commit: 12fb365205f621fb2cc57979b9990a87c6c46cf0 Author: Arisu Tachibana <alicef <AT> gentoo <DOT> org> AuthorDate: Mon Oct 6 11:06:02 2025 +0000 Commit: Arisu Tachibana <alicef <AT> gentoo <DOT> org> CommitDate: Mon Oct 6 11:08:33 2025 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=12fb3652
Linux patch 6.17.1 Signed-off-by: Arisu Tachibana <alicef <AT> gentoo.org> 0000_README | 5 + 1000_linux-6.17.1.patch | 659 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 664 insertions(+) diff --git a/0000_README b/0000_README index f2189223..50189b54 100644 --- a/0000_README +++ b/0000_README @@ -42,6 +42,11 @@ EXPERIMENTAL Individual Patch Descriptions: -------------------------------------------------------------------------- + +Patch: 1000_linux-6.17.1.patch +From: https://www.kernel.org +Desc: Linux 6.17.1 + Patch: 1510_fs-enable-link-security-restrictions-by-default.patch From: http://sources.debian.net/src/linux/3.16.7-ckt4-3/debian/patches/debian/fs-enable-link-security-restrictions-by-default.patch/ Desc: Enable link security restrictions by default. diff --git a/1000_linux-6.17.1.patch b/1000_linux-6.17.1.patch new file mode 100644 index 00000000..1266cc07 --- /dev/null +++ b/1000_linux-6.17.1.patch @@ -0,0 +1,659 @@ +diff --git a/Makefile b/Makefile +index 82bb9cdf73a32b..389bfac0adaaac 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 6 + PATCHLEVEL = 17 +-SUBLEVEL = 0 ++SUBLEVEL = 1 + EXTRAVERSION = + NAME = Baby Opossum Posse + +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index d880c50629d612..5cffa5668d0c38 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -622,6 +622,7 @@ int blk_mq_tag_update_depth(struct blk_mq_hw_ctx *hctx, + return -ENOMEM; + + blk_mq_free_map_and_rqs(set, *tagsptr, hctx->queue_num); ++ hctx->queue->elevator->et->tags[hctx->queue_num] = new; + *tagsptr = new; + } else { + /* +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 1cc7636e446d77..5042cf612d21e8 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -2245,10 +2245,10 @@ static int tc358743_probe(struct i2c_client *client) + err_work_queues: + cec_unregister_adapter(state->cec_adap); + if (!state->i2c_client->irq) { +- timer_delete(&state->timer); ++ timer_delete_sync(&state->timer); + flush_work(&state->work_i2c_poll); + } +- cancel_delayed_work(&state->delayed_work_enable_hotplug); ++ cancel_delayed_work_sync(&state->delayed_work_enable_hotplug); + mutex_destroy(&state->confctl_mutex); + err_hdl: + media_entity_cleanup(&sd->entity); +diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/flexcop-pci.c +index 486c8ec0fa60d9..ab53c5b02c48df 100644 +--- a/drivers/media/pci/b2c2/flexcop-pci.c ++++ b/drivers/media/pci/b2c2/flexcop-pci.c +@@ -411,7 +411,7 @@ static void flexcop_pci_remove(struct pci_dev *pdev) + struct flexcop_pci *fc_pci = pci_get_drvdata(pdev); + + if (irq_chk_intv > 0) +- cancel_delayed_work(&fc_pci->irq_check_work); ++ cancel_delayed_work_sync(&fc_pci->irq_check_work); + + flexcop_pci_dma_exit(fc_pci); + flexcop_device_exit(fc_pci->fc_dev); +diff --git a/drivers/media/platform/qcom/iris/iris_buffer.c b/drivers/media/platform/qcom/iris/iris_buffer.c +index 6425e4919e3b0b..9f664c24114936 100644 +--- a/drivers/media/platform/qcom/iris/iris_buffer.c ++++ b/drivers/media/platform/qcom/iris/iris_buffer.c +@@ -413,6 +413,16 @@ static int iris_destroy_internal_buffers(struct iris_inst *inst, u32 plane, bool + } + } + ++ if (force) { ++ buffers = &inst->buffers[BUF_PERSIST]; ++ ++ list_for_each_entry_safe(buf, next, &buffers->list, list) { ++ ret = iris_destroy_internal_buffer(inst, buf); ++ if (ret) ++ return ret; ++ } ++ } ++ + return 0; + } + +diff --git a/drivers/media/platform/st/stm32/stm32-csi.c b/drivers/media/platform/st/stm32/stm32-csi.c +index b69048144cc12b..fd2b6dfbd44c57 100644 +--- a/drivers/media/platform/st/stm32/stm32-csi.c ++++ b/drivers/media/platform/st/stm32/stm32-csi.c +@@ -443,8 +443,7 @@ static void stm32_csi_phy_reg_write(struct stm32_csi_dev *csidev, + static int stm32_csi_start(struct stm32_csi_dev *csidev, + struct v4l2_subdev_state *state) + { +- struct media_pad *src_pad = +- &csidev->s_subdev->entity.pads[csidev->s_subdev_pad_nb]; ++ struct media_pad *src_pad; + const struct stm32_csi_mbps_phy_reg *phy_regs = NULL; + struct v4l2_mbus_framefmt *sink_fmt; + const struct stm32_csi_fmts *fmt; +@@ -466,6 +465,7 @@ static int stm32_csi_start(struct stm32_csi_dev *csidev, + if (!csidev->s_subdev) + return -EIO; + ++ src_pad = &csidev->s_subdev->entity.pads[csidev->s_subdev_pad_nb]; + link_freq = v4l2_get_link_freq(src_pad, + fmt->bpp, 2 * csidev->num_lanes); + if (link_freq < 0) +diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c +index f5221b01880813..cf3e6e43c0c7e4 100644 +--- a/drivers/media/rc/imon.c ++++ b/drivers/media/rc/imon.c +@@ -536,7 +536,9 @@ static int display_open(struct inode *inode, struct file *file) + + mutex_lock(&ictx->lock); + +- if (!ictx->display_supported) { ++ if (ictx->disconnected) { ++ retval = -ENODEV; ++ } else if (!ictx->display_supported) { + pr_err("display not supported by device\n"); + retval = -ENODEV; + } else if (ictx->display_isopen) { +@@ -598,6 +600,9 @@ static int send_packet(struct imon_context *ictx) + int retval = 0; + struct usb_ctrlrequest *control_req = NULL; + ++ if (ictx->disconnected) ++ return -ENODEV; ++ + /* Check if we need to use control or interrupt urb */ + if (!ictx->tx_control) { + pipe = usb_sndintpipe(ictx->usbdev_intf0, +@@ -949,12 +954,14 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, + static const unsigned char vfd_packet6[] = { + 0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF }; + +- if (ictx->disconnected) +- return -ENODEV; +- + if (mutex_lock_interruptible(&ictx->lock)) + return -ERESTARTSYS; + ++ if (ictx->disconnected) { ++ retval = -ENODEV; ++ goto exit; ++ } ++ + if (!ictx->dev_present_intf0) { + pr_err_ratelimited("no iMON device present\n"); + retval = -ENODEV; +@@ -1029,11 +1036,13 @@ static ssize_t lcd_write(struct file *file, const char __user *buf, + int retval = 0; + struct imon_context *ictx = file->private_data; + +- if (ictx->disconnected) +- return -ENODEV; +- + mutex_lock(&ictx->lock); + ++ if (ictx->disconnected) { ++ retval = -ENODEV; ++ goto exit; ++ } ++ + if (!ictx->display_supported) { + pr_err_ratelimited("no iMON display present\n"); + retval = -ENODEV; +@@ -2499,7 +2508,11 @@ static void imon_disconnect(struct usb_interface *interface) + int ifnum; + + ictx = usb_get_intfdata(interface); ++ ++ mutex_lock(&ictx->lock); + ictx->disconnected = true; ++ mutex_unlock(&ictx->lock); ++ + dev = ictx->dev; + ifnum = interface->cur_altsetting->desc.bInterfaceNumber; + +diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c +index 30aa4ee958bdea..ec9a3cd4784e1f 100644 +--- a/drivers/media/tuners/xc5000.c ++++ b/drivers/media/tuners/xc5000.c +@@ -1304,7 +1304,7 @@ static void xc5000_release(struct dvb_frontend *fe) + mutex_lock(&xc5000_list_mutex); + + if (priv) { +- cancel_delayed_work(&priv->timer_sleep); ++ cancel_delayed_work_sync(&priv->timer_sleep); + hybrid_tuner_release_state(priv); + } + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 775bede0d93d9b..50e1589668ba50 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -137,6 +137,9 @@ struct uvc_entity *uvc_entity_by_id(struct uvc_device *dev, int id) + { + struct uvc_entity *entity; + ++ if (id == UVC_INVALID_ENTITY_ID) ++ return NULL; ++ + list_for_each_entry(entity, &dev->entities, list) { + if (entity->id == id) + return entity; +@@ -795,14 +798,27 @@ static const u8 uvc_media_transport_input_guid[16] = + UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT; + static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING; + +-static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id, +- unsigned int num_pads, unsigned int extra_size) ++static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type, ++ u16 id, unsigned int num_pads, ++ unsigned int extra_size) + { + struct uvc_entity *entity; + unsigned int num_inputs; + unsigned int size; + unsigned int i; + ++ /* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */ ++ if (id == 0) { ++ dev_err(&dev->intf->dev, "Found Unit with invalid ID 0\n"); ++ id = UVC_INVALID_ENTITY_ID; ++ } ++ ++ /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */ ++ if (uvc_entity_by_id(dev, id)) { ++ dev_err(&dev->intf->dev, "Found multiple Units with ID %u\n", id); ++ id = UVC_INVALID_ENTITY_ID; ++ } ++ + extra_size = roundup(extra_size, sizeof(*entity->pads)); + if (num_pads) + num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1; +@@ -812,7 +828,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id, + + num_inputs; + entity = kzalloc(size, GFP_KERNEL); + if (entity == NULL) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + entity->id = id; + entity->type = type; +@@ -924,10 +940,10 @@ static int uvc_parse_vendor_control(struct uvc_device *dev, + break; + } + +- unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3], +- p + 1, 2*n); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT, ++ buffer[3], p + 1, 2 * n); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->guid, &buffer[4], 16); + unit->extension.bNumControls = buffer[20]; +@@ -1036,10 +1052,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3], +- 1, n + p); +- if (term == NULL) +- return -ENOMEM; ++ term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT, ++ buffer[3], 1, n + p); ++ if (IS_ERR(term)) ++ return PTR_ERR(term); + + if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) { + term->camera.bControlSize = n; +@@ -1095,10 +1111,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return 0; + } + +- term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3], +- 1, 0); +- if (term == NULL) +- return -ENOMEM; ++ term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT, ++ buffer[3], 1, 0); ++ if (IS_ERR(term)) ++ return PTR_ERR(term); + + memcpy(term->baSourceID, &buffer[7], 1); + +@@ -1117,9 +1133,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], ++ p + 1, 0); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->baSourceID, &buffer[5], p); + +@@ -1139,9 +1156,9 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->baSourceID, &buffer[4], 1); + unit->processing.wMaxMultiplier = +@@ -1168,9 +1185,10 @@ static int uvc_parse_standard_control(struct uvc_device *dev, + return -EINVAL; + } + +- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n); +- if (unit == NULL) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], ++ p + 1, n); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + memcpy(unit->guid, &buffer[4], 16); + unit->extension.bNumControls = buffer[20]; +@@ -1315,9 +1333,10 @@ static int uvc_gpio_parse(struct uvc_device *dev) + return dev_err_probe(&dev->intf->dev, irq, + "No IRQ for privacy GPIO\n"); + +- unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1); +- if (!unit) +- return -ENOMEM; ++ unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT, ++ UVC_EXT_GPIO_UNIT_ID, 0, 1); ++ if (IS_ERR(unit)) ++ return PTR_ERR(unit); + + unit->gpio.gpio_privacy = gpio_privacy; + unit->gpio.irq = irq; +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index 757254fc4fe930..37bb8167abe9ac 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -41,6 +41,8 @@ + #define UVC_EXT_GPIO_UNIT 0x7ffe + #define UVC_EXT_GPIO_UNIT_ID 0x100 + ++#define UVC_INVALID_ENTITY_ID 0xffff ++ + /* ------------------------------------------------------------------------ + * Driver specific constants. + */ +diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c +index 378ac96b861b70..1a42b4abe71682 100644 +--- a/drivers/net/wireless/ath/ath11k/qmi.c ++++ b/drivers/net/wireless/ath/ath11k/qmi.c +@@ -2557,7 +2557,7 @@ static int ath11k_qmi_m3_load(struct ath11k_base *ab) + GFP_KERNEL); + if (!m3_mem->vaddr) { + ath11k_err(ab, "failed to allocate memory for M3 with size %zu\n", +- fw->size); ++ m3_len); + ret = -ENOMEM; + goto out; + } +diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c +index 57590f5577a360..b9c2224dde4a37 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -1073,6 +1073,14 @@ rtw89_core_tx_update_desc_info(struct rtw89_dev *rtwdev, + } + } + ++static void rtw89_tx_wait_work(struct wiphy *wiphy, struct wiphy_work *work) ++{ ++ struct rtw89_dev *rtwdev = container_of(work, struct rtw89_dev, ++ tx_wait_work.work); ++ ++ rtw89_tx_wait_list_clear(rtwdev); ++} ++ + void rtw89_core_tx_kick_off(struct rtw89_dev *rtwdev, u8 qsel) + { + u8 ch_dma; +@@ -1090,6 +1098,8 @@ int rtw89_core_tx_kick_off_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *sk + unsigned long time_left; + int ret = 0; + ++ lockdep_assert_wiphy(rtwdev->hw->wiphy); ++ + wait = kzalloc(sizeof(*wait), GFP_KERNEL); + if (!wait) { + rtw89_core_tx_kick_off(rtwdev, qsel); +@@ -1097,18 +1107,23 @@ int rtw89_core_tx_kick_off_and_wait(struct rtw89_dev *rtwdev, struct sk_buff *sk + } + + init_completion(&wait->completion); ++ wait->skb = skb; + rcu_assign_pointer(skb_data->wait, wait); + + rtw89_core_tx_kick_off(rtwdev, qsel); + time_left = wait_for_completion_timeout(&wait->completion, + msecs_to_jiffies(timeout)); +- if (time_left == 0) +- ret = -ETIMEDOUT; +- else if (!wait->tx_done) +- ret = -EAGAIN; + +- rcu_assign_pointer(skb_data->wait, NULL); +- kfree_rcu(wait, rcu_head); ++ if (time_left == 0) { ++ ret = -ETIMEDOUT; ++ list_add_tail(&wait->list, &rtwdev->tx_waits); ++ wiphy_delayed_work_queue(rtwdev->hw->wiphy, &rtwdev->tx_wait_work, ++ RTW89_TX_WAIT_WORK_TIMEOUT); ++ } else { ++ if (!wait->tx_done) ++ ret = -EAGAIN; ++ rtw89_tx_wait_release(wait); ++ } + + return ret; + } +@@ -4978,6 +4993,7 @@ void rtw89_core_stop(struct rtw89_dev *rtwdev) + wiphy_work_cancel(wiphy, &btc->dhcp_notify_work); + wiphy_work_cancel(wiphy, &btc->icmp_notify_work); + cancel_delayed_work_sync(&rtwdev->txq_reinvoke_work); ++ wiphy_delayed_work_cancel(wiphy, &rtwdev->tx_wait_work); + wiphy_delayed_work_cancel(wiphy, &rtwdev->track_work); + wiphy_delayed_work_cancel(wiphy, &rtwdev->track_ps_work); + wiphy_delayed_work_cancel(wiphy, &rtwdev->chanctx_work); +@@ -5203,6 +5219,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev) + INIT_LIST_HEAD(&rtwdev->scan_info.pkt_list[band]); + } + INIT_LIST_HEAD(&rtwdev->scan_info.chan_list); ++ INIT_LIST_HEAD(&rtwdev->tx_waits); + INIT_WORK(&rtwdev->ba_work, rtw89_core_ba_work); + INIT_WORK(&rtwdev->txq_work, rtw89_core_txq_work); + INIT_DELAYED_WORK(&rtwdev->txq_reinvoke_work, rtw89_core_txq_reinvoke_work); +@@ -5214,6 +5231,7 @@ int rtw89_core_init(struct rtw89_dev *rtwdev) + wiphy_delayed_work_init(&rtwdev->coex_rfk_chk_work, rtw89_coex_rfk_chk_work); + wiphy_delayed_work_init(&rtwdev->cfo_track_work, rtw89_phy_cfo_track_work); + wiphy_delayed_work_init(&rtwdev->mcc_prepare_done_work, rtw89_mcc_prepare_done_work); ++ wiphy_delayed_work_init(&rtwdev->tx_wait_work, rtw89_tx_wait_work); + INIT_DELAYED_WORK(&rtwdev->forbid_ba_work, rtw89_forbid_ba_work); + wiphy_delayed_work_init(&rtwdev->antdiv_work, rtw89_phy_antdiv_work); + rtwdev->txq_wq = alloc_workqueue("rtw89_tx_wq", WQ_UNBOUND | WQ_HIGHPRI, 0); +diff --git a/drivers/net/wireless/realtek/rtw89/core.h b/drivers/net/wireless/realtek/rtw89/core.h +index 43e10278e14dc3..337971c744e60f 100644 +--- a/drivers/net/wireless/realtek/rtw89/core.h ++++ b/drivers/net/wireless/realtek/rtw89/core.h +@@ -3506,9 +3506,12 @@ struct rtw89_phy_rate_pattern { + bool enable; + }; + ++#define RTW89_TX_WAIT_WORK_TIMEOUT msecs_to_jiffies(500) + struct rtw89_tx_wait_info { + struct rcu_head rcu_head; ++ struct list_head list; + struct completion completion; ++ struct sk_buff *skb; + bool tx_done; + }; + +@@ -5925,6 +5928,9 @@ struct rtw89_dev { + /* used to protect rpwm */ + spinlock_t rpwm_lock; + ++ struct list_head tx_waits; ++ struct wiphy_delayed_work tx_wait_work; ++ + struct rtw89_cam_info cam_info; + + struct sk_buff_head c2h_queue; +@@ -6181,6 +6187,26 @@ rtw89_assoc_link_rcu_dereference(struct rtw89_dev *rtwdev, u8 macid) + list_first_entry_or_null(&p->dlink_pool, typeof(*p->links_inst), dlink_schd); \ + }) + ++static inline void rtw89_tx_wait_release(struct rtw89_tx_wait_info *wait) ++{ ++ dev_kfree_skb_any(wait->skb); ++ kfree_rcu(wait, rcu_head); ++} ++ ++static inline void rtw89_tx_wait_list_clear(struct rtw89_dev *rtwdev) ++{ ++ struct rtw89_tx_wait_info *wait, *tmp; ++ ++ lockdep_assert_wiphy(rtwdev->hw->wiphy); ++ ++ list_for_each_entry_safe(wait, tmp, &rtwdev->tx_waits, list) { ++ if (!completion_done(&wait->completion)) ++ continue; ++ list_del(&wait->list); ++ rtw89_tx_wait_release(wait); ++ } ++} ++ + static inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev, + struct rtw89_core_tx_request *tx_req) + { +@@ -6190,6 +6216,7 @@ static inline int rtw89_hci_tx_write(struct rtw89_dev *rtwdev, + static inline void rtw89_hci_reset(struct rtw89_dev *rtwdev) + { + rtwdev->hci.ops->reset(rtwdev); ++ rtw89_tx_wait_list_clear(rtwdev); + } + + static inline int rtw89_hci_start(struct rtw89_dev *rtwdev) +@@ -7258,11 +7285,12 @@ static inline struct sk_buff *rtw89_alloc_skb_for_rx(struct rtw89_dev *rtwdev, + return dev_alloc_skb(length); + } + +-static inline void rtw89_core_tx_wait_complete(struct rtw89_dev *rtwdev, ++static inline bool rtw89_core_tx_wait_complete(struct rtw89_dev *rtwdev, + struct rtw89_tx_skb_data *skb_data, + bool tx_done) + { + struct rtw89_tx_wait_info *wait; ++ bool ret = false; + + rcu_read_lock(); + +@@ -7270,11 +7298,14 @@ static inline void rtw89_core_tx_wait_complete(struct rtw89_dev *rtwdev, + if (!wait) + goto out; + ++ ret = true; + wait->tx_done = tx_done; +- complete(&wait->completion); ++ /* Don't access skb anymore after completion */ ++ complete_all(&wait->completion); + + out: + rcu_read_unlock(); ++ return ret; + } + + static inline bool rtw89_is_mlo_1_1(struct rtw89_dev *rtwdev) +diff --git a/drivers/net/wireless/realtek/rtw89/pci.c b/drivers/net/wireless/realtek/rtw89/pci.c +index a669f2f843aab4..4e3034b44f5641 100644 +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -464,7 +464,8 @@ static void rtw89_pci_tx_status(struct rtw89_dev *rtwdev, + struct rtw89_tx_skb_data *skb_data = RTW89_TX_SKB_CB(skb); + struct ieee80211_tx_info *info; + +- rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status == RTW89_TX_DONE); ++ if (rtw89_core_tx_wait_complete(rtwdev, skb_data, tx_status == RTW89_TX_DONE)) ++ return; + + info = IEEE80211_SKB_CB(skb); + ieee80211_tx_info_clear_status(info); +diff --git a/drivers/net/wireless/realtek/rtw89/ser.c b/drivers/net/wireless/realtek/rtw89/ser.c +index bb39fdbcba0d80..fe7beff8c42465 100644 +--- a/drivers/net/wireless/realtek/rtw89/ser.c ++++ b/drivers/net/wireless/realtek/rtw89/ser.c +@@ -502,7 +502,9 @@ static void ser_reset_trx_st_hdl(struct rtw89_ser *ser, u8 evt) + } + + drv_stop_rx(ser); ++ wiphy_lock(wiphy); + drv_trx_reset(ser); ++ wiphy_unlock(wiphy); + + /* wait m3 */ + hal_send_m2_event(ser); +diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c +index 0904ecae253a8e..b19acd662726d4 100644 +--- a/drivers/target/target_core_configfs.c ++++ b/drivers/target/target_core_configfs.c +@@ -2774,7 +2774,7 @@ static ssize_t target_lu_gp_members_show(struct config_item *item, char *page) + config_item_name(&dev->dev_group.cg_item)); + cur_len++; /* Extra byte for NULL terminator */ + +- if ((cur_len + len) > PAGE_SIZE) { ++ if ((cur_len + len) > PAGE_SIZE || cur_len > LU_GROUP_NAME_BUF) { + pr_warn("Ran out of lu_gp_show_attr" + "_members buffer\n"); + break; +diff --git a/mm/swapfile.c b/mm/swapfile.c +index b4f3cc71258049..ad438a4d0e68ca 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2243,6 +2243,8 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) + VMA_ITERATOR(vmi, mm, 0); + + mmap_read_lock(mm); ++ if (check_stable_address_space(mm)) ++ goto unlock; + for_each_vma(vmi, vma) { + if (vma->anon_vma && !is_vm_hugetlb_page(vma)) { + ret = unuse_vma(vma, type); +@@ -2252,6 +2254,7 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) + + cond_resched(); + } ++unlock: + mmap_read_unlock(mm); + return ret; + } +diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h +index 6cb6d105181520..8f1b3500f8e2dc 100644 +--- a/scripts/gcc-plugins/gcc-common.h ++++ b/scripts/gcc-plugins/gcc-common.h +@@ -173,10 +173,17 @@ static inline opt_pass *get_pass_for_id(int id) + return g->get_passes()->get_pass_for_id(id); + } + ++#if BUILDING_GCC_VERSION < 16000 + #define TODO_verify_ssa TODO_verify_il + #define TODO_verify_flow TODO_verify_il + #define TODO_verify_stmts TODO_verify_il + #define TODO_verify_rtl_sharing TODO_verify_il ++#else ++#define TODO_verify_ssa 0 ++#define TODO_verify_flow 0 ++#define TODO_verify_stmts 0 ++#define TODO_verify_rtl_sharing 0 ++#endif + + #define INSN_DELETED_P(insn) (insn)->deleted() + +diff --git a/sound/soc/qcom/qdsp6/topology.c b/sound/soc/qcom/qdsp6/topology.c +index 83319a928f2917..01bb1bdee5cec1 100644 +--- a/sound/soc/qcom/qdsp6/topology.c ++++ b/sound/soc/qcom/qdsp6/topology.c +@@ -587,8 +587,8 @@ static int audioreach_widget_load_module_common(struct snd_soc_component *compon + return PTR_ERR(cont); + + mod = audioreach_parse_common_tokens(apm, cont, &tplg_w->priv, w); +- if (IS_ERR(mod)) +- return PTR_ERR(mod); ++ if (IS_ERR_OR_NULL(mod)) ++ return mod ? PTR_ERR(mod) : -ENODEV; + + dobj = &w->dobj; + dobj->private = mod; +diff --git a/sound/usb/midi.c b/sound/usb/midi.c +index acb3bf92857c10..97e7e7662b12de 100644 +--- a/sound/usb/midi.c ++++ b/sound/usb/midi.c +@@ -1522,15 +1522,14 @@ static void snd_usbmidi_free(struct snd_usb_midi *umidi) + { + int i; + ++ if (!umidi->disconnected) ++ snd_usbmidi_disconnect(&umidi->list); ++ + for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) { + struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i]; +- if (ep->out) +- snd_usbmidi_out_endpoint_delete(ep->out); +- if (ep->in) +- snd_usbmidi_in_endpoint_delete(ep->in); ++ kfree(ep->out); + } + mutex_destroy(&umidi->mutex); +- timer_shutdown_sync(&umidi->error_timer); + kfree(umidi); + } +
