  18 +-
 drivers/hwmon/pmbus/tps546d24.c                    |   4 +-
 drivers/hwmon/pmbus/ucd9000.c                      |  16 +-
 drivers/hwmon/pmbus/ucd9200.c                      |  18 +-
 drivers/hwmon/pmbus/xdp710.c                       |   2 +-
 drivers/hwmon/pmbus/xdp720.c                       |   4 +-
 drivers/hwmon/pmbus/xdpe12284.c                    |   8 +-
 drivers/hwmon/pmbus/xdpe152c4.c                    |   6 +-
 drivers/hwmon/pmbus/xdpe1a2g7b.c                   |   6 +-
 drivers/hwmon/pmbus/zl6100.c                       |  44 +--
 drivers/hwmon/powr1220.c                           |   4 +-
 drivers/hwmon/pt5161l.c                            |   4 +-
 drivers/hwmon/sbtsi_temp.c                         |   4 +-
 drivers/hwmon/sg2042-mcu.c                         |   2 +-
 drivers/hwmon/sht21.c                              |   6 +-
 drivers/hwmon/sht3x.c                              |   8 +-
 drivers/hwmon/sht4x.c                              |   4 +-
 drivers/hwmon/shtc1.c                              |   6 +-
 drivers/hwmon/smsc47m192.c                         |   2 +-
 drivers/hwmon/spd5118.c                            |   2 +-
 drivers/hwmon/stts751.c                            |   2 +-
 drivers/hwmon/tc654.c                              |   6 +-
 drivers/hwmon/tc74.c                               |   4 +-
 drivers/hwmon/thmc50.c                             |   4 +-
 drivers/hwmon/tmp102.c                             |   2 +-
 drivers/hwmon/tmp103.c                             |   2 +-
 drivers/hwmon/tmp108.c                             |   8 +-
 drivers/hwmon/tmp401.c                             |  10 +-
 drivers/hwmon/tmp421.c                             |  10 +-
 drivers/hwmon/tmp464.c                             |   4 +-
 drivers/hwmon/tmp513.c                             |   4 +-
 drivers/hwmon/tsc1641.c                            |   2 +-
 drivers/hwmon/w83773g.c                            |   2 +-
 drivers/hwmon/w83781d.c                            |   8 +-
 drivers/hwmon/w83791d.c                            |   2 +-
 drivers/hwmon/w83792d.c                            |   2 +-
 drivers/hwmon/w83793.c                             |   2 +-
 drivers/hwmon/w83795.c                             |   4 +-
 drivers/hwmon/w83l785ts.c                          |   2 +-
 drivers/hwmon/w83l786ng.c                          |   2 +-
 drivers/hwtracing/intel_th/core.c                  |  10 -
 drivers/hwtracing/intel_th/msu.c                   |   2 +
 drivers/infiniband/core/cma.c                      |   2 +-
 drivers/infiniband/core/mad.c                      |  30 ++
 drivers/infiniband/core/verbs.c                    |   6 +-
 drivers/infiniband/hw/bng_re/bng_dev.c             |   6 +-
 drivers/infiniband/hw/erdma/erdma_qp.c             |   2 +-
 drivers/infiniband/hw/hns/hns_roce_hem.c           |   2 +-
 drivers/infiniband/hw/irdma/uk.c                   |   9 +-
 drivers/infiniband/hw/irdma/user.h                 |   1 -
 drivers/infiniband/hw/irdma/verbs.c                |  33 +-
 drivers/infiniband/hw/mana/wr.c                    |   2 +-
 drivers/infiniband/sw/siw/siw_verbs.c              |  44 ++-
 drivers/iommu/amd/init.c                           |   6 +
 drivers/iommu/amd/iommu.c                          |  22 +-
 drivers/iommu/amd/nested.c                         |  34 +-
 drivers/iommu/intel/perf.c                         |   2 +-
 drivers/iommu/intel/svm.c                          |   2 +-
 drivers/media/cec/platform/seco/seco-cec.c         |   6 +-
 drivers/media/common/videobuf2/videobuf2-core.c    |  12 +-
 drivers/media/dvb-frontends/rtl2832.c              |   4 +-
 drivers/media/dvb-frontends/rtl2832_sdr.c          |  19 +-
 drivers/media/i2c/alvium-csi2.c                    |  21 +-
 drivers/media/i2c/dw9719.c                         |  10 +
 drivers/media/i2c/imx219.c                         |   2 +-
 drivers/media/pci/cx23885/cx23885-core.c           |  14 +-
 drivers/media/pci/dm1105/dm1105.c                  |   1 +
 drivers/media/pci/intel/ipu6/ipu6-isys-dwc-phy.c   |  24 +-
 drivers/media/pci/saa7134/saa7134-video.c          |  25 +-
 .../media/platform/amlogic/c3/isp/c3-isp-params.c  |   4 +
 .../media/platform/arm/mali-c55/mali-c55-core.c    |  21 +-
 drivers/media/platform/arm/mali-c55/mali-c55-isp.c |   7 +
 drivers/media/platform/aspeed/aspeed-video.c       |   1 +
 .../platform/chips-media/wave5/wave5-vpu-enc.c     |  29 +-
 drivers/media/platform/marvell/cafe-driver.c       |   1 +
 drivers/media/platform/nuvoton/npcm-video.c        |  34 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-core.c    |   2 +
 .../media/platform/nxp/imx8-isi/imx8-isi-core.h    |  16 +
 .../platform/nxp/imx8-isi/imx8-isi-crossbar.c      |   1 +
 drivers/media/platform/nxp/imx8-isi/imx8-isi-hw.c  |   9 +-
 drivers/media/platform/nxp/imx8-isi/imx8-isi-m2m.c |  11 +-
 .../media/platform/nxp/imx8-isi/imx8-isi-pipe.c    |  20 +-
 drivers/media/platform/qcom/camss/camss-csid-340.c |  18 +-
 drivers/media/platform/qcom/camss/camss-csid-680.c |  30 +-
 .../media/platform/qcom/camss/camss-csid-gen2.c    |  47 +--
 .../media/platform/qcom/camss/camss-csid-gen3.c    |  28 +-
 drivers/media/platform/qcom/iris/iris_probe.c      |   6 +-
 .../platform/renesas/rzg2l-cru/rzg2l-cru-regs.h    |   1 +
 .../media/platform/renesas/rzg2l-cru/rzg2l-video.c |  17 +-
 .../platform/renesas/rzv2h-ivc/rzv2h-ivc-video.c   |  31 +-
 drivers/media/platform/st/stm32/stm32-dcmi.c       |   1 +
 .../st/stm32/stm32-dcmipp/dcmipp-bytecap.c         |   6 +-
 drivers/media/platform/sunxi/sun4i-csi/sun4i_dma.c |   6 +-
 .../media/platform/synopsys/hdmirx/snps_hdmirx.c   |   4 +-
 drivers/media/platform/ti/davinci/vpif_capture.c   |   2 +-
 drivers/media/platform/ti/vpe/vip.c                |  16 +-
 drivers/media/platform/ti/vpe/vpe.c                |   3 +-
 drivers/media/platform/verisilicon/hantro_v4l2.c   |   6 +-
 drivers/media/radio/radio-si476x.c                 |   1 +
 drivers/media/test-drivers/vidtv/vidtv_bridge.c    |   4 +-
 drivers/media/test-drivers/vimc/vimc-core.c        |   1 +
 drivers/media/test-drivers/vivid/vivid-core.c      |   6 +-
 drivers/media/test-drivers/vivid/vivid-ctrls.c     |  15 +-
 drivers/media/test-drivers/vivid/vivid-vid-cap.c   |  38 +-
 drivers/media/test-drivers/vivid/vivid-vid-cap.h   |   1 +
 drivers/media/test-drivers/vivid/vivid-vid-out.c   |   6 +
 drivers/media/usb/airspy/airspy.c                  |   8 +-
 drivers/media/usb/cx231xx/cx231xx-cards.c          |  16 +-
 drivers/media/usb/msi2500/msi2500.c                |  32 +-
 drivers/media/usb/pwc/pwc-if.c                     |  13 +-
 drivers/media/v4l2-core/v4l2-ctrls-core.c          |  13 +
 drivers/media/v4l2-core/v4l2-ctrls-request.c       |  14 +-
 drivers/media/v4l2-core/v4l2-fwnode.c              |   6 +-
 drivers/media/v4l2-core/v4l2-subdev.c              |   4 +
 drivers/misc/mei/bus.c                             |  16 +-
 drivers/misc/nsm.c                                 |   3 +-
 drivers/mtd/mtd_virt_concat.c                      |   4 +-
 drivers/mtd/mtdcore.c                              |  23 +-
 drivers/mtd/mtdswap.c                              |   5 +-
 drivers/mtd/nand/ecc-mtk.c                         |  16 +-
 drivers/net/amt.c                                  | 101 +++--
 drivers/net/bonding/bond_main.c                    |   3 +-
 drivers/net/ethernet/airoha/airoha_eth.c           |   3 +-
 drivers/net/ethernet/airoha/airoha_npu.c           |   4 +-
 drivers/net/ethernet/airoha/airoha_ppe.c           |   1 +
 drivers/net/ethernet/amd/pds_core/adminq.c         |  12 +-
 drivers/net/ethernet/amd/pds_core/auxbus.c         |  17 +-
 drivers/net/ethernet/amd/pds_core/core.c           |  22 +-
 drivers/net/ethernet/amd/pds_core/devlink.c        |   6 +
 drivers/net/ethernet/amd/pds_core/main.c           |  14 +-
 drivers/net/ethernet/amd/xgbe/xgbe-mdio.c          |  11 +-
 drivers/net/ethernet/broadcom/bnge/bnge.h          |   1 +
 drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.c |   8 +-
 drivers/net/ethernet/broadcom/bnge/bnge_hwrm_lib.h |   2 +-
 drivers/net/ethernet/broadcom/bnge/bnge_netdev.c   |  50 ++-
 drivers/net/ethernet/broadcom/bnge/bnge_netdev.h   |   4 +-
 drivers/net/ethernet/broadcom/bnge/bnge_rmem.h     |   2 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c      |  39 +-
 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c   |   1 +
 .../net/ethernet/freescale/dpaa2/dpaa2-switch.c    |   1 +
 drivers/net/ethernet/freescale/fman/fman_dtsec.c   |  17 +-
 drivers/net/ethernet/google/gve/gve.h              |   3 +
 drivers/net/ethernet/google/gve/gve_rx_dqo.c       |  34 ++
 drivers/net/ethernet/hisilicon/hip04_eth.c         |  11 +-
 drivers/net/ethernet/huawei/hinic/hinic_dev.h      |   2 -
 drivers/net/ethernet/huawei/hinic/hinic_ethtool.c  |  21 --
 drivers/net/ethernet/intel/ice/ice.h               |   3 +
 drivers/net/ethernet/intel/ice/ice_eswitch.c       |   3 -
 drivers/net/ethernet/intel/ice/ice_lag.c           |   2 +-
 drivers/net/ethernet/intel/ice/ice_parser.c        |   3 +
 drivers/net/ethernet/intel/ice/ice_ptp.c           |   7 +-
 drivers/net/ethernet/intel/ice/ice_sriov.c         |  14 +-
 drivers/net/ethernet/intel/ice/ice_vf_lib.c        |   3 +-
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c    |   7 +-
 .../ethernet/marvell/octeontx2/nic/otx2_flows.c    |   1 +
 .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c   |  29 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c |  15 +
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   4 +-
 .../ethernet/mellanox/mlx5/core/esw/acl/helper.c   |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/port.c     |   4 +-
 drivers/net/ethernet/microsoft/mana/gdma_main.c    |  78 +++-
 .../ethernet/netronome/nfp/nfpcore/nfp_resource.c  |   3 +
 drivers/net/ethernet/realtek/rtase/rtase.h         |   8 +
 drivers/net/ethernet/realtek/rtase/rtase_main.c    | 197 ++++++++++
 drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c  |  31 ++
 drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c   |  24 ++
 .../net/ethernet/stmicro/stmmac/dwxgmac2_core.c    |  28 +-
 drivers/net/ethernet/stmicro/stmmac/hwif.h         |   4 +
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  |  96 ++---
 drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c    |  35 ++
 drivers/net/ethernet/wangxun/txgbe/txgbe_aml.c     |   6 +-
 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c    |   1 +
 drivers/net/geneve.c                               |  27 +-
 drivers/net/gtp.c                                  |  17 +-
 drivers/net/mctp/mctp-i3c.c                        |  11 +-
 drivers/net/mctp/mctp-serial.c                     |   2 +-
 drivers/net/ovpn/io.c                              |   4 +-
 drivers/net/ovpn/peer.c                            |  16 +-
 drivers/net/ovpn/tcp.c                             |   6 +-
 drivers/net/pcs/pcs-xpcs.c                         |  34 +-
 drivers/net/phy/marvell.c                          |   2 +-
 drivers/net/ppp/ppp_generic.c                      | 100 +++--
 drivers/net/ppp/pppoe.c                            |   1 +
 drivers/net/slip/slip.c                            |   4 +
 drivers/net/vmxnet3/vmxnet3_drv.c                  |  22 +-
 drivers/net/vxlan/vxlan_core.c                     |   3 +
 drivers/net/vxlan/vxlan_mdb.c                      |  30 +-
 drivers/net/wan/wanxl.c                            |   3 +-
 drivers/net/wireless/ath/ath10k/htt_rx.c           |   2 +
 drivers/net/wireless/ath/ath11k/ahb.c              |   1 +
 drivers/net/wireless/ath/ath11k/dp_rx.c            |   3 +
 drivers/net/wireless/ath/ath11k/pci.c              |   4 +
 drivers/net/wireless/ath/ath11k/qmi.c              |  11 +-
 drivers/net/wireless/ath/ath12k/dp_peer.c          |  11 +-
 drivers/net/wireless/ath/ath12k/dp_peer.h          |   1 +
 drivers/net/wireless/ath/ath12k/dp_rx.c            |   7 +-
 drivers/net/wireless/ath/ath12k/hw.h               |  16 +
 drivers/net/wireless/ath/ath12k/mac.c              |  10 +-
 drivers/net/wireless/ath/ath12k/pci.c              |   4 +
 drivers/net/wireless/ath/ath12k/peer.c             |   3 +
 drivers/net/wireless/ath/ath12k/wifi7/dp_rx.c      |  33 ++
 drivers/net/wireless/ath/ath12k/wifi7/dp_rx.h      |   6 +
 drivers/net/wireless/ath/ath12k/wifi7/hw.c         |   3 +
 drivers/net/wireless/ath/ath6kl/txrx.c             |  12 +-
 drivers/net/wireless/ath/ath6kl/wmi.c              |  20 +
 drivers/net/wireless/ath/ath9k/hif_usb.c           |   7 +-
 drivers/net/wireless/ath/carl9170/rx.c             |   7 +-
 drivers/net/wireless/ath/carl9170/tx.c             |   2 +-
 drivers/net/wireless/atmel/at76c50x-usb.c          |   7 +-
 .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  |  14 +
 .../net/wireless/broadcom/brcm80211/brcmfmac/bus.h |   6 +
 .../broadcom/brcm80211/brcmfmac/cfg80211.c         |   2 +-
 .../wireless/broadcom/brcm80211/brcmfmac/core.c    |  46 ++-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  14 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    |   8 +-
 .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |   1 +
 .../net/wireless/broadcom/brcm80211/brcmfmac/usb.c |   3 +
 drivers/net/wireless/intel/ipw2x00/ipw2100.c       |   8 +-
 drivers/net/wireless/intel/iwlwifi/fw/pnvm.c       |   9 +-
 drivers/net/wireless/intel/iwlwifi/fw/regulatory.c |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/d3.c        |   3 +-
 drivers/net/wireless/intel/iwlwifi/mvm/fw.c        |  10 +
 drivers/net/wireless/intersil/p54/txrx.c           |   8 +
 drivers/net/wireless/marvell/libertas/firmware.c   |   1 +
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c   |  14 +-
 drivers/net/wireless/marvell/mwifiex/tdls.c        |   2 +-
 drivers/net/wireless/marvell/mwifiex/uap_event.c   |  24 +-
 drivers/net/wireless/mediatek/mt76/Kconfig         |   4 +-
 drivers/net/wireless/mediatek/mt76/Makefile        |   6 +-
 drivers/net/wireless/mediatek/mt76/mt76.h          |   6 +-
 drivers/net/wireless/mediatek/mt76/mt7615/mac.c    |   6 +
 .../net/wireless/mediatek/mt76/mt76_connac_mcu.c   |   2 +
 drivers/net/wireless/mediatek/mt76/mt7915/mcu.c    |  18 +-
 drivers/net/wireless/mediatek/mt76/mt7921/mac.c    |  10 +-
 drivers/net/wireless/mediatek/mt76/mt7925/mac.c    |  13 +-
 drivers/net/wireless/mediatek/mt76/mt7925/main.c   |   3 +
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c    |   2 +
 drivers/net/wireless/mediatek/mt76/mt7996/Kconfig  |   2 +-
 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c    |  19 +-
 drivers/net/wireless/microchip/wilc1000/hif.c      |   5 +
 drivers/net/wireless/virtual/mac80211_hwsim.c      |   1 +
 drivers/platform/loongarch/loongson-laptop.c       |   1 +
 drivers/platform/x86/asus-wmi.c                    |  26 +-
 .../uncore-frequency/uncore-frequency-common.c     |   7 +-
 drivers/platform/x86/intel/vsec.c                  |  31 +-
 drivers/platform/x86/intel/vsec_tpmi.c             |  13 +-
 drivers/ptp/ptp_netc.c                             |   1 +
 drivers/ptp/ptp_s390.c                             |   6 +-
 drivers/regulator/mt6358-regulator.c               |   2 +-
 drivers/resctrl/mpam_devices.c                     |  36 +-
 drivers/reset/spacemit/reset-spacemit-k3.c         |   2 +-
 drivers/scsi/hosts.c                               |   2 +
 drivers/scsi/scsi_error.c                          |  22 +-
 drivers/scsi/scsi_priv.h                           |   1 +
 drivers/spi/spi-cadence-quadspi.c                  |  12 +-
 drivers/staging/media/meson/vdec/vdec.c            |   4 +-
 drivers/staging/media/sunxi/cedrus/cedrus.c        |   6 +-
 drivers/staging/media/sunxi/cedrus/cedrus_h264.c   |   3 +
 drivers/staging/media/tegra-video/vi.c             |   4 +-
 drivers/staging/rtl8723bs/core/rtw_ieee80211.c     |   9 +-
 drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c  |   2 +-
 drivers/thunderbolt/debugfs.c                      |   2 +
 drivers/thunderbolt/domain.c                       |  30 ++
 drivers/thunderbolt/icm.c                          |   5 +
 drivers/thunderbolt/switch.c                       |  14 +
 drivers/thunderbolt/tb.c                           |  59 ++-
 drivers/thunderbolt/tb.h                           |   2 +
 drivers/thunderbolt/xdomain.c                      | 100 +++--
 drivers/tty/serial/8250/8250_mid.c                 |  14 +-
 drivers/tty/serial/sc16is7xx.c                     |  12 +
 drivers/uio/uio_hv_generic.c                       |   8 +-
 drivers/usb/atm/ueagle-atm.c                       |  17 +
 drivers/usb/chipidea/core.c                        |   1 +
 drivers/usb/core/port.c                            |   2 +
 drivers/usb/core/sysfs.c                           |   8 +-
 drivers/usb/gadget/function/f_midi.c               |   1 +
 drivers/usb/gadget/function/f_ncm.c                |  17 +-
 drivers/usb/gadget/function/f_printer.c            |  23 +-
 drivers/usb/gadget/function/f_tcm.c                | 192 ++++++++--
 drivers/usb/gadget/function/tcm.h                  |  13 +
 drivers/usb/gadget/function/uvc_v4l2.c             |   2 +
 drivers/usb/gadget/udc/bdc/bdc_core.c              |  20 +
 drivers/usb/gadget/udc/bdc/bdc_udc.c               |   7 +-
 drivers/usb/gadget/udc/dummy_hcd.c                 |  40 +-
 drivers/usb/gadget/udc/fsl_udc_core.c              |  93 +++--
 drivers/usb/gadget/udc/fsl_usb2_udc.h              |   1 +
 drivers/usb/gadget/udc/snps_udc_core.c             |   1 -
 drivers/usb/host/xhci-pci.c                        |   1 +
 drivers/usb/host/xhci.c                            |  15 +-
 drivers/usb/host/xhci.h                            |   1 +
 drivers/usb/musb/omap2430.c                        |   2 -
 drivers/usb/serial/ftdi_sio.c                      |   2 +
 drivers/usb/serial/ftdi_sio_ids.h                  |   5 +
 drivers/usb/serial/io_edgeport.c                   |   3 +-
 drivers/usb/serial/keyspan_pda.c                   |  44 ++-
 drivers/usb/serial/option.c                        |   1 +
 drivers/usb/storage/unusual_devs.h                 |   7 +
 drivers/usb/typec/ucsi/ucsi.c                      | 158 +++++++-
 drivers/vhost/net.c                                |   8 +-
 drivers/virt/coco/pkvm-guest/arm-pkvm-guest.c      |   2 +-
 drivers/watchdog/airoha_wdt.c                      |   3 +
 drivers/watchdog/ni903x_wdt.c                      |   7 +-
 drivers/watchdog/s32g_wdt.c                        |   3 +-
 drivers/watchdog/watchdog_pretimeout.c             |   2 +
 fs/afs/dir_edit.c                                  |   2 +-
 fs/binfmt_elf_fdpic.c                              |   4 +
 fs/binfmt_misc.c                                   |   5 +-
 fs/btrfs/btrfs_inode.h                             |   2 +
 fs/btrfs/extent_io.c                               |   4 +-
 fs/btrfs/extent_map.c                              |   4 +-
 fs/btrfs/file-item.c                               |  26 +-
 fs/btrfs/free-space-cache.c                        |   3 +
 fs/btrfs/relocation.c                              |   2 +
 fs/ceph/addr.c                                     |   9 +
 fs/ceph/caps.c                                     |   1 +
 fs/ceph/dir.c                                      |   7 +-
 fs/ceph/ioctl.c                                    |   6 +
 fs/crypto/inline_crypt.c                           |  57 +--
 fs/crypto/keysetup_v1.c                            |   8 +-
 fs/erofs/zmap.c                                    |   3 +-
 fs/exec.c                                          |   2 +-
 fs/f2fs/super.c                                    |  25 +-
 fs/fuse/dev_uring.c                                |  22 +-
 fs/iomap/buffered-io.c                             |  42 ++-
 fs/nfsd/vfs.c                                      |   6 +-
 fs/overlayfs/file.c                                |  16 +-
 fs/overlayfs/xattrs.c                              |   2 +-
 fs/pidfs.c                                         |   2 +-
 fs/posix_acl.c                                     |   7 +
 fs/proc/namespaces.c                               |   4 +-
 fs/smb/client/cifsfs.c                             |   1 +
 fs/smb/client/cifsglob.h                           |   1 +
 fs/smb/client/file.c                               |  69 +++-
 fs/smb/client/inode.c                              |   6 +
 fs/smb/client/misc.c                               | 106 +++++-
 fs/smb/client/smb2file.c                           |  21 ++
 fs/smb/client/smb2inode.c                          |  23 +-
 fs/smb/client/smb2ops.c                            |  25 +-
 fs/smb/server/connection.c                         |  16 +-
 fs/smb/server/oplock.c                             |   6 +-
 fs/smb/server/smb2misc.c                           |   5 +
 fs/smb/server/smb2pdu.c                            |   9 +-
 fs/smb/server/smbacl.c                             |  42 ++-
 fs/super.c                                         |  34 +-
 fs/xfs/scrub/cow_repair.c                          | 203 ++++++----
 fs/xfs/scrub/trace.h                               |  28 +-
 include/drm/drm_connector.h                        |   6 +-
 include/drm/drm_utils.h                            |   1 +
 include/drm/ttm/ttm_backup.h                       |  12 +-
 include/linux/arm_ffa.h                            |   2 +-
 include/linux/audit.h                              |   4 +-
 include/linux/audit_arch.h                         |  12 +-
 include/linux/bnge/hsi.h                           |   7 +-
 include/linux/bootconfig.h                         |   3 +
 include/linux/firmware/intel/stratix10-smc.h       |   4 +
 include/linux/fscrypt.h                            |  18 +-
 include/linux/intel_vsec.h                         |   6 +-
 include/linux/memory_hotplug.h                     |   8 +-
 include/linux/mlx5/mlx5_ifc.h                      |  13 +-
 include/linux/seqlock.h                            |   7 +-
 include/linux/sunrpc/xdr.h                         |  19 +-
 include/linux/vtime.h                              |   6 +
 include/media/v4l2-async.h                         |   4 +-
 include/media/videobuf2-core.h                     |   8 +-
 include/net/bluetooth/hci_core.h                   |   1 +
 include/net/bluetooth/rfcomm.h                     |   3 +
 include/net/cfg80211.h                             |   4 +-
 include/net/pkt_cls.h                              |  14 +-
 include/net/sctp/structs.h                         |   3 +-
 include/net/tcp.h                                  |   2 +
 include/scsi/scsi_host.h                           |   3 +
 include/trace/events/memory-failure.h              |   6 +-
 include/uapi/linux/btrfs.h                         |   2 +-
 include/uapi/linux/rkisp1-config.h                 |   6 +-
 init/Kconfig                                       |   3 +
 init/main.c                                        |  45 ---
 io_uring/rw.c                                      |  42 ++-
 kernel/audit.c                                     |   2 +-
 kernel/audit.h                                     |  19 +-
 kernel/audit_fsnotify.c                            |  32 +-
 kernel/audit_tree.c                                |   2 +-
 kernel/audit_watch.c                               |  25 +-
 kernel/auditfilter.c                               |  17 +-
 kernel/auditsc.c                                   |   2 +-
 kernel/sched/ext.c                                 | 134 ++++---
 kernel/sched/ext_internal.h                        |  30 ++
 kernel/smp.c                                       |  30 +-
 kernel/trace/ftrace.c                              |  13 +
 kernel/trace/trace.c                               |   2 +-
 kernel/trace/trace.h                               |   1 +
 kernel/trace/trace_eprobe.c                        |   3 +-
 kernel/trace/trace_events.c                        |   4 +-
 kernel/trace/trace_events_hist.c                   |   2 +
 kernel/trace/trace_events_trigger.c                |  22 +-
 kernel/trace/trace_mmiotrace.c                     |   4 +-
 kernel/trace/trace_probe.c                         |  13 +-
 kernel/trace/trace_remote.c                        |  16 +-
 kernel/trace/trace_syscalls.c                      |   5 +
 lib/bootconfig.c                                   |  65 ++++
 lib/compat_audit.c                                 |  12 +-
 lib/rhashtable.c                                   |   1 +
 mm/damon/core.c                                    |  13 +
 mm/huge_memory.c                                   |  12 +-
 mm/kmemleak.c                                      |   7 +-
 mm/memory_hotplug.c                                |  13 +-
 mm/memremap.c                                      |   4 +-
 mm/page_vma_mapped.c                               |  33 +-
 mm/slub.c                                          |  21 +-
 mm/sparse-vmemmap.c                                |  46 ++-
 mm/userfaultfd.c                                   |   5 +-
 net/bluetooth/hci_event.c                          |  18 +-
 net/bluetooth/hci_sync.c                           |  79 +++-
 net/bluetooth/mgmt.c                               | 105 +++++-
 net/bluetooth/rfcomm/core.c                        |  17 +
 net/bluetooth/rfcomm/tty.c                         |   7 +-
 net/bridge/br_netlink_tunnel.c                     |   3 +-
 net/bridge/br_private.h                            |   6 +-
 net/bridge/br_vlan.c                               |  10 +-
 net/bridge/br_vlan_options.c                       |   3 +-
 net/can/j1939/transport.c                          |  18 +-
 net/can/raw.c                                      |  66 ++--
 net/ceph/auth_x.c                                  |   9 +-
 net/ceph/ceph_common.c                             |   4 +-
 net/ceph/cls_lock_client.c                         |   8 +-
 net/ceph/mon_client.c                              |   4 +-
 net/ceph/osdmap.c                                  |  16 +-
 net/core/bpf_sk_storage.c                          |   2 -
 net/core/dev.c                                     |  10 +-
 net/core/drop_monitor.c                            |  18 +-
 net/core/filter.c                                  |  17 +-
 net/core/gro.c                                     |   4 +-
 net/core/sock.c                                    |  13 +-
 net/core/sock_map.c                                |   2 +
 net/hsr/hsr_slave.c                                |   2 +
 net/ipv4/datagram.c                                |   4 +-
 net/ipv4/fib_trie.c                                |   2 +-
 net/ipv4/icmp.c                                    |  18 +-
 net/ipv4/ip_gre.c                                  |   4 +-
 net/ipv4/nexthop.c                                 |   2 +-
 net/ipv4/raw.c                                     |  23 +-
 net/ipv4/tcp_bpf.c                                 |   2 +-
 net/ipv4/tcp_input.c                               |  56 ++-
 net/ipv4/tcp_ipv4.c                                |  14 +-
 net/ipv4/tcp_minisocks.c                           |  12 +-
 net/ipv6/ila/ila_common.c                          |  12 +
 net/ipv6/ip6_gre.c                                 |   4 +-
 net/ipv6/raw.c                                     |   2 +-
 net/ipv6/route.c                                   |   4 +-
 net/ipv6/tcp_ipv6.c                                |   8 +-
 net/ipv6/xfrm6_policy.c                            |   1 +
 net/iucv/af_iucv.c                                 |  21 +-
 net/mac80211/cfg.c                                 |  14 +-
 net/mac80211/iface.c                               |   8 +-
 net/mac80211/link.c                                |   4 +
 net/mac80211/mlme.c                                |   6 +-
 net/mac80211/nan.c                                 |  35 +-
 net/mac80211/rx.c                                  |   2 +
 net/mac80211/sta_info.c                            |  15 +-
 net/mac802154/llsec.c                              |   5 +
 net/mac802154/scan.c                               |  11 +
 net/mctp/device.c                                  |   4 +-
 net/mpls/af_mpls.c                                 |  11 +-
 net/mptcp/options.c                                |  17 +-
 net/mptcp/pm_userspace.c                           |   7 +-
 net/mptcp/protocol.c                               |  34 +-
 net/openvswitch/actions.c                          |  19 +-
 net/openvswitch/datapath.c                         |  25 +-
 net/openvswitch/datapath.h                         |   2 +-
 net/openvswitch/vport.c                            |   2 +-
 net/packet/af_packet.c                             |   6 +-
 net/phonet/pep.c                                   |   2 +
 net/qrtr/af_qrtr.c                                 |   8 +
 net/qrtr/ns.c                                      |   4 +-
 net/rds/ib.c                                       |   4 +
 net/rds/ib_cm.c                                    |   4 +
 net/rds/recv.c                                     |  15 +
 net/rds/tcp.c                                      |  12 +-
 net/rxrpc/ar-internal.h                            |   6 +-
 net/sched/act_tunnel_key.c                         |  14 +-
 net/sched/cls_api.c                                |   6 +-
 net/sched/sch_api.c                                |  24 +-
 net/sched/sch_cake.c                               |   2 +-
 net/sched/sch_drr.c                                |   2 +-
 net/sched/sch_dualpi2.c                            |   2 +-
 net/sched/sch_ets.c                                |   2 +-
 net/sched/sch_fq_codel.c                           |   2 +-
 net/sched/sch_fq_pie.c                             |   2 +-
 net/sched/sch_hfsc.c                               |   2 +-
 net/sched/sch_htb.c                                |   2 +-
 net/sched/sch_multiq.c                             |   2 +-
 net/sched/sch_prio.c                               |   2 +-
 net/sched/sch_qfq.c                                |   2 +-
 net/sched/sch_sfb.c                                |   2 +-
 net/sched/sch_sfq.c                                |   2 +-
 net/sctp/auth.c                                    |   2 +-
 net/sctp/protocol.c                                |  21 +-
 net/sctp/sm_make_chunk.c                           |   6 +
 net/sctp/sm_statefuns.c                            |   2 +-
 net/sctp/stream.c                                  |   6 +-
 net/sctp/sysctl.c                                  |   9 +-
 net/sunrpc/svcsock.c                               |  14 +-
 net/sunrpc/xdr.c                                   | 210 ++++++++++-
 net/sunrpc/xprtrdma/rpc_rdma.c                     |   4 +
 net/sunrpc/xprtrdma/verbs.c                        |  12 +-
 net/tipc/netlink.c                                 |   6 +-
 net/tipc/netlink_compat.c                          |   4 +
 net/tipc/socket.c                                  |   5 +-
 net/tipc/udp_media.c                               |  56 ++-
 net/tls/tls_device.c                               |   6 +-
 net/vmw_vsock/virtio_transport_common.c            | 165 +++++++-
 net/wireless/core.c                                |  14 +-
 net/wireless/core.h                                |   4 +-
 net/wireless/nl80211.c                             |  25 +-
 net/wireless/pmsr.c                                |  34 +-
 net/wireless/scan.c                                |  13 +-
 net/wireless/sme.c                                 |   6 +-
 net/x25/af_x25.c                                   |   8 +-
 net/xfrm/xfrm_device.c                             |  12 +-
 net/xfrm/xfrm_iptfs.c                              |   1 +
 net/xfrm/xfrm_policy.c                             |   4 +-
 net/xfrm/xfrm_state.c                              |  11 +-
 net/xfrm/xfrm_user.c                               |   3 +-
 rust/bindings/lib.rs                               |   4 +
 rust/kernel/device.rs                              |  20 +-
 rust/kernel/time.rs                                |  11 +-
 rust/uapi/lib.rs                                   |   4 +
 sound/core/seq/seq_timer.c                         |  13 +-
 sound/core/timer.c                                 |  21 +-
 sound/hda/codecs/hdmi/hdmi.c                       |   3 +
 sound/hda/codecs/hdmi/hdmi_local.h                 |   9 +
 sound/hda/codecs/hdmi/intelhdmi.c                  |  36 +-
 sound/hda/codecs/realtek/alc269.c                  |   9 +
 sound/hda/codecs/side-codecs/cs35l41_hda.c         |  11 +-
 sound/soc/amd/acp/Kconfig                          |  10 +-
 sound/soc/amd/acp/Makefile                         |   3 +-
 sound/soc/amd/acp/amd-acp70-acpi-match.c           |   2 +-
 sound/soc/amd/acp/soc-acpi-amd-sdca-quirks.c       |   4 -
 sound/soc/amd/ps/pci-ps.c                          |  33 +-
 sound/soc/codecs/bt-sco.c                          |  10 +-
 sound/soc/codecs/cs35l56-i2c.c                     |   4 +-
 sound/soc/codecs/cs35l56-spi.c                     |   4 +-
 sound/soc/codecs/cs35l56.c                         |  17 +-
 sound/soc/codecs/cs42l43-jack.c                    |   3 +-
 sound/soc/codecs/tas2562.c                         |   5 +-
 sound/soc/codecs/tas2781-fmwlib.c                  |  63 +++-
 sound/soc/fsl/fsl_sai.c                            |  29 +-
 sound/soc/fsl/imx-card.c                           |  12 +-
 sound/soc/meson/aiu-fifo-spdif.c                   |   5 +
 sound/soc/sunxi/sun4i-codec.c                      |   1 +
 sound/usb/mixer.c                                  |   2 +-
 sound/usb/quirks.c                                 |   2 +
 tools/objtool/check.c                              |   1 +
 tools/testing/selftests/alsa/mixer-test.c          |   1 +
 .../testing/selftests/bpf/progs/verifier_map_ptr.c |  36 +-
 tools/testing/selftests/drivers/net/.gitignore     |   1 +
 tools/testing/selftests/drivers/net/Makefile       |   2 +
 tools/testing/selftests/drivers/net/config         |   5 +
 .../drivers/net/netconsole/netcons_resume.sh       |   3 +-
 tools/testing/selftests/drivers/net/settings       |   1 +
 .../selftests/{ => drivers}/net/so_txtime.c        |  35 +-
 tools/testing/selftests/drivers/net/so_txtime.py   | 103 +++++
 tools/testing/selftests/drivers/ntsync/config      |   2 +-
 tools/testing/selftests/ftrace/ftracetest          |   1 +
 tools/testing/selftests/net/.gitignore             |   1 -
 tools/testing/selftests/net/Makefile               |   2 -
 tools/testing/selftests/net/af_unix/config         |   1 +
 tools/testing/selftests/net/mptcp/userspace_pm.sh  |   2 +-
 tools/testing/selftests/net/openvswitch/config     |  16 +
 tools/testing/selftests/net/ovpn/config            |   2 +
 tools/testing/selftests/net/ovpn/ovpn-cli.c        |   4 +-
 tools/testing/selftests/net/ovpn/settings          |   1 +
 tools/testing/selftests/net/so_txtime.sh           | 110 ------
 tools/testing/selftests/net/tun.c                  |   8 +-
 946 files changed, 9236 insertions(+), 4123 deletions(-)

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Guixiong Wei <[email protected]>

commit 6b63520ed14b17bbe9c2103debbd2152dde1fba3 upstream.

When the last CPU of a legacy uncore die goes offline, uncore_freq_remove_die_entry() clears control_cpu. During CPU hotplug re-add, uncore_freq_add_entry() still populates sysfs attributes before assigning the new control CPU. As a result, the current frequency read returns -ENXIO and current_freq_khz is omitted from the recreated sysfs group.

Assign control_cpu before the initial read paths and before create_attr_group() so sysfs recreation uses the new online CPU. If sysfs creation fails, restore control_cpu to -1 to keep the error path state consistent.

---
 .../x86/intel/uncore-frequency/uncore-frequency-common.c   | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index 7070c94324e0ed..f8137ee92e4754 100644
@@ -275,15 +275,20 @@ int uncore_freq_add_entry(struct uncore_data *data, int cpu)
 			  data->package_id, data->die_id);
 	}
 
+	/*
+	 * Set the control CPU before any read path so entry recreation after CPU
+	 * hotplug can populate read-only attributes from the new online CPU.
+	 */
+	data->control_cpu = cpu;
 	uncore_read(data, &data->initial_min_freq_khz, UNCORE_INDEX_MIN_FREQ);
 	uncore_read(data, &data->initial_max_freq_khz, UNCORE_INDEX_MAX_FREQ);
 
 	ret = create_attr_group(data, data->name);
 	if (ret) {
+		data->control_cpu = -1;
 		if (data->domain_id != UNCORE_DOMAIN_ID_INVALID)
 			ida_free(&intel_uncore_ida, data->instance_id);
 	} else {
-		data->control_cpu = cpu;
 		data->valid = true;
 	}
 

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kuba Piecuch <[email protected]>

commit 0e2f4ab68a89fad42e0f5a9ff4b740738e7aa1d6 upstream.

When switching a task's sched_class away from sched_ext, we get the following sequence of events in __sched_setscheduler():

sched_change_begin()
switched_from_scx()
scx_disable_task(p)
ops.disable(p)
__setscheduler_params()
set_load_weight()
reweight_task_scx(p)
ops.set_weight(p)
p->sched_class = next_class;
sched_change_end()
...

Notably, ops.set_weight() is called _after_ ops.disable(). This violates the expected semantics of the callbacks, the expectation being that ops.disable() can only be followed by ops.exit_task() or ops.enable().

Skipping the weight adjustment for disabled tasks should be harmless since the weight will be recalculated in scx_enable_task() if the task ever rejoins SCX.

---
 kernel/sched/ext.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

index 5d2d19473a82e8..8429bebc21a19a 100644
@@ -3904,6 +3904,17 @@ static void reweight_task_scx(struct rq *rq, struct task_struct *p,
 	if (task_dead_and_done(p))
 		return;
 
+	/*
+	 * When switching sched_class away from SCX, reweight_task_scx()
+	 * is called _after_ scx_disable_task(). Skip calling ops.set_weight()
+	 * since the BPF scheduler may have already forgotten the task in
+	 * ops.disable().
+	 * p->scx.weight will be recalculated in scx_enable_task() if the task
+	 * ever returns to SCX class.
+	 */
+	if (scx_get_task_state(p) != SCX_TASK_ENABLED)
+		return;
+
 	p->scx.weight = sched_weight_to_cgroup(scale_load_down(lw->weight));
 	if (SCX_HAS_OP(sch, set_weight))
 		SCX_CALL_OP_TASK(sch, set_weight, rq, p, p->scx.weight);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ryosuke Yasuoka <[email protected]>

[ Upstream commit d1b894c5bbb3fee0012bd14356286dc2384e8213 ]

A probe-time deadlock can occur between the dequeue worker and drm_client_register(). During probe, drm_client_register() holds clientlist_mutex and calls the fbdev hotplug callback, which triggers an atomic commit that ends up sleeping in virtio_gpu_queue_ctrl_sgs() waiting for virtqueue space. The dequeue worker that would free that space calls virtio_gpu_cmd_get_display_info_cb(), which invokes drm_kms_helper_hotplug_event() -> drm_client_dev_hotplug(), attempting to acquire the same clientlist_mutex. Since wake_up() is only called after the resp_cb loop, the probe thread is never woken and both threads deadlock.

Fix this by removing the hotplug notification from virtio_gpu_cmd_get_display_info_cb(). The display data (outputs[i].info) is still updated synchronously in the callback.

For the init path, drm_client_register() already fires an initial hotplug when the client is registered, which picks up the connector state updated by display_info_cb.

For the runtime config_changed path, add a wait_event_timeout() in config_changed_work_func() so that display_info_cb updates the connector data before the hotplug notification is sent. Also replace drm_helper_hpd_irq_event() with drm_kms_helper_hotplug_event() since virtio-gpu never calls drm_kms_helper_poll_init() and thus drm_helper_hpd_irq_event() always returns false without doing anything.

---
 drivers/gpu/drm/virtio/virtgpu_kms.c | 5 ++++-
 drivers/gpu/drm/virtio/virtgpu_vq.c  | 3 ---
 2 files changed, 4 insertions(+), 4 deletions(-)

index 80ba69b4860bc5..b79fd8350b6a47 100644
@@ -49,7 +49,10 @@ static void virtio_gpu_config_changed_work_func(struct work_struct *work)
 				virtio_gpu_cmd_get_edids(vgdev);
 			virtio_gpu_cmd_get_display_info(vgdev);
 			virtio_gpu_notify(vgdev);
-			drm_helper_hpd_irq_event(vgdev->ddev);
+			wait_event_timeout(vgdev->resp_wq,
+					   !vgdev->display_info_pending,
+					   5 * HZ);
+			drm_kms_helper_hotplug_event(vgdev->ddev);
 		}
 		events_clear |= VIRTIO_GPU_EVENT_DISPLAY;
 	}

index 67865810a2e708..337189b15ad01b 100644
@@ -840,9 +840,6 @@ static void virtio_gpu_cmd_get_display_info_cb(struct virtio_gpu_device *vgdev,
 	vgdev->display_info_pending = false;
 	spin_unlock(&vgdev->display_info_lock);
 	wake_up(&vgdev->resp_wq);
-
-	if (!drm_helper_hpd_irq_event(vgdev->ddev))
-		drm_kms_helper_hotplug_event(vgdev->ddev);
 }
 
 static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Heiko Carstens <[email protected]>

commit 88331c4ec23a28c1006ec532fa64763d4c695e90 upstream.

With gcc-15 and gcc-16 with UBSAN_ALIGNMENT enabled the compiler fails to inline and optimize __scoped_seqlock_bug() away on s390:

s390x-16.1.0-ld: kernel/sched/build_policy.o: in function `__scoped_seqlock_next':
/.../seqlock.h:1286:(.text+0x22030): undefined reference to `__scoped_seqlock_bug'

Fix this by adding UBSAN_ALIGNMENT to the list of config options where a not inlined empty __scoped_seqlock_bug() is allowed.

---
 include/linux/seqlock.h |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

@@ -1259,14 +1259,15 @@ static __always_inline void __scoped_seq
 
 extern void __scoped_seqlock_invalid_target(void);
 
-#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || defined(CONFIG_KASAN)
+#if (defined(CONFIG_CC_IS_GCC) && CONFIG_GCC_VERSION < 90000) || \
+	defined(CONFIG_KASAN) || defined(CONFIG_UBSAN_ALIGNMENT)
 /*
  * For some reason some GCC-8 architectures (nios2, alpha) have trouble
  * determining that the ss_done state is impossible in __scoped_seqlock_next()
  * below.
  *
- * Similarly KASAN is known to confuse compilers enough to break this. But we
- * don't care about code quality for KASAN builds anyway.
+ * Similarly KASAN and UBSAN_ALIGNMENT are known to confuse compilers enough
+ * to break this. But we don't care about code quality for such builds anyway.
  */
 static inline void __scoped_seqlock_bug(void) { }
 #else

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sean Christopherson <[email protected]>

commit 2abd5287f08319fa35764566b15c6e22cb1068db upstream.

Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages.

Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit 2e53d63acba7, "KVM: MMU: ignore zapped root pagetables"), but the true badness only came along in 2020 (Linux 5.9) with the invariant that invalid shadow pages can't be on the list of active pages.

Note #2, inheriting role.invalid when creating child shadow pages is also far from ideal; that flaw will be addressed separately.

---
 arch/x86/kvm/mmu/mmu.c         |    9 +++++----
 arch/x86/kvm/mmu/paging_tmpl.h |   10 ++++++----
 2 files changed, 11 insertions(+), 8 deletions(-)

@@ -4837,16 +4837,17 @@ static int direct_page_fault(struct kvm_
 	if (r != RET_PF_CONTINUE)
 		return r;
 
-	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
-	if (is_page_fault_stale(vcpu, fault))
-		goto out_unlock;
-
 	r = make_mmu_pages_available(vcpu);
 	if (r)
 		goto out_unlock;
 
+	if (is_page_fault_stale(vcpu, fault)) {
+		r = RET_PF_RETRY;
+		goto out_unlock;
+	}
+
 	r = direct_map(vcpu, fault);
 
 out_unlock:

@@ -827,15 +827,17 @@ static int FNAME(page_fault)(struct kvm_
 	}
 #endif
 
-	r = RET_PF_RETRY;
 	write_lock(&vcpu->kvm->mmu_lock);
 
-	if (is_page_fault_stale(vcpu, fault))
-		goto out_unlock;
-
 	r = make_mmu_pages_available(vcpu);
 	if (r)
 		goto out_unlock;
+
+	if (is_page_fault_stale(vcpu, fault)) {
+		r = RET_PF_RETRY;
+		goto out_unlock;
+	}
+
 	r = FNAME(fetch)(vcpu, fault, &walker);
 
 out_unlock:

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Venkatesh Srinivas <[email protected]>

commit e800decd9c0ac4349bcd8f8f9b29fd21fe93165e upstream.

On Intel platforms with a VMX preemption timer and APICv, if a VMM calls KVM_GET_LAPIC before KVM_GET_MSRS to save the vCPU state, it is possible to lose a pending timer interrupt.

If the thread running these ioctls is migrated to another core after calling KVM_GET_LAPIC but before KVM_GET_MSRS and the guest is using their LAPIC timer in TSC-deadline mode, not only does the save LAPIC state not carry the pending interrupt, the TSCDEADLINE MSR will be zeroed.

After migration across CPUs, KVM_GET_MSRS calls vcpu_load, posting the interrupt and clearing the MSR:
vcpu_load() ->
kvm_arch_vcpu_load() ->

    kvm_lapic_restart_hv_timer() ->
      start_hv_timer() ->
        apic_timer_expired() ->
          kvm_apic_inject_pending_timer_irqs()
            . post interrupt into the LAPIC state
            . clear IA32_TSCDEADLINE

The saved LAPIC state will be missing the pending interrupt and the saved MSR will be zero. Oops.

Fix by only posting an interrupt when we're attempting to enter the guest (vcpu->wants_to_run == true), not for vcpu_load from other paths.

Message-ID: <[email protected]>

---
 arch/x86/kvm/lapic.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2052,7 +2052,7 @@ static void apic_timer_expired(struct kv
 	if (apic_lvtt_tscdeadline(apic) || ktimer->hv_timer_in_use)
 		ktimer->expired_tscdeadline = ktimer->tscdeadline;
 
-	if (!from_timer_fn && apic->apicv_active) {
+	if (!from_timer_fn && apic->apicv_active && vcpu->wants_to_run) {
 		WARN_ON(kvm_get_running_vcpu() != vcpu);
 		kvm_apic_inject_pending_timer_irqs(apic);
 		return;

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hyunwoo Kim <[email protected]>

commit 622ebfac01ba4f9c0060cebd41257fe46fc4a0b3 upstream.

free_nested() frees the shadow VMCS while vmcs01 still points to it. But because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU might migrate before the pointer is cleared and __loaded_vmcs_clear() may then execute VMCLEAR.

The VMCS needs to stay attached until its explicit VMCLEAR completes, but then it can be hidden and the page safely freed.

---
 arch/x86/kvm/vmx/nested.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

@@ -336,6 +336,7 @@ static void nested_put_vmcs12_pages(stru
 static void free_nested(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+	struct vmcs *shadow_vmcs;
 
 	if (WARN_ON_ONCE(vmx->loaded_vmcs != &vmx->vmcs01))
 		vmx_switch_vmcs(vcpu, &vmx->vmcs01);

@@ -353,9 +354,15 @@ static void free_nested(struct kvm_vcpu
 	vmx->nested.current_vmptr = INVALID_GPA;
 	if (enable_shadow_vmcs) {
 		vmx_disable_shadow_vmcs(vmx);
-		vmcs_clear(vmx->vmcs01.shadow_vmcs);
-		free_vmcs(vmx->vmcs01.shadow_vmcs);
+
+		/*
+		 * Keep the pointer visible until after VMCLEAR, so migration
+		 * can clear an active shadow VMCS on the old CPU.
+		 */
+		shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+		vmcs_clear(shadow_vmcs);
 		vmx->vmcs01.shadow_vmcs = NULL;
+		free_vmcs(shadow_vmcs);
 	}
 	kfree(vmx->nested.cached_vmcs12);
 	vmx->nested.cached_vmcs12 = NULL;

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Phil Rosenthal <[email protected]>

commit 52f2f7c30126037975389aa04d24c506a5177c35 upstream.

mmu_destroy_caches() destroys pte_list_desc_cache and mmu_page_header_cache, but leaves both pointers unchanged. The pointers live in kvm.ko, and therefore survive when a vendor module is unloaded while kvm.ko remains loaded.

If creation of pte_list_desc_cache fails during a subsequent vendor module load, its assignment sets pte_list_desc_cache to NULL and the error path calls mmu_destroy_caches(). mmu_page_header_cache still points to the cache destroyed during the preceding vendor module unload. Passing that stale pointer to kmem_cache_destroy() causes a slab use-after-free.

Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y, CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A one-shot test hook forces pte_list_desc_cache to NULL on the second invocation of kvm_mmu_vendor_module_init():

1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.

KASAN reports:

  BUG: KASAN: slab-use-after-free in
  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
  ...
  kmem_cache_destroy+0x21/0x1d0
  kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
  ...
  Allocated by task 16817:
  __kmem_cache_create_args+0x12c/0x3b0
  __kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]
  kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]
  ...
  Freed by task 16820:
  kmem_cache_destroy+0x117/0x1d0
  kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]

Clear both pointers immediately after destroying their caches so that the stored state reflects the caches' lifetime and repeated cleanup is safe.

With the fix applied, the same injected vendor module reload fails with -ENOMEM as expected and produces no KASAN report.

Message-ID: <[email protected]>

---
 arch/x86/kvm/mmu/mmu.c |    2 ++
 1 file changed, 2 insertions(+)

@@ -7502,7 +7502,9 @@ void kvm_mmu_invalidate_mmio_sptes(struc
 static void mmu_destroy_caches(void)
 {
 	kmem_cache_destroy(pte_list_desc_cache);
+	pte_list_desc_cache = NULL;
 	kmem_cache_destroy(mmu_page_header_cache);
+	mmu_page_header_cache = NULL;
 }
 
 static void kvm_wake_nx_recovery_thread(struct kvm *kvm)

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mikko Perttunen <[email protected]>

[ Upstream commit 266cddf7bd0f6c79b6c0633aef742a22bf70265b ]

__host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead.

---
 drivers/gpu/host1x/bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index c273a4476f2370..a8cddb3425b428 100644
@@ -1012,10 +1012,10 @@ void host1x_bo_clear_cached_mappings(struct host1x_bo *bo)
 		if (WARN_ON(!cache))
 			continue;
 
-		mutex_lock(&mapping->cache->lock);
+		mutex_lock(&cache->lock);
 		WARN_ON(kref_read(&mapping->ref) != 1);
 		__host1x_bo_unpin(&mapping->ref);
-		mutex_unlock(&mapping->cache->lock);
+		mutex_unlock(&cache->lock);
 	}
 }
 EXPORT_SYMBOL(host1x_bo_clear_cached_mappings);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Mikko Perttunen <[email protected]>

[ Upstream commit f8c9c57d750346abd213ffed2ae3cacb0268e9f1 ]

Since commit "gpu: host1x: Allow entries in BO caches to be freed", host1x_bo_pin() and host1x_bo_unpin() handle the bo's refcount themselves. .pin/.unpin callbacks should not adjust it.

---
 drivers/crypto/tegra/tegra-se-main.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index e8d8c3a23d7adb..d2f518ef9a103f 100644
@@ -52,7 +52,7 @@ tegra_se_cmdbuf_pin(struct device *dev, struct host1x_bo *bo, enum dma_data_dire
 		return ERR_PTR(-ENOMEM);
 
 	kref_init(&map->ref);
-	map->bo = host1x_bo_get(bo);
+	map->bo = bo;
 	map->direction = direction;
 	map->dev = dev;
 

@@ -93,7 +93,6 @@ static void tegra_se_cmdbuf_unpin(struct host1x_bo_mapping *map)
 	dma_unmap_sgtable(map->dev, map->sgt, map->direction, 0);
 	sg_free_table(map->sgt);
 	kfree(map->sgt);
-	host1x_bo_put(map->bo);
 
 	kfree(map);
 }

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chuck Lever <[email protected]>

[ Upstream commit 2ae8e7afbc63bf84243367f89eb43571f0345a74 ]

Three small ownership-state cleanups land the transport in a state that lets future reviewers reason about each pointer locally rather than tracing the whole reply path:

rpcrdma_rep_put() clears rep->rr_rqst before the rep enters rb_free_reps so that no rep on the free list still carries a stale rqst pointer. rpcrdma_reply_handler() and rpcrdma_unpin_rqst() are the only sites that set rr_rqst; rpcrdma_reply_handler() hands the rep through rpcrdma_rep_put(), and rpcrdma_unpin_rqst() NULLs rr_rqst directly because its error path abandons the rep for teardown cleanup rather than returning it to rb_free_reps.

rpcrdma_reply_put() NULLs req->rl_reply before calling rpcrdma_rep_put(). The previous order placed the rep on rb_free_reps while req->rl_reply still pointed at it; the window was harmless because xprt_rdma_free_slot() holds the req exclusively across the pair, but closing it makes the invariant 'rep on rb_free_reps implies no req references it' strictly checkable.

rpcrdma_sendctx_unmap() and rpcrdma_sendctx_cancel() clear req->rl_sendctx after dropping the sendctx pointer in the sendctx ring. Without this, req->rl_sendctx survives across Send completion and points at a sendctx that may already have been reassigned by rpcrdma_sendctx_get_locked() to a different req. No caller dereferences the stale pointer today -- rpcrdma_prepare_send_sges() overwrites it before the next Send -- but a NULL is a more honest representation of 'the Send is no longer outstanding' and lets the assertion patch that follows trip on any future regression.

---
 net/sunrpc/xprtrdma/rpc_rdma.c |  4 ++++
 net/sunrpc/xprtrdma/verbs.c    | 12 ++++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

index e8b5fc86a01bbf..81070b78512b1e 100644
@@ -493,6 +493,7 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
 
 	rpcrdma_sendctx_dma_unmap(sc);
 	sc->sc_req = NULL;
+	req->rl_sendctx = NULL;
 	rpcrdma_req_put(req);
 }
 

@@ -501,8 +502,11 @@ void rpcrdma_sendctx_unmap(struct rpcrdma_sendctx *sc)
  */
 static void rpcrdma_sendctx_cancel(struct rpcrdma_sendctx *sc)
 {
+	struct rpcrdma_req *req = sc->sc_req;
+
 	rpcrdma_sendctx_dma_unmap(sc);
 	sc->sc_req = NULL;
+	req->rl_sendctx = NULL;
 }
 
 /* Prepare an SGE for the RPC-over-RDMA transport header.

index 0ac82f26bf6ec9..cbd20bef367d96 100644
@@ -1095,9 +1095,15 @@ static struct rpcrdma_rep *rpcrdma_rep_get_locked(struct rpcrdma_buffer *buf)
  * @buf: buffer pool
  * @rep: rep to release
  *
+ * The rep's transient association with an rpc_rqst, established
+ * by rpcrdma_reply_handler() and torn down here, must not survive
+ * onto rb_free_reps: rpcrdma_post_recvs() pulls reps from the free
+ * list to re-post them, and a non-NULL rr_rqst on a free-listed rep
+ * would imply the rep is still referenced by a req.
  */
 void rpcrdma_rep_put(struct rpcrdma_buffer *buf, struct rpcrdma_rep *rep)
 {
+	rep->rr_rqst = NULL;
 	llist_add(&rep->rr_node, &buf->rb_free_reps);
 }
 

@@ -1280,9 +1286,11 @@ rpcrdma_mr_get(struct rpcrdma_xprt *r_xprt)
  */
 void rpcrdma_reply_put(struct rpcrdma_buffer *buffers, struct rpcrdma_req *req)
 {
-	if (req->rl_reply) {
-		rpcrdma_rep_put(buffers, req->rl_reply);
+	struct rpcrdma_rep *rep = req->rl_reply;
+
+	if (rep) {
 		req->rl_reply = NULL;
+		rpcrdma_rep_put(buffers, rep);
 	}
 	/* I2: rl_reply NULL after the put closes the
 	 * 'rep on rb_free_reps still referenced by req' window.

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Akhil R <[email protected]>

[ Upstream commit ee7863e43228a3143398dc5bbb943c9a735a8fca ]

Remove the fallback compatible string "nvidia,tegra186-gpcdma" for GPCDMA in Tegra264. Tegra186 compatible cannot work on Tegra264 because of the register offset changes and absence of the reset property.

---
 arch/arm64/boot/dts/nvidia/tegra264.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 2d8e7e37830ff2..3dfdd7bb28a911 100644
@@ -3208,7 +3208,7 @@ agic_page5: interrupt-controller@99b0000 {
 		};
 
 		gpcdma: dma-controller@8400000 {
-			compatible = "nvidia,tegra264-gpcdma", "nvidia,tegra186-gpcdma";
+			compatible = "nvidia,tegra264-gpcdma";
 			reg = <0x0 0x08400000 0x0 0x210000>;
 			interrupts = <GIC_SPI 584 IRQ_TYPE_LEVEL_HIGH>,
 				     <GIC_SPI 585 IRQ_TYPE_LEVEL_HIGH>,

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Doehyun Baek <[email protected]>

[ Upstream commit 46d65096ce8d278abf4528e254878c14ddd0b459 ]

Fix minor cgroup v2 memory.stat documentation issues. Correct the vmalloc per-node marker now that vmalloc uses the native NR_VMALLOC node stat, and document zswap_incomp as a byte-valued memory amount instead of as a page counter.

---
 Documentation/admin-guide/cgroup-v2.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 6efd0095ed995b..5cc33d87c3dffe 100644
@@ -1570,7 +1570,7 @@ The following nested keys are defined.
 	  sock (npn)
 		Amount of memory used in network transmission buffers
 
-	  vmalloc (npn)
+	  vmalloc
 		Amount of memory used for vmap backed memory.
 
 	  shmem

@@ -1735,7 +1735,7 @@ The following nested keys are defined.
 		Number of pages written from zswap to swap.
 
 	  zswap_incomp
-		Number of incompressible pages currently stored in zswap
+		Amount of memory used by incompressible pages currently stored in zswap
 		without compression. These pages could not be compressed to
 		a size smaller than PAGE_SIZE, so they are stored as-is.
 

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

[ Upstream commit 115d1ce989747045bd7745c7ab020982660c7e42 ]

scx_kick_syncs is a per-CPU __rcu pointer, so per_cpu_ptr() returns struct scx_kick_syncs __rcu **. alloc_kick_syncs() and free_kick_syncs() stored it in a plain struct scx_kick_syncs **ksyncs, which sparse flags as an __rcu address-space mismatch. Annotate ksyncs to match. Its accesses already go through rcu_*_pointer().

---
 kernel/sched/ext.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 8429bebc21a19a..0e13139a7f27b9 100644
@@ -5615,7 +5615,7 @@ static void free_kick_syncs(void)
 	int cpu;
 
 	for_each_possible_cpu(cpu) {
-		struct scx_kick_syncs **ksyncs = per_cpu_ptr(&scx_kick_syncs, cpu);
+		struct scx_kick_syncs __rcu **ksyncs = per_cpu_ptr(&scx_kick_syncs, cpu);
 		struct scx_kick_syncs *to_free;
 
 		to_free = rcu_replace_pointer(*ksyncs, NULL, true);

@@ -6538,7 +6538,7 @@ static int alloc_kick_syncs(void)
 	 * can exceed percpu allocator limits on large machines.
 	 */
 	for_each_possible_cpu(cpu) {
-		struct scx_kick_syncs **ksyncs = per_cpu_ptr(&scx_kick_syncs, cpu);
+		struct scx_kick_syncs __rcu **ksyncs = per_cpu_ptr(&scx_kick_syncs, cpu);
 		struct scx_kick_syncs *new_ksyncs;
 
 		WARN_ON_ONCE(rcu_access_pointer(*ksyncs));

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Sumit Gupta <[email protected]>

[ Upstream commit 0dfa1e960f86e032007882b032c5cc7d14ebe73e ]

The Tegra234 SoC uses Cortex-A78AE cores, not Cortex-A78. Update the compatible string for all CPU nodes to match the actual hardware.

Tegra234 hardware reports:

  # head /proc/cpuinfo | egrep 'implementer|part'
  CPU implementer : 0x41
  CPU part        : 0xd42

Which maps to (from arch/arm64/include/asm/cputype.h):
#define ARM_CPU_IMP_ARM 0x41
#define ARM_CPU_PART_CORTEX_A78AE 0xD42

---
 arch/arm64/boot/dts/nvidia/tegra234.dtsi | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

index 18220cdac9f9bb..eda23431ed05ea 100644
@@ -5339,7 +5339,7 @@ cpus {
 		#size-cells = <0>;
 
 		cpu0_0: cpu@0 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x00000>;
 

@@ -5358,7 +5358,7 @@ cpu0_0: cpu@0 {
 		};
 
 		cpu0_1: cpu@100 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x00100>;
 

@@ -5377,7 +5377,7 @@ cpu0_1: cpu@100 {
 		};
 
 		cpu0_2: cpu@200 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x00200>;
 

@@ -5396,7 +5396,7 @@ cpu0_2: cpu@200 {
 		};
 
 		cpu0_3: cpu@300 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x00300>;
 

@@ -5415,7 +5415,7 @@ cpu0_3: cpu@300 {
 		};
 
 		cpu1_0: cpu@10000 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x10000>;
 

@@ -5434,7 +5434,7 @@ cpu1_0: cpu@10000 {
 		};
 
 		cpu1_1: cpu@10100 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x10100>;
 

@@ -5453,7 +5453,7 @@ cpu1_1: cpu@10100 {
 		};
 
 		cpu1_2: cpu@10200 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x10200>;
 

@@ -5472,7 +5472,7 @@ cpu1_2: cpu@10200 {
 		};
 
 		cpu1_3: cpu@10300 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x10300>;
 

@@ -5491,7 +5491,7 @@ cpu1_3: cpu@10300 {
 		};
 
 		cpu2_0: cpu@20000 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x20000>;
 

@@ -5510,7 +5510,7 @@ cpu2_0: cpu@20000 {
 		};
 
 		cpu2_1: cpu@20100 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x20100>;
 

@@ -5529,7 +5529,7 @@ cpu2_1: cpu@20100 {
 		};
 
 		cpu2_2: cpu@20200 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x20200>;
 

@@ -5548,7 +5548,7 @@ cpu2_2: cpu@20200 {
 		};
 
 		cpu2_3: cpu@20300 {
-			compatible = "arm,cortex-a78";
+			compatible = "arm,cortex-a78ae";
 			device_type = "cpu";
 			reg = <0x20300>;
 

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Petr Wozniak <[email protected]>

[ Upstream commit 6860b467f569f732b11cbc588ae7e195e90e7e23 ]

validate_xmit_xfrm() returns NULL both when a packet is dropped and when it is stolen by async crypto (-EINPROGRESS from ->xmit()). Callers cannot distinguish the two cases.

f53c723902d1 ("net: Add asynchronous callbacks for xfrm on layer 2.") changed the semantics of a NULL return from "dropped" to "stolen or dropped", but __dev_queue_xmit() was not updated. On virtual/bridge interfaces (noqueue qdisc) __dev_queue_xmit() initialises rc=-ENOMEM and jumps to out: when skb is NULL, returning -ENOMEM to the caller even though the packet will be delivered correctly via xfrm_dev_resume().

Return ERR_PTR(-EINPROGRESS) from validate_xmit_xfrm() for the async case so callers can tell it apart from a real drop. Update __dev_queue_xmit() to handle ERR_PTR(-EINPROGRESS) from validate_xmit_skb() correctly. Update validate_xmit_skb_list() to use IS_ERR_OR_NULL() so that ERR_PTR(-EINPROGRESS) is not mistakenly added to the transmitted list.

---
 net/core/dev.c         | 10 ++++++++--
 net/xfrm/xfrm_device.c |  4 ++--
 2 files changed, 10 insertions(+), 4 deletions(-)

index f81ce83fb3250d..31741169cb0ba6 100644
@@ -4016,6 +4016,9 @@ static struct sk_buff *validate_xmit_unreadable_skb(struct sk_buff *skb,
 	return NULL;
 }
 
+/* Returns the skb on success, NULL if dropped, or ERR_PTR(-EINPROGRESS)
+ * if stolen by async xfrm crypto (delivered via xfrm_dev_resume()).
+ */
 static struct sk_buff *validate_xmit_skb(struct sk_buff *skb, struct net_device *dev, bool *again)
 {
 	netdev_features_t features;

@@ -4087,7 +4090,7 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d
 		skb->prev = skb;
 
 		skb = validate_xmit_skb(skb, dev, again);
-		if (!skb)
+		if (IS_ERR_OR_NULL(skb))
 			continue;
 
 		if (!head)

@@ -4858,8 +4861,11 @@ int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev)
 			goto recursion_alert;
 
 		skb = validate_xmit_skb(skb, dev, &again);
-		if (!skb)
+		if (IS_ERR_OR_NULL(skb)) {
+			if (PTR_ERR(skb) == -EINPROGRESS)
+				rc = NET_XMIT_SUCCESS;
 			goto out;
+		}
 
 		HARD_TX_LOCK(dev, txq, cpu);
 

index 550457e4c4f01d..8b526e3676389a 100644
@@ -182,7 +182,7 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
 		err = x->type_offload->xmit(x, skb, esp_features);
 		if (err) {
 			if (err == -EINPROGRESS)
-				return NULL;
+				return ERR_PTR(-EINPROGRESS);
 
 			XFRM_INC_STATS(xs_net(x), LINUX_MIB_XFRMOUTSTATEPROTOERROR);
 			kfree_skb(skb);

@@ -224,7 +224,7 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
 		pskb = skb2;
 	}
 
-	return skb;
+	return skb ? skb : ERR_PTR(-EINPROGRESS);
 }
 EXPORT_SYMBOL_GPL(validate_xmit_xfrm);
 

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Petr Wozniak <[email protected]>

[ Upstream commit 3f4c3919baf0944ad96580467c302bc6c7758b00 ]

skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev).

When validate_xmit_xfrm() walks a GSO list and some segments are stolen by async crypto (->xmit() returns -EINPROGRESS), those segments are unlinked from the list but the head ->prev is never updated. If the last segment is the one stolen, the returned head still has ->prev pointing at it, even though it is now owned by the crypto engine and may be freed. validate_xmit_skb_list() later does tail->next = skb, writing through that stale pointer -- a use-after-free.

Repoint skb->prev at the last retained segment before returning.

---
 net/xfrm/xfrm_device.c | 8 ++++++++
 1 file changed, 8 insertions(+)

index 8b526e3676389a..4719aba331cd66 100644
@@ -224,6 +224,14 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur
 		pskb = skb2;
 	}
 
+	/* skb_gso_segment() set skb->prev to the last segment, but async
+	 * crypto may have stolen it above without updating ->prev.  Repoint
+	 * it at the last retained segment so validate_xmit_skb_list() does
+	 * not chain onto a segment now owned by the crypto engine.
+	 */
+	if (skb)
+		skb->prev = pskb;
+
 	return skb ? skb : ERR_PTR(-EINPROGRESS);
 }
 EXPORT_SYMBOL_GPL(validate_xmit_xfrm);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Seth Forshee <[email protected]>

[ Upstream commit 53716a4d745f1dac7aff33f3d1494b701eb2f888 ]

FFA_FEATURES reports the minimum size and alignment boundary required for RXTX_MAP. In FF-A v1.2 and later it can also report a maximum buffer size, with zero meaning that no maximum is enforced.

The driver only used the minimum value and then rounded it up to PAGE_SIZE before invoking RXTX_MAP after commit 83210251fd70 ("firmware: arm_ffa:
Use the correct buffer size during RXTX_MAP"). On systems where PAGE_SIZE is larger than the advertised minimum, this can exceed a non-zero maximum reported by firmware. Older implementations do not advertise a maximum and may also reject the rounded-up size.

Decode the maximum size and clamp the page-aligned minimum to it when it is present. If no maximum is advertised and RXTX_MAP rejects the rounded size with INVALID_PARAMETERS, retry with the advertised minimum size. Record drv_info->rxtx_bufsz only after RXTX_MAP succeeds so it reflects the size registered with firmware.

While there, also update RXTX_MAP_MIN_BUFSZ() to use FIELD_GET() for consistency.

(sudeep.holla: Minor rewording subject and commit message)

---
 drivers/firmware/arm_ffa/driver.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

index cab32cfdac4236..e2438ca09da24b 100644
@@ -32,6 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
+#include <linux/minmax.h>
 #include <linux/module.h>
 #include <linux/mm.h>
 #include <linux/mutex.h>

@@ -55,7 +56,9 @@
 	(FIELD_PREP(SENDER_ID_MASK, (s)) | FIELD_PREP(RECEIVER_ID_MASK, (r)))
 
 #define RXTX_MAP_MIN_BUFSZ_MASK	GENMASK(1, 0)
-#define RXTX_MAP_MIN_BUFSZ(x)	((x) & RXTX_MAP_MIN_BUFSZ_MASK)
+#define RXTX_MAP_MAX_BUFSZ_MASK	GENMASK(31, 16)
+#define RXTX_MAP_MIN_BUFSZ(x)	(FIELD_GET(RXTX_MAP_MIN_BUFSZ_MASK, (x)))
+#define RXTX_MAP_MAX_BUFSZ(x)	(FIELD_GET(RXTX_MAP_MAX_BUFSZ_MASK, (x)))
 
 #define FFA_MAX_NOTIFICATIONS		64
 

@@ -2095,7 +2098,7 @@ static int __init ffa_init(void)
 {
 	int ret;
 	u32 buf_sz;
-	size_t rxtx_bufsz = SZ_4K;
+	size_t rxtx_min_bufsz = SZ_4K, rxtx_max_bufsz = 0, rxtx_bufsz;
 
 	ret = ffa_transport_init(&invoke_ffa_fn);
 	if (ret)

@@ -2118,15 +2121,18 @@ static int __init ffa_init(void)
 	ret = ffa_features(FFA_FN_NATIVE(RXTX_MAP), 0, &buf_sz, NULL);
 	if (!ret) {
 		if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 1)
-			rxtx_bufsz = SZ_64K;
+			rxtx_min_bufsz = SZ_64K;
 		else if (RXTX_MAP_MIN_BUFSZ(buf_sz) == 2)
-			rxtx_bufsz = SZ_16K;
+			rxtx_min_bufsz = SZ_16K;
 		else
-			rxtx_bufsz = SZ_4K;
+			rxtx_min_bufsz = SZ_4K;
+
+		rxtx_max_bufsz = RXTX_MAP_MAX_BUFSZ(buf_sz) * SZ_4K;
+		if (rxtx_max_bufsz != 0 && rxtx_max_bufsz < rxtx_min_bufsz)
+			rxtx_max_bufsz = rxtx_min_bufsz;
 	}
 
-	rxtx_bufsz = PAGE_ALIGN(rxtx_bufsz);
-	drv_info->rxtx_bufsz = rxtx_bufsz;
+	rxtx_bufsz = min_not_zero(PAGE_ALIGN(rxtx_min_bufsz), rxtx_max_bufsz);
 	drv_info->rx_buffer = alloc_pages_exact(rxtx_bufsz, GFP_KERNEL);
 	if (!drv_info->rx_buffer) {
 		ret = -ENOMEM;

@@ -2142,10 +2148,17 @@ static int __init ffa_init(void)
 	ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
 			   virt_to_phys(drv_info->rx_buffer),
 			   rxtx_bufsz / FFA_PAGE_SIZE);
+	if (ret == -EINVAL && !rxtx_max_bufsz && rxtx_min_bufsz < rxtx_bufsz) {
+		rxtx_bufsz = rxtx_min_bufsz;
+		ret = ffa_rxtx_map(virt_to_phys(drv_info->tx_buffer),
+				   virt_to_phys(drv_info->rx_buffer),
+				   rxtx_bufsz / FFA_PAGE_SIZE);
+	}
 	if (ret) {
 		pr_err("failed to register FFA RxTx buffers\n");
 		goto free_pages;
 	}
+	drv_info->rxtx_bufsz = rxtx_bufsz;
 
 	mutex_init(&drv_info->rx_lock);
 	mutex_init(&drv_info->tx_lock);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Michael Bommarito <[email protected]>

[ Upstream commit d2e52d610b9b09694261632340b801a421e0b0c5 ]

Kernel-handled RMPP receive processing starts reassembly for active DATA responses before the response is matched to an outstanding send. The normal match happens later, after ib_process_rmpp_recv_wc() has either assembled a complete message or consumed the segment.

That ordering lets an unsolicited response that routes to a kernel RMPP agent by the high TID bits allocate or extend RMPP receive state before the full TID and source address are checked against a real request. A reordered burst can therefore reach the receive-side insertion path even though the response would not match any send.

For kernel-handled RMPP DATA responses, require the existing ib_find_send_mad() match before entering RMPP reassembly. The matcher already checks the full TID, management class and source address/GID against the agent wait, backlog and in-flight send lists. If there is no match, drop the response without creating RMPP state.

This leaves the RMPP window behavior unchanged and only rejects responses that have no corresponding request.

---
 drivers/infiniband/core/mad.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

index 8d19613179e3ee..e0b3b36b8b1496 100644
@@ -2031,6 +2031,24 @@ void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
 		change_mad_state(mad_send_wr, IB_MAD_STATE_EARLY_RESP);
 }
 
+static bool is_kernel_rmpp_data_response(struct ib_mad_agent_private *agent,
+					 struct ib_mad_recv_wc *mad_recv_wc)
+{
+	const struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
+	struct ib_rmpp_mad *rmpp_mad;
+
+	if (!ib_mad_kernel_rmpp_agent(&agent->agent) ||
+	    !ib_response_mad(mad_hdr) ||
+	    !ib_is_mad_class_rmpp(mad_hdr->mgmt_class))
+		return false;
+
+	rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
+
+	return (ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
+		IB_MGMT_RMPP_FLAG_ACTIVE) &&
+	       rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA;
+}
+
 static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
 				 struct ib_mad_recv_wc *mad_recv_wc)
 {

@@ -2050,6 +2068,18 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
 	}
 
 	list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
+	if (is_kernel_rmpp_data_response(mad_agent_priv, mad_recv_wc)) {
+		spin_lock_irqsave(&mad_agent_priv->lock, flags);
+		mad_send_wr = ib_find_send_mad(mad_agent_priv, mad_recv_wc);
+		spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
+
+		if (!mad_send_wr) {
+			ib_free_recv_mad(mad_recv_wc);
+			deref_mad_agent(mad_agent_priv);
+			return;
+		}
+	}
+
 	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
 		mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
 						      mad_recv_wc);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Harshit Mogalapalli <[email protected]>

[ Upstream commit 75c0c09541b49daa08fddbc2c18c2232f4eab7d8 ]

mtd_concat_destroy() frees item->concat so calling mtd_virt_concat_put_mtd_devices(item->concat) leads to a use after free.

Fix this by moving mtd_virt_concat_put_mtd_devices() before mtd_concat_destroy()

---
 drivers/mtd/mtd_virt_concat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 5db6e648927e29..5761816e7f4dca 100644
@@ -75,8 +75,8 @@ void mtd_virt_concat_destroy_joins(void)
 		if (item->concat) {
 			mtd_device_unregister(mtd);
 			kfree(mtd->name);
-			mtd_concat_destroy(mtd);
 			mtd_virt_concat_put_mtd_devices(item->concat);
+			mtd_concat_destroy(mtd);
 		}
 	}
 }

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Harshit Mogalapalli <[email protected]>

[ Upstream commit 4b45d7836b9526b8776af5f29219615be9417230 ]

mtd_concat_destroy() frees item->concat so calling mtd_virt_concat_put_mtd_devices(item->concat) after that leads to a use-after-free.

Fix it by moving mtd_virt_concat_put_mtd_devices() before mtd_concat_destroy().

---
 drivers/mtd/mtd_virt_concat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 5761816e7f4dca..da4277ced4d63b 100644
@@ -126,8 +126,8 @@ int mtd_virt_concat_destroy(struct mtd_info *mtd)
 		if (concat->mtd.name) {
 			del_mtd_device(&concat->mtd);
 			kfree(concat->mtd.name);
-			mtd_concat_destroy(&concat->mtd);
 			mtd_virt_concat_put_mtd_devices(item->concat);
+			mtd_concat_destroy(&concat->mtd);
 		}
 
 		for (idx = 0; idx < item->count; idx++)

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pengpeng Hou <[email protected]>

[ Upstream commit 66fb31358108d10245b9e4ef0eef3e7d9747055e ]

mtdswap_add_debugfs() creates an mtdswap_stats debugfs file under the per-MTD debugfs directory, but mtdswap_remove_dev() never removes it before freeing the mtdswap_dev.

Store the returned dentry and remove it during device teardown before the driver-private state is freed.

---
 drivers/mtd/mtdswap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 866933fc84265d..f33f753f0a9fda 100644
@@ -125,6 +125,7 @@ struct mtdswap_dev {
 
 	char *page_buf;
 	char *oob_buf;
+	struct dentry *debugfs_stats;
 };
 
 struct mtdswap_oobdata {

@@ -1262,7 +1263,8 @@ static int mtdswap_add_debugfs(struct mtdswap_dev *d)
 	if (IS_ERR_OR_NULL(root))
 		return -1;
 
-	debugfs_create_file("mtdswap_stats", S_IRUSR, root, d, &mtdswap_fops);
+	d->debugfs_stats = debugfs_create_file("mtdswap_stats", 0400, root,
+					       d, &mtdswap_fops);
 
 	return 0;
 }

@@ -1463,6 +1465,7 @@ static void mtdswap_remove_dev(struct mtd_blktrans_dev *dev)
 {
 	struct mtdswap_dev *d = MTDSWAP_MBD_TO_MTDSWAP(dev);
 
+	debugfs_remove(d->debugfs_stats);
 	del_mtd_blktrans_dev(dev);
 	mtdswap_cleanup(d);
 	kfree(d);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Pengpeng Hou <[email protected]>

[ Upstream commit 16f7ec8d5dc100eafd2c8e06cd30340a30b104a1 ]

mtk_ecc_wait_idle() logs when the encoder or decoder does not become idle, but returns void. Callers can therefore configure a non-idle ECC engine or read parity bytes after an unconfirmed encoder idle state.

Return the idle poll result and propagate it from the enable and encode paths that require the engine to be idle before continuing.

---
 drivers/mtd/nand/ecc-mtk.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

index c75bb8b80cc1e1..96703f0a418ea2 100644
@@ -123,8 +123,8 @@ static int mt7622_ecc_regs[] = {
 	[ECC_DECIRQ_STA] =      0x144,
 };
 
-static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,
-				     enum mtk_ecc_operation op)
+static inline int mtk_ecc_wait_idle(struct mtk_ecc *ecc,
+				    enum mtk_ecc_operation op)
 {
 	struct device *dev = ecc->dev;
 	u32 val;

@@ -136,6 +136,8 @@ static inline void mtk_ecc_wait_idle(struct mtk_ecc *ecc,
 	if (ret)
 		dev_warn(dev, "%s NOT idle\n",
 			 op == ECC_ENCODE ? "encoder" : "decoder");
+
+	return ret;
 }
 
 static irqreturn_t mtk_ecc_irq(int irq, void *id)

@@ -312,7 +314,11 @@ int mtk_ecc_enable(struct mtk_ecc *ecc, struct mtk_ecc_config *config)
 		return ret;
 	}
 
-	mtk_ecc_wait_idle(ecc, op);
+	ret = mtk_ecc_wait_idle(ecc, op);
+	if (ret) {
+		mutex_unlock(&ecc->lock);
+		return ret;
+	}
 
 	ret = mtk_ecc_config(ecc, config);
 	if (ret) {

@@ -412,7 +418,9 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
 	if (ret)
 		goto timeout;
 
-	mtk_ecc_wait_idle(ecc, ECC_ENCODE);
+	ret = mtk_ecc_wait_idle(ecc, ECC_ENCODE);
+	if (ret)
+		goto timeout;
 
 	/* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */
 	len = (config->strength * ecc->caps->parity_bits + 7) >> 3;

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiang Mei <[email protected]>

[ Upstream commit a2d8d5647ed854e38f941741aea45b9eb15a6350 ]

When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight from the on-disk btrfs_free_space_header. That header is stored in the tree_root under a key with type 0, which the tree-checker has no case for, so neither count is validated before the load trusts it.

The load loops num_entries times and maps the next page whenever the current one runs out, going through io_ctl_check_crc() -> io_ctl_map_page(), which does io_ctl->pages[io_ctl->index++]. But pages[] is allocated in io_ctl_init() from the cache inode's i_size, not from num_entries:

	num_pages = DIV_ROUND_UP(i_size_read(inode), PAGE_SIZE);
	io_ctl->pages = kcalloc(num_pages, sizeof(struct page *), GFP_NOFS);

So if num_entries claims more records than the pages can hold, io_ctl->index runs off the end of pages[]. The write side never hits this because io_ctl_add_entry() and io_ctl_add_bitmap() both stop once io_ctl->index >= io_ctl->num_pages; the read side just never had the same check.

To trigger it, take a clean cache (num_entries = <N> here), set num_entries in the header to 0x10000, and fix up the leaf checksum so it still passes the tree-checker. The cache inode has i_size = 65536, so num_pages is 16 and pages[] is a 16-pointer (kmalloc-128) array. The load now tries to read 65536 entries, io_ctl->index walks up to 16, and pages[16] is read past the array:

  BUG: KASAN: slab-out-of-bounds in io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)
  Read of size 8 at addr ffff88800c833a80 by task kworker/u8:3/58
   io_ctl_check_crc (fs/btrfs/free-space-cache.c:420 fs/btrfs/free-space-cache.c:565)
   __load_free_space_cache (fs/btrfs/free-space-cache.c:655 fs/btrfs/free-space-cache.c:820)
   load_free_space_cache (fs/btrfs/free-space-cache.c:1017)
   caching_thread (fs/btrfs/block-group.c:880)
   btrfs_work_helper (fs/btrfs/async-thread.c:312)
   process_one_work
   worker_thread
   kthread
   ret_from_fork

free-space-cache.c:420 is io_ctl_map_page(), inlined into io_ctl_check_crc() at line 565, which is why that is the frame KASAN names. The out-of-bounds slot is then treated as a struct page and handed to crc32c(), so the bad read turns into a GP fault.

Add the missing check to io_ctl_check_crc(), which is where both the entry loop and the bitmap loop end up. When num_entries is too large the load now fails like any corrupt cache: __load_free_space_cache() drops it and rebuilds the free space from the extent tree, so a valid cache is never rejected.

---
 fs/btrfs/free-space-cache.c | 3 +++
 1 file changed, 3 insertions(+)

index ab22e4f9ffdde0..bbc4db7fe74bbd 100644
@@ -555,6 +555,9 @@ static int io_ctl_check_crc(struct btrfs_io_ctl *io_ctl, int index)
 	u32 crc = ~(u32)0;
 	unsigned offset = 0;
 
+	if (index >= io_ctl->num_pages)
+		return -EIO;
+
 	if (index == 0)
 		offset = sizeof(u32) * io_ctl->num_pages;
 

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Filipe Manana <[email protected]>

[ Upstream commit ce6050bafb4e33377dc17fcc357736bfc351180c ]

If we have an unexpected reloc_root for our root, we jump to the out label but never drop the reference we obtained for root, resulting in a leak. Add a missing btrfs_put_root() call.

---
 fs/btrfs/relocation.c | 1 +
 1 file changed, 1 insertion(+)

index 3ebaf5880125fa..6c826be4174934 100644
@@ -1850,6 +1850,7 @@ void merge_reloc_roots(struct reloc_control *rc)
 				 * corruption, e.g. bad reloc tree key offset.
 				 */
 				ret = -EINVAL;
+				btrfs_put_root(root);
 				goto out;
 			}
 			ret = merge_reloc_root(rc, root);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Boris Burkov <[email protected]>

[ Upstream commit 3dcd50730814e5220072d2b26d0587af6bfb6dbe ]

We have been running with commit root csums enabled for some time and have noticed a slight uptick in zero csum errors. Investigating those revealed that they were same transaction reads of extents that were just relocated, but the extent map generation was long ago.

It turns out that relocation intentionally does not update the extent generation (replace_file_extents()), but must write a new csum since the data has moved, so we must account for this with commit root csum reading.

Luckily this is a short lived condition: after the relocation transaction the commit root will once again have the csum. So we can add a generic fallback to the lookup to try again with the transaction csum root.

---
 fs/btrfs/file-item.c | 26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

index d72249390030f4..e50b10b30c717b 100644
@@ -356,6 +356,7 @@ int btrfs_lookup_bio_sums(struct btrfs_bio *bbio)
 	const unsigned int nblocks = orig_len >> fs_info->sectorsize_bits;
 	int ret = 0;
 	u32 bio_offset = 0;
+	bool using_commit_root = false;
 
 	if ((inode->flags & BTRFS_INODE_NODATASUM) ||
 	    test_bit(BTRFS_FS_STATE_NO_DATA_CSUMS, &fs_info->fs_state))

@@ -429,6 +430,7 @@ int btrfs_lookup_bio_sums(struct btrfs_bio *bbio)
 	 * from across transactions.
 	 */
 	if (bbio->csum_search_commit_root) {
+		using_commit_root = true;
 		path->search_commit_root = true;
 		path->skip_locking = true;
 		down_read(&fs_info->commit_root_sem);

@@ -461,6 +463,28 @@ int btrfs_lookup_bio_sums(struct btrfs_bio *bbio)
 		 * assume this is the case.
 		 */
 		if (count == 0) {
+			/*
+			 * If an extent is relocated in the current transaction
+			 * then relocation writes a new csum without updating
+			 * the extent map generation. Until the next commit, we
+			 * will see a hole in that case, so we need to fallback
+			 * to searching the transaction csum root.
+			 *
+			 * Note that a commit root lookup of a referenced extent can
+			 * only miss, not return a stale csum. A freed extent's csum
+			 * is deleted in the same transaction and its bytenr is not
+			 * reusable until that transaction has committed and the
+			 * extent is unpinned.
+			 */
+			if (using_commit_root) {
+				up_read(&fs_info->commit_root_sem);
+				using_commit_root = false;
+				path->search_commit_root = false;
+				path->skip_locking = false;
+				btrfs_release_path(path);
+				continue;
+			}
+
 			memset(csum_dst, 0, csum_size);
 			count = 1;
 

@@ -479,7 +503,7 @@ int btrfs_lookup_bio_sums(struct btrfs_bio *bbio)
 		bio_offset += count * sectorsize;
 	}
 
-	if (bbio->csum_search_commit_root)
+	if (using_commit_root)
 		up_read(&fs_info->commit_root_sem);
 	return ret;
 }

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Unnathi Chalicheemala <[email protected]>

[ Upstream commit 8ae5f8e4836667fcaffdf2e3c6068b0a8b364dd8 ]

ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a caller passes NULL, uuid_parse() -> __uuid_parse() -> uuid_is_valid() dereferences the pointer, causing a kernel panic:

  |  Unable to handle kernel NULL pointer dereference at virtual address
  |  0000000000000040
  |  pc : uuid_parse+0x40/0xac
  |  lr : ffa_partition_info_get+0x1c/0x94 [arm_ffa]

Add a NULL guard before uuid_parse() so a NULL argument returns -ENODEV instead of crashing. Callers are expected to always supply a valid partition UUID, so NULL is not a supported input.

---
 drivers/firmware/arm_ffa/driver.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index e2438ca09da24b..ea0671180a16d9 100644
@@ -1137,7 +1137,7 @@ static int ffa_partition_info_get(const char *uuid_str,
 	uuid_t uuid;
 	struct ffa_partition_info *pbuf;
 
-	if (uuid_parse(uuid_str, &uuid)) {
+	if (!uuid_str || uuid_parse(uuid_str, &uuid)) {
 		pr_err("invalid uuid (%s)\n", uuid_str);
 		return -ENODEV;
 	}

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Tejun Heo <[email protected]>

[ Upstream commit b7d9c359e5cf867f7eb23df3bb1c6b9e58af24da ]

put_prev_task_scx() warns when a runnable task drops to a lower sched_class without SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have kept it running. Core scheduling breaks that: a forced-idle SMT sibling reschedules through the core_pick fast path in pick_next_task(), which skips pick_task_scx() and thus balance_one(), so a runnable task can drop to idle with ENQ_LAST unset.

Gate the warning on sched_cpu_cookie_match(): a cookie mismatch means core scheduling forced the idle, while a match (or core scheduling off) still catches a genuine missing-ENQ_LAST drop.

---
 kernel/sched/ext.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

index 0e13139a7f27b9..5f1accb092e30b 100644
@@ -3097,9 +3097,14 @@ static void put_prev_task_scx(struct rq *rq, struct task_struct *p,
 		 * sched_class, %SCX_OPS_ENQ_LAST must be set. Tell
 		 * ops.enqueue() that @p is the only one available for this cpu,
 		 * which should trigger an explicit follow-up scheduling event.
+		 *
+		 * Core scheduling can force this CPU idle while @p stays
+		 * runnable. @p's cookie then won't match the core's, so skip
+		 * the warning in that case.
 		 */
 		if (next && sched_class_above(&ext_sched_class, next->sched_class)) {
-			WARN_ON_ONCE(!(sch->ops.flags & SCX_OPS_ENQ_LAST));
+			WARN_ON_ONCE(sched_cpu_cookie_match(rq, p) &&
+				     !(sch->ops.flags & SCX_OPS_ENQ_LAST));
 			do_enqueue_task(rq, p, SCX_ENQ_LAST, -1);
 		} else {
 			do_enqueue_task(rq, p, 0, -1);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yixun Lan <[email protected]>

[ Upstream commit 1ca22c6aa006b05143367268066fb74e32cfe66b ]

According to SpacemiT K3's updated docs, the USB2 ahb reset and USB2 bus clock enable bit was wrongly swapped, the correct one should be:

Register : APMU_USB_CLK_RES_CTRL
bit[1] : usb2_port_bus_clk_en
bit[0] : usb2_port_ahb_rstn

---
 drivers/reset/spacemit/reset-spacemit-k3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 9841f5e057b2a0..2e87f320cf1184 100644
@@ -112,7 +112,7 @@ static const struct ccu_reset_data k3_apmu_resets[] = {
 	[RESET_APMU_SDH0]	= RESET_DATA(APMU_SDH0_CLK_RES_CTRL,	0, BIT(1)),
 	[RESET_APMU_SDH1]	= RESET_DATA(APMU_SDH1_CLK_RES_CTRL,	0, BIT(1)),
 	[RESET_APMU_SDH2]	= RESET_DATA(APMU_SDH2_CLK_RES_CTRL,	0, BIT(1)),
-	[RESET_APMU_USB2_AHB]	= RESET_DATA(APMU_USB_CLK_RES_CTRL,	0, BIT(1)),
+	[RESET_APMU_USB2_AHB]	= RESET_DATA(APMU_USB_CLK_RES_CTRL,	0, BIT(0)),
 	[RESET_APMU_USB2_VCC]	= RESET_DATA(APMU_USB_CLK_RES_CTRL,	0, BIT(2)),
 	[RESET_APMU_USB2_PHY]	= RESET_DATA(APMU_USB_CLK_RES_CTRL,	0, BIT(3)),
 	[RESET_APMU_USB3_A_AHB]	= RESET_DATA(APMU_USB_CLK_RES_CTRL,	0, BIT(5)),

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiang Mei (Microsoft) <[email protected]>

[ Upstream commit c283e9ada7fcb7dd4b10592623086b2e6d2f9925 ]

xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with rcu_dereference_protected(), stores NULL and dst_release()s the old dst. That is only safe if no other thread modifies sk_dst_cache concurrently.

For a connected UDP socket that does not hold: the transmit fast path (udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly with an atomic xchg(). A per-socket policy change racing a send can make both sides observe the same old dst and each dst_release() it, dropping the socket's single reference twice and freeing the xfrm_dst bundle while it is still referenced:

  BUG: KASAN: slab-use-after-free in dst_release
  Write of size 4 at addr ffff88801897b6c0 by task exploit/155
  Call Trace:
   ...
   dst_release (... ./include/linux/rcuref.h:109)
   xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)
   do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)
   ip_setsockopt (net/ipv4/ip_sockglue.c:1417)
   do_sock_setsockopt (net/socket.c:2368)
   __sys_setsockopt (net/socket.c:2393)
   __x64_sys_setsockopt (net/socket.c:2396)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Reachable by an unprivileged user via a user+network namespace.

Use the atomic sk_dst_reset() so the cache is cleared and released with a single xchg(): whichever side wins releases the dst once, the other sees NULL and does nothing. Behaviour is otherwise unchanged.

---
 net/xfrm/xfrm_state.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index ec9ecf72c76ba1..511a7402ada41b 100644
@@ -2973,7 +2973,7 @@ int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, int optlen)
 	if (sockptr_is_null(optval) && !optlen) {
 		xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL);
 		xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL);
-		__sk_dst_reset(sk);
+		sk_dst_reset(sk);
 		return 0;
 	}
 

@@ -3013,7 +3013,7 @@ int xfrm_user_policy(struct sock *sk, int optname, sockptr_t optval, int optlen)
 	if (err >= 0) {
 		xfrm_sk_policy_insert(sk, err, pol);
 		xfrm_pol_put(pol);
-		__sk_dst_reset(sk);
+		sk_dst_reset(sk);
 		err = 0;
 	}
 

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Antony Antony <[email protected]>

[ Upstream commit ea528f18231ec0f33317be57f8866913b19aba6e ]

syzbot reported a stack-out-of-bounds read in xfrm_state_find() which flows from xfrm_tmpl_resolve_one().

Commit 3d776e31c841 ("xfrm: Reject optional tunnel/BEET mode templates in outbound policies") disallowed optional tunnel and BEET in outbound policies to prevent this. Later when IPTFS added, it was not covered by that fix and can still trigger the out-of-bounds read;

Extend the check to disallow optional IPTFS in outbound policies as well. IPTFS should be identical to tunnel mode.
IN and FWD policies are not affected: xfrm_tmpl_resolve_one() is only reachable via the outbound path.

Reproducer, before:

ip link add dummy0 type dummy
ip link set dummy0 up
ip addr add 10.1.1.1/24 dev dummy0
ip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl
src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid 2 mode transport
ping -W 1 -c 1 10.1.1.2
PING 10.1.1.2 (10.1.1.2) 56(84) bytes of data.

[   64.168420] ==================================================================
[   64.169977] BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash+0x11e/0x170
[   64.169977] Read of size 4 at addr ffff88800e1ffd20 by task ping/2844

[   64.169977] CPU: 2 UID: 0 PID: 2844 Comm: ping Not tainted 7.1.0-rc7-00180-geb23b588430a #98 PREEMPT(full)
[   64.169977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   64.169977] Call Trace:
[   64.169977]  <TASK>
[   64.169977]  dump_stack_lvl+0x47/0x70
[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170
[   64.169977]  print_report+0x152/0x4b0
[   64.169977]  ? ksys_mmap_pgoff+0x6d/0xa0
[   64.169977]  ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   64.169977]  ? rcu_read_unlock_sched+0xa/0x20
[   64.169977]  ? __virt_addr_valid+0x21b/0x230
[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170
[   64.169977]  kasan_report+0xa8/0xd0
[   64.169977]  ? __xfrm6_addr_hash+0x11e/0x170
[   64.169977]  __xfrm6_addr_hash+0x11e/0x170
[   64.169977]  __xfrm_dst_hash+0x24/0xc0
[   64.169977]  xfrm_state_find+0xa2d/0x2f90
[   64.169977]  ? __pfx_xfrm_state_find+0x10/0x10
[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10
[   64.169977]  ? __pfx_ftrace_graph_ret_addr+0x10/0x10
[   64.169977]  xfrm_tmpl_resolve_one+0x210/0x570
[   64.169977]  ? __pfx_xfrm_tmpl_resolve_one+0x10/0x10
[   64.169977]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[   64.169977]  ? kernel_text_address+0x5b/0x80
[   64.169977]  ? __kernel_text_address+0xe/0x30
[   64.169977]  ? unwind_get_return_address+0x5e/0x90
[   64.169977]  ? arch_stack_walk+0x8c/0xe0
[   64.169977]  xfrm_tmpl_resolve+0x130/0x200
[   64.169977]  ? __pfx_xfrm_tmpl_resolve+0x10/0x10
[   64.169977]  ? __pfx_xfrm_policy_inexact_lookup_rcu+0x10/0x10
[   64.169977]  ? __refcount_add_not_zero.constprop.0+0xb2/0x110
[   64.169977]  ? __pfx___refcount_add_not_zero.constprop.0+0x10/0x10
[   64.169977]  xfrm_resolve_and_create_bundle+0xd5/0x310
[   64.169977]  ? __pfx_xfrm_resolve_and_create_bundle+0x10/0x10
[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10
[   64.169977]  ? __pfx_xfrm_policy_lookup_bytype+0x10/0x10
[   64.169977]  xfrm_lookup_with_ifid+0x3d8/0xb80
[   64.169977]  ? __pfx_xfrm_lookup_with_ifid+0x10/0x10
[   64.169977]  ? ip_route_output_key_hash+0xc6/0x110
[   64.169977]  ? kasan_save_track+0x10/0x30
[   64.169977]  xfrm_lookup_route+0x18/0xe0
[   64.169977]  ip4_datagram_release_cb+0x4c9/0x530
[   64.169977]  ? __pfx_ip4_datagram_release_cb+0x10/0x10
[   64.169977]  ? do_raw_spin_lock+0x71/0xc0
[   64.169977]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   64.169977]  release_sock+0xb0/0x170
[   64.169977]  udp_connect+0x43/0x50
[   64.169977]  __sys_connect+0xa6/0x100
[   64.169977]  ? alloc_fd+0x2e9/0x300
[   64.169977]  ? __pfx___sys_connect+0x10/0x10
[   64.169977]  ? preempt_latency_start+0x1f/0x70
[   64.169977]  ? fd_install+0x7e/0x150
[   64.169977]  ? rcu_read_unlock_sched+0xa/0x20
[   64.169977]  ? __sys_socket+0xdf/0x130
[   64.169977]  ? __pfx___sys_socket+0x10/0x10
[   64.169977]  ? vma_refcount_put+0x43/0xa0
[   64.169977]  __x64_sys_connect+0x7e/0x90
[   64.169977]  do_syscall_64+0x11b/0x2b0
[   64.169977]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   64.169977] RIP: 0033:0x7f4851ecb570
[   64.169977] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 80 3d f9 ca 0d 00 00 74 17 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 54
[   64.169977] RSP: 002b:00007ffc830e3498 EFLAGS: 00000202 ORIG_RAX: 000000000000002a
[   64.169977] RAX: ffffffffffffffda RBX: 00007ffc830e34d0 RCX: 00007f4851ecb570
[   64.169977] RDX: 0000000000000010 RSI: 00007ffc830e34d0 RDI: 0000000000000005
[   64.169977] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000000
[   64.169977] R10: 0000000000000006 R11: 0000000000000202 R12: 0000000000000005
[   64.169977] R13: 0000000000000000 R14: 00005619a863f340 R15: 0000000000000000
[   64.169977]  </TASK>

[   64.169977] The buggy address belongs to stack of task ping/2844
[   64.169977]  and is located at offset 88 in frame:
[   64.169977]  ip4_datagram_release_cb+0x0/0x530

[   64.169977] This frame has 1 object:
[   64.169977]  [32, 88) 'fl4'

[   64.169977] The buggy address belongs to the physical page:
[   64.169977] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe1ff
[   64.169977] flags: 0x4000000000000000(zone=1)
[   64.169977] raw: 4000000000000000 0000000000000000 ffffea0000387fc8 0000000000000000
[   64.169977] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[   64.169977] page dumped because: kasan: bad access detected

[   64.169977] Memory state around the buggy address:
[   64.169977]  ffff88800e1ffc00: f2 f2 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00
[   64.169977]  ffff88800e1ffc80: 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00
[   64.169977] >ffff88800e1ffd00: 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00
[   64.169977]                                ^
[   64.169977]  ffff88800e1ffd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
[   64.169977]  ffff88800e1ffe00: f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   64.169977] ==================================================================
[   64.245153] Disabling lock debugging due to kernel taint

After the fix:

ip xfrm policy add src 10.1.1.1/32 dst 10.1.1.2/32 dir out tmpl \
src fc00::dead:1 dst fc00::dead:2 proto esp reqid 1 mode iptfs \
level use tmpl src fc00::dead:1 dst fc00::dead:2 proto esp reqid 2 \
mode transport

Error: Mode in optional template not allowed in outbound policy.

---
 net/xfrm/xfrm_user.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index 61eb5de33b87ee..b36741c4ea3de9 100644
@@ -2077,13 +2077,12 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family,
 		switch (ut[i].mode) {
 		case XFRM_MODE_TUNNEL:
 		case XFRM_MODE_BEET:
+		case XFRM_MODE_IPTFS:
 			if (ut[i].optional && dir == XFRM_POLICY_OUT) {
 				NL_SET_ERR_MSG(extack, "Mode in optional template not allowed in outbound policy");
 				return -EINVAL;
 			}
 			break;
-		case XFRM_MODE_IPTFS:
-			break;
 		default:
 			if (ut[i].family != prev_family) {
 				NL_SET_ERR_MSG(extack, "Mode in template doesn't support a family change");

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Or Gerlitz <[email protected]>

[ Upstream commit 18313833e2c6de222a4f6c072da759d0d5888528 ]

The cited commit hardcoded the hardware address comparison len to ETH_ALEN.

This breaks IPoIB, which uses 20-byte addresses. By truncating the memcmp, the CMA may incorrectly assume the target address is unchanged and fails to abort the stalled connection.

Fix this by replacing ETH_ALEN with the dynamic neigh->dev->addr_len to correctly evaluate the full address regardless of the link layer.

---
 drivers/infiniband/core/cma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 9480d1a51c116e..e88d3efb967b3b 100644
@@ -5270,7 +5270,7 @@ static int cma_netevent_callback(struct notifier_block *self,
 
 	list_for_each_entry(current_id, &ips_node->id_list, id_list_entry) {
 		if (!memcmp(current_id->id.route.addr.dev_addr.dst_dev_addr,
-			   neigh->ha, ETH_ALEN))
+			   neigh->ha, neigh->dev->addr_len))
 			continue;
 		cma_id_get(current_id);
 		if (!queue_work(cma_wq, &current_id->id.net_work))

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jacob Moroni <[email protected]>

[ Upstream commit a846aecb931b4d65d5eafa92a0623545af46d4f2 ]

When a QP/CQ/SRQ is created, a two step process is used where the buffer is allocated in userspace and explicitly registered with the normal reg_mr mechanism prior to creating the actual QP/CQ/SRQ object.

These special registrations are indicated via an ABI field so the driver knows that they do not have a valid mkey and to skip the actual CQP command submission.

Since these are real MR objects from the core's perspective, it is possible for a user application to invoke rereg_mr on them and cause a real CQP op to be emitted with the zero-initialized mkey value of 0.

Fix this by preventing rereg_mr on these special regions.

---
 drivers/infiniband/hw/irdma/verbs.c | 3 +++
 1 file changed, 3 insertions(+)

index 7da7a7e8b30ca2..a33bd3c8571247 100644
@@ -3810,6 +3810,9 @@ static struct ib_mr *irdma_rereg_user_mr(struct ib_mr *ib_mr, int flags,
 	if (flags & ~(IB_MR_REREG_TRANS | IB_MR_REREG_PD | IB_MR_REREG_ACCESS))
 		return ERR_PTR(-EOPNOTSUPP);
 
+	if (iwmr->type != IRDMA_MEMREG_TYPE_MEM)
+	     return ERR_PTR(-EINVAL);
+
 	ret = ib_umem_check_rereg(iwmr->region, flags, new_access);
 	if (ret)
 		return ERR_PTR(ret);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jacob Moroni <[email protected]>

[ Upstream commit ed8621be482bf18dcd217aa024e95758bf9d28f2 ]

The driver has the following invariants:

1. legacy_mode is only allowed on GEN_1 hardware (enforced in irdma_alloc_ucontext).

2. GEN_1 hardware does not set IRDMA_FEATURE_CQ_RESIZE or IRDMA_FEATURE_RTS_AE. These feature flags are only set for GEN_2 and GEN_3 hardware.

Therefore, legacy_mode is always false if IRDMA_FEATURE_CQ_RESIZE or IRDMA_FEATURE_RTS_AE is set, so remove the redundant checks.

Stable-dep-of: b9b088907156 ("RDMA/irdma: Prevent user-triggered null deref on QP create")

---
 drivers/infiniband/hw/irdma/uk.c    | 9 +++------
 drivers/infiniband/hw/irdma/user.h  | 1 -
 drivers/infiniband/hw/irdma/verbs.c | 7 +------
 3 files changed, 4 insertions(+), 13 deletions(-)

index 4718acf6c6fd00..a34883fe998368 100644
@@ -1568,15 +1568,12 @@ static const struct irdma_wqe_uk_ops iw_wqe_uk_ops_gen_1 = {
  * irdma_setup_connection_wqes - setup WQEs necessary to complete
  * connection.
  * @qp: hw qp (user and kernel)
- * @info: qp initialization info
  */
-static void irdma_setup_connection_wqes(struct irdma_qp_uk *qp,
-					struct irdma_qp_uk_init_info *info)
+static void irdma_setup_connection_wqes(struct irdma_qp_uk *qp)
 {
 	u16 move_cnt = 1;
 
-	if (!info->legacy_mode &&
-	    (qp->uk_attrs->feature_flags & IRDMA_FEATURE_RTS_AE))
+	if (qp->uk_attrs->feature_flags & IRDMA_FEATURE_RTS_AE)
 		move_cnt = 3;
 
 	qp->conn_wqes = move_cnt;

@@ -1727,7 +1724,7 @@ int irdma_uk_qp_init(struct irdma_qp_uk *qp, struct irdma_qp_uk_init_info *info)
 	sq_ring_size = qp->sq_size << info->sq_shift;
 	IRDMA_RING_INIT(qp->sq_ring, sq_ring_size);
 	if (info->first_sq_wq) {
-		irdma_setup_connection_wqes(qp, info);
+		irdma_setup_connection_wqes(qp);
 		qp->swqe_polarity = 1;
 		qp->first_sq_wq = true;
 	} else {

index 008af1acc92884..4dd3776a4cddb6 100644
@@ -563,7 +563,6 @@ struct irdma_qp_uk_init_info {
 	u8 sq_shift;
 	u8 rq_shift;
 	int abi_ver;
-	bool legacy_mode;
 	struct irdma_srq_uk *srq_uk;
 };
 

index a33bd3c8571247..7ab08f324eb9a2 100644
@@ -634,7 +634,6 @@ static int irdma_setup_umode_qp(struct ib_udata *udata,
 	iwqp->ctx_info.qp_compl_ctx = req.user_compl_ctx;
 	iwqp->user_mode = 1;
 	if (req.user_wqe_bufs) {
-		info->qp_uk_init_info.legacy_mode = ucontext->legacy_mode;
 		spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
 		iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs,
 					    &ucontext->qp_reg_mem_list);

@@ -2074,10 +2073,6 @@ static int irdma_resize_cq(struct ib_cq *ibcq, unsigned int entries,
 			rdma_udata_to_drv_context(udata, struct irdma_ucontext,
 						  ibucontext);
 
-		/* CQ resize not supported with legacy GEN_1 libi40iw */
-		if (ucontext->legacy_mode)
-			return -EOPNOTSUPP;
-
 		if (ib_copy_from_udata(&req, udata,
 				       min(sizeof(req), udata->inlen)))
 			return -EINVAL;

@@ -2559,7 +2554,7 @@ static int irdma_create_cq(struct ib_cq *ibcq,
 		cqmr = &iwpbl->cq_mr;
 
 		if (rf->sc_dev.hw_attrs.uk_attrs.feature_flags &
-		    IRDMA_FEATURE_CQ_RESIZE && !ucontext->legacy_mode) {
+		    IRDMA_FEATURE_CQ_RESIZE) {
 			spin_lock_irqsave(&ucontext->cq_reg_mem_list_lock, flags);
 			iwpbl_shadow = irdma_get_pbl(
 					(unsigned long)req.user_shadow_area,

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jacob Moroni <[email protected]>

[ Upstream commit b9b0889071569d43623c260074e159cd8f26adb1 ]

Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp.

While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref.

Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.

---
 drivers/infiniband/hw/irdma/verbs.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

index 7ab08f324eb9a2..e7f6ebd9c9557d 100644
@@ -633,17 +633,16 @@ static int irdma_setup_umode_qp(struct ib_udata *udata,
 
 	iwqp->ctx_info.qp_compl_ctx = req.user_compl_ctx;
 	iwqp->user_mode = 1;
-	if (req.user_wqe_bufs) {
-		spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
-		iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs,
-					    &ucontext->qp_reg_mem_list);
-		spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
 
-		if (!iwqp->iwpbl) {
-			ret = -ENODATA;
-			ibdev_dbg(&iwdev->ibdev, "VERBS: no pbl info\n");
-			return ret;
-		}
+	spin_lock_irqsave(&ucontext->qp_reg_mem_list_lock, flags);
+	iwqp->iwpbl = irdma_get_pbl((unsigned long)req.user_wqe_bufs,
+				    &ucontext->qp_reg_mem_list);
+	spin_unlock_irqrestore(&ucontext->qp_reg_mem_list_lock, flags);
+
+	if (!iwqp->iwpbl) {
+		ret = -ENODATA;
+		ibdev_dbg(&iwdev->ibdev, "VERBS: no pbl info\n");
+		return ret;
 	}
 
 	if (!ucontext->use_raw_attrs) {

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruoyu Wang <[email protected]>

[ Upstream commit 2815a277c53e9a84784d6410cd55a9da5b33068d ]

erdma_post_recv() returns ret after walking the receive work request list. If the caller passes an empty list, the loop is skipped and ret is not assigned.

Initialize ret to 0 so an empty receive work request list returns success instead of stack data.

---
 drivers/infiniband/hw/erdma/erdma_qp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 25f6c49aec7798..e002343832f74d 100644
@@ -734,7 +734,7 @@ int erdma_post_recv(struct ib_qp *ibqp, const struct ib_recv_wr *recv_wr,
 	const struct ib_recv_wr *wr = recv_wr;
 	struct erdma_qp *qp = to_eqp(ibqp);
 	unsigned long flags;
-	int ret;
+	int ret = 0;
 
 	spin_lock_irqsave(&qp->lock, flags);
 

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruoyu Wang <[email protected]>

[ Upstream commit 155fd5ce2382b0ffbec0d7ee7b3a6818a27a5aed ]

mana_ib_post_send() returns err after walking the send work request list. If the caller passes an empty list, the loop is skipped and err is not assigned.

Initialize err to 0 so an empty send work request list returns success instead of stack data.

---
 drivers/infiniband/hw/mana/wr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 1813567d3b16c9..36a1d506f08f65 100644
@@ -144,7 +144,7 @@ static int mana_ib_post_send_ud(struct mana_ib_qp *qp, const struct ib_ud_wr *wr
 int mana_ib_post_send(struct ib_qp *ibqp, const struct ib_send_wr *wr,
 		      const struct ib_send_wr **bad_wr)
 {
-	int err;
+	int err = 0;
 	struct mana_ib_qp *qp = container_of(ibqp, struct mana_ib_qp, ibqp);
 
 	for (; wr; wr = wr->next) {

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Chenguang Zhao <[email protected]>

[ Upstream commit e939334ea7dd219f100f963dbb1cb43df520c20a ]

Move the zero CQE validation before rdma_zalloc_drv_obj() to avoid leaking the CQ object when returning -EINVAL.

---
 drivers/infiniband/core/verbs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

index bac87de9cc6735..2f3237e6086b9b 100644
@@ -2199,13 +2199,13 @@ struct ib_cq *__ib_create_cq(struct ib_device *device,
 	struct ib_cq *cq;
 	int ret;
 
+	if (WARN_ON_ONCE(!cq_attr->cqe))
+		return ERR_PTR(-EINVAL);
+
 	cq = rdma_zalloc_drv_obj(device, ib_cq);
 	if (!cq)
 		return ERR_PTR(-ENOMEM);
 
-	if (WARN_ON_ONCE(!cq_attr->cqe))
-		return ERR_PTR(-EINVAL);
-
 	cq->device = device;
 	cq->comp_handler = comp_handler;
 	cq->event_handler = event_handler;

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danila Chernetsov <[email protected]>

[ Upstream commit 9f0f2d2121f16d420199a82ac5bbc242269133b3 ]

In hns_roce_cleanup_mhop_hem_table(), the expression:

    obj = i * buf_chunk_size / table->obj_size;

is evaluated using 32-bit unsigned arithmetic because 'buf_chunk_size' is u32 and the usual arithmetic conversions convert 'i' to unsigned int. The result is assigned to a u64 variable, but the multiplication may overflow before the assignment.

For sufficiently large HEM tables, this produces an incorrect object index passed to hns_roce_table_mhop_put().

Cast 'i' to u64 before the multiplication so that the intermediate calculation is performed with 64-bit arithmetic.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

---
 drivers/infiniband/hw/hns/hns_roce_hem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index ccb40f8a48b726..a38bfd9a0fe243 100644
@@ -836,7 +836,7 @@ static void hns_roce_cleanup_mhop_hem_table(struct hns_roce_dev *hr_dev,
 					mhop.bt_chunk_size;
 
 	for (i = 0; i < table->num_hem; ++i) {
-		obj = i * buf_chunk_size / table->obj_size;
+		obj = (u64)i * buf_chunk_size / table->obj_size;
 		if (table->hem[i])
 			hns_roce_table_mhop_put(hr_dev, table, obj, 0);
 	}

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ruoyu Wang <[email protected]>

[ Upstream commit bb27fcc67c429d97f785c92c35a6c5adebb05d7f ]

siw_create_qp() currently calls siw_qp_add() before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being constructed.

Move siw_qp_add() to the end of siw_create_qp(), after QP initialization and before adding the QP to the siw device list.

---
 drivers/infiniband/sw/siw/siw_verbs.c | 44 +++++++++++++++------------
 1 file changed, 24 insertions(+), 20 deletions(-)

index 1e1d262a4ae2db..a513ca96259fd2 100644
@@ -316,6 +316,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 	struct siw_ucontext *uctx =
 		rdma_udata_to_drv_context(udata, struct siw_ucontext,
 					  base_ucontext);
+	struct siw_uresp_create_qp uresp = {};
 	unsigned long flags;
 	int num_sqe, num_rqe, rv = 0;
 	size_t length;

@@ -369,11 +370,6 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 	spin_lock_init(&qp->rq_lock);
 	spin_lock_init(&qp->orq_lock);
 
-	rv = siw_qp_add(sdev, qp);
-	if (rv)
-		goto err_atomic;
-
-
 	/* All queue indices are derived from modulo operations
 	 * on a free running 'get' (consumer) and 'put' (producer)
 	 * unsigned counter. Having queue sizes at power of two

@@ -391,14 +387,14 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 
 	if (qp->sendq == NULL) {
 		rv = -ENOMEM;
-		goto err_out_xa;
+		goto err_out;
 	}
 	if (attrs->sq_sig_type != IB_SIGNAL_REQ_WR) {
 		if (attrs->sq_sig_type == IB_SIGNAL_ALL_WR)
 			qp->attrs.flags |= SIW_SIGNAL_ALL_WR;
 		else {
 			rv = -EINVAL;
-			goto err_out_xa;
+			goto err_out;
 		}
 	}
 	qp->pd = pd;

@@ -424,7 +420,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 
 		if (qp->recvq == NULL) {
 			rv = -ENOMEM;
-			goto err_out_xa;
+			goto err_out;
 		}
 		qp->attrs.rq_size = num_rqe;
 	}

@@ -439,11 +435,8 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 	qp->attrs.state = SIW_QP_STATE_IDLE;
 
 	if (udata) {
-		struct siw_uresp_create_qp uresp = {};
-
 		uresp.num_sqe = num_sqe;
 		uresp.num_rqe = num_rqe;
-		uresp.qp_id = qp_id(qp);
 
 		if (qp->sendq) {
 			length = num_sqe * sizeof(struct siw_sqe);

@@ -452,7 +445,7 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 						      length, &uresp.sq_key);
 			if (!qp->sq_entry) {
 				rv = -ENOMEM;
-				goto err_out_xa;
+				goto err_out;
 			}
 		}
 

@@ -464,9 +457,23 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 			if (!qp->rq_entry) {
 				uresp.sq_key = SIW_INVAL_UOBJ_KEY;
 				rv = -ENOMEM;
-				goto err_out_xa;
+				goto err_out;
 			}
 		}
+	}
+	qp->tx_cpu = siw_get_tx_cpu(sdev);
+	if (qp->tx_cpu < 0) {
+		rv = -EINVAL;
+		goto err_out;
+	}
+	init_completion(&qp->qp_free);
+
+	rv = siw_qp_add(sdev, qp);
+	if (rv)
+		goto err_out_tx;
+
+	if (udata) {
+		uresp.qp_id = qp_id(qp);
 
 		if (udata->outlen < sizeof(uresp)) {
 			rv = -EINVAL;

@@ -476,22 +483,19 @@ int siw_create_qp(struct ib_qp *ibqp, struct ib_qp_init_attr *attrs,
 		if (rv)
 			goto err_out_xa;
 	}
-	qp->tx_cpu = siw_get_tx_cpu(sdev);
-	if (qp->tx_cpu < 0) {
-		rv = -EINVAL;
-		goto err_out_xa;
-	}
+
 	INIT_LIST_HEAD(&qp->devq);
 	spin_lock_irqsave(&sdev->lock, flags);
 	list_add_tail(&qp->devq, &sdev->qp_list);
 	spin_unlock_irqrestore(&sdev->lock, flags);
 
-	init_completion(&qp->qp_free);
-
 	return 0;
 
 err_out_xa:
 	xa_erase(&sdev->qp_xa, qp_id(qp));
+err_out_tx:
+	siw_put_tx_cpu(qp->tx_cpu);
+err_out:
 	if (uctx) {
 		rdma_user_mmap_entry_remove(qp->sq_entry);
 		rdma_user_mmap_entry_remove(qp->rq_entry);

2.53.0

7.1-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xue Lei <[email protected]>

[ Upstream commit 9d4af746af8ce27eefc2338b2feaa1e01f28b6c3 ]

When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device() or device_unregister(). mtd_release() calls release_mtd_partition() which frees the mtd_info structure. However, callers such as mtd_add_partition() and add_mtd_partitions() also call free_partition() in their error paths, resulting in a double free.

Additionally, release_mtd_partition() hits WARN_ON(!list_empty( &mtd->part.node)) because the partition node is still linked in the parent's partitions list when the release callback fires from the add_mtd_device() error path.

Fix this by overriding dev->type and dev->release before put_device() in the error paths, so that device_release() invokes a no-op function instead of mtd_release(). For the mtd_nvmem_add() failure case, device_unregister() is replaced with device_del() to separate the device removal from the final kobject reference drop, allowing the override to take effect before put_device() is called.

The callers' error paths (list_del + free_partition) remain the sole owners of mtd_info lifetime on add_mtd_device() failure, which is the expected contract.

The normal partition teardown path is not affected: del_mtd_device() goes through kref_put() -> mtd_device_release() -> device_unregister() with dev->type still set to &mtd_devtype, so mtd_release() -> release_mtd_partition() continues to work correctly for the regular removal case.

---
 drivers/mtd/mtdcore.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

index 57653777462887..16629382a787bd 100644
@@ -105,6 +105,15 @@ static void mtd_release(struct device *dev)
 	device_destroy(&mtd_class, index + 1);
 }
 
+/*
+ * No-op device release used in add_mtd_device() error paths.
+ * Prevents mtd_release() from being called via device_release(),
+ * which would free the mtd_info that the caller still manages.
+ */
+static void mtd_dev_release_nop(struct device *dev)
+{
+}
+
 static void mtd_device_release(struct kref *kref)
 {
 	struct mtd_info *mtd = container_of(kref, struct mtd_info, refcnt);