6.18.32-rc1 review

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ming Lei <[email protected]>

[ Upstream commit 3dbaacf6ab68f81e3375fe769a2ecdbd3ce386fd ]

When a queue is shared across disk rebind (e.g., SCSI unbind/bind), the previous disk's blkcg state is cleaned up asynchronously via disk_release() -> blkcg_exit_disk(). If the new disk's blkcg_init_disk() runs before that cleanup finishes, we may overwrite q->root_blkg while the old one is still alive, and radix_tree_insert() in blkg_create() fails with -EEXIST because the old blkg entries still occupy the same queue id slot in blkcg->blkg_tree. This causes the sd probe to fail with -ENOMEM.

Fix it by waiting in blkcg_init_disk() for root_blkg to become NULL, which indicates the previous disk's blkcg cleanup has completed.

---
 block/blk-cgroup.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

index 3cffb68ba5d87..890c161bee25e 100644
@@ -24,6 +24,7 @@
 #include <linux/backing-dev.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
+#include <linux/wait_bit.h>
 #include <linux/atomic.h>
 #include <linux/ctype.h>
 #include <linux/resume_user_mode.h>

@@ -611,6 +612,8 @@ static void blkg_destroy_all(struct gendisk *disk)
 
 	q->root_blkg = NULL;
 	spin_unlock_irq(&q->queue_lock);
+
+	wake_up_var(&q->root_blkg);
 }
 
 static void blkg_iostat_set(struct blkg_iostat *dst, struct blkg_iostat *src)

@@ -1498,6 +1501,18 @@ int blkcg_init_disk(struct gendisk *disk)
 	struct blkcg_gq *new_blkg, *blkg;
 	bool preloaded;
 
+	/*
+	 * If the queue is shared across disk rebind (e.g., SCSI), the
+	 * previous disk's blkcg state is cleaned up asynchronously via
+	 * disk_release() -> blkcg_exit_disk(). Wait for that cleanup to
+	 * finish (indicated by root_blkg becoming NULL) before setting up
+	 * new blkcg state. Otherwise, we may overwrite q->root_blkg while
+	 * the old one is still alive, and radix_tree_insert() in
+	 * blkg_create() will fail with -EEXIST because the old entries
+	 * still occupy the same queue id slot in blkcg->blkg_tree.
+	 */
+	wait_var_event(&q->root_blkg, !READ_ONCE(q->root_blkg));
+
 	new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);
 	if (!new_blkg)
 		return -ENOMEM;

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gao Xiang <[email protected]>

[ Upstream commit 307210c262a29f41d7177851295ea1703bd04175 ]

For file-backed mounts, metadata is fetched via the page cache of backing inodes to avoid double caching and redundant copy ops out of RO uptodate folios, which is used by Android APEXes, ComposeFS, containerd. However, rw_verify_area() was missing prior to metadata accesses.

Similar to vfs_iocb_iter_read(), fix this by:
- Enabling fanotify pre-content hooks on metadata accesses;
- security_file_permission() for security modules.

Verified that fanotify pre-content hooks now works correctly.

---
 fs/erofs/data.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

index 8ca29962a3dde..58aea2b48580c 100644
@@ -29,6 +29,20 @@ void *erofs_bread(struct erofs_buf *buf, erofs_off_t offset, bool need_kmap)
 {
 	pgoff_t index = (buf->off + offset) >> PAGE_SHIFT;
 	struct folio *folio = NULL;
+	loff_t fpos;
+	int err;
+
+	/*
+	 * Metadata access for file-backed mounts reuses page cache of backing
+	 * fs inodes (only folio data will be needed) to prevent double caching.
+	 * However, the data access range must be verified here in advance.
+	 */
+	if (buf->file) {
+		fpos = index << PAGE_SHIFT;
+		err = rw_verify_area(READ, buf->file, &fpos, PAGE_SIZE);
+		if (err < 0)
+			return ERR_PTR(err);
+	}
 
 	if (buf->page) {
 		folio = page_folio(buf->page);

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhan Xusheng <[email protected]>

[ Upstream commit d6250d49da4d8f11afc0d8991c84e0307949f92e ]

erofs_ioctl_get_volume_label() passes strlen(sbi->volume_name) as the length to copy_to_user(), which copies the label string without the trailing NUL byte. Since FS_IOC_GETFSLABEL callers expect a NUL-terminated string in the FSLABEL_MAX-sized buffer and may not pre-zero the buffer, this can cause userspace to read past the label into uninitialised stack memory.

Fix this by using strlen() + 1 to include the NUL terminator, consistent with how ext4 and xfs implement FS_IOC_GETFSLABEL.

---
 fs/erofs/inode.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index cb780c095d282..218ab22589228 100644
@@ -348,7 +348,7 @@ static int erofs_ioctl_get_volume_label(struct inode *inode, void __user *arg)
 		ret = clear_user(arg, 1);
 	else
 		ret = copy_to_user(arg, sbi->volume_name,
-				   strlen(sbi->volume_name));
+				   strlen(sbi->volume_name) + 1);
 	return ret ? -EFAULT : 0;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email protected]>

[ Upstream commit 2aa72276fab9851dbd59c2daeb4b590c5a113908 ]

When "clear" is written to array_state, md_attr_store() breaks sysfs active protection so the array can delete itself from its own sysfs store method.

However, md_attr_store() currently drops the mddev reference before calling sysfs_unbreak_active_protection(). Once do_md_stop(..., 0) has made the mddev eligible for delayed deletion, the temporary kobject reference taken by sysfs_break_active_protection() can become the last kobject reference protecting the md kobject.

That allows sysfs_unbreak_active_protection() to drop the last kobject reference from the current sysfs writer context. kobject teardown then recurses into kernfs removal while the current sysfs node is still being unwound, and lockdep reports recursive locking on kn->active with kernfs_drain() in the call chain.

Reproducer on an existing level:
1. Create an md0 linear array and activate it:
mknod /dev/md0 b 9 0
echo none > /sys/block/md0/md/metadata_version
echo linear > /sys/block/md0/md/level
echo 1 > /sys/block/md0/md/raid_disks
echo "$(cat /sys/class/block/sdb/dev)" > /sys/block/md0/md/new_dev

   echo "$(($(cat /sys/class/block/sdb/size) / 2))" > \
	/sys/block/md0/md/dev-sdb/size

echo 0 > /sys/block/md0/md/dev-sdb/slot echo active > /sys/block/md0/md/array_state
2. Wait briefly for the array to settle, then clear it:
sleep 2
echo clear > /sys/block/md0/md/array_state

The warning looks like:

WARNING: possible recursive locking detected bash/588 is trying to acquire lock:
(kn->active#65) at __kernfs_remove+0x157/0x1d0
but task is already holding lock:
(kn->active#65) at sysfs_unbreak_active_protection+0x1f/0x40
...

  Call Trace:
   kernfs_drain
   __kernfs_remove
   kernfs_remove_by_name_ns
   sysfs_remove_group
   sysfs_remove_groups
   __kobject_del
   kobject_put
   md_attr_store
   kernfs_fop_write_iter
   vfs_write
   ksys_write

Restore active protection before mddev_put() so the extra sysfs kobject reference is dropped while the mddev is still held alive. The actual md kobject deletion is then deferred until after the sysfs write path has fully returned.

---
 drivers/md/md.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

index 92ec4be20db85..7560e98dc35b3 100644
@@ -6032,10 +6032,16 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
 	}
 	spin_unlock(&all_mddevs_lock);
 	rv = entry->store(mddev, page, length);
-	mddev_put(mddev);
 
+	/*
+	 * For "array_state=clear", dropping the extra kobject reference from
+	 * sysfs_break_active_protection() can trigger md kobject deletion.
+	 * Restore active protection before mddev_put() so deletion happens
+	 * after the sysfs write path fully unwinds.
+	 */
 	if (kn)
 		sysfs_unbreak_active_protection(kn);
+	mddev_put(mddev);
 
 	return rv;
 }

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Zhan Xusheng <[email protected]>

[ Upstream commit 63c2f06198ca7513433f1c92f2c654869d72417e ]

erofs_init_device() only reads blocks_lo and uniaddr_lo from the on-disk device slot, ignoring blocks_hi and uniaddr_hi that were introduced alongside the 48-bit block addressing feature.

For the primary device (dif0), erofs_read_superblock() already handles this correctly by combining blocks_lo with blocks_hi when 48-bit layout is enabled. But the same logic was not applied to extra devices.

With a 48-bit EROFS image using extra devices whose uniaddr or blocks exceed 32-bit range, the truncated values cause erofs_map_dev() to compute wrong physical addresses, leading to silent data corruption.

Fix this by reading blocks_hi and uniaddr_hi in erofs_init_device() when 48-bit layout is enabled, consistent with the primary device handling. Also fix the erofs_deviceslot on-disk definition where blocks_hi was incorrectly declared as __le32 instead of __le16.

---
 fs/erofs/erofs_fs.h | 4 ++--
 fs/erofs/super.c    | 8 ++++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

index 3d5738f80072e..63efadf75b1c0 100644
@@ -44,9 +44,9 @@ struct erofs_deviceslot {
 	u8 tag[64];		/* digest(sha256), etc. */
 	__le32 blocks_lo;	/* total blocks count of this device */
 	__le32 uniaddr_lo;	/* unified starting block of this device */
-	__le32 blocks_hi;	/* total blocks count MSB */
+	__le16 blocks_hi;	/* total blocks count MSB */
 	__le16 uniaddr_hi;	/* unified starting block MSB */
-	u8 reserved[50];
+	u8 reserved[52];
 };
 #define EROFS_DEVT_SLOT_SIZE	sizeof(struct erofs_deviceslot)
 

index ee37628ec99fb..f5f5d19459ecc 100644
@@ -140,6 +140,7 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
 	struct erofs_fscache *fscache;
 	struct erofs_deviceslot *dis;
 	struct file *file;
+	bool _48bit;
 
 	dis = erofs_read_metabuf(buf, sb, *pos, false);
 	if (IS_ERR(dis))

@@ -186,8 +187,11 @@ static int erofs_init_device(struct erofs_buf *buf, struct super_block *sb,
 		dif->file = file;
 	}
 
-	dif->blocks = le32_to_cpu(dis->blocks_lo);
-	dif->uniaddr = le32_to_cpu(dis->uniaddr_lo);
+	_48bit = erofs_sb_has_48bit(sbi);
+	dif->blocks = le32_to_cpu(dis->blocks_lo) |
+		(_48bit ? (u64)le16_to_cpu(dis->blocks_hi) << 32 : 0);
+	dif->uniaddr = le32_to_cpu(dis->uniaddr_lo) |
+		(_48bit ? (u64)le16_to_cpu(dis->uniaddr_hi) << 32 : 0);
 	sbi->total_blocks += dif->blocks;
 	*pos += EROFS_DEVT_SLOT_SIZE;
 	return 0;

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Marco Crivellari <[email protected]>

[ Upstream commit d4880868670198df321627a949e7b7f2d76cf54e ]

This continues the effort to refactor workqueue APIs, which began with the introduction of new workqueues and a new alloc_workqueue flag in:

commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag")

The refactoring is going to alter the default behavior of alloc_workqueue() to be unbound by default.

With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND), any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND must now use WQ_PERCPU. For more details see the Link tag below.

In order to keep alloc_workqueue() behavior identical, explicitly request WQ_PERCPU.

Stable-dep-of: e4979f4fac4d ("md: remove unused static md_wq workqueue")

---
 drivers/md/dm-bufio.c              |  3 ++-
 drivers/md/dm-cache-target.c       |  3 ++-
 drivers/md/dm-clone-target.c       |  3 ++-
 drivers/md/dm-crypt.c              |  6 ++++--
 drivers/md/dm-delay.c              |  4 +++-
 drivers/md/dm-integrity.c          | 15 ++++++++++-----
 drivers/md/dm-kcopyd.c             |  3 ++-
 drivers/md/dm-log-userspace-base.c |  3 ++-
 drivers/md/dm-mpath.c              |  5 +++--
 drivers/md/dm-raid1.c              |  5 +++--
 drivers/md/dm-snap-persistent.c    |  3 ++-
 drivers/md/dm-stripe.c             |  2 +-
 drivers/md/dm-verity-target.c      |  4 +++-
 drivers/md/dm-writecache.c         |  3 ++-
 drivers/md/dm.c                    |  3 ++-
 drivers/md/md.c                    |  4 ++--
 16 files changed, 45 insertions(+), 24 deletions(-)

index 5235f3e4924b7..f41f649c01d4e 100644
@@ -2833,7 +2833,8 @@ static int __init dm_bufio_init(void)
 	__cache_size_refresh();
 	mutex_unlock(&dm_bufio_clients_lock);
 
-	dm_bufio_wq = alloc_workqueue("dm_bufio_cache", WQ_MEM_RECLAIM, 0);
+	dm_bufio_wq = alloc_workqueue("dm_bufio_cache",
+				      WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!dm_bufio_wq)
 		return -ENOMEM;
 

index a10d75a562db0..7bad7cc87d370 100644
@@ -2533,7 +2533,8 @@ static int cache_create(struct cache_args *ca, struct cache **result)
 		goto bad;
 	}
 
-	cache->wq = alloc_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM, 0);
+	cache->wq = alloc_workqueue("dm-" DM_MSG_PREFIX,
+				    WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!cache->wq) {
 		*error = "could not create workqueue for metadata object";
 		goto bad;

index e956d980672c8..b25845e362744 100644
@@ -1877,7 +1877,8 @@ static int clone_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	clone->hydration_offset = 0;
 	atomic_set(&clone->hydrations_in_flight, 0);
 
-	clone->wq = alloc_workqueue("dm-" DM_MSG_PREFIX, WQ_MEM_RECLAIM, 0);
+	clone->wq = alloc_workqueue("dm-" DM_MSG_PREFIX,
+				    WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!clone->wq) {
 		ti->error = "Failed to allocate workqueue";
 		r = -ENOMEM;

index 5ef43231fe77f..fd735155336bc 100644
@@ -3441,7 +3441,9 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	if (test_bit(DM_CRYPT_HIGH_PRIORITY, &cc->flags))
 		common_wq_flags |= WQ_HIGHPRI;
 
-	cc->io_queue = alloc_workqueue("kcryptd_io-%s-%d", common_wq_flags, 1, devname, wq_id);
+	cc->io_queue = alloc_workqueue("kcryptd_io-%s-%d",
+				       common_wq_flags | WQ_PERCPU, 1,
+				       devname, wq_id);
 	if (!cc->io_queue) {
 		ti->error = "Couldn't create kcryptd io queue";
 		goto bad;

@@ -3449,7 +3451,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
 	if (test_bit(DM_CRYPT_SAME_CPU, &cc->flags)) {
 		cc->crypt_queue = alloc_workqueue("kcryptd-%s-%d",
-						  common_wq_flags | WQ_CPU_INTENSIVE,
+						  common_wq_flags | WQ_CPU_INTENSIVE | WQ_PERCPU,
 						  1, devname, wq_id);
 	} else {
 		/*

index 4bb6553278c74..029f04776490a 100644
@@ -290,7 +290,9 @@ static int delay_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	} else {
 		timer_setup(&dc->delay_timer, handle_delayed_timer, 0);
 		INIT_WORK(&dc->flush_expired_bios, flush_expired_bios);
-		dc->kdelayd_wq = alloc_workqueue("kdelayd", WQ_MEM_RECLAIM, 0);
+		dc->kdelayd_wq = alloc_workqueue("kdelayd",
+						 WQ_MEM_RECLAIM | WQ_PERCPU,
+						 0);
 		if (!dc->kdelayd_wq) {
 			ret = -EINVAL;
 			DMERR("Couldn't start kdelayd");

index ba52631052503..a9c0157bf42fe 100644
@@ -5003,7 +5003,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 	}
 
 	ic->metadata_wq = alloc_workqueue("dm-integrity-metadata",
-					  WQ_MEM_RECLAIM, METADATA_WORKQUEUE_MAX_ACTIVE);
+					  WQ_MEM_RECLAIM | WQ_PERCPU,
+					  METADATA_WORKQUEUE_MAX_ACTIVE);
 	if (!ic->metadata_wq) {
 		ti->error = "Cannot allocate workqueue";
 		r = -ENOMEM;

@@ -5021,7 +5022,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 		goto bad;
 	}
 
-	ic->offload_wq = alloc_workqueue("dm-integrity-offload", WQ_MEM_RECLAIM,
+	ic->offload_wq = alloc_workqueue("dm-integrity-offload",
+					  WQ_MEM_RECLAIM | WQ_PERCPU,
 					  METADATA_WORKQUEUE_MAX_ACTIVE);
 	if (!ic->offload_wq) {
 		ti->error = "Cannot allocate workqueue";

@@ -5029,7 +5031,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 		goto bad;
 	}
 
-	ic->commit_wq = alloc_workqueue("dm-integrity-commit", WQ_MEM_RECLAIM, 1);
+	ic->commit_wq = alloc_workqueue("dm-integrity-commit",
+					WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 	if (!ic->commit_wq) {
 		ti->error = "Cannot allocate workqueue";
 		r = -ENOMEM;

@@ -5038,7 +5041,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 	INIT_WORK(&ic->commit_work, integrity_commit);
 
 	if (ic->mode == 'J' || ic->mode == 'B') {
-		ic->writer_wq = alloc_workqueue("dm-integrity-writer", WQ_MEM_RECLAIM, 1);
+		ic->writer_wq = alloc_workqueue("dm-integrity-writer",
+						WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 		if (!ic->writer_wq) {
 			ti->error = "Cannot allocate workqueue";
 			r = -ENOMEM;

@@ -5210,7 +5214,8 @@ static int dm_integrity_ctr(struct dm_target *ti, unsigned int argc, char **argv
 	}
 
 	if (ic->internal_hash) {
-		ic->recalc_wq = alloc_workqueue("dm-integrity-recalc", WQ_MEM_RECLAIM, 1);
+		ic->recalc_wq = alloc_workqueue("dm-integrity-recalc",
+						WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 		if (!ic->recalc_wq) {
 			ti->error = "Cannot allocate workqueue";
 			r = -ENOMEM;

index 6ea75436a433a..cec9a60227b6f 100644
@@ -934,7 +934,8 @@ struct dm_kcopyd_client *dm_kcopyd_client_create(struct dm_kcopyd_throttle *thro
 		goto bad_slab;
 
 	INIT_WORK(&kc->kcopyd_work, do_work);
-	kc->kcopyd_wq = alloc_workqueue("kcopyd", WQ_MEM_RECLAIM, 0);
+	kc->kcopyd_wq = alloc_workqueue("kcopyd", WQ_MEM_RECLAIM | WQ_PERCPU,
+					0);
 	if (!kc->kcopyd_wq) {
 		r = -ENOMEM;
 		goto bad_workqueue;

index 9fbb4b48fb2bb..607436804a8b2 100644
@@ -299,7 +299,8 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
 	}
 
 	if (lc->integrated_flush) {
-		lc->dmlog_wq = alloc_workqueue("dmlogd", WQ_MEM_RECLAIM, 0);
+		lc->dmlog_wq = alloc_workqueue("dmlogd",
+					       WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 		if (!lc->dmlog_wq) {
 			DMERR("couldn't start dmlogd");
 			r = -ENOMEM;

index 7d3fdd96f4edf..00df5be165759 100644
@@ -2330,7 +2330,8 @@ static int __init dm_multipath_init(void)
 {
 	int r = -ENOMEM;
 
-	kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM, 0);
+	kmultipathd = alloc_workqueue("kmpathd", WQ_MEM_RECLAIM | WQ_PERCPU,
+				      0);
 	if (!kmultipathd) {
 		DMERR("failed to create workqueue kmpathd");
 		goto bad_alloc_kmultipathd;

@@ -2349,7 +2350,7 @@ static int __init dm_multipath_init(void)
 		goto bad_alloc_kmpath_handlerd;
 	}
 
-	dm_mpath_wq = alloc_workqueue("dm_mpath_wq", 0, 0);
+	dm_mpath_wq = alloc_workqueue("dm_mpath_wq", WQ_PERCPU, 0);
 	if (!dm_mpath_wq) {
 		DMERR("failed to create workqueue dm_mpath_wq");
 		goto bad_alloc_dm_mpath_wq;

index bc8e04f6832a6..d9ec783a37ddc 100644
@@ -1128,7 +1128,8 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	ti->num_discard_bios = 1;
 	ti->per_io_data_size = sizeof(struct dm_raid1_bio_record);
 
-	ms->kmirrord_wq = alloc_workqueue("kmirrord", WQ_MEM_RECLAIM, 0);
+	ms->kmirrord_wq = alloc_workqueue("kmirrord",
+					  WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!ms->kmirrord_wq) {
 		DMERR("couldn't start kmirrord");
 		r = -ENOMEM;

@@ -1500,7 +1501,7 @@ static int __init dm_mirror_init(void)
 {
 	int r;
 
-	dm_raid1_wq = alloc_workqueue("dm_raid1_wq", 0, 0);
+	dm_raid1_wq = alloc_workqueue("dm_raid1_wq", WQ_PERCPU, 0);
 	if (!dm_raid1_wq) {
 		DMERR("Failed to alloc workqueue");
 		return -ENOMEM;

index 568d10842b1f4..0e13d60bfdd12 100644
@@ -871,7 +871,8 @@ static int persistent_ctr(struct dm_exception_store *store, char *options)
 	atomic_set(&ps->pending_count, 0);
 	ps->callbacks = NULL;
 
-	ps->metadata_wq = alloc_workqueue("ksnaphd", WQ_MEM_RECLAIM, 0);
+	ps->metadata_wq = alloc_workqueue("ksnaphd",
+					  WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!ps->metadata_wq) {
 		DMERR("couldn't start header metadata update thread");
 		r = -ENOMEM;

index 1461dc740dae6..1cff9df5b8b47 100644
@@ -489,7 +489,7 @@ int __init dm_stripe_init(void)
 {
 	int r;
 
-	dm_stripe_wq = alloc_workqueue("dm_stripe_wq", 0, 0);
+	dm_stripe_wq = alloc_workqueue("dm_stripe_wq", WQ_PERCPU, 0);
 	if (!dm_stripe_wq)
 		return -ENOMEM;
 	r = dm_register_target(&stripe_target);

index c8695c079cfe0..a5cd55b2ba02f 100644
@@ -1549,7 +1549,9 @@ static int verity_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 	 * will fall-back to using it for error handling (or if the bufio cache
 	 * doesn't have required hashes).
 	 */
-	v->verify_wq = alloc_workqueue("kverityd", WQ_MEM_RECLAIM | WQ_HIGHPRI, 0);
+	v->verify_wq = alloc_workqueue("kverityd",
+				       WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_PERCPU,
+				       0);
 	if (!v->verify_wq) {
 		ti->error = "Cannot allocate workqueue";
 		r = -ENOMEM;

index d8de4a3076a17..af54e289bcebe 100644
@@ -2275,7 +2275,8 @@ static int writecache_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 		goto bad;
 	}
 
-	wc->writeback_wq = alloc_workqueue("writecache-writeback", WQ_MEM_RECLAIM, 1);
+	wc->writeback_wq = alloc_workqueue("writecache-writeback",
+					   WQ_MEM_RECLAIM | WQ_PERCPU, 1);
 	if (!wc->writeback_wq) {
 		r = -ENOMEM;
 		ti->error = "Could not allocate writeback workqueue";

index 52f01c44e73a6..fb6bcd598c5b8 100644
@@ -2363,7 +2363,8 @@ static struct mapped_device *alloc_dev(int minor)
 
 	format_dev_t(md->name, MKDEV(_major, minor));
 
-	md->wq = alloc_workqueue("kdmflush/%s", WQ_MEM_RECLAIM, 0, md->name);
+	md->wq = alloc_workqueue("kdmflush/%s", WQ_MEM_RECLAIM | WQ_PERCPU, 0,
+				 md->name);
 	if (!md->wq)
 		goto bad;
 

index 7560e98dc35b3..0fc779493fa78 100644
@@ -10345,11 +10345,11 @@ static int __init md_init(void)
 		goto err_bitmap;
 
 	ret = -ENOMEM;
-	md_wq = alloc_workqueue("md", WQ_MEM_RECLAIM, 0);
+	md_wq = alloc_workqueue("md", WQ_MEM_RECLAIM | WQ_PERCPU, 0);
 	if (!md_wq)
 		goto err_wq;
 
-	md_misc_wq = alloc_workqueue("md_misc", 0, 0);
+	md_misc_wq = alloc_workqueue("md_misc", WQ_PERCPU, 0);
 	if (!md_misc_wq)
 		goto err_misc_wq;
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Abd-Alrhman Masalkhi <[email protected]>

[ Upstream commit e4979f4fac4d6bbe757be50441b45e28e6bf7360 ]

The md_wq workqueue is defined as static and initialized in md_init(), but it is not used anywhere within md.c.

All asynchronous and deferred work in this file is handled via md_misc_wq or dedicated md threads.

---
 drivers/md/md.c | 8 --------
 1 file changed, 8 deletions(-)

index 0fc779493fa78..0a3152f21d488 100644
@@ -84,7 +84,6 @@ static DEFINE_XARRAY(md_submodule);
 static const struct kobj_type md_ktype;
 
 static DECLARE_WAIT_QUEUE_HEAD(resync_wait);
-static struct workqueue_struct *md_wq;
 
 /*
  * This workqueue is used for sync_work to register new sync_thread, and for

@@ -10345,10 +10344,6 @@ static int __init md_init(void)
 		goto err_bitmap;
 
 	ret = -ENOMEM;
-	md_wq = alloc_workqueue("md", WQ_MEM_RECLAIM | WQ_PERCPU, 0);
-	if (!md_wq)
-		goto err_wq;
-
 	md_misc_wq = alloc_workqueue("md_misc", WQ_PERCPU, 0);
 	if (!md_misc_wq)
 		goto err_misc_wq;

@@ -10373,8 +10368,6 @@ static int __init md_init(void)
 err_md:
 	destroy_workqueue(md_misc_wq);
 err_misc_wq:
-	destroy_workqueue(md_wq);
-err_wq:
 	md_llbitmap_exit();
 err_bitmap:
 	md_bitmap_exit();

@@ -10683,7 +10676,6 @@ static __exit void md_exit(void)
 	spin_unlock(&all_mddevs_lock);
 
 	destroy_workqueue(md_misc_wq);
-	destroy_workqueue(md_wq);
 	md_bitmap_exit();
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Yu Kuai <[email protected]>

[ Upstream commit cf86bb53b9c92354904a328e947a05ffbfdd1840 ]

During raid456 reshape, direct IO across the reshape position can sleep in raid5_make_request() waiting for reshape progress while still holding an active_io reference. If userspace then freezes reshape and writes md/suspend_lo or md/suspend_hi, mddev_suspend() kills active_io and waits for all in-flight IO to drain.

This can deadlock: the IO needs reshape progress to continue, but the reshape thread is already frozen, so the active_io reference is never dropped and suspend never completes.

raid5_prepare_suspend() already wakes wait_for_reshape for dm-raid. Do the same for normal md suspend when reshape is already interrupted, so waiting raid456 IO can abort, drop its reference, and let suspend finish.

The mdadm test tests/25raid456-reshape-deadlock reproduces the hang.

---
 drivers/md/md.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

index 0a3152f21d488..b91ac1b7d7a15 100644
@@ -486,6 +486,17 @@ int mddev_suspend(struct mddev *mddev, bool interruptible)
 	}
 
 	percpu_ref_kill(&mddev->active_io);
+
+	/*
+	 * RAID456 IO can sleep in wait_for_reshape while still holding an
+	 * active_io reference. If reshape is already interrupted or frozen,
+	 * wake those waiters so they can abort and drop the reference instead
+	 * of deadlocking suspend.
+	 */
+	if (mddev->pers && mddev->pers->prepare_suspend &&
+	    reshape_interrupted(mddev))
+		mddev->pers->prepare_suspend(mddev);
+
 	if (interruptible)
 		err = wait_event_interruptible(mddev->sb_wait,
 				percpu_ref_is_zero(&mddev->active_io));

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Filipe Manana <[email protected]>

[ Upstream commit b48c980b6a7e409050bb3067165db31cc6205e3e ]

When using the flushoncommit mount option, we can have a deadlock between a transaction commit and a reflink operation that copied an inline extent to an offset beyond the current i_size of the destination node.

The deadlock happens like this:

1) Task A clones an inline extent from inode X to an offset of inode Y that is beyond Y's current i_size. This means we copied the inline extent's data to a folio of inode Y that is beyond its EOF, using a call to copy_inline_to_page();

2) Task B starts a transaction commit and calls btrfs_start_delalloc_flush() to flush delalloc;

3) The delalloc flushing sees the new dirty folio of inode Y and when it attempts to flush it, it ends up at extent_writepage() and sees that the offset of the folio is beyond the i_size of inode Y, so it attempts to invalidate the folio by calling folio_invalidate(), which ends up at btrfs' folio invalidate callback - btrfs_invalidate_folio(). There it tries to lock the folio's range in inode Y's extent io tree, but it blocks since it's currently locked by task A - during a reflink we lock the inodes and the source and destination ranges after flushing all delalloc and waiting for ordered extent completion - after that we don't expect to have dirty folios in the ranges, the exception is if we have to copy an inline extent's data (because the destination offset is not zero);

4) Task A then attempts to start a transaction to update the inode item, and then it's blocked since the current transaction is in the TRANS_STATE_COMMIT_START state. Therefore task A has to wait for the current transaction to become unblocked (its state >= TRANS_STATE_UNBLOCKED).

So task A is waiting for the transaction commit done by task B, and the later waiting on the extent lock of inode Y that is currently held by task A.

Syzbot recently reported this with the following stack traces:

  INFO: task kworker/u8:7:1053 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:kworker/u8:7    state:D stack:23520 pid:1053  tgid:1053  ppid:2      task_flags:0x4208060 flags:0x00080000
  Workqueue: writeback wb_workfn (flush-btrfs-46)
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wait_extent_bit fs/btrfs/extent-io-tree.c:811 [inline]
   btrfs_lock_extent_bits+0x59c/0x700 fs/btrfs/extent-io-tree.c:1914
   btrfs_lock_extent fs/btrfs/extent-io-tree.h:152 [inline]
   btrfs_invalidate_folio+0x43d/0xc40 fs/btrfs/inode.c:7704
   extent_writepage fs/btrfs/extent_io.c:1852 [inline]
   extent_write_cache_pages fs/btrfs/extent_io.c:2580 [inline]
   btrfs_writepages+0x12ff/0x2440 fs/btrfs/extent_io.c:2713
   do_writepages+0x32e/0x550 mm/page-writeback.c:2554
   __writeback_single_inode+0x133/0x11a0 fs/fs-writeback.c:1750
   writeback_sb_inodes+0x995/0x19d0 fs/fs-writeback.c:2042
   wb_writeback+0x456/0xb70 fs/fs-writeback.c:2227
   wb_do_writeback fs/fs-writeback.c:2374 [inline]
   wb_workfn+0x41a/0xf60 fs/fs-writeback.c:2414
   process_one_work kernel/workqueue.c:3276 [inline]
   process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
   worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
   kthread+0x388/0x470 kernel/kthread.c:436
   ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
   </TASK>
  INFO: task syz.4.64:6910 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:syz.4.64        state:D stack:22752 pid:6910  tgid:6905  ppid:5944   task_flags:0x400140 flags:0x00080002
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wait_current_trans+0x39f/0x590 fs/btrfs/transaction.c:535
   start_transaction+0x6a7/0x1650 fs/btrfs/transaction.c:705
   clone_copy_inline_extent fs/btrfs/reflink.c:299 [inline]
   btrfs_clone+0x128a/0x24d0 fs/btrfs/reflink.c:529
   btrfs_clone_files+0x271/0x3f0 fs/btrfs/reflink.c:750
   btrfs_remap_file_range+0x76b/0x1320 fs/btrfs/reflink.c:903
   vfs_copy_file_range+0xda7/0x1390 fs/read_write.c:1600
   __do_sys_copy_file_range fs/read_write.c:1683 [inline]
   __se_sys_copy_file_range+0x2fb/0x480 fs/read_write.c:1650
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  RIP: 0033:0x7f5f73afc799
  RSP: 002b:00007f5f7315e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000146
  RAX: ffffffffffffffda RBX: 00007f5f73d75fa0 RCX: 00007f5f73afc799
  RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000005
  RBP: 00007f5f73b92c99 R08: 0000000000000863 R09: 0000000000000000
  R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000000
  R13: 00007f5f73d76038 R14: 00007f5f73d75fa0 R15: 00007fff138a5068
   </TASK>
  INFO: task syz.4.64:6975 blocked for more than 143 seconds.
        Not tainted syzkaller #0
  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
  task:syz.4.64        state:D stack:24736 pid:6975  tgid:6905  ppid:5944   task_flags:0x400040 flags:0x00080002
  Call Trace:
   <TASK>
   context_switch kernel/sched/core.c:5298 [inline]
   __schedule+0x1553/0x5240 kernel/sched/core.c:6911
   __schedule_loop kernel/sched/core.c:6993 [inline]
   schedule+0x164/0x360 kernel/sched/core.c:7008
   wb_wait_for_completion+0x3e8/0x790 fs/fs-writeback.c:227
   __writeback_inodes_sb_nr+0x24c/0x2d0 fs/fs-writeback.c:2838
   try_to_writeback_inodes_sb+0x9a/0xc0 fs/fs-writeback.c:2886
   btrfs_start_delalloc_flush fs/btrfs/transaction.c:2175 [inline]
   btrfs_commit_transaction+0x82e/0x31a0 fs/btrfs/transaction.c:2364
   btrfs_ioctl+0xca7/0xd00 fs/btrfs/ioctl.c:5206
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:597 [inline]
   __se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
  RIP: 0033:0x7f5f73afc799
  RSP: 002b:00007f5f7313d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
  RAX: ffffffffffffffda RBX: 00007f5f73d76090 RCX: 00007f5f73afc799
  RDX: 0000000000000000 RSI: 0000000000009408 RDI: 0000000000000004
  RBP: 00007f5f73b92c99 R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
  R13: 00007f5f73d76128 R14: 00007f5f73d76090 R15: 00007fff138a5068
   </TASK>

Fix this by updating the i_size of the destination inode of a reflink operation after we copy an inline extent's data to an offset beyond the i_size and before attempting to start a transaction to update the inode's item.

---
 fs/btrfs/reflink.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

index 5465a5eae9b2d..614e884c2a9bc 100644
@@ -321,6 +321,51 @@ static int clone_copy_inline_extent(struct btrfs_inode *inode,
 
 	ret = copy_inline_to_page(inode, new_key->offset,
 				  inline_data, size, datal, comp_type);
+
+	/*
+	 * If we copied the inline extent data to a page/folio beyond the i_size
+	 * of the destination inode, then we need to increase the i_size before
+	 * we start a transaction to update the inode item. This is to prevent a
+	 * deadlock when the flushoncommit mount option is used, which happens
+	 * like this:
+	 *
+	 * 1) Task A clones an inline extent from inode X to an offset of inode
+	 *    Y that is beyond Y's current i_size. This means we copied the
+	 *    inline extent's data to a folio of inode Y that is beyond its EOF,
+	 *    using the call above to copy_inline_to_page();
+	 *
+	 * 2) Task B starts a transaction commit and calls
+	 *    btrfs_start_delalloc_flush() to flush delalloc;
+	 *
+	 * 3) The delalloc flushing sees the new dirty folio of inode Y and when
+	 *    it attempts to flush it, it ends up at extent_writepage() and sees
+	 *    that the offset of the folio is beyond the i_size of inode Y, so
+	 *    it attempts to invalidate the folio by calling folio_invalidate(),
+	 *    which ends up at btrfs' folio invalidate callback -
+	 *    btrfs_invalidate_folio(). There it tries to lock the folio's range
+	 *    in inode Y's extent io tree, but it blocks since it's currently
+	 *    locked by task A - during reflink we lock the inodes and the
+	 *    source and destination ranges after flushing all delalloc and
+	 *    waiting for ordered extent completion - after that we don't expect
+	 *    to have dirty folios in the ranges, the exception is if we have to
+	 *    copy an inline extent's data (because the destination offset is
+	 *    not zero);
+	 *
+	 * 4) Task A then does the 'goto out' below and attempts to start a
+	 *    transaction to update the inode item, and then it's blocked since
+	 *    the current transaction is in the TRANS_STATE_COMMIT_START state.
+	 *    Therefore task A has to wait for the current transaction to become
+	 *    unblocked (its state >= TRANS_STATE_UNBLOCKED).
+	 *
+	 * This leads to a deadlock - the task committing the transaction
+	 * waiting for the delalloc flushing which is blocked during folio
+	 * invalidation on the inode's extent lock and the reflink task waiting
+	 * for the current transaction to be unblocked so that it can start a
+	 * a new one to update the inode item (while holding the extent lock).
+	 */
+	if (ret == 0 && new_key->offset + datal > i_size_read(&inode->vfs_inode))
+		i_size_write(&inode->vfs_inode, new_key->offset + datal);
+
 	goto out;
 }
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Manivannan Sadhasivam <[email protected]>

[ Upstream commit e560083c0467f86b72aecac377b27bd1e7d16c49 ]

Some OPP tables have entries with same rate and different performance level. For these entries, using only the rate as the debugfs directory name causes below error:

debugfs: 'opp:5000000' already exists in '[email protected]'

Fix it by appending the performance level to the dir name if available.

---
 drivers/opp/debugfs.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

index 8fc6238b17284..61506d30d5ff0 100644
@@ -130,22 +130,24 @@ void opp_debug_create_one(struct dev_pm_opp *opp, struct opp_table *opp_table)
 {
 	struct dentry *pdentry = opp_table->dentry;
 	struct dentry *d;
-	unsigned long id;
-	char name[25];	/* 20 chars for 64 bit value + 5 (opp:\0) */
+	char name[36];	/* "opp:"(4) + u64(20) + "-" (1) + u32(10) + NULL(1) */
 
 	/*
 	 * Get directory name for OPP.
 	 *
-	 * - Normally rate is unique to each OPP, use it to get unique opp-name.
+	 * - Normally rate is unique to each OPP, use it to get unique opp-name,
+	 *   together with performance level if available.
 	 * - For some devices rate isn't available or there are multiple, use
 	 *   index instead for them.
 	 */
-	if (likely(opp_table->clk_count == 1 && opp->rates[0]))
-		id = opp->rates[0];
-	else
-		id = _get_opp_count(opp_table);
-
-	snprintf(name, sizeof(name), "opp:%lu", id);
+	if (likely(opp_table->clk_count == 1 && opp->rates[0])) {
+		if (opp->level == OPP_LEVEL_UNSET)
+			snprintf(name, sizeof(name), "opp:%lu", opp->rates[0]);
+		else
+			snprintf(name, sizeof(name), "opp:%lu-%u", opp->rates[0], opp->level);
+	} else {
+		snprintf(name, sizeof(name), "opp:%u", _get_opp_count(opp_table));
+	}
 
 	/* Create per-opp directory */
 	d = debugfs_create_dir(name, pdentry);

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Viresh Kumar <[email protected]>

[ Upstream commit 3d2398f44a2d48fb1c575a6e0bc6b38f3e689e22 ]

The commit ff9c512041f2 ("OPP: Use mutex locking guards") unintentionally made the for loop run longer than required.

scoped_guard() is implemented as a for loop. The break statement now breaks out out the scoped_guard() and not out of the outer for loop. The outer loop always iterates to completion.

Fix it.

---
 drivers/opp/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 775d4a36f2f54..157c84b689feb 100644
@@ -2741,8 +2741,8 @@ struct dev_pm_opp *dev_pm_opp_xlate_required_opp(struct opp_table *src_table,
 					break;
 				}
 			}
-			break;
 		}
+		break;
 	}
 
 	if (IS_ERR(dest_opp)) {

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: HyungJung Joo <[email protected]>

[ Upstream commit 0621c385fda1376e967f37ccd534c26c3e511d14 ]

omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).

Later, omfs_make_empty() uses

    sbi->s_sys_blocksize - OMFS_DIR_START

as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer.

Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

---
 fs/omfs/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 135c49c5d848c..31218d89b7580 100644
@@ -512,6 +512,12 @@ static int omfs_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto out_brelse_bh;
 	}
 
+	if (sbi->s_sys_blocksize < OMFS_DIR_START) {
+		printk(KERN_ERR "omfs: sysblock size (%d) is too small\n",
+			sbi->s_sys_blocksize);
+		goto out_brelse_bh;
+	}
+
 	if (sbi->s_blocksize < sbi->s_sys_blocksize ||
 	    sbi->s_blocksize > OMFS_MAX_BLOCK_SIZE) {
 		printk(KERN_ERR "omfs: block size (%d) is out of range\n",

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

[ Upstream commit ba0b236736dde4059bdcb8e99beaa50d6e5b6e7e ]

Make multiple changes that do not alter functionality to the CMOS RTC ACPI address space handler driver, including the following:

- Drop the unused .detach() callback from cmos_rtc_handler.

- Rename acpi_cmos_rtc_attach_handler() to acpi_cmos_rtc_attach().

- Rearrange acpi_cmos_rtc_space_handler() to reduce the number of redundant checks and make white space follow the coding style.

- Adjust an error message in acpi_install_cmos_rtc_space_handler() and make the white space follow the coding style.

- Rearrange acpi_remove_cmos_rtc_space_handler() and adjust an error message in it.

No intentional functional impact.

Stable-dep-of: 6cee29ad9d7e ("ACPI: x86: cmos_rtc: Improve coordination with ACPI TAD driver")

---
 drivers/acpi/x86/cmos_rtc.c | 61 +++++++++++++++++++------------------
 1 file changed, 32 insertions(+), 29 deletions(-)

index 51643ff6fe5fc..977234da9fc11 100644
@@ -24,31 +24,35 @@ static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
 	{}
 };
 
-static acpi_status
-acpi_cmos_rtc_space_handler(u32 function, acpi_physical_address address,
-		      u32 bits, u64 *value64,
-		      void *handler_context, void *region_context)
+static acpi_status acpi_cmos_rtc_space_handler(u32 function,
+					       acpi_physical_address address,
+					       u32 bits, u64 *value64,
+					       void *handler_context,
+					       void *region_context)
 {
-	int i;
+	unsigned int i, bytes = DIV_ROUND_UP(bits, 8);
 	u8 *value = (u8 *)value64;
 
 	if (address > 0xff || !value64)
 		return AE_BAD_PARAMETER;
 
-	if (function != ACPI_WRITE && function != ACPI_READ)
-		return AE_BAD_PARAMETER;
+	guard(spinlock_irq)(&rtc_lock);
+
+	if (function == ACPI_WRITE) {
+		for (i = 0; i < bytes; i++, address++, value++)
+			CMOS_WRITE(*value, address);
 
-	spin_lock_irq(&rtc_lock);
+		return AE_OK;
+	}
 
-	for (i = 0; i < DIV_ROUND_UP(bits, 8); ++i, ++address, ++value)
-		if (function == ACPI_READ)
+	if (function == ACPI_READ) {
+		for (i = 0; i < bytes; i++, address++, value++)
 			*value = CMOS_READ(address);
-		else
-			CMOS_WRITE(*value, address);
 
-	spin_unlock_irq(&rtc_lock);
+		return AE_OK;
+	}
 
-	return AE_OK;
+	return AE_BAD_PARAMETER;
 }
 
 int acpi_install_cmos_rtc_space_handler(acpi_handle handle)

@@ -56,11 +60,11 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 	acpi_status status;
 
 	status = acpi_install_address_space_handler(handle,
-			ACPI_ADR_SPACE_CMOS,
-			&acpi_cmos_rtc_space_handler,
-			NULL, NULL);
+						    ACPI_ADR_SPACE_CMOS,
+						    acpi_cmos_rtc_space_handler,
+						    NULL, NULL);
 	if (ACPI_FAILURE(status)) {
-		pr_err("Error installing CMOS-RTC region handler\n");
+		pr_err("Failed to install CMOS-RTC address space handler\n");
 		return -ENODEV;
 	}
 

@@ -70,26 +74,25 @@ EXPORT_SYMBOL_GPL(acpi_install_cmos_rtc_space_handler);
 
 void acpi_remove_cmos_rtc_space_handler(acpi_handle handle)
 {
-	if (ACPI_FAILURE(acpi_remove_address_space_handler(handle,
-			ACPI_ADR_SPACE_CMOS, &acpi_cmos_rtc_space_handler)))
-		pr_err("Error removing CMOS-RTC region handler\n");
+	acpi_status status;
+
+	status = acpi_remove_address_space_handler(handle,
+						   ACPI_ADR_SPACE_CMOS,
+						   acpi_cmos_rtc_space_handler);
+	if (ACPI_FAILURE(status))
+		pr_err("Failed to remove CMOS-RTC address space handler\n");
 }
 EXPORT_SYMBOL_GPL(acpi_remove_cmos_rtc_space_handler);
 
-static int acpi_cmos_rtc_attach_handler(struct acpi_device *adev, const struct acpi_device_id *id)
+static int acpi_cmos_rtc_attach(struct acpi_device *adev,
+				const struct acpi_device_id *id)
 {
 	return acpi_install_cmos_rtc_space_handler(adev->handle);
 }
 
-static void acpi_cmos_rtc_detach_handler(struct acpi_device *adev)
-{
-	acpi_remove_cmos_rtc_space_handler(adev->handle);
-}
-
 static struct acpi_scan_handler cmos_rtc_handler = {
 	.ids = acpi_cmos_rtc_ids,
-	.attach = acpi_cmos_rtc_attach_handler,
-	.detach = acpi_cmos_rtc_detach_handler,
+	.attach = acpi_cmos_rtc_attach,
 };
 
 void __init acpi_cmos_rtc_init(void)

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Rafael J. Wysocki <[email protected]>

[ Upstream commit 6cee29ad9d7e400d39ae0b1a54447fedcb62eecd ]

If a CMOS RTC (PNP0B00/PNP0B01/PNP0B02) device coexists with an ACPI TAD (timer and event alarm device, ACPI000E), the ACPI TAD driver will attempt to install the CMOS RTC address space hanlder that has been installed already and the TAD probing will fail.

Avoid that by changing acpi_install_cmos_rtc_space_handler() to return zero and acpi_remove_cmos_rtc_space_handler() to do nothing if the CMOS RTC address space handler has been installed already.

---
 drivers/acpi/x86/cmos_rtc.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

index 977234da9fc11..45db7e51cbe60 100644
@@ -24,6 +24,8 @@ static const struct acpi_device_id acpi_cmos_rtc_ids[] = {
 	{}
 };
 
+static bool cmos_rtc_space_handler_present __read_mostly;
+
 static acpi_status acpi_cmos_rtc_space_handler(u32 function,
 					       acpi_physical_address address,
 					       u32 bits, u64 *value64,

@@ -59,6 +61,9 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 {
 	acpi_status status;
 
+	if (cmos_rtc_space_handler_present)
+		return 0;
+
 	status = acpi_install_address_space_handler(handle,
 						    ACPI_ADR_SPACE_CMOS,
 						    acpi_cmos_rtc_space_handler,

@@ -68,6 +73,8 @@ int acpi_install_cmos_rtc_space_handler(acpi_handle handle)
 		return -ENODEV;
 	}
 
+	cmos_rtc_space_handler_present = true;
+
 	return 1;
 }
 EXPORT_SYMBOL_GPL(acpi_install_cmos_rtc_space_handler);

@@ -76,6 +83,9 @@ void acpi_remove_cmos_rtc_space_handler(acpi_handle handle)
 {
 	acpi_status status;
 
+	if (cmos_rtc_space_handler_present)
+		return;
+
 	status = acpi_remove_address_space_handler(handle,
 						   ACPI_ADR_SPACE_CMOS,
 						   acpi_cmos_rtc_space_handler);

@@ -87,7 +97,13 @@ EXPORT_SYMBOL_GPL(acpi_remove_cmos_rtc_space_handler);
 static int acpi_cmos_rtc_attach(struct acpi_device *adev,
 				const struct acpi_device_id *id)
 {
-	return acpi_install_cmos_rtc_space_handler(adev->handle);
+	int ret;
+
+	ret = acpi_install_cmos_rtc_space_handler(adev->handle);
+	if (ret < 0)
+		return ret;
+
+	return 1;
 }
 
 static struct acpi_scan_handler cmos_rtc_handler = {

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit f813ec9e84b4d0ca81ec1da94ab07bfb4a29266c ]

Fix missing call to set_node_dbginfo() for new devres nodes created by devm_krealloc().

---
 drivers/base/devres.c | 2 ++
 1 file changed, 2 insertions(+)

index c948c88d39560..9893d656302d9 100644
@@ -940,6 +940,8 @@ void *devm_krealloc(struct device *dev, void *ptr, size_t new_size, gfp_t gfp)
 	if (!new_dr)
 		return NULL;
 
+	set_node_dbginfo(&new_dr->node, "devm_krealloc_release", new_size);
+
 	/*
 	 * The spinlock protects the linked list against concurrent
 	 * modifications but not the resource itself.

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gopi Krishna Menon <[email protected]>

[ Upstream commit da2c4f332a0504d9c284e7626a561d343c8d6f57 ]

of_property_read_u32 returns 0 on success. The current check returns -EINVAL if the property is read successfully.

Fix the check by removing ! from of_property_read_u32

---
 drivers/thermal/spear_thermal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 603dadcd3df58..5e3e9c1f32f8e 100644
@@ -93,7 +93,7 @@ static int spear_thermal_probe(struct platform_device *pdev)
 	struct device_node *np = pdev->dev.of_node;
 	int ret = 0, val;
 
-	if (!np || !of_property_read_u32(np, "st,thermal-flags", &val)) {
+	if (!np || of_property_read_u32(np, "st,thermal-flags", &val)) {
 		dev_err(&pdev->dev, "Failed: DT Pdata not passed\n");
 		return -EINVAL;
 	}

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 31de83980d3764d784f79ff1bc93c42b324f4013 ]

Passing a NULL pointer to debugfs_create_str() leads to a NULL pointer dereference when the debugfs file is read. Following upstream discussions, forbid the creation of debugfs string files with NULL pointers. Add a WARN_ON() to expose offending callers and return early.

---
 fs/debugfs/file.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index 3ec3324c20603..252fca572eb76 100644
@@ -1127,7 +1127,7 @@ static const struct file_operations fops_str_wo = {
  *          directory dentry if set.  If this parameter is %NULL, then the
  *          file will be created in the root of the debugfs filesystem.
  * @value: a pointer to the variable that the file should read to and write
- *         from.
+ *         from. This pointer and the string it points to must not be %NULL.
  *
  * This function creates a file in debugfs with the given name that
  * contains the value of the variable @value.  If the @mode variable is so

@@ -1136,6 +1136,9 @@ static const struct file_operations fops_str_wo = {
 void debugfs_create_str(const char *name, umode_t mode,
 			struct dentry *parent, char **value)
 {
+	if (WARN_ON(!value || !*value))
+		return;
+
 	debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str,
 				   &fops_str_ro, &fops_str_wo);
 }

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 4afc929c0f74c4f22b055a82b371d50586da58ca ]

The EXPORT_SYMBOL_GPL() for debugfs_create_str was placed incorrectly away from the function definition. Move it immediately below the debugfs_create_str() function where it belongs.

---
 fs/debugfs/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 252fca572eb76..880a8a9deacfe 100644
@@ -1047,7 +1047,6 @@ ssize_t debugfs_read_file_str(struct file *file, char __user *user_buf,
 
 	return ret;
 }
-EXPORT_SYMBOL_GPL(debugfs_create_str);
 
 static ssize_t debugfs_write_file_str(struct file *file, const char __user *user_buf,
 				      size_t count, loff_t *ppos)

@@ -1142,6 +1141,7 @@ void debugfs_create_str(const char *name, umode_t mode,
 	debugfs_create_mode_unsafe(name, mode, parent, value, &fops_str,
 				   &fops_str_ro, &fops_str_wo);
 }
+EXPORT_SYMBOL_GPL(debugfs_create_str);
 
 static ssize_t read_file_blob(struct file *file, char __user *user_buf,
 			      size_t count, loff_t *ppos)

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gui-Dong Han <[email protected]>

[ Upstream commit 7215e4552f31e53595eae56a834f7e286beecccc ]

Passing NULL to debugfs_create_str() causes a NULL pointer dereference, and creating debugfs nodes with NULL string pointers is no longer permitted.

Additionally, firmware_file is a global pointer. Previously, adding every new slave blindly overwrote it with NULL.

Fix these issues by initializing firmware_file to an allocated empty string once in the subsystem init path (sdw_debugfs_init), and freeing it in the exit path. Existing driver code handles empty strings correctly.

---
 drivers/soundwire/debugfs.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

index 1e0f9318b6165..feb4d15102753 100644
@@ -350,8 +350,8 @@ void sdw_slave_debugfs_init(struct sdw_slave *slave)
 	debugfs_create_file("go", 0200, d, slave, &cmd_go_fops);
 
 	debugfs_create_file("read_buffer", 0400, d, slave, &read_buffer_fops);
-	firmware_file = NULL;
-	debugfs_create_str("firmware_file", 0200, d, &firmware_file);
+	if (firmware_file)
+		debugfs_create_str("firmware_file", 0200, d, &firmware_file);
 
 	slave->debugfs = d;
 }

@@ -363,10 +363,15 @@ void sdw_slave_debugfs_exit(struct sdw_slave *slave)
 
 void sdw_debugfs_init(void)
 {
+	if (!firmware_file)
+		firmware_file = kstrdup("", GFP_KERNEL);
+
 	sdw_debugfs_root = debugfs_create_dir("soundwire", NULL);
 }
 
 void sdw_debugfs_exit(void)
 {
 	debugfs_remove_recursive(sdw_debugfs_root);
+	kfree(firmware_file);
+	firmware_file = NULL;
 }

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gautham R. Shenoy <[email protected]>

[ Upstream commit beda3b363546a423e4e29a7395e04c0ac4ff677e ]

On failure to set the epp, the function amd_pstate_epp_cpu_init() returns with an error code without freeing the cpudata object that was allocated at the beginning of the function.

Ensure that the cpudata object is freed before returning from the function.

This memory leak was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts
(https://github.com/masoncl/review-prompts/tree/main/kernel).

---
 drivers/cpufreq/amd-pstate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 602e4fa81d6c5..86d8762ac82c5 100644
@@ -1525,7 +1525,7 @@ static int amd_pstate_epp_cpu_init(struct cpufreq_policy *policy)
 
 	ret = amd_pstate_set_epp(policy, cpudata->epp_default);
 	if (ret)
-		return ret;
+		goto free_cpudata1;
 
 	current_pstate_driver->adjust_perf = NULL;
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Gautham R. Shenoy <[email protected]>

[ Upstream commit fcc25a291fbdca2c06c2c6602532050873f0c9de ]

The function msr_update_perf() does not cache the new value that is written to MSR_AMD_CPPC_REQ into the variable cpudata->cppc_req_cached when the update is happening from the fast path.

Fix that by caching the value everytime the MSR_AMD_CPPC_REQ gets updated.

This issue was discovered by Claude Opus 4.6 with the aid of Chris Mason's AI review-prompts
(https://github.com/masoncl/review-prompts/tree/main/kernel).

---
 drivers/cpufreq/amd-pstate.c | 1 -
 1 file changed, 1 deletion(-)

index 86d8762ac82c5..39681ad1606f6 100644
@@ -259,7 +259,6 @@ static int msr_update_perf(struct cpufreq_policy *policy, u8 min_perf,
 
 	if (fast_switch) {
 		wrmsrq(MSR_AMD_CPPC_REQ, value);
-		return 0;
 	} else {
 		int ret = wrmsrq_on_cpu(cpudata->cpu, MSR_AMD_CPPC_REQ, value);
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: K Prateek Nayak <[email protected]>

[ Upstream commit c03791085adcd61fa9b766ab303c7d0941d7378d ]

cpufreq_cpu_get() can sleep on PREEMPT_RT in presence of concurrent writer(s), however amd-pstate depends on fetching the cpudata via the policy's driver data which necessitates grabbing the reference.

Since schedutil governor can call "cpufreq_driver->update_perf()" during sched_tick/enqueue/dequeue with rq_lock held and IRQs disabled, fetching the policy object using the cpufreq_cpu_get() helper in the scheduler fast-path leads to "BUG: scheduling while atomic" on PREEMPT_RT [1].

Pass the cached cpufreq policy object in sg_policy to the update_perf() instead of just the CPU. The CPU can be inferred using "policy->cpu".

The lifetime of cpufreq_policy object outlasts that of the governor and the cpufreq driver (allocated when the CPU is onlined and only reclaimed when the CPU is offlined / the CPU device is removed) which makes it safe to be referenced throughout the governor's lifetime.

---
 drivers/cpufreq/amd-pstate.c     |  3 +--
 drivers/cpufreq/cpufreq.c        |  6 +++---
 drivers/cpufreq/intel_pstate.c   |  4 ++--
 include/linux/cpufreq.h          |  4 ++--
 kernel/sched/cpufreq_schedutil.c |  5 +++--
 rust/kernel/cpufreq.rs           | 13 ++++++-------
 6 files changed, 17 insertions(+), 18 deletions(-)

index 39681ad1606f6..ce6d6b3ff58a3 100644
@@ -697,13 +697,12 @@ static unsigned int amd_pstate_fast_switch(struct cpufreq_policy *policy,
 	return policy->cur;
 }
 
-static void amd_pstate_adjust_perf(unsigned int cpu,
+static void amd_pstate_adjust_perf(struct cpufreq_policy *policy,
 				   unsigned long _min_perf,
 				   unsigned long target_perf,
 				   unsigned long capacity)
 {
 	u8 max_perf, min_perf, des_perf, cap_perf;
-	struct cpufreq_policy *policy __free(put_cpufreq_policy) = cpufreq_cpu_get(cpu);
 	struct amd_cpudata *cpudata;
 	union perf_cached perf;
 

index 852e024facc3c..1ed528e34bab4 100644
@@ -2222,7 +2222,7 @@ EXPORT_SYMBOL_GPL(cpufreq_driver_fast_switch);
 
 /**
  * cpufreq_driver_adjust_perf - Adjust CPU performance level in one go.
- * @cpu: Target CPU.
+ * @policy: cpufreq policy object of the target CPU.
  * @min_perf: Minimum (required) performance level (units of @capacity).
  * @target_perf: Target (desired) performance level (units of @capacity).
  * @capacity: Capacity of the target CPU.

@@ -2241,12 +2241,12 @@ EXPORT_SYMBOL_GPL(cpufreq_driver_fast_switch);
  * parallel with either ->target() or ->target_index() or ->fast_switch() for
  * the same CPU.
  */
-void cpufreq_driver_adjust_perf(unsigned int cpu,
+void cpufreq_driver_adjust_perf(struct cpufreq_policy *policy,
 				 unsigned long min_perf,
 				 unsigned long target_perf,
 				 unsigned long capacity)
 {
-	cpufreq_driver->adjust_perf(cpu, min_perf, target_perf, capacity);
+	cpufreq_driver->adjust_perf(policy, min_perf, target_perf, capacity);
 }
 
 /**

index 5efda8af4b708..eb7fb25dfbefc 100644
@@ -3270,12 +3270,12 @@ static unsigned int intel_cpufreq_fast_switch(struct cpufreq_policy *policy,
 	return target_pstate * cpu->pstate.scaling;
 }
 
-static void intel_cpufreq_adjust_perf(unsigned int cpunum,
+static void intel_cpufreq_adjust_perf(struct cpufreq_policy *policy,
 				      unsigned long min_perf,
 				      unsigned long target_perf,
 				      unsigned long capacity)
 {
-	struct cpudata *cpu = all_cpu_data[cpunum];
+	struct cpudata *cpu = all_cpu_data[policy->cpu];
 	u64 hwp_cap = READ_ONCE(cpu->hwp_cap_cached);
 	int old_pstate = cpu->pstate.current_pstate;
 	int cap_pstate, min_pstate, max_pstate, target_pstate;

index 0465d1e6f72ac..fd26b3a4aa286 100644
@@ -367,7 +367,7 @@ struct cpufreq_driver {
 	 * conditions) scale invariance can be disabled, which causes the
 	 * schedutil governor to fall back to the latter.
 	 */
-	void		(*adjust_perf)(unsigned int cpu,
+	void		(*adjust_perf)(struct cpufreq_policy *policy,
 				       unsigned long min_perf,
 				       unsigned long target_perf,
 				       unsigned long capacity);

@@ -612,7 +612,7 @@ struct cpufreq_governor {
 /* Pass a target to the cpufreq driver */
 unsigned int cpufreq_driver_fast_switch(struct cpufreq_policy *policy,
 					unsigned int target_freq);
-void cpufreq_driver_adjust_perf(unsigned int cpu,
+void cpufreq_driver_adjust_perf(struct cpufreq_policy *policy,
 				unsigned long min_perf,
 				unsigned long target_perf,
 				unsigned long capacity);

index 0ab5f9d4bc59a..307f3076635eb 100644
@@ -461,6 +461,7 @@ static void sugov_update_single_perf(struct update_util_data *hook, u64 time,
 				     unsigned int flags)
 {
 	struct sugov_cpu *sg_cpu = container_of(hook, struct sugov_cpu, update_util);
+	struct sugov_policy *sg_policy = sg_cpu->sg_policy;
 	unsigned long prev_util = sg_cpu->util;
 	unsigned long max_cap;
 

@@ -482,10 +483,10 @@ static void sugov_update_single_perf(struct update_util_data *hook, u64 time,
 	if (sugov_hold_freq(sg_cpu) && sg_cpu->util < prev_util)
 		sg_cpu->util = prev_util;
 
-	cpufreq_driver_adjust_perf(sg_cpu->cpu, sg_cpu->bw_min,
+	cpufreq_driver_adjust_perf(sg_policy->policy, sg_cpu->bw_min,
 				   sg_cpu->util, max_cap);
 
-	sg_cpu->sg_policy->last_freq_update_time = time;
+	sg_policy->last_freq_update_time = time;
 }
 
 static unsigned int sugov_next_freq_shared(struct sugov_cpu *sg_cpu, u64 time)

index df5d9f6f43f3b..19729ccb3f6d2 100644
@@ -1257,18 +1257,17 @@ impl<T: Driver> Registration<T> {
     /// # Safety
     ///
     /// - This function may only be called from the cpufreq C infrastructure.
+    /// - The pointer arguments must be valid pointers.
     unsafe extern "C" fn adjust_perf_callback(
-        cpu: c_uint,
+        ptr: *mut bindings::cpufreq_policy,
         min_perf: c_ulong,
         target_perf: c_ulong,
         capacity: c_ulong,
     ) {
-        // SAFETY: The C API guarantees that `cpu` refers to a valid CPU number.
-        let cpu_id = unsafe { CpuId::from_u32_unchecked(cpu) };
-
-        if let Ok(mut policy) = PolicyCpu::from_cpu(cpu_id) {
-            T::adjust_perf(&mut policy, min_perf, target_perf, capacity);
-        }
+        // SAFETY: The `ptr` is guaranteed to be valid by the contract with the C code for the
+        // lifetime of `policy`.
+        let policy = unsafe { Policy::from_raw_mut(ptr) };
+        T::adjust_perf(policy, min_perf, target_perf, capacity);
     }
 
     /// Driver's `get_intermediate` callback.

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: HyungJung Joo <[email protected]>

[ Upstream commit d227786ab1119669df4dc333a61510c52047cce4 ]

mb_cache_destroy() calls shrinker_free() and then frees all cache entries and the cache itself, but it does not cancel the pending c_shrink_work work item first.

If mb_cache_entry_create() schedules c_shrink_work via schedule_work() and the work item is still pending or running when mb_cache_destroy() runs, mb_cache_shrink_worker() will access the cache after its memory has been freed, causing a use-after-free.

This is only reachable by a privileged user (root or CAP_SYS_ADMIN) who can trigger the last put of a mounted ext2/ext4/ocfs2 filesystem.

Cancel the work item with cancel_work_sync() before calling shrinker_free(), ensuring the worker has finished and will not be rescheduled before the cache is torn down.

---
 fs/mbcache.c | 1 +
 1 file changed, 1 insertion(+)

index e60a840999aa9..90b0564c62d0b 100644
@@ -408,6 +408,7 @@ void mb_cache_destroy(struct mb_cache *cache)
 {
 	struct mb_cache_entry *entry, *next;
 
+	cancel_work_sync(&cache->c_shrink_work);
 	shrinker_free(cache->c_shrink);
 
 	/*

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit 10a4206a24013be4d558d476010cbf2eb4c9fa64 ]

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

---
 drivers/pci/pci-driver.c           | 11 +++++++----
 drivers/pci/pci-sysfs.c            | 28 ----------------------------
 drivers/pci/probe.c                |  1 -
 drivers/vfio/pci/vfio_pci_core.c   |  5 ++---
 drivers/xen/xen-pciback/pci_stub.c |  6 ++++--
 include/linux/pci.h                |  6 ------
 6 files changed, 13 insertions(+), 44 deletions(-)

index b4111c92c9572..fba07a700508f 100644
@@ -138,9 +138,11 @@ static const struct pci_device_id *pci_match_device(struct pci_driver *drv,
 {
 	struct pci_dynid *dynid;
 	const struct pci_device_id *found_id = NULL, *ids;
+	int ret;
 
 	/* When driver_override is set, only bind to the matching driver */
-	if (dev->driver_override && strcmp(dev->driver_override, drv->name))
+	ret = device_match_driver_override(&dev->dev, &drv->driver);
+	if (ret == 0)
 		return NULL;
 
 	/* Look at the dynamic ids first, before the static ones */

@@ -164,7 +166,7 @@ static const struct pci_device_id *pci_match_device(struct pci_driver *drv,
 		 * matching.
 		 */
 		if (found_id->override_only) {
-			if (dev->driver_override)
+			if (ret > 0)
 				return found_id;
 		} else {
 			return found_id;

@@ -172,7 +174,7 @@ static const struct pci_device_id *pci_match_device(struct pci_driver *drv,
 	}
 
 	/* driver_override will always match, send a dummy id */
-	if (dev->driver_override)
+	if (ret > 0)
 		return &pci_device_id_any;
 	return NULL;
 }

@@ -423,7 +425,7 @@ static int __pci_device_probe(struct pci_driver *drv, struct pci_dev *pci_dev)
 static inline bool pci_device_can_probe(struct pci_dev *pdev)
 {
 	return (!pdev->is_virtfn || pdev->physfn->sriov->drivers_autoprobe ||
-		pdev->driver_override);
+		device_has_driver_override(&pdev->dev));
 }
 #else
 static inline bool pci_device_can_probe(struct pci_dev *pdev)

@@ -1695,6 +1697,7 @@ static const struct cpumask *pci_device_irq_get_affinity(struct device *dev,
 
 const struct bus_type pci_bus_type = {
 	.name		= "pci",
+	.driver_override = true,
 	.match		= pci_bus_match,
 	.uevent		= pci_uevent,
 	.probe		= pci_device_probe,

index 9d6f74bd95f8c..d36b46849fee2 100644
@@ -615,33 +615,6 @@ static ssize_t devspec_show(struct device *dev,
 static DEVICE_ATTR_RO(devspec);
 #endif
 
-static ssize_t driver_override_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
-{
-	struct pci_dev *pdev = to_pci_dev(dev);
-	int ret;
-
-	ret = driver_set_override(dev, &pdev->driver_override, buf, count);
-	if (ret)
-		return ret;
-
-	return count;
-}
-
-static ssize_t driver_override_show(struct device *dev,
-				    struct device_attribute *attr, char *buf)
-{
-	struct pci_dev *pdev = to_pci_dev(dev);
-	ssize_t len;
-
-	device_lock(dev);
-	len = sysfs_emit(buf, "%s\n", pdev->driver_override);
-	device_unlock(dev);
-	return len;
-}
-static DEVICE_ATTR_RW(driver_override);
-
 static struct attribute *pci_dev_attrs[] = {
 	&dev_attr_power_state.attr,
 	&dev_attr_resource.attr,

@@ -669,7 +642,6 @@ static struct attribute *pci_dev_attrs[] = {
 #ifdef CONFIG_OF
 	&dev_attr_devspec.attr,
 #endif
-	&dev_attr_driver_override.attr,
 	&dev_attr_ari_enabled.attr,
 	NULL,
 };

index 23833fd7265e2..4e4e38e626912 100644
@@ -2449,7 +2449,6 @@ static void pci_release_dev(struct device *dev)
 	pci_release_of_node(pci_dev);
 	pcibios_release_device(pci_dev);
 	pci_bus_put(pci_dev->bus);
-	kfree(pci_dev->driver_override);
 	bitmap_free(pci_dev->dma_alias_mask);
 	dev_dbg(dev, "device released\n");
 	kfree(pci_dev);

index 085373d71e9c2..69476fc67ca08 100644
@@ -2013,9 +2013,8 @@ static int vfio_pci_bus_notifier(struct notifier_block *nb,
 	    pdev->is_virtfn && physfn == vdev->pdev) {
 		pci_info(vdev->pdev, "Captured SR-IOV VF %s driver_override\n",
 			 pci_name(pdev));
-		pdev->driver_override = kasprintf(GFP_KERNEL, "%s",
-						  vdev->vdev.ops->name);
-		WARN_ON(!pdev->driver_override);
+		WARN_ON(device_set_driver_override(&pdev->dev,
+						   vdev->vdev.ops->name));
 	} else if (action == BUS_NOTIFY_BOUND_DRIVER &&
 		   pdev->is_virtfn && physfn == vdev->pdev) {
 		struct pci_driver *drv = pci_dev_driver(pdev);

index 045e74847fe6b..7de2fa67743c6 100644
@@ -598,6 +598,8 @@ static int pcistub_seize(struct pci_dev *dev,
 	return err;
 }
 
+static struct pci_driver xen_pcibk_pci_driver;
+
 /* Called when 'bind'. This means we must _NOT_ call pci_reset_function or
  * other functions that take the sysfs lock. */
 static int pcistub_probe(struct pci_dev *dev, const struct pci_device_id *id)

@@ -609,8 +611,8 @@ static int pcistub_probe(struct pci_dev *dev, const struct pci_device_id *id)
 
 	match = pcistub_match(dev);
 
-	if ((dev->driver_override &&
-	     !strcmp(dev->driver_override, PCISTUB_DRIVER_NAME)) ||
+	if (device_match_driver_override(&dev->dev,
+					 &xen_pcibk_pci_driver.driver) > 0 ||
 	    match) {
 
 		if (dev->hdr_type != PCI_HEADER_TYPE_NORMAL

index 05aeee8c8844a..89f5a4290b6e2 100644
@@ -547,12 +547,6 @@ struct pci_dev {
 	u8		supported_speeds; /* Supported Link Speeds Vector */
 	phys_addr_t	rom;		/* Physical address if not from BAR */
 	size_t		romlen;		/* Length if not from BAR */
-	/*
-	 * Driver name to force a match.  Do not set directly, because core
-	 * frees it.  Use driver_set_override() to set or clear it.
-	 */
-	const char	*driver_override;
-
 	unsigned long	priv_flags;	/* Private flags for the PCI driver */
 
 	/* These methods index pci_reset_fn_methods[] */

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit 8a700b1fc94df4d847a04f14ebc7f8532592b367 ]

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

---
 drivers/platform/x86/wmi.c | 36 +++++-------------------------------
 include/linux/wmi.h        |  4 ----
 2 files changed, 5 insertions(+), 35 deletions(-)

index 4e86a422f05f1..6f8e96476fd07 100644
@@ -702,39 +702,11 @@ static ssize_t expensive_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(expensive);
 
-static ssize_t driver_override_show(struct device *dev, struct device_attribute *attr,
-				    char *buf)
-{
-	struct wmi_device *wdev = to_wmi_device(dev);
-	ssize_t ret;
-
-	device_lock(dev);
-	ret = sysfs_emit(buf, "%s\n", wdev->driver_override);
-	device_unlock(dev);
-
-	return ret;
-}
-
-static ssize_t driver_override_store(struct device *dev, struct device_attribute *attr,
-				     const char *buf, size_t count)
-{
-	struct wmi_device *wdev = to_wmi_device(dev);
-	int ret;
-
-	ret = driver_set_override(dev, &wdev->driver_override, buf, count);
-	if (ret < 0)
-		return ret;
-
-	return count;
-}
-static DEVICE_ATTR_RW(driver_override);
-
 static struct attribute *wmi_attrs[] = {
 	&dev_attr_modalias.attr,
 	&dev_attr_guid.attr,
 	&dev_attr_instance_count.attr,
 	&dev_attr_expensive.attr,
-	&dev_attr_driver_override.attr,
 	NULL
 };
 ATTRIBUTE_GROUPS(wmi);

@@ -803,7 +775,6 @@ static void wmi_dev_release(struct device *dev)
 {
 	struct wmi_block *wblock = dev_to_wblock(dev);
 
-	kfree(wblock->dev.driver_override);
 	kfree(wblock);
 }
 

@@ -812,10 +783,12 @@ static int wmi_dev_match(struct device *dev, const struct device_driver *driver)
 	const struct wmi_driver *wmi_driver = to_wmi_driver(driver);
 	struct wmi_block *wblock = dev_to_wblock(dev);
 	const struct wmi_device_id *id = wmi_driver->id_table;
+	int ret;
 
 	/* When driver_override is set, only bind to the matching driver */
-	if (wblock->dev.driver_override)
-		return !strcmp(wblock->dev.driver_override, driver->name);
+	ret = device_match_driver_override(dev, driver);
+	if (ret >= 0)
+		return ret;
 
 	if (id == NULL)
 		return 0;

@@ -936,6 +909,7 @@ static struct class wmi_bus_class = {
 static const struct bus_type wmi_bus_type = {
 	.name = "wmi",
 	.dev_groups = wmi_groups,
+	.driver_override = true,
 	.match = wmi_dev_match,
 	.uevent = wmi_dev_uevent,
 	.probe = wmi_dev_probe,

index 10751c8e5e6a0..c20bb22133381 100644
@@ -16,16 +16,12 @@
  * struct wmi_device - WMI device structure
  * @dev: Device associated with this WMI device
  * @setable: True for devices implementing the Set Control Method
- * @driver_override: Driver name to force a match; do not set directly,
- *		     because core frees it; use driver_set_override() to
- *		     set or clear it.
  *
  * This represents WMI devices discovered by the WMI driver core.
  */
 struct wmi_device {
 	struct device dev;
 	bool setable;
-	const char *driver_override;
 };
 
 /**

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit 85bb534ff12aab6916058897b39c748940a7a4c6 ]

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

---
 drivers/vdpa/vdpa.c  | 48 +++++---------------------------------------
 include/linux/vdpa.h |  4 ----
 2 files changed, 5 insertions(+), 47 deletions(-)

index 34874beb0152e..caf0ee5d6856c 100644
@@ -67,57 +67,20 @@ static void vdpa_dev_remove(struct device *d)
 
 static int vdpa_dev_match(struct device *dev, const struct device_driver *drv)
 {
-	struct vdpa_device *vdev = dev_to_vdpa(dev);
+	int ret;
 
 	/* Check override first, and if set, only use the named driver */
-	if (vdev->driver_override)
-		return strcmp(vdev->driver_override, drv->name) == 0;
+	ret = device_match_driver_override(dev, drv);
+	if (ret >= 0)
+		return ret;
 
 	/* Currently devices must be supported by all vDPA bus drivers */
 	return 1;
 }
 
-static ssize_t driver_override_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
-{
-	struct vdpa_device *vdev = dev_to_vdpa(dev);
-	int ret;
-
-	ret = driver_set_override(dev, &vdev->driver_override, buf, count);
-	if (ret)
-		return ret;
-
-	return count;
-}
-
-static ssize_t driver_override_show(struct device *dev,
-				    struct device_attribute *attr, char *buf)
-{
-	struct vdpa_device *vdev = dev_to_vdpa(dev);
-	ssize_t len;
-
-	device_lock(dev);
-	len = sysfs_emit(buf, "%s\n", vdev->driver_override);
-	device_unlock(dev);
-
-	return len;
-}
-static DEVICE_ATTR_RW(driver_override);
-
-static struct attribute *vdpa_dev_attrs[] = {
-	&dev_attr_driver_override.attr,
-	NULL,
-};
-
-static const struct attribute_group vdpa_dev_group = {
-	.attrs  = vdpa_dev_attrs,
-};
-__ATTRIBUTE_GROUPS(vdpa_dev);
-
 static const struct bus_type vdpa_bus = {
 	.name  = "vdpa",
-	.dev_groups = vdpa_dev_groups,
+	.driver_override = true,
 	.match = vdpa_dev_match,
 	.probe = vdpa_dev_probe,
 	.remove = vdpa_dev_remove,

@@ -132,7 +95,6 @@ static void vdpa_release_dev(struct device *d)
 		ops->free(vdev);
 
 	ida_free(&vdpa_index_ida, vdev->index);
-	kfree(vdev->driver_override);
 	kfree(vdev);
 }
 

index 4cf21d6e9cfde..0d8373adc1e46 100644
@@ -72,9 +72,6 @@ struct vdpa_mgmt_dev;
  * struct vdpa_device - representation of a vDPA device
  * @dev: underlying device
  * @vmap: the metadata passed to upper layer to be used for mapping
- * @driver_override: driver name to force a match; do not set directly,
- *                   because core frees it; use driver_set_override() to
- *                   set or clear it.
  * @config: the configuration ops for this device.
  * @map: the map ops for this device
  * @cf_lock: Protects get and set access to configuration layout.

@@ -90,7 +87,6 @@ struct vdpa_mgmt_dev;
 struct vdpa_device {
 	struct device dev;
 	union virtio_map vmap;
-	const char *driver_override;
 	const struct vdpa_config_ops *config;
 	const struct virtio_map_ops *map;
 	struct rw_semaphore cf_lock; /* Protects get/set config */

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit ac4d8bb6e2e13e8684a76ea48d13ebaaaf5c24c4 ]

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

---
 drivers/s390/cio/cio.h |  5 -----
 drivers/s390/cio/css.c | 34 ++++------------------------------
 2 files changed, 4 insertions(+), 35 deletions(-)

index 08a5e9380e75a..bad142c536e1e 100644
@@ -103,11 +103,6 @@ struct subchannel {
 	struct work_struct todo_work;
 	struct schib_config config;
 	u64 dma_mask;
-	/*
-	 * Driver name to force a match.  Do not set directly, because core
-	 * frees it.  Use driver_set_override() to set or clear it.
-	 */
-	const char *driver_override;
 } __attribute__ ((aligned(8)));
 
 DECLARE_PER_CPU_ALIGNED(struct irb, cio_irb);

index 8a70596a55447..629d3993144e1 100644
@@ -160,7 +160,6 @@ static void css_subchannel_release(struct device *dev)
 
 	sch->config.intparm = 0;
 	cio_commit_config(sch);
-	kfree(sch->driver_override);
 	kfree(sch);
 }
 

@@ -324,37 +323,9 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
 
 static DEVICE_ATTR_RO(modalias);
 
-static ssize_t driver_override_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
-{
-	struct subchannel *sch = to_subchannel(dev);
-	int ret;
-
-	ret = driver_set_override(dev, &sch->driver_override, buf, count);
-	if (ret)
-		return ret;
-
-	return count;
-}
-
-static ssize_t driver_override_show(struct device *dev,
-				    struct device_attribute *attr, char *buf)
-{
-	struct subchannel *sch = to_subchannel(dev);
-	ssize_t len;
-
-	device_lock(dev);
-	len = sysfs_emit(buf, "%s\n", sch->driver_override);
-	device_unlock(dev);
-	return len;
-}
-static DEVICE_ATTR_RW(driver_override);
-
 static struct attribute *subch_attrs[] = {
 	&dev_attr_type.attr,
 	&dev_attr_modalias.attr,
-	&dev_attr_driver_override.attr,
 	NULL,
 };
 

@@ -1358,9 +1329,11 @@ static int css_bus_match(struct device *dev, const struct device_driver *drv)
 	struct subchannel *sch = to_subchannel(dev);
 	const struct css_driver *driver = to_cssdriver(drv);
 	struct css_device_id *id;
+	int ret;
 
 	/* When driver_override is set, only bind to the matching driver */
-	if (sch->driver_override && strcmp(sch->driver_override, drv->name))
+	ret = device_match_driver_override(dev, drv);
+	if (ret == 0)
 		return 0;
 
 	for (id = driver->subchannel_type; id->match_flags; id++) {

@@ -1417,6 +1390,7 @@ static int css_uevent(const struct device *dev, struct kobj_uevent_env *env)
 
 static const struct bus_type css_bus_type = {
 	.name     = "css",
+	.driver_override = true,
 	.match    = css_bus_match,
 	.probe    = css_probe,
 	.remove   = css_remove,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Danilo Krummrich <[email protected]>

[ Upstream commit 6c8dfb0362732bf1e4829867a2a5239fedc592d0 ]

When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF.

Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally.

Note that calling match() from __driver_attach() without the device lock held is intentional. [1]

---
 drivers/bus/fsl-mc/fsl-mc-bus.c   | 43 +++++--------------------------
 drivers/vfio/fsl-mc/vfio_fsl_mc.c |  4 +--
 include/linux/fsl/mc.h            |  4 ---
 3 files changed, 8 insertions(+), 43 deletions(-)

index eb7b6c0ba9e7c..996379ace3764 100644
@@ -86,12 +86,16 @@ static int fsl_mc_bus_match(struct device *dev, const struct device_driver *drv)
 	struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
 	const struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(drv);
 	bool found = false;
+	int ret;
 
 	/* When driver_override is set, only bind to the matching driver */
-	if (mc_dev->driver_override) {
-		found = !strcmp(mc_dev->driver_override, mc_drv->driver.name);
+	ret = device_match_driver_override(dev, drv);
+	if (ret > 0) {
+		found = true;
 		goto out;
 	}
+	if (ret == 0)
+		goto out;
 
 	if (!mc_drv->match_id_table)
 		goto out;

@@ -181,39 +185,8 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(modalias);
 
-static ssize_t driver_override_store(struct device *dev,
-				     struct device_attribute *attr,
-				     const char *buf, size_t count)
-{
-	struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
-	int ret;
-
-	if (WARN_ON(dev->bus != &fsl_mc_bus_type))
-		return -EINVAL;
-
-	ret = driver_set_override(dev, &mc_dev->driver_override, buf, count);
-	if (ret)
-		return ret;
-
-	return count;
-}
-
-static ssize_t driver_override_show(struct device *dev,
-				    struct device_attribute *attr, char *buf)
-{
-	struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev);
-	ssize_t len;
-
-	device_lock(dev);
-	len = sysfs_emit(buf, "%s\n", mc_dev->driver_override);
-	device_unlock(dev);
-	return len;
-}
-static DEVICE_ATTR_RW(driver_override);
-
 static struct attribute *fsl_mc_dev_attrs[] = {
 	&dev_attr_modalias.attr,
-	&dev_attr_driver_override.attr,
 	NULL,
 };
 

@@ -316,6 +289,7 @@ ATTRIBUTE_GROUPS(fsl_mc_bus);
 
 const struct bus_type fsl_mc_bus_type = {
 	.name = "fsl-mc",
+	.driver_override = true,
 	.match = fsl_mc_bus_match,
 	.uevent = fsl_mc_bus_uevent,
 	.dma_configure  = fsl_mc_dma_configure,

@@ -925,9 +899,6 @@ static struct notifier_block fsl_mc_nb;
  */
 void fsl_mc_device_remove(struct fsl_mc_device *mc_dev)
 {
-	kfree(mc_dev->driver_override);
-	mc_dev->driver_override = NULL;
-
 	/*
 	 * The device-specific remove callback will get invoked by device_del()
 	 */

index 76ccbab0e3d64..84cd0eb65c471 100644
@@ -430,9 +430,7 @@ static int vfio_fsl_mc_bus_notifier(struct notifier_block *nb,
 
 	if (action == BUS_NOTIFY_ADD_DEVICE &&
 	    vdev->mc_dev == mc_cont) {
-		mc_dev->driver_override = kasprintf(GFP_KERNEL, "%s",
-						    vfio_fsl_mc_ops.name);
-		if (!mc_dev->driver_override)
+		if (device_set_driver_override(dev, vfio_fsl_mc_ops.name))
 			dev_warn(dev, "VFIO_FSL_MC: Setting driver override for device in dprc %s failed\n",
 				 dev_name(&mc_cont->dev));
 		else

index 897d6211c1635..1da63f2d70401 100644
@@ -178,9 +178,6 @@ struct fsl_mc_obj_desc {
  * @regions: pointer to array of MMIO region entries
  * @irqs: pointer to array of pointers to interrupts allocated to this device
  * @resource: generic resource associated with this MC object device, if any.
- * @driver_override: driver name to force a match; do not set directly,
- *                   because core frees it; use driver_set_override() to
- *                   set or clear it.
  *
  * Generic device object for MC object devices that are "attached" to a
  * MC bus.

@@ -214,7 +211,6 @@ struct fsl_mc_device {
 	struct fsl_mc_device_irq **irqs;
 	struct fsl_mc_resource *resource;
 	struct device_link *consumer_link;
-	const char *driver_override;
 };
 
 #define to_fsl_mc_device(_dev) \

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Brian Masney <[email protected]>

[ Upstream commit 86be659415b0ddefebc3120e309091aa215a9064 ]

This driver is currently only build on 32 bit MIPS systems. When building it on x86_64, the following warning occurs:

drivers/irqchip/irq-pic32-evic.c: In function ‘pic32_ext_irq_of_init’:
./include/linux/kern_levels.h:5:25: error: format ‘%d’ expects argument of type
‘int’, but argument 2 has type ‘long unsigned int’ [-Werror=format=]

Update the printf() formatter in preparation for allowing this driver to be compiled on all architectures.

---
 drivers/irqchip/irq-pic32-evic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 5dfda8e8df10d..0bb664e3d7c51 100644
@@ -196,7 +196,7 @@ static void __init pic32_ext_irq_of_init(struct irq_domain *domain)
 
 	of_property_for_each_u32(node, pname, hwirq) {
 		if (i >= ARRAY_SIZE(priv->ext_irqs)) {
-			pr_warn("More than %d external irq, skip rest\n",
+			pr_warn("More than %zu external irq, skip rest\n",
 				ARRAY_SIZE(priv->ext_irqs));
 			break;
 		}

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <[email protected]>

[ Upstream commit d19ff16c11db38f3ee179d72751fb9b340174330 ]

Much like hrtimer_reprogram(), skip programming if the cpu_base is running the hrtimer interrupt.

Stable-dep-of: f2e388a019e4 ("hrtimer: Reduce trace noise in hrtimer_start()")

---
 kernel/time/hrtimer.c | 8 ++++++++
 1 file changed, 8 insertions(+)

index 21b6d93401480..2589cd1b2ec3a 100644
@@ -1261,6 +1261,14 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
 	}
 
 	first = enqueue_hrtimer(timer, new_base, mode);
+
+	/*
+	 * If the hrtimer interrupt is running, then it will reevaluate the
+	 * clock bases and reprogram the clock event device.
+	 */
+	if (new_base->cpu_base->in_hrtirq)
+		return false;
+
 	if (!force_local) {
 		/*
 		 * If the current CPU base is online, then the timer is

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Xiao Ni <[email protected]>

[ Upstream commit de3544d2e5ea99064498de3c21ba490155864657 ]

Interval tree uses [start, end] as a region which stores in the tree. In raid1, it uses the wrong end value. For example:
bio(A,B) is too big and needs to be split to bio1(A,C-1), bio2(C,B). The region of bio1 is [A,C] and the region of bio2 is [C,B]. So bio1 and bio2 overlap which is not right.

Fix this problem by using right end value of the region.

---
 drivers/md/raid1.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index ce7fd68869566..84dbf801e9b1b 100644
@@ -62,7 +62,7 @@ static int check_and_add_serial(struct md_rdev *rdev, struct r1bio *r1_bio,
 	unsigned long flags;
 	int ret = 0;
 	sector_t lo = r1_bio->sector;
-	sector_t hi = lo + r1_bio->sectors;
+	sector_t hi = lo + r1_bio->sectors - 1;
 	struct serial_in_rdev *serial = &rdev->serial[idx];
 
 	spin_lock_irqsave(&serial->serial_lock, flags);

@@ -453,7 +453,7 @@ static void raid1_end_write_request(struct bio *bio)
 	int mirror = find_bio_disk(r1_bio, bio);
 	struct md_rdev *rdev = conf->mirrors[mirror].rdev;
 	sector_t lo = r1_bio->sector;
-	sector_t hi = r1_bio->sector + r1_bio->sectors;
+	sector_t hi = r1_bio->sector + r1_bio->sectors - 1;
 	bool ignore_error = !raid1_should_handle_error(bio) ||
 		(bio->bi_status && bio_op(bio) == REQ_OP_DISCARD);
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <[email protected]>

[ Upstream commit 2b31e86387e60b3689339f0f0fbb4d3623d9d494 ]

Make drbd_adm_dump_devices() call rcu_read_lock() before rcu_read_unlock() is called. This has been detected by the Clang thread-safety analyzer.

---
 drivers/block/drbd/drbd_nl.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

index b502038be0a92..0ddbf71286a91 100644
@@ -3378,8 +3378,10 @@ int drbd_adm_dump_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 			cb->args[0] = (long)resource;
 		}
 	}

@@ -3628,8 +3630,10 @@ int drbd_adm_dump_peer_devices(struct sk_buff *skb, struct netlink_callback *cb)
 		if (resource_filter) {
 			retcode = ERR_RES_NOT_KNOWN;
 			resource = drbd_find_resource(nla_data(resource_filter));
-			if (!resource)
+			if (!resource) {
+				rcu_read_lock();
 				goto put_result;
+			}
 		}
 		cb->args[0] = (long)resource;
 	}

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Daan De Meyer <[email protected]>

[ Upstream commit 267ec4d7223a783f029a980f41b93c39b17996da ]

When LOOP_CONFIGURE is called with LO_FLAGS_PARTSCAN, the following sequence occurs:

1. disk_force_media_change() sets GD_NEED_PART_SCAN
2. Uevent suppression is lifted and a KOBJ_CHANGE uevent is sent
3. loop_global_unlock() releases the lock
4. loop_reread_partitions() calls bdev_disk_changed() to scan

There is a race between steps 2 and 4: when udev receives the uevent and opens the device before loop_reread_partitions() runs, blkdev_get_whole() in bdev.c sees GD_NEED_PART_SCAN set and calls bdev_disk_changed() for a first scan. Then loop_reread_partitions() does a second scan. The open_mutex serializes these two scans, but does not prevent both from running.

The second scan in bdev_disk_changed() drops all partition devices from the first scan (via blk_drop_partitions()) before re-adding them, causing partition block devices to briefly disappear. This breaks any systemd unit with BindsTo= on the partition device: systemd observes the device going dead, fails the dependent units, and does not retry them when the device reappears.

Fix this by removing the GD_NEED_PART_SCAN set from disk_force_media_change() entirely. None of the current callers need the lazy on-open partition scan triggered by this flag:

- floppy: sets GENHD_FL_NO_PART, so disk_has_partscan() is always false and GD_NEED_PART_SCAN has no effect.
- loop (loop_configure, loop_change_fd): when LO_FLAGS_PARTSCAN is set, loop_reread_partitions() performs an explicit scan. When not set, GD_SUPPRESS_PART_SCAN prevents the lazy scan path.
- loop (__loop_clr_fd): calls bdev_disk_changed() explicitly if LO_FLAGS_PARTSCAN is set.
- nbd (nbd_clear_sock_ioctl): capacity is set to zero immediately after; nbd manages GD_NEED_PART_SCAN explicitly elsewhere.

With GD_NEED_PART_SCAN no longer set by disk_force_media_change(), udev opening the loop device after the uevent no longer triggers a redundant scan in blkdev_get_whole(), and only the single explicit scan from loop_reread_partitions() runs.

A regression test for this bug has been submitted to blktests:
https://github.com/linux-blktests/blktests/pull/240.

---
 block/disk-events.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

index 2f697224386aa..868823915bdc6 100644
@@ -290,13 +290,14 @@ EXPORT_SYMBOL(disk_check_media_change);
  * Should be called when the media changes for @disk.  Generates a uevent
  * and attempts to free all dentries and inodes and invalidates all block
  * device page cache entries in that case.
+ *
+ * Callers that need a partition re-scan should arrange for one explicitly.
  */
 void disk_force_media_change(struct gendisk *disk)
 {
 	disk_event_uevent(disk, DISK_EVENT_MEDIA_CHANGE);
 	inc_diskseq(disk);
 	bdev_mark_dead(disk->part0, true);
-	set_bit(GD_NEED_PART_SCAN, &disk->state);
 }
 EXPORT_SYMBOL_GPL(disk_force_media_change);
 

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Deepanshu Kartikey <[email protected]>

[ Upstream commit be3e5d10643d3be1cbac9d9939f220a99253f980 ]

nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks by comparing it with the current block number bd_blocknr. If they differ, the block is considered dead and skipped.

However, bd_oblocknr should never be 0 since block 0 typically stores the primary superblock and is never a valid GC target block. A corrupted ioctl request with bd_oblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering the WARN_ON(ret == -ENOENT).

Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the beginning of each iteration.

[ryusuke: slightly modified the commit message and comments for accuracy]

---
 fs/nilfs2/ioctl.c | 6 ++++++
 1 file changed, 6 insertions(+)

index 3288c3b4be9ec..7fa02146f1e06 100644
@@ -736,6 +736,12 @@ static int nilfs_ioctl_mark_blocks_dirty(struct the_nilfs *nilfs,
 	int ret, i;
 
 	for (i = 0; i < nmembs; i++) {
+		/*
+		 * bd_oblocknr must never be 0 as block 0
+		 * is never a valid GC target block
+		 */
+		if (unlikely(!bdescs[i].bd_oblocknr))
+			return -EINVAL;
 		/* XXX: use macro or inline func to check liveness */
 		ret = nilfs_bmap_lookup_at_level(bmap,
 						 bdescs[i].bd_offset,

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jackie Liu <[email protected]>

[ Upstream commit 23308af722fefed00af5f238024c11710938fba3 ]

Add the missing put_disk() on the error path in blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or blkg_tryget() fails, the function jumps to the out label which only calls rcu_read_unlock() but does not release the disk reference acquired by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk is already set to NULL before the lookup, blkcg_exit() cannot release this reference either, causing the disk to never be freed.

Restore the reference release that was present as blk_put_queue() in the original code but was inadvertently dropped during the conversion from request_queue to gendisk.

---
 block/blk-cgroup.c | 1 +
 1 file changed, 1 insertion(+)

index 890c161bee25e..9a8d047be580b 100644
@@ -2037,6 +2037,7 @@ void blkcg_maybe_throttle_current(void)
 	return;
 out:
 	rcu_read_unlock();
+	put_disk(disk);
 }
 
 /**

2.53.0

6.18-stable review patch. If anyone has any objections, please let me know.

------------------

From: Cole Leavitt <[email protected]>

[ Upstream commit 2ddb69f686ef7a621645e97fc7329c50edf5d0e5 ]

In persistent_ram_iomap(), ioremap() or ioremap_wc() may return NULL on failure. Currently, if this happens, the function returns NULL without releasing the memory region acquired by request_mem_region().

This leads to a resource leak where the memory region remains reserved but unusable.

Additionally, the caller persistent_ram_buffer_map() handles NULL correctly by returning -ENOMEM, but without this check, a NULL return combined with request_mem_region() succeeding leaves resources in an inconsistent state.

This is the ioremap() counterpart to commit 05363abc7625 ("pstore:
ram_core: fix incorrect success return when vmap() fails") which fixed a similar issue in the vmap() path.

---
 fs/pstore/ram_core.c | 4 ++++
 1 file changed, 4 insertions(+)

index 7b6d6378a3b87..95675d4bab141 100644
@@ -489,6 +489,10 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size,
 	else
 		va = ioremap_wc(start, size);
 
+	/* We must release the mem region if ioremap fails. */
+	if (!va)
+		release_mem_region(start, size);
+
 	/*
 	 * Since request_mem_region() and ioremap() are byte-granularity
 	 * there is no need handle anything special like we do when the

2.53.0

This is the start of the stable review cycle for the 6.18.32 release. There are 957 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Fri, 22 May 2026 16:20:16 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 6.18.32-rc1

Johan Hovold <[email protected]>
spi: sifive: fix controller deregistration

Pei Xiao <[email protected]>
spi: sifive: Simplify clock handling with devm_clk_get_enabled()

Chao Yu <[email protected]>
f2fs: fix false alarm of lockdep on cp_global_sem lock

Tejun Heo <[email protected]>
sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before

Tejun Heo <[email protected]>

    sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new

Dapeng Mi <[email protected]>
perf/x86/intel: Disable PMI for self-reloaded ACR events

Qu Wenruo <[email protected]>
btrfs: do not mark inode incompressible after inline attempt fails

Piyush Sachdeva <[email protected]>
smb: client: Use FullSessionKey for AES-256 encryption key derivation

David Carlier <[email protected]>
eventfs: Use list_add_tail_rcu() for SRCU-protected children list

Ashutosh Desai <[email protected]>
drm/v3d: Reject empty multisync extension to prevent infinite loop

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init

Johan Hovold <[email protected]>
drm/gma500/oaktrail_lvds: fix hang on init failure

Johan Hovold <[email protected]>
drm/gma500/oaktrail_hdmi: fix i2c adapter leak on setup

Thomas Hellström <[email protected]>
drm/ttm: Convert -EAGAIN from dmem_cgroup_try_charge to -ENOSPC

Matthew Auld <[email protected]>
drm/xe/dma-buf: fix UAF with retry loop

Matthew Auld <[email protected]>
drm/xe/dma-buf: handle empty bo and UAF races

Gyeyoung Baek <[email protected]>
drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

Sebastian Brzezinka <[email protected]>
drm/i915: skip __i915_request_skip() for already signaled requests

Zhenzhong Duan <[email protected]>
iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

Zhenzhong Duan <[email protected]>
iommu/vt-d: Fix oops due to out of scope access

Naval Alcalá <[email protected]>
iommu/vt-d: Disable DMAR for Intel Q35 IGFX

Raphael Zimmer <[email protected]>
libceph: handle rbtree insertion error in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in crush_decode()

Raphael Zimmer <[email protected]>
libceph: Fix potential null-ptr-deref in decode_choose_args()

Raphael Zimmer <[email protected]>
libceph: Fix potential out-of-bounds access in osdmap_decode()

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Allocate ITS parent LPIs as a range

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Support range allocation for LPIs

Sascha Bischoff <[email protected]>
irqchip/gic-v5: Move LPI allocation into the LPI domain

Xianwei Zhao <[email protected]>
irqchip/meson-gpio: Use the correct register in meson_s4_gpio_irq_set_type()

Yong-Xuan Wang <[email protected]>
irqchip/riscv-imsic: Clear interrupt move state during CPU offlining

Scott Mayhew <[email protected]>
nfsd: fix file change detection in CB_GETATTR

Paulo Alcantara <[email protected]>
netfs: fix error handling in netfs_extract_user_iter()

Ma Ke <[email protected]>
powerpc/warp: Fix error handling in pika_dtm_thread

Vivian Wang <[email protected]>
riscv: misaligned: Make enabling delegation depend on NONPORTABLE

Carlos López <[email protected]>
virt: sev-guest: Do not use host-controlled page order in cleanup path

Wilfred Mallawa <[email protected]>
xfs: fix memory leak on error in xfs_alloc_zone_info()

David Woodhouse <[email protected]>
x86/kexec: Push kjump return address even for non-kjump kexec

Jose Fernandez (Anthropic) <[email protected]>
iommu/amd: Bounds-check devid in __rlookup_amd_iommu()

Nicholas Carlini <[email protected]>
io-wq: check that the predecessor is hashed in io_wq_remove_pending()

Viacheslav Dubeyko <[email protected]>
ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size

Viacheslav Dubeyko <[email protected]>
ceph: fix a buffer leak in __ceph_setxattr()

Qu Wenruo <[email protected]>
btrfs: only release the dirty pages io tree after successful writes

Cássio Gabriel <[email protected]>
ALSA: usb-audio: qcom: Check offload mapping failures

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Bound MIDI endpoint descriptor scans

Cássio Gabriel <[email protected]>
ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans

Markus Kramer <[email protected]>
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book5 360 headphone

Adrien Burnett <[email protected]>

    ALSA: hda/realtek: Add mute LED quirk for HP Pavilion Laptop 16-ag0xxx

Gyeyoung Baek <[email protected]>
accel/rocket: Fix prep_bo ioctl leaking positive return from dma_resv_wait_timeout()

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-other: Fix tunable_attr_01 struct members

Derek J. Clark <[email protected]>
platform/x86: lenovo-wmi-helpers: Move gamezone enums to wmi-helpers

Srinivas Pandruvada <[email protected]>
platform/x86: intel: Move debugfs register before creating devices

Chaitanya Kumar Borah <[email protected]>
drm/i915/dp: Fix VSC dynamic range signaling for RGB formats

Edward Adam Davis <[email protected]>
drm: Replace old pointer to new idr

Myeonghun Pak <[email protected]>
drm/loongson: Use managed KMS polling

Ye Bin <[email protected]>
smb/client: fix possible infinite loop and oob read in symlink_data()

Nick Chan <[email protected]>

    nvme-apple: Reset q->sq_tail during queue init

Pauli Virtanen <[email protected]>
Bluetooth: btmtk: accept too short WMT FUNC_CTRL events

Michael Tretter <[email protected]>
media: staging: imx: configure src_mux in csi_start

Igor Pylypiv <[email protected]>
ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands

Vlad Poenaru <[email protected]>

    fuse: avoid 0x10 fault in fuse_readahead when max_pages == 0

Nathan Chancellor <[email protected]>
HID: core: Fix size_t specifier in hid_report_raw_event()

Benjamin Tissoires <[email protected]>
HID: core: introduce hid_safe_input_report()

Benjamin Tissoires <[email protected]>
HID: pass the buffer size to hid_report_raw_event

Qiang Ma <[email protected]>
KVM: x86: Fix Xen hypercall tracepoint argument assignment

Junrui Luo <[email protected]>
KVM: s390: pci: fix GAIT table indexing due to double-scaling pointer arithmetic

Aaron Sacks <[email protected]>
KVM: Reject wrapped offset in kvm_reset_dirty_gfn()

Sergio Correia <[email protected]>
audit: enforce AUDIT_LOCKED for AUDIT_TRIM and AUDIT_MAKE_EQUIV

Zoran Ilievski <[email protected]>
net: atlantic: preserve PCI wake-from-D3 on shutdown when WOL enabled

Li Xiasong <[email protected]>
netfilter: nft_ct: fix missing expect put in obj eval

Mario Limonciello <[email protected]>
Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn"

Greg Kroah-Hartman <[email protected]>
idpf: fix double free and use-after-free in aux device error paths

Guopeng Zhang <[email protected]>
cgroup/dmem: Return -ENOMEM on failed pool preallocation

Arthur Kiyanovski <[email protected]>
net: ena: PHC: Check return code before setting timestamp output

Sergio Correia <[email protected]>
audit: fix incorrect inheritable capability in CAPSET records

Li Xiasong <[email protected]>
netfilter: nf_conntrack_sip: get helper before allocating expectation

Arthur Kiyanovski <[email protected]>
net: ena: PHC: Fix potential use-after-free in get_timestamp

Breno Leitao <[email protected]>

    workqueue: Fix wq->cpu_pwq leak in alloc_and_link_pwqs() WQ_UNBOUND path

Matt Vollrath <[email protected]>
i40e: Cleanup PTP pins on probe failure

Herbert Xu <[email protected]>

    crypto: af_alg - Cap AEAD AD length to 0x80000000

Vincent Guittot <[email protected]>
sched/fair: Revert force wakeup preemption

Vincent Guittot <[email protected]>
sched/fair: Fix wakeup_preempt_fair() for not waking up task

Erni Sri Satya Vennela <[email protected]>
net: mana: Init gf_stats_work before potential error paths in probe

Dipayaan Roy <[email protected]>
net: mana: Fix use-after-free in reset service rescan path

Lorenzo Bianconi <[email protected]>
net: airoha: Fix VIP configuration for AN7583 SoC

Lorenzo Bianconi <[email protected]>
net: airoha: Use gdm port enum value whenever possible

Lorenzo Bianconi <[email protected]>
net: airoha: Remove code duplication in airoha_regs.h

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate more data-races in pie_dump_stats()

Lorenzo Bianconi <[email protected]>
net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()

Lorenzo Bianconi <[email protected]>
net: airoha: Move entries to queue head in case of DMA mapping failure in airoha_dev_xmit()

Costa Shulyupin <[email protected]>
rtla: Fix parse_cpu_set() bug introduced by strtoi()

Miklos Szeredi <[email protected]>
fuse: make sure dentry is evicted if stale

Miklos Szeredi <[email protected]>
fuse: fix race when disposing stale dentries

Dan Carpenter <[email protected]>
net: airoha: Fix a copy and paste bug in probe()

Daniel Borkmann <[email protected]>
bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation

Gao Xiang <[email protected]>
erofs: fix offset truncation when shifting pgoff on 32-bit platforms

Samiullah Khawaja <[email protected]>
PCI: Initialize temporary device in new_id_store()

Sasha Levin <[email protected]>
Revert "papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"

Sasha Levin <[email protected]>
Revert "pseries/papr-hvpipe: Fix race with interrupt handler"

Davidlohr Bueso <[email protected]>
futex: Drop CLONE_THREAD requirement for private default hash alloc

Zhaoyang Huang <[email protected]>
arm64: Reserve an extra page for early kernel mapping

Leo Yan <[email protected]>
kselftest/arm64: Include <asm/ptrace.h> for user_gcs definition

Paolo Abeni <[email protected]>
net/sched: cls_flower: revert unintended changes

Dan Carpenter <[email protected]>
sfc: fix error code in efx_devlink_info_running_versions()

Jakub Kicinski <[email protected]>
net: tls: fix strparser anchor skb leak on offload RX setup failure

Petr Oros <[email protected]>
ice: add dpll peer notification for paired SMA and U.FL pins

Ivan Vecera <[email protected]>
dpll: export __dpll_pin_change_ntf() for use under dpll_lock

Petr Oros <[email protected]>
dpll: Add notifier chain for dpll events

Ivan Vecera <[email protected]>
dpll: Allow associating dpll pin with a firmware node

Petr Oros <[email protected]>
ice: fix missing dpll notifications for SW pins

Petr Oros <[email protected]>
ice: fix SMA and U.FL pin state changes affecting paired pin

Petr Oros <[email protected]>
ice: fix missing SMA pin initialization in DPLL subsystem

Petr Oros <[email protected]>
ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw

Petr Oros <[email protected]>
ice: fix NULL pointer dereference in ice_reset_all_vfs()

Petr Oros <[email protected]>
iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler

Petr Oros <[email protected]>
iavf: wait for PF confirmation before removing VLAN filters

Petr Oros <[email protected]>
iavf: stop removing VLAN filters from PF on interface down

Petr Oros <[email protected]>
iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING

Hasan Basbunar <[email protected]>
page_pool: fix memory-provider leak in page_pool_create_percpu() error path

Eric Dumazet <[email protected]>

    bonding: 3ad: implement proper RCU rules for port->aggregator

Hangbin Liu <[email protected]>
bonding: print churn state via netlink

Lorenzo Bianconi <[email protected]>
net: airoha: Do not return err in ndo_stop() callback

Lorenzo Bianconi <[email protected]>
net: airoha: fix BQL imbalance in TX path

Shuicheng Lin <[email protected]>
drm/xe/gsc: Fix BO leak on error in query_compatibility_version()

Shuicheng Lin <[email protected]>
drm/xe/eustall: Fix drm_dev_put called before stream disable in close

Shuicheng Lin <[email protected]>
drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

Matt Roper <[email protected]>
drm/xe/debugfs: Correct printing of register whitelist ranges

Timur Kristóf <[email protected]>
drm/amd/display: Read EDID from VBIOS embedded panel info

Timur Kristóf <[email protected]>
drm/amd/display: Allow constructing DCE8 link encoder without DDC

Timur Kristóf <[email protected]>
drm/amd/display: Allow constructing DCE6 link encoder without DDC

Timur Kristóf <[email protected]>
drm/amd/display: Allow DCE link encoder without AUX registers

Sebastian Andrzej Siewior <[email protected]>
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup

Shenghao Ding <[email protected]>
ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages >1

Richard Fitzgerald <[email protected]>
ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()

wangdicheng <[email protected]>
ALSA: hda/conexant: Fix missing error check for jack detection

Breno Leitao <[email protected]>
netconsole: propagate device name truncation in dev_name_store()

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)

Eric Dumazet <[email protected]>
net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)

Weiming Shi <[email protected]>
bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

Xin Long <[email protected]>
sctp: discard stale INIT after handshake completion

Xin Long <[email protected]>
netfilter: skip recording stale or retransmitted INIT

Christian A. Ehrhardt <[email protected]>
ASoC: codecs: ab8500: Fix casting of private data

Jakub Kicinski <[email protected]>
net: psp: require admin permission for dev-set and key-rotate

Jakub Kicinski <[email protected]>
net: psp: check for device unregister when creating assoc

Jens Axboe <[email protected]>
io_uring/napi: cap busy_poll_to 10 msec

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring

Yinjie Yao <[email protected]>
drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings

Yinjie Yao <[email protected]>
drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings

Heiko Schocher <[email protected]>
net: phy: dp83869: fix setting CLK_O_SEL field.

Heiko Carstens <[email protected]>
s390/mm: Fix phys_to_folio() usage in do_secure_storage_access()

Yu Kuai <[email protected]>
md/md-bitmap: add a none backend for bitmap grow

Yu Kuai <[email protected]>
md/md-bitmap: split bitmap sysfs groups

Yu Kuai <[email protected]>
md: factor bitmap creation away from sysfs handling

Yu Kuai <[email protected]>
md: add fallback to correct bitmap_ops on version mismatch

Keith Busch <[email protected]>
md/raid1,raid10: don't fail devices for invalid IO errors

William A. Kennington III <[email protected]>
net: mctp i2c: check length before marking flow active

Zicheng Qu <[email protected]>
sched/fair: Clear rel_deadline when initializing forked entities

Vincent Guittot <[email protected]>
sched/fair: Fix wakeup_preempt_fair() vs delayed dequeue

Mel Gorman <[email protected]>
sched/fair: Reimplement NEXT_BUDDY to align with EEVDF goals

Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams

Breno Leitao <[email protected]>
netpoll: fix IPv6 local-address corruption

Altan Hacigumus <[email protected]>
tcp: make probe0 timer handle expired user timeout

Florian Westphal <[email protected]>
neigh: let neigh_xmit take skb ownership

Weiming Shi <[email protected]>
net/sched: taprio: fix NULL pointer dereference in class dump

Paul Geurts <[email protected]>
NFC: trf7970a: Ignore antenna noise when checking for RF field

Felix Gu <[email protected]>
spi: amlogic-spisg: initialize completion before requesting IRQ

Morduan Zang <[email protected]>
net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit

Zhan Jun <[email protected]>

    net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

Ido Schimmel <[email protected]>
vrf: Fix a potential NPD when removing a port from a VRF

Eric Dumazet <[email protected]>
net/sched: sch_fq_pie: annotate data-races in fq_pie_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_choke: annotate data-races in choke_dump_stats()

Lorenzo Bianconi <[email protected]>
net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

Lorenzo Bianconi <[email protected]>
net: airoha: Do not wake all netdev TX queues in airoha_qdma_wake_netdev_txqs()

Zhengping Zhang <[email protected]>
net: airoha: fix typo in function name

Lorenzo Bianconi <[email protected]>
net: airoha: stop net_device TX queue before updating CPU index

Stephen Hemminger <[email protected]>
net/sched: netem: check for negative latency and jitter

Stephen Hemminger <[email protected]>
net/sched: netem: fix slot delay calculation overflow

Stephen Hemminger <[email protected]>
net/sched: netem: validate slot configuration

Stephen Hemminger <[email protected]>
net/sched: netem: only reseed PRNG when seed is explicitly provided

Stephen Hemminger <[email protected]>
net/sched: netem: fix queue limit check to include reordered packets

Stephen Hemminger <[email protected]>
net/sched: netem: fix probability gaps in 4-state loss model

Nikola Z. Ivanov <[email protected]>
netdevsim: zero initialize struct iphdr in dummy sk_buff

Daan De Meyer <[email protected]>
cdrom, scsi: sr: propagate read-only status to block layer via set_disk_ro()

Tony Luck <[email protected]>
ACPI: APEI: EINJ: Fix EINJV2 memory error injection

Tony Luck <[email protected]>
ACPICA: Provide #defines for EINJV2 error types

Wentao Guan <[email protected]>
arm64/scs: Fix potential sign extension issue of advance_loc4

Geert Uytterhoeven <[email protected]>

    drm/color-mgmt: Typo s/R332/RGB332/

Yuho Choi <[email protected]>
drm/sysfb: ofdrm: fix PCI device reference leaks

James Calligeros <[email protected]>
ASoC: tas2770: Fix order of operations for temperature calculation

James Calligeros <[email protected]>
ASoC: tas2764: Mark die temp register as volatile

John Madieu <[email protected]>
spi: rockchip: Read ISR, not IMR, to detect cs-inactive IRQ

Guilherme G. Piccoli <[email protected]>
ASoC: amd: acp: Add DMI quirk for Valve Steam Deck OLED

Florian Westphal <[email protected]>
netfilter: nf_conntrack_sip: don't use simple_strtoul

Jiexun Wang <[email protected]>
netfilter: xt_policy: fix strict mode inbound policy matching

Timur Kristóf <[email protected]>
drm/amdgpu/gfx6: Support harvested SI chips with disabled TCCs (v2)

Timur Kristóf <[email protected]>
drm/amdgpu/uvd3.1: Don't validate the firmware when already validated

Christian König <[email protected]>
drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG

Timur Kristóf <[email protected]>
drm/amdgpu/gmc: Fix AMDGPU_GART_PLACEMENT_LOW to not overlap with VRAM

Keith Busch <[email protected]>
nvme-pci: fix missed admin queue sq doorbell write

Florian Westphal <[email protected]>
netfilter: nf_tables: use list_del_rcu for netlink hooks

Pablo Neira Ayuso <[email protected]>
netfilter: arp_tables: fix IEEE1394 ARP payload parsing

Maurizio Lombardi <[email protected]>
nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

Breno Leitao <[email protected]>
tracing: branch: Fix inverted check on stat tracer registration

Petr Malat <[email protected]>
cgroup: Increment nr_dying_subsys_* from rmdir context

Mark Harmstone <[email protected]>
btrfs: fix double-decrement of bytes_may_use in submit_one_async_extent()

Amir Goldstein <[email protected]>
fsnotify: fix inode reference leak in fsnotify_recalc_mask()

Wolfram Sang <[email protected]>
mailbox: mailbox-test: make data_ready a per-instance variable

Wolfram Sang <[email protected]>
mailbox: mailbox-test: initialize struct earlier

Wolfram Sang <[email protected]>
mailbox: mailbox-test: don't free the reused channel

Wolfram Sang <[email protected]>
mailbox: add sanity check for channel array

cuitao <[email protected]>
cgroup/rdma: fix integer overflow in rdmacg_try_charge()

Edward Adam Davis <[email protected]>
sched/psi: fix race between file release and pressure write

Wolfram Sang <[email protected]>
mailbox: mailbox-test: free channels on probe error

Jason-JH Lin <[email protected]>
mailbox: mtk-cmdq: Fix CURR and END addr for task insert case

Thomas Weißschuh <[email protected]>
kbuild: Never respect CONFIG_WERROR / W=e to fixdep

David Arcari <[email protected]>
tools/power turbostat: Fix unrecognized option '-P'

Len Brown <[email protected]>

    tools/power turbostat: Fix and document --header_iterations

Kaushlendra Kumar <[email protected]>
tools/power turbostat: Use strtoul() for iteration parsing

Len Brown <[email protected]>
tools/power turbostat.8: Document the "--force" option

Yuho Choi <[email protected]>
fbdev: offb: fix PCI device reference leak on probe failure

Mathias Krause <[email protected]>
kbuild: builddeb - avoid recompiles for non-cross-compiles

Anthony Pighin (Nokia) <[email protected]>

    rtc: abx80x: Disable alarm feature if no interrupt attached

Bae Yeonju <[email protected]>
fs/adfs: validate nzones in adfs_validate_bblk()

Christian Brauner <[email protected]>
eventpoll: fix ep_remove struct eventpoll / struct file UAF

Christian Brauner <[email protected]>
eventpoll: move epi_fget() up

Christian Brauner <[email protected]>
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

Christian Brauner <[email protected]>
eventpoll: kill __ep_remove()

Christian Brauner <[email protected]>
eventpoll: split __ep_remove()

Christian Brauner <[email protected]>
eventpoll: use hlist_is_singular_node() in __ep_remove()

Randy Dunlap <[email protected]>
nstree: fix func. parameter kernel-doc warnings

Kohei Enju <[email protected]>
vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()

Lee Jones <[email protected]>
tipc: fix double-free in tipc_buf_append()

Jiayuan Chen <[email protected]>
tcp: send a challenge ACK on SEG.ACK > SND.NXT

Alexey Kodanev <[email protected]>
nfp: fix swapped arguments in nfp_encode_basic_qdr() calls

Brett Creeley <[email protected]>
virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET

Stefano Garzarella <[email protected]>
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting

Erni Sri Satya Vennela <[email protected]>
net: mana: Fix EQ leak in mana_remove on NULL port

Dipayaan Roy <[email protected]>
net: mana: Implement ndo_tx_timeout and serialize queue resets per port.

Long Li <[email protected]>
net: mana: Handle hardware recovery events when probing the device

Aditya Garg <[email protected]>
net: mana: Handle SKB if TX SGEs exceed hardware limit

Erni Sri Satya Vennela <[email protected]>
net: mana: Don't overwrite port probe error with add_adev result

Erni Sri Satya Vennela <[email protected]>
net: mana: Add standard counter rx_missed_errors

Erni Sri Satya Vennela <[email protected]>
net: mana: Move hardware counter stats from per-port to per-VF context

Erni Sri Satya Vennela <[email protected]>
net: mana: Guard mana_remove against double invocation

Erni Sri Satya Vennela <[email protected]>
net: mana: Init link_change_work before potential error paths in probe

Lorenzo Bianconi <[email protected]>
net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup()

Lorenzo Bianconi <[email protected]>
net: airoha: Rework the code flow in airoha_remove() and in airoha_probe() error path

Lorenzo Bianconi <[email protected]>
net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()

Mieczyslaw Nalewaj <[email protected]>
net: dsa: realtek: rtl8365mb: fix mode mask calculation

Lorenzo Bianconi <[email protected]>
net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()

Lorenzo Bianconi <[email protected]>
net: airoha: Add the capability to consume out-of-order DMA tx descriptors

Lorenzo Bianconi <[email protected]>
net: airoha: Add AN7583 SoC support

Lorenzo Bianconi <[email protected]>
net: airoha: Refactor src port configuration in airhoha_set_gdm2_loopback

Lorenzo Bianconi <[email protected]>
net: airoha: ppe: Move PPE memory info in airoha_eth_soc_data struct

Lorenzo Bianconi <[email protected]>
net: airoha: ppe: Dynamically allocate foe_check_time array in airoha_ppe struct

Eric Dumazet <[email protected]>
net/sched: sch_sfb: annotate data-races in sfb_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_red: annotate data-races in red_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()

Eric Dumazet <[email protected]>
net/sched: sch_pie: annotate data-races in pie_dump_stats()

Eric Dumazet <[email protected]>
net_sched: sch_hhf: annotate data-races in hhf_dump_stats()

Jacob Keller <[email protected]>
ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g

Jacob Keller <[email protected]>
ice: fix ready bitmap check for non-E822 devices

Grzegorz Nitka <[email protected]>
ice: perform PHY soft reset for E825C ports at initialization

Grzegorz Nitka <[email protected]>
ice: fix timestamp interrupt configuration for E825C

Michael Bommarito <[email protected]>
net/rds: zero per-item info buffer before handing it to visitors

Vikas Gupta <[email protected]>
bnge: remove unsupported backing store type

Vikas Gupta <[email protected]>
bnge: fix initial HWRM sequence

Kohei Enju <[email protected]>

    net: validate skb->napi_id in RX tracepoints

Hyunwoo Kim <[email protected]>

    ksmbd: scope conn->binding slowpath to bound sessions only

DaeMyung Kang <[email protected]>
ksmbd: fix durable fd leak on ClientGUID mismatch in durable v2 open

DaeMyung Kang <[email protected]>
ksmbd: destroy async_ida in ksmbd_conn_free()

DaeMyung Kang <[email protected]>
ksmbd: destroy tree_conn_ida in ksmbd_session_destroy()

Sangyun Kim <[email protected]>
pwm: atmel-tcb: Cache clock rates and mark chip as atomic

Jun Yan <[email protected]>
arm64: dts: meson-gxl-p230: fix ethernet PHY interrupt number

Anand Moon <[email protected]>
arm64: dts: amlogic: meson-axg: Add missing cache information to cpu0

Chia-Yu Chang <[email protected]>
net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()

Weiming Shi <[email protected]>
slip: bound decode() reads against the compressed packet length

Weiming Shi <[email protected]>
slip: reject VJ receive packets on instances with no rstate array

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

Fernando Fernandez Mancera <[email protected]>
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

Yingnan Zhang <[email protected]>
ipvs: fix MTU check for GSO packets in tunnel mode

Pablo Neira Ayuso <[email protected]>
netfilter: nat: use kfree_rcu to release ops

Pablo Neira Ayuso <[email protected]>
netfilter: xtables: restrict several matches to inet family

Florian Westphal <[email protected]>
netfilter: conntrack: remove sprintf usage

Xiang Mei <[email protected]>
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

Pablo Neira Ayuso <[email protected]>
netfilter: nft_osf: restrict it to ipv4

Lorenzo Bianconi <[email protected]>
net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()

Weiming Shi <[email protected]>
openvswitch: cap upcall PID array size and pre-size vport replies

Prathamesh Deshpande <[email protected]>
net/mlx5: Fix HCA caps leak on notifier init failure

Qingfang Deng <[email protected]>
pppoe: drop PFC frames

Michael Bommarito <[email protected]>
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks

Eric Dumazet <[email protected]>
ipv6: fix possible UAF in icmpv6_rcv()

Matt Vollrath <[email protected]>
e1000e: Unroll PTP in probe error handling

Petr Oros <[email protected]>
iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2

Kohei Enju <[email protected]>
i40e: don't advertise IFF_SUPP_NOFCS

Paul Greenwalt <[email protected]>
ice: fix ICE_AQ_LINK_SPEED_M for 200G

Michal Schmidt <[email protected]>
ice: fix double-free of tx_buf skb

Alice Mikityanska <[email protected]>
ice: Remove jumbo_remove step from TX path

Grzegorz Nitka <[email protected]>
ice: update PCS latency settings for E825 10G/25Gb modes

Grzegorz Nitka <[email protected]>
ice: fix 'adjust' timer programming for E830 devices

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->plb_rehash

Eric Dumazet <[email protected]>

    tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->timeout_rehash

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->srtt_us

Eric Dumazet <[email protected]>
tcp: better handle TCP_TX_DELAY on established flows

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->reord_seen

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->dsack_dups

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_retrans

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->bytes_sent

Eric Dumazet <[email protected]>
tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->delivered and tp->delivered_ce

Eric Dumazet <[email protected]>

    tcp: annotate data-races around tp->snd_ssthresh

Eric Dumazet <[email protected]>

    tcp: add data-races annotations around tp->reordering, tp->snd_cwnd

Eric Dumazet <[email protected]>

    tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans

Eric Dumazet <[email protected]>
tcp: annotate data-races in tcp_get_info_chrono_stats()

Eric Dumazet <[email protected]>
tcp: inline tcp_chrono_start()

Eric Dumazet <[email protected]>

    tcp: move tp->chrono_type next tp->chrono_stat[]

Akif <[email protected]>
ksmbd: fix use-after-free in smb2_open during durable reconnect

ZhangGuoDong <[email protected]>
smb: move smb_version_values to common/smbglob.h

Wei Fang <[email protected]>
net: enetc: fix NTMP DMA use-after-free issue

Wei Fang <[email protected]>
net: enetc: correct the command BD ring consumer index

Stanislav Fomichev <[email protected]>
net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops

Vladimir Oltean <[email protected]>
net: dsa: append ethtool counters of all hidden ports to conduit

Vladimir Oltean <[email protected]>
net: dsa: use kernel data types for ethtool ops on conduit

Vladimir Oltean <[email protected]>

    net: dsa: cpu_dp->orig_ethtool_ops might be NULL

Vinicius Costa Gomes <[email protected]>
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch

Lorenzo Bianconi <[email protected]>
net: airoha: Wait for NPU PPE configuration to complete in airoha_ppe_offload_setup()

Jiayuan Chen <[email protected]>
nexthop: fix IPv6 route referencing IPv4 nexthop

Dudu Lu <[email protected]>
net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys

Dudu Lu <[email protected]>
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF

Dudu Lu <[email protected]>
net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

Uwe Kleine-König <[email protected]>
pwm: stm32: Fix rounding issue for requests with inverted polarity

Gabor Juhos <[email protected]>
arm64: dts: marvell: armada-37xx: use 'usb2-phy' in USB3 controller's phy-names

Peng Fan <[email protected]>
arm64: dts: imx8mm-tqma8mqml: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mn-tqma8mqnl: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mm-emtop-som: Correct PAD settings for PMIC_nINT

Ronald Claveau <[email protected]>
reset: amlogic: t7: Fix null reset ops

René Rebe <[email protected]>
PCMCIA: Fix garbled log messages for KERN_CONT

Peng Fan <[email protected]>
arm64: dts: imx8mp-data-modul-edm-sbc: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-dhcom-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-ultra-mach-sbc: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-sr-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-nitrogen-som: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-aristainetos3a-som-v1: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-edm-g: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-icore-mx8mp: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-navqp: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-debix-som-a: Correct PAD settings for PMIC_nINT

Peng Fan <[email protected]>
arm64: dts: imx8mp-debix-model-a: Correct PAD settings for PMIC_nINT

Gao Xiang <[email protected]>
erofs: unify lcn as u64 for 32-bit platforms

Paul Moses <[email protected]>
crypto: ccp - copy IV using skcipher ivsize

T Pratham <[email protected]>
crypto: sa2ul - Fix AEAD fallback algorithm names

Aleksander Jan Bajkowski <[email protected]>
crypto: eip93 - fix hmac setkey algo selection

Sami Mujawar <[email protected]>
virt: arm-cca-guest: fix error check for RSI_INCOMPLETE

Ville Syrjälä <[email protected]>
drm/i915/wm: Verify the correct plane DDB entry

Yongpeng Yang <[email protected]>
f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

Jaegeuk Kim <[email protected]>
f2fs: allow empty mount string for Opt_usr|grp|projjquota

Brian Masney <[email protected]>
clk: visconti: pll: initialize clk_init_data to zero

Jagadeesh Kona <[email protected]>
clk: qcom: gcc-x1e80100: Keep GCC USB QTB clock always ON

Zhiguo Niu <[email protected]>
f2fs: fix to preserve previous reserve_{blocks,node} value when remount

Chao Yu <[email protected]>
f2fs: expand scalability of f2fs mount option

Geert Uytterhoeven <[email protected]>
lib/hexdump: print_hex_dump_bytes() calls print_hex_dump_debug()

Vladimir Zapolskiy <[email protected]>
clk: qcom: gdsc: Fix error path on registration of multiple pm subdomains

Jianan Huang <[email protected]>
f2fs: avoid reading already updated pages during GC

Chao Yu <[email protected]>
f2fs: use f2fs_filemap_get_folio() instead of f2fs_pagecache_get_page()

Shuwei Wu <[email protected]>
clk: spacemit: ccu_mix: fix inverted condition in ccu_mix_trigger_fc()

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-sc7180: Add missing MDSS resets

Konrad Dybcio <[email protected]>
dt-bindings: clock: qcom,dispcc-sc7180: Define MDSS resets

Geert Uytterhoeven <[email protected]>
clk: xgene: Fix mapping leak in xgene_pllclk_init()

Arnd Bergmann <[email protected]>
clk: qoriq: avoid format string warning

Thomas Weißschuh <[email protected]>
x86/um: fix vDSO installation

Thomas Weißschuh <[email protected]>
x86/um/vdso: Drop VDSO64-y from Makefile

Sebastian Krzyszkowiak <[email protected]>
clk: imx8mq: Correct the CSI PHY sels

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in of_assigned_ldb_sels()

Felix Gu <[email protected]>
clk: imx: imx6q: Fix device node reference leak in pll6_bypassed()

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Enable parents for pixel clocks

Val Packett <[email protected]>
clk: qcom: dispcc-sm8250: Use shared ops on the mdss vsync clk

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for PCIe power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Use retention for USB power domains

Val Packett <[email protected]>

    clk: qcom: gcc-sc8180x: Add missing GDSCs

Val Packett <[email protected]>

    dt-bindings: clock: qcom,gcc-sc8180x: Add missing GDSCs

Shawn Lin <[email protected]>
scsi: ufs: rockchip,rk3576-ufshc: dt-bindings: Add new mphy reset item

Junrui Luo <[email protected]>
scsi: target: core: Fix integer overflow in UNMAP bounds check

Fabrizio Castro <[email protected]>

    clk: renesas: r9a09g057: Remove entries for WDT{0,2,3}

Ovidiu Panait <[email protected]>
clk: renesas: r9a09g057: Fix ordering of module clocks array

Lad Prabhakar <[email protected]>
clk: renesas: r9a09g057: Add entries for RSCIs

Ovidiu Panait <[email protected]>
clk: renesas: r9a09g057: Add clock and reset entries for RTC

Konrad Dybcio <[email protected]>
clk: qcom: dispcc[01]-sa8775p: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-sm4450: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-milos: Fix DSI byte clock rate setting

Konrad Dybcio <[email protected]>
clk: qcom: dispcc-glymur: Fix DSI byte clock rate setting

White Lewis <[email protected]>

    clk: qcom: dispcc-sc8280xp: remove CLK_SET_RATE_PARENT from byte_div_clk_src dividers

Yang Erkun <[email protected]>
scsi: sg: Resolve soft lockup issue when opening /dev/sgX

Yang Erkun <[email protected]>
scsi: sg: Fix sysctl sg-big-buff register during sg_init()

Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: sun55i-a523-r: Add missing r-spi module clock

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-sm8450: use RCG2 ops for DPTX1 AUX clock source

Dmitry Baryshkov <[email protected]>
clk: qcom: dispcc-glymur: use RCG2 ops for DPTX1 AUX clock source

Taniya Das <[email protected]>
clk: qcom: gcc-glymur: Add video axi clock resets for glymur

Taniya Das <[email protected]>
dt-bindings: clock: qcom: Add GCC video axi reset clock for Glymur