* [PATCH 5.10 000/699] 5.10.261-rc1 review
@ 2026-07-21 15:15 Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 001/699] nvmet-tcp: fix race between ICReq handling and queue teardown Greg Kroah-Hartman
` (702 more replies)
0 siblings, 703 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 5.10.261 release.
There are 699 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.261-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.10.261-rc1
Taehee Yoo <ap420073@gmail.com>
mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
Eric Dumazet <edumazet@google.com>
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
Taehee Yoo <ap420073@gmail.com>
net: mld: fix reference count leak in mld_{query | report}_work()
Eric Dumazet <edumazet@google.com>
ipv6: fix lockdep splat in in6_dump_addrs()
Ignat Korchagin <ignat@cloudflare.com>
ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
Kristian Evensen <kristian.evensen@gmail.com>
net: ethernet: rmnet: Always subtract MAP header
Yue Haibing <yuehaibing@huawei.com>
ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
Taehee Yoo <ap420073@gmail.com>
mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix timestamp clock period by using lower value
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: invensense: fix odr switching to same value
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_mpu6050: fix frequency setting when chip is off
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix regressions caused by reusing ident
Marc Zyngier <maz@kernel.org>
KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
Zhan Xusheng <zhanxusheng1024@gmail.com>
posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
Ricardo Robaina <rrobaina@redhat.com>
audit: fix potential integer overflow in audit_log_n_hex()
Ricardo Robaina <rrobaina@redhat.com>
audit: add audit_log_nf_skb helper function
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - validate RSA CRT component lengths
Ahsan Atta <ahsan.atta@intel.com>
crypto: qat - fix restarting state leak on allocation failure
Qu Wenruo <wqu@suse.com>
btrfs: do not trim a device which is not writeable
Neill Kapron <nkapron@google.com>
usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
Uwe Kleine-König <u.kleine-koenig@baylibre.com>
crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
crypto: atmel-sha204a - Mark OF related data as maybe unused
Tyler Baker <tyler.baker@oss.qualcomm.com>
usb: gadget: f_fs: initialize reset_work at allocation time
Andy Yan <andyshrk@163.com>
usb: typec: tcpm: Fix VDM type for Enter Mode commands
Mauricio Faria de Oliveira <mfo@igalia.com>
usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
Fan Wu <fanwu01@zju.edu.cn>
usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
gpio: pca953x: Make platform teardown callback return void
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
leds: lm3601x: Improve error reporting for problems during .remove()
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
leds: lm3697: Remove duplicated error reporting in .remove()
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
drm/i2c/sil164: Drop no-op remove function
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix write buffer corruption
Oliver Neukum <oneukum@suse.com>
usb: iowarrior: remove inherent race with minor number
Dawei Feng <dawei.feng@seu.edu.cn>
usb: free iso schedules on failed submit
Xu Rao <raoxu@uniontech.com>
usb: gadget: f_printer: take kref only for successful open
Andrzej Pietrasiewicz <andrzej.p@collabora.com>
usb: gadget: function: Simplify diagnostic messaging in printer
Tristan Madani <tristan@talencesecurity.com>
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
Viacheslav Dubeyko <slava@dubeyko.com>
hfs/hfsplus: prevent getting negative values of offset/length
Yousef Alhouseen <alhouseenyousef@gmail.com>
xfs: use null daddr for unset first bad log block
Alexey Nepomnyashih <sdl@nppct.ru>
xfs: fix unreachable BIGTIME check in dquot flush validation
Dave Chinner <dchinner@redhat.com>
xfs: reflect sb features in xfs_mount
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
serial: 8250_mid: Disable DMA for selected platforms
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
serial: 8250_mid: Remove 8250_pci usage
Manish Khadka <maskmemanish@gmail.com>
HID: appleir: fix UAF on pending key_up_timer in remove()
Jann Horn <jannh@google.com>
proc: protect ptrace_may_access() with exec_update_lock (part 1)
Fushuai Wang <wangfushuai@baidu.com>
cpufreq: intel_pstate: Sync policy->cur during CPU offline
Trung Nguyen <trungnh@cystack.net>
HID: multitouch: fix out-of-bounds bit access on mt_io_flags
Angela Czubak <aczubak@google.com>
HID: add haptics page defines
Jann Horn <jannh@google.com>
proc: protect ptrace_may_access() with exec_update_lock (FD links)
Christoph Hellwig <hch@lst.de>
proc: rename proc_setattr to proc_nochmod_setattr
Thomas Weißschuh <linux@weissschuh.net>
proc: use generic setattr() for /proc/$PID/net
Lukas Wunner <lukas@wunner.de>
X.509: Fix validation of ASN.1 certificate header
Baokun Li <libaokun@linux.alibaba.com>
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
Zihan Xi <xizh2024@lzu.edu.cn>
smb: client: harden POSIX SID length parsing
Zihan Xi <xizh2024@lzu.edu.cn>
smb: client: use unaligned reads in parse_posix_ctxt()
Norbert Manthey <nmanthey@amazon.de>
smb: client: mask server-provided mode to 07777 in modefromsid
Haoxiang Li <haoxiang_li2024@163.com>
smb: client: Fix next buffer leak in receive_encrypted_standard()
Runyu Xiao <runyu.xiao@seu.edu.cn>
Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
Hyunwoo Kim <imv4bel@gmail.com>
Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: L2CAP: Fix not tracking outstanding TX ident
Florian Westphal <fw@strlen.de>
netfilter: ebtables: zero chainstack array
Qianfeng Rong <rongqianfeng@vivo.com>
netfilter: ebtables: Use vmalloc_array() to improve code
Runyu Xiao <runyu.xiao@seu.edu.cn>
coresight: etb10: restore atomic_t for shared reading state
Marco Nenciarini <mnencia@kcore.it>
PCI: Skip Resizable BAR restore on read error
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Move Resizable BAR code to rebar.c
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Add kerneldoc for pci_resize_resource()
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Fix restoring BARs on BAR resize rollback path
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Free saved list without holding pci_bus_sem
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: Prevent resource tree corruption when BAR resize fails
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
Fabio Aiuto <fabioaiuto83@gmail.com>
staging: rtl8723bs: remove DBG_871X log argument
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
PCI: mediatek: Fix IRQ domain leak when port fails to enable
Christian Marangi <ansuelsmth@gmail.com>
PCI: mediatek: Convert bool to single quirks entry and bitmap
Jiri Slaby (SUSE) <jirislaby@kernel.org>
PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
Franziska Naepelt <franziska.naepelt@googlemail.com>
staging: rtl8723bs: Fix space issues
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
Michael Straube <straube.linux@gmail.com>
staging: rtl8723bs: clean up comparsions to NULL
Fabio Aiuto <fabioaiuto83@gmail.com>
staging: rtl8723bs: remove commented out condition
Fabio Aiuto <fabioaiuto83@gmail.com>
staging: rtl8723bs: remove 5Ghz code blocks
Fabio Aiuto <fabioaiuto83@gmail.com>
staging: rtl8723bs: remove 5Ghz code related to channel plan definition
Fabio Aiuto <fabioaiuto83@gmail.com>
staging: rtl8723bs: remove all 5Ghz network types
Fabio Aiuto <fabioaiuto83@gmail.com>
staging: rtl8723bs: remove commented out RT_ASSERT occurrences
Fabio Aiuto <fabioaiuto83@gmail.com>
staging: rtl8723bs: split too long line
Richard Zhu <hongxing.zhu@nxp.com>
PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
smb: client: restrict implied bcc[0] exemption to responses without data area
Enzo Matsumiya <ematsumiya@suse.de>
cifs: remove unused server parameter from calc_smb_size()
Enzo Matsumiya <ematsumiya@suse.de>
smb2: small refactor in smb2_check_message()
Jakob Koschel <jakobkoschel@gmail.com>
cifs: remove check of list iterator against head past the loop body
Ronnie Sahlberg <lsahlber@redhat.com>
cifs: Create a new shared file holding smb2 pdu definitions
Arnd Bergmann <arnd@arndb.de>
staging: media: atomisp: reduce load_primary_binaries() stack usage
Martiros Shakhzadyan <vrzh@vrzh.net>
media: staging: media: atomisp: Fix alignment and line length issues
Martiros Shakhzadyan <vrzh@vrzh.net>
media: staging: media: atomisp: Replace if else clause with a ternary
Martiros Shakhzadyan <vrzh@vrzh.net>
media: staging: media: atomisp: Fix the rest of sh_css.c brace issues
Martiros Shakhzadyan <vrzh@vrzh.net>
media: staging: media: atomisp: Fix sh_css.c brace coding style issues
Aditya Srivastava <yashsri421@gmail.com>
media: atomisp: replace boolean comparison of values with bool variables
Mahesh Vaidya <mahesh.vaidya@altera.com>
PCI: altera: Fix resource leaks on probe failure
Carlos Llamas <cmllamas@google.com>
binder: fix UAF in binder_free_transaction()
Alex Williamson <alex.williamson@nvidia.com>
vfio/pci: Release the VGA arbiter client on register_device() failure
Johan Hovold <johan@kernel.org>
Bluetooth: btusb: fix wakeup source leak on probe failure
Johan Hovold <johan@kernel.org>
Bluetooth: btusb: fix use-after-free on marvell probe failure
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: btintel: Check firmware version before download
Kiran K <kiran.k@intel.com>
Bluetooth: btintel: Fix offset calculation boot address parameter
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: aoa: check snd_ctl_new1() return value
Herman van Hazendonk <github.com@herrie.org>
iio: common: st_sensors: honour channel endianness in read_axis_data
Alexander Lobakin <aleksander.lobakin@intel.com>
bitops: make BYTES_TO_BITS() treewide-available
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: stabilized timestamp in interrupt
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: invensense: fix timestamp glitches when switching frequency
Colin Ian King <colin.i.king@gmail.com>
iio: invensense: remove redundant initialization of variable period
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_mpu6050: use the common inv_sensors timestamp module
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: make invensense timestamp module generic
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: move inv_icm42600 timestamp module in common
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: make timestamp module chip independent
Zhang Lixu <lixu.zhang@intel.com>
iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
Runyu Xiao <runyu.xiao@seu.edu.cn>
iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
Sven Eckelmann <sven@narfation.org>
batman-adv: clean untagged VLAN on netdev registration failure
Eric Biggers <ebiggers@kernel.org>
crypto: crypto4xx - Remove insecure and unused rng_alg
Herbert Xu <herbert@gondor.apana.org.au>
crypto: crypto4xx - Remove ahash-related code
Aditya Srivastava <yashsri421@gmail.com>
crypto: amcc - fix incorrect kernel-doc comment syntax in files
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: fsl_ifc: return errors for failed page reads
Runyu Xiao <runyu.xiao@seu.edu.cn>
mmc: vub300: defer reset until cmd_mutex is unlocked
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: onenand: samsung: report DMA completion timeouts
Rafael Beims <rafael.beims@toradex.com>
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
Zhiling Zou <roxy520tt@gmail.com>
wifi: mac80211: free ack status frame on TX header build failure
Junrui Luo <moonafterrain@outlook.com>
powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
Zhao Dongdong <zhaodongdong@kylinos.cn>
reset: sunxi: fix memory region leak on ioremap failure
Robby Cai <robby.cai@nxp.com>
reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
Julian Anastasov <ja@ssi.bg>
ipvs: fix more places with wrong ipv6 transport offsets
Maoyi Xie <maoyixie.tju@gmail.com>
memstick: ms_block: reject a card that reports too many blocks
James Raphael Tiovalen <jamestiotio@gmail.com>
macsec: fix promiscuity refcount leak in macsec_dev_open()
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
llc: fix SAP refcount leak when creating incoming sockets
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Bluetooth: btrtl: validate firmware patch bounds
Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
Dawei Feng <dawei.feng@seu.edu.cn>
wifi: mac80211: fix memory leak in ieee80211_register_hw()
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: rt2x00: avoid full teardown before work setup in probe
Farhad Alemi <farhad.alemi@berkeley.edu>
cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
Michael Bommarito <michael.bommarito@gmail.com>
drbd: reject data replies with an out-of-range payload size
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: use parsed transport offset in SCTP state lookup
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
llc: fix SAP refcount leak in llc_ui_autobind()
Yousef Alhouseen <alhouseenyousef@gmail.com>
mac802154: remove interfaces with RCU list deletion
Gerald Schaefer <gerald.schaefer@linux.ibm.com>
s390/monwriter: Reject buffer reuse with different data length
HyeongJun An <sammiee5311@gmail.com>
hwmon: (asus_atk0110) Check package count before accessing element
Wentao Liang <vulab@iscas.ac.cn>
ata: pata_pxa: Fix DMA channel leak on probe error
Bryam Vargas <hexlabsecurity@proton.me>
orangefs: keep the readdir entry size 64-bit in fill_from_part()
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/probes: Fix double addition of offset for @+FOFFSET
Bryam Vargas <hexlabsecurity@proton.me>
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Haoxiang Li <haoxiang_li2024@163.com>
fsl/fman: Free init resources on KeyGen failure in fman_init()
Haoxiang Li <haoxiang_li2024@163.com>
net: liquidio: fix BAR resource leak on PF number failure
Pengpeng Hou <pengpeng@iscas.ac.cn>
hwmon: (w83793) remove vrm sysfs file on probe failure
Pengpeng Hou <pengpeng@iscas.ac.cn>
hwmon: (w83627hf) remove VID sysfs files on error and remove
Abdun Nihaal <nihaal@cse.iitm.ac.in>
bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
Davidlohr Bueso <dave@stgolabs.net>
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
Keenan Dong <keenanat2000@gmail.com>
rtmutex: Use waiter::task instead of current in remove_waiter()
Sven Eckelmann <sven@narfation.org>
batman-adv: ensure minimal ethernet header on TX
Sven Eckelmann <sven@narfation.org>
batman-adv: retrieve ethhdr after potential skb realloc on RX
Shivam Kumar <kumar.shivam43666@gmail.com>
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
Shitalkumar Gandhi <shital.gandhi45@gmail.com>
ieee802154: ca8210: fix cas_ctl leak on spi_async failure
Michael Bommarito <michael.bommarito@gmail.com>
ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
Michael Bommarito <michael.bommarito@gmail.com>
ieee802154: admin-gate legacy LLSEC dump operations
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
Dawei Feng <dawei.feng@seu.edu.cn>
net: ena: clean up XDP TX queues when regular TX setup fails
Maoyi Xie <maoyixie.tju@gmail.com>
net: sit: require CAP_NET_ADMIN in the device netns for changelink
Andreas Kemnade <andreas@kemnade.info>
gpios: palmas: add .get_direction() op
Bradley Morgan <include@grrlz.net>
cpu: hotplug: Preserve per instance callback errors
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix type confusion in CDC union descriptor parsing
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix DMA mapping violation in line setup
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - add response length checks
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - validate control endpoint type
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - release data interface on disconnect
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: ims-pcu - fix use-after-free and double-free in disconnect
Bryam Vargas <hexlabsecurity@proton.me>
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
Xu Rao <raoxu@uniontech.com>
scsi: sg: Report request-table problems when any status is set
Haoxiang Li <haoxiang_li2024@163.com>
scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
Mikulas Patocka <mpatocka@redhat.com>
dm-verity: increase sprintf buffer size
Mikulas Patocka <mpatocka@redhat.com>
dm_early_create: fix freeing used table on dm_resume failure
Mikulas Patocka <mpatocka@redhat.com>
dm-stats: fix merge accounting
Mikulas Patocka <mpatocka@redhat.com>
dm-stats: fix dm_jiffies_to_msec64
Benjamin Marzinski <bmarzins@redhat.com>
dm-log: fix a bitset_size overflow on 32bit machines
Mikulas Patocka <mpatocka@redhat.com>
dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
Samuel Moelius <sam.moelius@trailofbits.com>
dm era: fix out-of-bounds memory access for non-zero start sector
Ming-Hung Tsai <mtsai@redhat.com>
dm thin metadata: fix metadata snapshot consistency on commit failure
Genjian Zhang <zhanggenjian@kylinos.cn>
dm thin metadata: fix superblock refcount leak on snapshot shadow failure
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: add missing rcu list annotations and operations
Oliver Hartkopp <socketcan@hartkopp.net>
can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
Oliver Hartkopp <socketcan@hartkopp.net>
can: isotp: use unconditional synchronize_rcu() in isotp_release()
Bryam Vargas <hexlabsecurity@proton.me>
nvmet-rdma: handle inline data with a nonzero offset
Weiming Shi <bestswngs@gmail.com>
sctp: validate STALE_COOKIE cause length before reading staleness
Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
spi: uniphier: Fix completion initialization order before devm_request_irq()
Wang Yan <wangyan01@kylinos.cn>
time: Fix off-by-one in compat settimeofday() usec validation
Jaewon Yang <yong010301@gmail.com>
tpm: Make the TPM character devices non-seekable
Thorsten Blum <thorsten.blum@linux.dev>
tpm: fix event_size output in tpm1_binary_bios_measurements_show
Maoyi Xie <maoyixie.tju@gmail.com>
xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
Sanman Pradhan <psanman@juniper.net>
xfrm: use compat translator only for u64 alignment mismatch
Wentao Liang <vulab@iscas.ac.cn>
xen/gntdev: fix error handling in ioctl
Xuanqiang Luo <luoxuanqiang@kylinos.cn>
i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
Roman Vivchar <rva333@protonmail.com>
i2c: mediatek: fix WRRD for SoCs without auto_restart option
Bhargav Joshi <j.bhargav.u@gmail.com>
irqchip/crossbar: Use correct index in crossbar_domain_free()
Florian Fuchs <fuchsfl@gmail.com>
mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
Michael Bommarito <michael.bommarito@gmail.com>
ocfs2: reject non-inline dinodes with i_size and zero i_clusters
Michael Bommarito <michael.bommarito@gmail.com>
ocfs2: reject dinodes whose i_rdev disagrees with the file type
Michael Bommarito <michael.bommarito@gmail.com>
ocfs2: reject dinodes with non-canonical i_mode type
Ian Bridges <icb@fastmail.org>
ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
Kyle Zeng <kylebot@openai.com>
ocfs2: avoid moving extents to occupied clusters
Arseniy Krasnov <avkrasnov@rulkc.org>
mtd: rawnand: fix condition in 'nand_select_target()'
Tristan Madani <tristan@talencesecurity.com>
ocfs2: use kzalloc for quota recovery bitmap allocation
Martin Wilck <martin.wilck@suse.com>
scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
Ruoyu Wang <ruoyuw560@gmail.com>
mtd: slram: remove failed entries from the device list
Krzysztof Wilczyński <kwilczynski@kernel.org>
proc: only bump parent nlink when registering directories
WenTao Liang <vulab@iscas.ac.cn>
power: supply: charger-manager: fix refcount leak in is_full_charged()
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
Johan Hovold <johan@kernel.org>
MIPS: ip22-gio: fix device reference leak in probe
Johan Hovold <johan@kernel.org>
MIPS: ip22-gio: fix kfree() of static object
Johan Hovold <johan@kernel.org>
MIPS: ip22-gio: fix gio device memory leak
Chuck Lever <chuck.lever@oracle.com>
lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
Chuck Lever <chuck.lever@oracle.com>
lockd: Plug nlm_file leak when nlm_do_fopen() fails
Abdun Nihaal <nihaal@cse.iitm.ac.in>
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
Abdun Nihaal <nihaal@cse.iitm.ac.in>
nvdimm/btt: Free arenas on btt_init() error paths
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
mfd: tps6586x: Fix OF node refcount
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: prevent TVLV OOB check overflow
Sven Eckelmann <sven@narfation.org>
batman-adv: frag: fix primary_if leak on failed linearization
Sven Eckelmann <sven@narfation.org>
batman-adv: frag: free unfragmentable packet
Sven Eckelmann <sven@narfation.org>
batman-adv: fix VLAN priority offset
Sven Eckelmann <sven@narfation.org>
batman-adv: tt: avoid request storms during pending request
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: fix tie-break for candidate selection
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: ensure accessible eth_hdr proto field
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: reacquire gw address after skb realloc
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: acquire ARP hw source only after skb realloc
Sven Eckelmann <sven@narfation.org>
batman-adv: access unicast_ttvn skb->data only after skb realloc
Sven Eckelmann <sven@narfation.org>
batman-adv: gw: acquire ethernet header only after skb realloc
Thorsten Blum <thorsten.blum@linux.dev>
x86/boot: Reject too long acpi_rsdp= values
Thorsten Blum <thorsten.blum@linux.dev>
x86/boot: Validate console=uart8250 baud rate to fix early boot hang
Guangshuo Li <lgs201920130244@gmail.com>
mfd: sm501: Fix reference leak on failed device registration
Armin Wolf <W_Armin@gmx.de>
leds: uleds: Fix potential buffer overread
Wang Jun <1742789905@qq.com>
soc: fsl: qe: panic on ioremap() failure in qe_reset()
Siddharth Vadapalli <s-vadapalli@ti.com>
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
Guangshuo Li <lgs201920130244@gmail.com>
gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
Xiang Mei (Microsoft) <xmei5@asu.edu>
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
Wyatt Feng <bronzed_45_vested@icloud.com>
netfilter: xt_nat: reject unsupported target families
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
netfilter: nf_conncount: fix zone comparison in tuple dedup
Xiang Mei <xmei5@asu.edu>
netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
Florian Westphal <fw@strlen.de>
netfilter: nf_nat_sip: reload possible stale data pointer
Wyatt Feng <bronzed_45_vested@icloud.com>
netfilter: xt_cluster: reject template conntracks in hash match
David Carlier <devnexen@gmail.com>
netfilter: nfnl_cthelper: apply per-class values when updating policies
Muhammad Bilal <meatuni001@gmail.com>
netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: s3fb: fix potential memory leak in s3_pci_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: i740fb: fix potential memory leak in i740fb_probe()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
Li RongQing <lirongqing@baidu.com>
fbdev: sm712: Fix operator precedence in big_swap macro
Hyunwoo Kim <imv4bel@gmail.com>
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
Nickolay Goppen <setotau@mainlining.org>
arm64: dts: qcom: sdm630: describe adsp_mem region properly
Yong Wang <edragain@163.com>
net: ife: require ETH_HLEN to be pullable in ife_decode()
Zhengchuan Liang <zcliangcn@gmail.com>
net: atm: reject out-of-range traffic classes in QoS validation
Michael Bommarito <michael.bommarito@gmail.com>
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
Wentao Liang <vulab@iscas.ac.cn>
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
Guangshuo Li <lgs201920130244@gmail.com>
smb: client: fix overflow in passthrough ioctl bounds check
Li RongQing <lirongqing@baidu.com>
net/mlx5: Fix L3 tunnel entropy refcount leak
Timur Tabi <ttabi@nvidia.com>
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
Douglas Anderson <dianders@chromium.org>
regulator: core: Make regulator_lock_two() logic easier to follow
Cao Guanghui <caoguanghui@kylinos.cn>
dm era: fix NULL pointer dereference in metadata_open()
Julian Anastasov <ja@ssi.bg>
ipvs: ensure inner headers in ICMP errors are in headroom
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: use parsed transport offset in TCP state lookup
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
ipvs: pass parsed transport offset to state handlers
Eric Dumazet <edumazet@google.com>
ipv6: mcast: Fix potential UAF in MLD delayed work
Kuniyuki Iwashima <kuniyu@google.com>
ipv6: mcast: Replace locking comments with lockdep annotations.
Eric Dumazet <edumazet@google.com>
ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()
Taehee Yoo <ap420073@gmail.com>
mld: add mc_lock for protecting per-interface mld data
Taehee Yoo <ap420073@gmail.com>
mld: add new workqueues for process mld events
Taehee Yoo <ap420073@gmail.com>
mld: convert ifmcaddr6 to RCU
Taehee Yoo <ap420073@gmail.com>
mld: convert ip6_sf_list to RCU
Taehee Yoo <ap420073@gmail.com>
mld: convert ipv6_mc_socklist->sflist to RCU
Taehee Yoo <ap420073@gmail.com>
mld: get rid of inet6_dev->mc_lock
Taehee Yoo <ap420073@gmail.com>
mld: convert from timer to delayed work
Samuel Moelius <sam.moelius@trailofbits.com>
net/sched: cake: reject overhead values that underflow length
Enrico Pozzobon <enrico.pozzobon@dissecto.com>
net: usb: lan78xx: disable VLAN filter in promiscuous mode
Hui Wang <hui.wang@canonical.com>
ring-buffer: Fix event length with forced 8-byte alignment
Weiming Shi <bestswngs@gmail.com>
Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
Pauli Virtanen <pav@iki.fi>
Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
Xiang Mei <xmei5@asu.edu>
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
Xiang Mei <xmei5@asu.edu>
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
Daniele Palmas <dnlplm@gmail.com>
net: qualcomm: rmnet: add tx packets aggregation
Sharath Chandra Vurukala <sharathv@codeaurora.org>
net: ethernet: rmnet: Support for ingress MAPv5 checksum offload
Alex Elder <elder@linaro.org>
net: qualcomm: rmnet: don't use C bit-fields in rmnet checksum header
Alex Elder <elder@linaro.org>
net: qualcomm: rmnet: use masks instead of C bit-fields
Alex Elder <elder@linaro.org>
net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros
Alex Elder <elder@linaro.org>
net: qualcomm: rmnet: simplify some byte order logic
Shigeru Yoshida <syoshida@redhat.com>
qede: fix off-by-one in BD ring consumption on build_skb failure
Zhixing Chen <running910@gmail.com>
netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
Feng Wu <wufengwufengwufeng@gmail.com>
netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
Wyatt Feng <bronzed_45_vested@icloud.com>
netfilter: xt_u32: reject invalid shift counts
Qihang <q.h.hack.winter@gmail.com>
gue: validate REMCSUM private option length
Xiang Mei <xmei5@asu.edu>
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
Lee Jones <lee@kernel.org>
HID: core: Fix OOB read in hid_get_report for numbered reports
Georgiy Osokin <g.osokin@auroraos.dev>
HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
Myeonghun Pak <mhun512@gmail.com>
ata: sata_gemini: unwind clocks on IDE pinctrl errors
David Howells <dhowells@redhat.com>
afs: Fix unchecked-length string display in debug statement
David Howells <dhowells@redhat.com>
afs: Fix vllist leak
David Howells <dhowells@redhat.com>
afs: Fix callback service message parsers to pass through -EAGAIN
Dan Carpenter <error27@gmail.com>
afs: Fix error code in afs_extract_vl_addrs()
Samuel Moelius <sam.moelius@trailofbits.com>
net/sched: hhf: clear heavy-hitter state on reset
Vladimir Zapolskiy <vz@kernel.org>
gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
Gleb Markov <markov.gi@npc-ksb.ru>
cxgb4: Fix decode strings dump for T6 adapters
Longjun Tang <tanglongjun@kylinos.cn>
virtio_net: disable cb when NAPI is busy-polled
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/events: Fix to check the simple_tsk_fn creation
Xiang Mei <xmei5@asu.edu>
usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
Matti Vaittinen <mazziesaccount@gmail.com>
hwmon: adm1275: Prevent reading uninitialized stack
Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
seg6: validate SRH length before reading fixed fields
Pengpeng Hou <pengpeng@iscas.ac.cn>
gpio: htc-egpio: use managed gpiochip registration
Pengpeng Hou <pengpeng@iscas.ac.cn>
gpio: mvebu: fail probe if gpiochip registration fails
Pengpeng Hou <pengpeng@iscas.ac.cn>
spi: sh-msiof: abort transfers when reset times out
Martin Kaiser <martin@kaiser.cx>
tracing: probes: fix typo in a log message
Ruoyu Wang <ruoyuw560@gmail.com>
net: sungem: fix probe error cleanup
Yun Zhou <yun.zhou@windriver.com>
net: mvneta: re-enable percpu interrupt on resume
Haoxiang Li <haoxiang_li2024@163.com>
rtc: cmos: unregister HPET IRQ handler on probe failure
Fredrik M Olsson <fredrik.m.olsson@axis.com>
rtc: ds1307: Fix off-by-one issue with wday for rx8130
Huiwen He <hehuiwen@kylinos.cn>
smb/client: preserve errors from smb2_set_sparse()
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in disable_policy sysctl
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in forwarding sysctl
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in ignore_routes_with_linkdown sysctl
Fernando Fernandez Mancera <fmancera@suse.de>
ipv6: fix error handling in disable_ipv6 sysctl
Aleksandrova Alyona <aga@itb.spb.ru>
net: dsa: sja1105: round up PTP perout pin duration
Krzysztof Wilczyński <kwilczynski@kernel.org>
alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
Krzysztof Wilczyński <kwilczynski@kernel.org>
alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
Runyu Xiao <runyu.xiao@seu.edu.cn>
netfilter: nft_synproxy: stop bypassing the priv->info snapshot
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
Kuniyuki Iwashima <kuniyu@google.com>
ipv4: fib: Don't ignore error route in local/main tables.
Xiang Mei <xmei5@asu.edu>
ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
Xiang Mei <xmei5@asu.edu>
drm/edid: fix OOB read in drm_parse_tiled_block()
Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
bpf: Fix stack slot index in nospec checks
Ronan Dalton <ronan.dalton@alliedtelesis.co.nz>
rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
Antoni Pokusinski <apokusinski01@gmail.com>
rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
Sayali Patil <sayalip@linux.ibm.com>
selftests/mm: allow PUD-level entries in compound testcase of hmm tests
Sayali Patil <sayalip@linux.ibm.com>
selftests/mm: clarify alternate unmapping in compaction_test
Bhargav Joshi <j.bhargav.u@gmail.com>
irqchip/crossbar: Fix parent domain resource leak
Florian Westphal <fw@strlen.de>
netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
Jozsef Kadlecsik <kadlec@netfilter.org>
netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
Aleksandr Nogikh <nogikh@google.com>
ieee802154: fix kernel-infoleak in dgram_recvmsg()
Ivan Abramov <i.abramov@mt-integration.ru>
ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
ACPI: resource: Amend kernel-doc style
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
thermal: intel: Fix dangling resources on thermal_throttle_online() failure
Breno Leitao <leitao@debian.org>
arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
Xin Long <lucien.xin@gmail.com>
sctp: hold socket lock when dumping endpoints in sctp_diag
Jakub Kicinski <kuba@kernel.org>
net: psample: fix info leak in PSAMPLE_ATTR_DATA
Ratheesh Kannoth <rkannoth@marvell.com>
octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Use snprintf() for guestmount path construction
Eric Dumazet <edumazet@google.com>
xfrm: validate selector family and prefixlen during match
Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Use snprintf() for root_dir path construction
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
Pengpeng Hou <pengpeng@iscas.ac.cn>
sparc: led: avoid trimming a newline from empty writes
John Johansen <john.johansen@canonical.com>
apparmor: fix label can not be immediately before a declaration
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Prevent reuse of dynamic address on device add failure
Zygmunt Krynicki <me@zygoon.pl>
apparmor: put secmark label after secid lookup
Zygmunt Krynicki <me@zygoon.pl>
apparmor: aa_getprocattr free procattr leak on format failure
Maxime Bélair <maxime.belair@canonical.com>
apparmor: fix potential UAF in aa_replace_profiles
Ryan Lee <ryan.lee@canonical.com>
apparmor: grab ns lock and refresh when looking up changehat child profiles
Zygmunt Krynicki <me@zygoon.pl>
apparmor: aa_label_alloc use aa_label_free on alloc failure
Ruoyu Wang <ruoyuw560@gmail.com>
apparmor: check label build before no_new_privs test
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
PCI: mediatek: Use actual physical address instead of virt_to_phys()
Ryder Lee <ryder.lee@mediatek.com>
PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Add bounds checks to read_build_id() note iteration in minimal build
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Add bounds checks to elf_read_build_id() note iteration
Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()
Arnaldo Carvalho de Melo <acme@redhat.com>
tools lib api: Fix mount_overload() snprintf truncation and toupper range
Arnaldo Carvalho de Melo <acme@redhat.com>
tools lib api: Fix filename__write_int() writing uninitialized stack data
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Fix thread__set_comm_from_proc() on empty comm file
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Bounds-check .gnu_debuglink section data
Arnaldo Carvalho de Melo <acme@redhat.com>
perf symbols: Fix signed overflow in sysfs__read_build_id() size check
Arnaldo Carvalho de Melo <acme@redhat.com>
tools lib api: Fix missing null termination in filename__read_int/ull()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file
Arnaldo Carvalho de Melo <acme@redhat.com>
perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
Arnaldo Carvalho de Melo <acme@redhat.com>
perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Fix idle-hist callchain display using wrong rb_first variant
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
PCI: rcar-host: Remove unused LIST_HEAD(res)
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf tools: Fix get_max_num() size_t underflow on empty sysfs file
Li RongQing <lirongqing@baidu.com>
PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
Mike Snitzer <snitzer@kernel.org>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
Mike Snitzer <snitzer@kernel.org>
NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
Dai Ngo <dai.ngo@oracle.com>
NFSv4/pnfs: defer return_range callbacks until after inode unlock
Sagi Grimberg <sagi@grimberg.me>
pNFS/filelayout: fix cheking if a layout is striped
Phillip Varney <pbvarney@protonmail.com>
clk: qcom: a53: Corrected frequency multiplier for 1152MHz
Nuno Sá <nuno.sa@analog.com>
dmaengine: Fix possible use after free
Arnaldo Carvalho de Melo <acme@redhat.com>
perf c2c: Fix use-after-free in he__get_c2c_hists() error path
Arnaldo Carvalho de Melo <acme@redhat.com>
perf mmap: Fix NULL deref in aio cleanup on alloc failure
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Replace BUG_ON and add NULL checks in replay event helpers
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Clean up idle_threads entry on init failure
Rui Qi <qirui.001@bytedance.com>
perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
Rosen Penev <rosenp@gmail.com>
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
Joshua Crofts <joshua.crofts1@gmail.com>
iio: magnetometer: ak8975: fix potential kernel stack memory leak
Joshua Crofts <joshua.crofts1@gmail.com>
iio: light: si1133: prevent race condition on timeout
Joshua Crofts <joshua.crofts1@gmail.com>
iio: light: si1133: reset counter to prevent race condition
James Kim <james010kim@gmail.com>
char: tlclk: fix use-after-free in tlclk_cleanup()
Seungjin Bae <eeodqql09@gmail.com>
usb: host: max3421: Reject hub port requests for non-existent ports
Seungjin Bae <eeodqql09@gmail.com>
usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
Guangshuo Li <lgs201920130244@gmail.com>
staging: most: video: avoid double free on video register failure
Ian Rogers <irogers@google.com>
perf sched: Add missing mmap2 handler in timehist
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
platform/x86: xo15-ebook: Fix wakeup source and GPE handling
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
x86/platform/olpc: xo15: Drop wakeup source on driver removal
Yingchao Deng <yingchao.deng@oss.qualcomm.com>
coresight: cti: Fix DT filter signals silently ignored
Alexandru Hossu <hossu.alexandru@gmail.com>
staging: nvec: fix use-after-free in nvec_rx_completed()
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
net/9p: fix race condition on rdma->state in trans_rdma.c
Aleksandr Nogikh <nogikh@google.com>
ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
Eric Dumazet <edumazet@google.com>
tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
Eric Dumazet <edumazet@google.com>
tipc: fix UAF in tipc_l2_send_msg()
Gui-Dong Han <hanguidong02@gmail.com>
KEYS: Use acquire when reading state in keyring search
Aboorva Devarajan <aboorvad@linux.ibm.com>
powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
Aboorva Devarajan <aboorvad@linux.ibm.com>
powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
Aboorva Devarajan <aboorvad@linux.ibm.com>
powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
Yadan Fan <ydfan@suse.com>
MIPS: mm: Fix out-of-bounds write in maar_res_walk()
Sechang Lim <rhkrqnwk98@gmail.com>
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
Weiming Shi <bestswngs@gmail.com>
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
Florian Westphal <fw@strlen.de>
netfilter: nf_conncount: callers must hold rcu read lock
Runyu Xiao <runyu.xiao@seu.edu.cn>
kcm: use WRITE_ONCE() when changing lower socket callbacks
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
Lars Pöschel <lars.poeschel@edag.com>
spi: xilinx: use FIFO occupancy register to determine buffer size
Herbert Xu <herbert@gondor.apana.org.au>
crypto: rng - Free default RNG on module exit
Felix Gu <ustc.gu@gmail.com>
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
Felix Gu <ustc.gu@gmail.com>
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
Michael Bommarito <michael.bommarito@gmail.com>
tipc: prevent snt_unacked underflow on CONN_ACK
Michael Bommarito <michael.bommarito@gmail.com>
tipc: require net admin for TIPCv2 netlink mutators
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_hfsc: Don't make class passive twice
Xin Long <lucien.xin@gmail.com>
sctp: validate embedded address parameter length
Kuniyuki Iwashima <kuniyu@google.com>
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
HyeongJun An <sammiee5311@gmail.com>
ASoC: tegra: tegra210_ahub: Validate written enum value
HyeongJun An <sammiee5311@gmail.com>
ASoC: fsl: fsl_audmix: Validate written enum values
Maher Sanalla <msanalla@nvidia.com>
RDMA/mlx5: Fix undefined shift of user RQ WQE size
Maxwell Doose <m32285159@gmail.com>
fs: efs: remove unneeded debug prints
Louis Scalbert <louis.scalbert@6wind.com>
bonding: 3ad: fix mux port state on oper down
longlong yan <yanlonglong@kylinos.cn>
tools/virtio: check mmap return value in vringh_test
Qihang Tang <q.h.hack.winter@gmail.com>
vhost/vdpa: validate virtqueue index in mmap and fault paths
Jason Gunthorpe <jgg@ziepe.ca>
IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
David Laight <david.laight.linux@gmail.com>
fbdev: sm501fb: Fix buffer errors in OF binding code
Filipe Manana <fdmanana@suse.com>
btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
Wolfram Sang <wsa+renesas@sang-engineering.com>
hwspinlock: qcom: avoid uninitialized struct members
Luca Leonardo Scorcia <l.scorcia@gmail.com>
pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
Luca Leonardo Scorcia <l.scorcia@gmail.com>
pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
Al Viro <viro@zeniv.linux.org.uk>
configfs: fix lockless traversals of ->s_children
Dmitry Vyukov <dvyukov@google.com>
firmware_loader: Fix recursive lock in device_cache_fw_images()
Felix Gu <ustc.gu@gmail.com>
spi: ep93xx: fix double-free of zeropage on DMA setup failure
Pengjie Zhang <zhangpengjie2@huawei.com>
cpufreq: Documentation: fix conservative governor freq_step description
Yuho Choi <dbgh9129@gmail.com>
ACPI: IPMI: Fix message kref handling on dead device
Rui Qi <qirui.001@bytedance.com>
riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
Tristan Madani <tristan@talencesecurity.com>
wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
Leon Hwang <leon.hwang@linux.dev>
bpf: Update transport_header when encapsulating UDP tunnel in lwt
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
Fernando Fernandez Mancera <fmancera@suse.de>
netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
Zhang Cen <rollkingzzc@gmail.com>
ocfs2/dlm: require a ref for locking_state debugfs open
Zhang Cen <rollkingzzc@gmail.com>
ocfs2: reject FITRIM ranges shorter than a cluster
Dmitry Antipov <dmantipov@yandex.ru>
ocfs2: fix buffer head management in ocfs2_read_blocks()
Zhang Cen <rollkingzzc@gmail.com>
ocfs2: rebase copied fsdlm LVB pointers in locking_state
Sandipan Das <sandipan.das@amd.com>
perf/x86/amd/core: Always use the NMI latency mitigation
Woojin Ji <random6.xyz@gmail.com>
bpftool: Use libbpf error code for flow dissector query
Alexander Potapenko <glider@google.com>
lib/test_meminit: use && for bools
Sang-Heon Jeon <ekffu200098@gmail.com>
mm/fake-numa: fix under-allocation detection in uniform split
Dan Carpenter <error27@gmail.com>
scsi: pm8001: Fix error code in non_fatal_log_show()
Martin Wilck <martin.wilck@suse.com>
scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
Yuho Choi <dbgh9129@gmail.com>
ARM: imx31: Fix IIM mapping leak in revision check
Yuho Choi <dbgh9129@gmail.com>
ARM: imx3: Fix CCM node reference leak
Zhang Yi <yi.zhang@huawei.com>
ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
Renjiang Han <renjiang.han@oss.qualcomm.com>
media: qcom: venus: drop extra padding in NV12 raw size calculation
Jessica Zhang <jessica.zhang@oss.qualcomm.com>
drm/msm/dp: Fix the ISR_* enum values
Jessica Zhang <jessica.zhang@oss.qualcomm.com>
drm/msm/dp: fix HPD state status bit shift value
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
ocfs2: kill osb->system_file_mutex lock
ZhengYuan Huang <gality369@gmail.com>
ocfs2: don't BUG_ON an invalid journal dinode
Dan Carpenter <error27@gmail.com>
rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
Felix Gu <ustc.gu@gmail.com>
drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
Jiayuan Chen <jiayuan.chen@linux.dev>
net/sched: cls_bpf: prevent unbounded recursion in offload rollback
Eric Dumazet <edumazet@google.com>
ipv6: guard against possible NULL deref in __in6_dev_stats_get()
Breno Leitao <leitao@debian.org>
workqueue: drop spurious '*' from print_worker_info() fn declaration
Nilay Shroff <nilay@linux.ibm.com>
nvme-multipath: fix flex array size in struct nvme_ns_head
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: spi-nor: Drop duplicate Kconfig dependency
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: DEC: Remove do_IRQ() call indirection
Maciej W. Rozycki <macro@orcam.me.uk>
MIPS: Fix big-endian stack argument fetching in o32 wrapper
Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
PM: sleep: Use complete() in device_pm_sleep_init()
Lianfa Weng <wenglianfa@huawei.com>
RDMA/hns: Fix warning in poll cq direct mode
Guangshuo Li <lgs201920130244@gmail.com>
IB/mlx4: Fix refcount leak in add_port() error path
Samuel Holland <samuel@sholland.org>
bus: sunxi-rsb: Always check register address validity
Ronaldo Nunez <rnunez@baylibre.com>
pwm: imx27: Fix variable truncation in .apply()
Lifeng Zheng <zhenglifeng1@huawei.com>
cpufreq: conservative: Simplify frequency limit handling
Pengjie Zhang <zhangpengjie2@huawei.com>
cpufreq: Documentation: fix sampling_down_factor range
Stepan Ionichev <sozdayvek@gmail.com>
device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
Sven Püschel <s.pueschel@pengutronix.de>
media: rockchip: rga: fix too small buffer size
Eric Dumazet <edumazet@google.com>
net/sched: sch_drr: annotate data-races around cl->deficit
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
sysfs: clamp show() return value in sysfs_kf_read()
Zilin Guan <zilin@seu.edu.cn>
media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
Sara Venkatesh <sarajvenkatesh@gmail.com>
RDMA/srpt: fix integer overflow in immediate data length check
Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
RDMA/hns: Fix arithmetic overflow in calc_hem_config()
Linmao Li <lilinmao@kylinos.cn>
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
Eric Dumazet <edumazet@google.com>
net/sched: sch_htb: annotate data-races (I)
Sean Christopherson <seanjc@google.com>
crypto: ccp - Treat zero-length cert chain as query for blob lengths
Eric Dumazet <edumazet@google.com>
net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
thermal: hwmon: Fix critical temperature attribute removal
Cristian Marussi <cristian.marussi@arm.com>
clk: scmi: Fix clock rate rounding
Sean Christopherson <seanjc@google.com>
iommu/amd: Fix a stale comment about which legacy mode is user visible
Weiming Shi <bestswngs@gmail.com>
crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
Thorsten Blum <thorsten.blum@linux.dev>
crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
Lothar Rubusch <l.rubusch@gmail.com>
crypto: atmel-sha204a - fix blocking and non-blocking rng logic
Felix Gu <ustc.gu@gmail.com>
pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
Samuel Holland <samuel@sholland.org>
media: cedrus: Fix failure to clean up hardware on probe failure
Felix Gu <ustc.gu@gmail.com>
watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
Jihed Chaibi <jihed.chaibi.dev@gmail.com>
ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
Tristan Madani <tristan@talencesecurity.com>
wifi: ath9k: fix OOB access from firmware tx status queue ID
Xingjing Deng <micro6947@gmail.com>
kconfig: fix potential NULL pointer dereference in conf_askvalue
Tristan Madani <tristan@talencesecurity.com>
wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
Danilo Krummrich <dakr@kernel.org>
driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
Yuho Choi <dbgh9129@gmail.com>
drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drm/tidss: Drop extra drm_mode_config_reset() call
David Howells <dhowells@redhat.com>
afs: Fix further netns teardown to cancel the preallocation charger
Matvey Kovalev <matvey.kovalev@ispras.ru>
afs: fix NULL pointer dereference in afs_get_tree()
David Howells <dhowells@redhat.com>
afs: Fix netns teardown to cancel the preallocation charger
Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
serial: 8250_omap: clear rx_running on zero-length DMA completes
Stephan Gerhold <stephan.gerhold@linaro.org>
serial: msm: Disable DMA for kernel console UART
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Fix buffer sequence in frame gaps
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Avoid partial metadata buffers
Eric Biggers <ebiggers@kernel.org>
crypto: af_alg - Remove zero-copy support from skcipher and aead
Yichong Chen <chenyichong@uniontech.com>
tools/mm/slabinfo: fix total_objects attribute name
Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
crypto: algif_skcipher - force synchronous processing on trees without ctx->state
Adam Li <adamli@os.amperecomputing.com>
sched/fair: Only update stats for allowed CPUs when looking for dst group
Joanne Koong <joannelkoong@gmail.com>
fuse: re-lock request before returning from fuse_ref_folio()
Alberto Ruiz <aruiz@redhat.com>
fuse: fix device node leak in cuse_process_init_reply()
Michael Bommarito <michael.bommarito@gmail.com>
RDMA/siw: bound Read Response placement to the RREAD length
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: maplecontrol - set driver data before registering input device
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: maplemouse - set driver data before registering input device
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: maple_keyb - set driver data before registering input device
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: mms114 - fix multi-touch slot corruption
Florian Fuchs <fuchsfl@gmail.com>
Input: maplemouse - fix NULL pointer dereference in open()
Bryam Vargas <hexlabsecurity@proton.me>
Input: touchwin - reset the packet index on every complete packet
Bryam Vargas <hexlabsecurity@proton.me>
Input: iforce - bound the device-reported force-feedback effect index
Bryam Vargas <hexlabsecurity@proton.me>
Input: goodix - clamp the device-reported contact count
Ranjan Kumar <kumarranja@chromium.org>
Input: elan_i2c - prevent division by zero and arithmetic underflow
Bryam Vargas <hexlabsecurity@proton.me>
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
Bryam Vargas <hexlabsecurity@proton.me>
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
Haoxiang Li <haoxiang_li2024@163.com>
Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
Guillermo Rodríguez <guille.rodriguez@gmail.com>
i2c: stm32f7: truncate clock period instead of rounding it
Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
udmabuf: fix DMA direction mismatch in release_udmabuf()
Sean Christopherson <seanjc@google.com>
KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
Bryam Vargas <hexlabsecurity@proton.me>
exfat: bound uniname advance in exfat_find_dir_entry()
Benjamin Coddington <ben.coddington@hammerspace.com>
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
Huihui Huang <hhhuang@smu.edu.sg>
tracing: Prevent out-of-bounds read in glob matching
Carlos Song <carlos.song@nxp.com>
spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
Carlos Song <carlos.song@nxp.com>
spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
Paul Louvel <paul.louvel@bootlin.com>
crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
Eric Biggers <ebiggers@kernel.org>
crypto: drbg - Fix the fips_enabled priority boost
Eric Biggers <ebiggers@kernel.org>
crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
Eric Biggers <ebiggers@kernel.org>
crypto: drbg - Fix returning success on failure in CTR_DRBG
Ruijie Li <ruijieli51@gmail.com>
crypto: pcrypt - restore callback for non-parallel fallback
Anastasia Tishchenko <sv3iry@gmail.com>
crypto: ecc - Fix carry overflow in vli multiplication
Thorsten Blum <thorsten.blum@linux.dev>
crypto: caam - use print_hex_dump_devel to guard key hex dumps again
Thorsten Blum <thorsten.blum@linux.dev>
crypto: caam - use print_hex_dump_devel to guard key hex dumps
Bryam Vargas <hexlabsecurity@proton.me>
isofs: bound Rock Ridge symlink components to the SL record
Bryam Vargas <hexlabsecurity@proton.me>
partitions: aix: bound the pp_count scan to the ppe array
Mikulas Patocka <mpatocka@redhat.com>
dm-ioctl: report an error if a device has no table
Bryam Vargas <hexlabsecurity@proton.me>
udf: validate sparing table length as an entry count, not a byte count
Bryam Vargas <hexlabsecurity@proton.me>
udf: validate VAT header length against the VAT inode size
Michael Bommarito <michael.bommarito@gmail.com>
udf: validate free block extents against the partition length
Liviu Stan <liviu.stan@analog.com>
iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
Maxwell Doose <m32285159@gmail.com>
iio: adc: spear: Initialize completion before requesting IRQ
Madhu M <madhu.m@intel.com>
usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
Andrei Kuchynski <akuchynski@chromium.org>
usb: typec: ucsi: Invert DisplayPort role assignment
Badhri Jagan Sridharan <badhri@google.com>
usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
Sam Day <me@samcday.com>
usbip: vudc: fix NULL deref in vep_dequeue()
Yichong Chen <chenyichong@uniontech.com>
usbip: tools: support SuperSpeedPlus devices
Xu Rao <raoxu@uniontech.com>
USB: usb-storage: ene_ub6250: restore media-ready check
Johan Hovold <johan@kernel.org>
USB: ulpi: fix memory leak on registration failure
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix hard lockup on disconnect
Johan Hovold <johan@kernel.org>
USB: serial: digi_acceleport: fix broken rx after throttle
Fabio Porcedda <fabio.porcedda@gmail.com>
USB: serial: option: add Telit Cinterion FE990D50 compositions
Haoxiang Li <haoxiang_li2024@163.com>
usb: mtu3: unmap request DMA on queue failure
Myeonghun Pak <mhun512@gmail.com>
USB: misc: uss720: unregister parport on probe failure
Xu Rao <raoxu@uniontech.com>
USB: storage: include US_FL_NO_SAME in quirks mask
Myeonghun Pak <mhun512@gmail.com>
usb: sl811-hcd: disable controller wakeup on remove
Johan Hovold <johan@kernel.org>
USB: legousbtower: fix use-after-free on disconnect race
Erich E. Hoover <erich.e.hoover@gmail.com>
USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix use-after-free on disconnect
Johan Hovold <johan@kernel.org>
USB: ldusb: fix use-after-free on disconnect race
Johan Hovold <johan@kernel.org>
USB: idmouse: fix use-after-free on disconnect race
Maoyi Xie <maoyixie.tju@gmail.com>
usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
Rodrigo Lugathe da Conceição Alves <lugathe2@gmail.com>
USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
Jared Baldridge <jrb@expunge.us>
usb: cdc_acm: Add quirk for Uniden BC125AT scanner
Maoyi Xie <maoyixie.tju@gmail.com>
net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
Deepanshu Kartikey <kartikey406@gmail.com>
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
Tristan Madani <tristan@talencesecurity.com>
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
Maoyi Xie <maoyixie.tju@gmail.com>
HID: lg-g15: cancel pending work on remove to fix a use-after-free
Myeonghun Pak <mhun512@gmail.com>
HID: wacom: stop hardware after post-start probe failures
WenTao Liang <vulab@iscas.ac.cn>
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
Yuho Choi <dbgh9129@gmail.com>
cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
Tianxiang Chen <nanmu@xiaomi.com>
cpufreq: Fix hotplug-suspend race during reboot
Steven Rostedt <rostedt@goodmis.org>
sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
net: Drop the lock in skb_may_tx_timestamp()
Muhammad Bilal <meatuni001@gmail.com>
Bluetooth: L2CAP: validate option length before reading conf opt value
Yousef Alhouseen <alhouseenyousef@gmail.com>
Bluetooth: fix UAF in bt_accept_dequeue()
Yousef Alhouseen <alhouseenyousef@gmail.com>
Bluetooth: bnep: pin L2CAP connection during netdev registration
Xiang Mei <xmei5@asu.edu>
netfilter: ebtables: terminate table name before find_table_lock()
Florian Westphal <fw@strlen.de>
netfilter: ebtables: module names must be null-terminated
Andrei Kuchynski <akuchynski@chromium.org>
mfd: cros_ec: Delay dev_set_drvdata() until probe success
Wyatt Feng <bronzed_45_vested@icloud.com>
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
Yuyang Huang <yuyanghuang@google.com>
ipv4: igmp: remove multicast group from hash table on device destruction
Runyu Xiao <runyu.xiao@seu.edu.cn>
io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
Runyu Xiao <runyu.xiao@seu.edu.cn>
gpio: eic-sprd: use raw_spinlock_t in the irq startup path
Thomas Gleixner <tglx@kernel.org>
debugobjects: Plug race against a concurrent OOM disable
Chi Wang <wangchi@kylinos.cn>
audit: Fix data races of skb_queue_len() readers on audit_queue
Zijing Yin <yzjaurora@gmail.com>
net: af_key: initialize alg_key_len for IPComp states
Dawei Feng <dawei.feng@seu.edu.cn>
crypto: amlogic - avoid double cleanup in meson_crypto_probe()
Ricardo Ribalda <ribalda@chromium.org>
media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
Samuel Page <sam@bynar.io>
tipc: fix out-of-bounds read in broadcast Gap ACK blocks
Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
6lowpan: fix NHC entry use-after-free on error path
Alan Stern <stern@rowland.harvard.edu>
USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
Michael Bommarito <michael.bommarito@gmail.com>
hwrng: virtio: clamp device-reported used.len at copy_data()
Johan Hovold <johan@kernel.org>
virtio-mmio: fix device release warning on module unload
Xiang Mei <xmei5@asu.edu>
netfilter: ipset: fix race between dump and ip_set_list resize
Ratheesh Kannoth <rkannoth@marvell.com>
PCI: host-common: Request bus reassignment when not probe-only
Mahesh Vaidya <mahesh.vaidya@altera.com>
PCI: altera: Do not dispose parent IRQ mapping
胡连勤 <hulianqin@vivo.com>
usb: xhci: Fix sleep in atomic context in xhci_free_streams()
Carlos Llamas <cmllamas@google.com>
binder: fix UAF in binder_thread_release()
Johan Hovold <johan@kernel.org>
Bluetooth: btusb: fix use-after-free on registration failure
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Roll back quirk control caches on write errors
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
Cássio Gabriel <cassiogabrielcontato@gmail.com>
ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
Darvell Long <contact@darvell.me>
ALSA: usb-audio: avoid kobject path lookup in DualSense match
Maoyi Xie <maoyixie.tju@gmail.com>
ALSA: firewire: isight: bound the sample count to the packet payload
Zhao Dongdong <zhaodongdong@kylinos.cn>
ALSA: es1938: check snd_ctl_new1() return value
Maoyi Xie <maoyixie.tju@gmail.com>
ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
Liviu Stan <liviu.stan@analog.com>
iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
Javier Carrasco <javier.carrasco.cruz@gmail.com>
iio: light: veml6030: fix channel type when pushing events
Joshua Crofts <joshua.crofts1@gmail.com>
iio: light: opt3001: fix missing state reset on timeout
Biren Pandya <birenpandya@gmail.com>
iio: light: gp2ap002: fix runtime PM leak on read error
Vidhu Sarwal <vidhu.linux@gmail.com>
iio: light: al3010: fix incorrect scale for the highest gain range
Andreas Kempe <andreas.kempe@actia.se>
iio: imu: st_lsm6dsx: deselect shub page before reading whoami
Runyu Xiao <runyu.xiao@seu.edu.cn>
iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
Stepan Ionichev <sozdayvek@gmail.com>
iio: gyro: bmg160: wait full startup time after mode change at probe
Stepan Ionichev <sozdayvek@gmail.com>
iio: gyro: bmg160: bail out when bandwidth/filter is not in table
Lars-Peter Clausen <lars@metafoo.de>
iio: event: Fix event FIFO reset race
Maxwell Doose <m32285159@gmail.com>
iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
Pengpeng Hou <pengpeng@iscas.ac.cn>
iio: adc: ti-ads124s08: Return reset GPIO lookup errors
Maxwell Doose <m32285159@gmail.com>
iio: adc: lpc32xx: Initialize completion before requesting IRQ
Biren Pandya <birenpandya@gmail.com>
iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
Bryam Vargas <hexlabsecurity@proton.me>
iio: accel: bmc150: clamp the device-reported FIFO frame count
Griffin Kroah-Hartman <griffin@kroah.com>
usb: gadget: function: rndis: add length check for header
Griffin Kroah-Hartman <griffin@kroah.com>
usb: gadget: function: rndis: add length check to response query
Michal Kosiorek <mkosiorek121@gmail.com>
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
Fan Wu <fanwu01@zju.edu.cn>
hdlc_ppp: sync per-proto timers before freeing hdlc state
Johan Hovold <johan@kernel.org>
i2c: core: fix adapter registration race
Johan Hovold <johan@kernel.org>
i2c: core: fix adapter debugfs creation
Johan Hovold <johan@kernel.org>
i2c: core: fix NULL-deref on adapter registration failure
Johan Hovold <johan@kernel.org>
i2c: core: fix hang on adapter registration failure
Johan Hovold <johan@kernel.org>
i2c: core: fix irq domain leak on adapter registration failure
Mingyu Wang <25181214217@stu.xidian.edu.cn>
fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
Michael Bommarito <michael.bommarito@gmail.com>
NFSv4/flexfiles: reject zero filehandle version count
Keshav Verma <iganschel@gmail.com>
f2fs: fix listxattr handling of corrupted xattr entries
Ruipeng Qi <ruipengqi3@gmail.com>
f2fs: fix potential deadlock in f2fs_balance_fs()
Bryam Vargas <hexlabsecurity@proton.me>
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
Wenjie Qi <qwjhust@gmail.com>
f2fs: validate orphan inode entry count
Sunmin Jeong <s_min.jeong@samsung.com>
f2fs: fix to round down start offset of fallocate for pin file
Jaegeuk Kim <jaegeuk@kernel.org>
f2fs: adjust zone capacity when considering valid block count
Bryam Vargas <hexlabsecurity@proton.me>
apparmor: mediate the implicit connect of TCP fast open sendmsg
Maoyi Xie <maoyixie.tju@gmail.com>
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
Ruslan Valiyev <linuxoid@gmail.com>
apparmor: fix use-after-free in rawdata dedup loop
Yiming Qian <yimingqian591@gmail.com>
net: skmsg: preserve sg.copy across SG transforms
Eric Dumazet <edumazet@google.com>
skmsg: convert struct sk_msg_sg::copy to a bitmap
Xiang Mei <xmei5@asu.edu>
netfilter: nf_log: validate MAC header was set before dumping it
Krishna chaitanya chundru <quic_krichai@quicinc.com>
bus: mhi: host: Add alignment check for event ring read pointer
Florian Fainelli <florian.fainelli@broadcom.com>
perf trace beauty fcntl: Fix build with older kernel headers
Sean Christopherson <seanjc@google.com>
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC
NeilBrown <neil@brown.name>
nfsd: change nfs4_client_to_reclaim() to allocate data
NeilBrown <neilb@ownmail.net>
nfsd: move name lookup out of nfsd4_list_rec_dir()
Jiasheng Jiang <jiasheng@iscas.ac.cn>
clk: imx: Add check for kcalloc
Kiryl Shutsemau <kas@kernel.org>
userfaultfd: gate must_wait writability check on pte_present()
Jeff Layton <jlayton@kernel.org>
nfsd: reset write verifier on deferred writeback errors
Chris Mason <clm@meta.com>
nfsd: release layout stid on setlease failure
Chaitanya Kulkarni <kch@nvidia.com>
nvmet-tcp: fix race between ICReq handling and queue teardown
-------------
Diffstat:
Documentation/admin-guide/pm/cpufreq.rst | 6 +-
Documentation/crypto/userspace-if.rst | 31 +-
Documentation/driver-api/pci/pci.rst | 3 +
Makefile | 4 +-
arch/alpha/kernel/pci-sysfs.c | 13 +-
arch/arm/boot/dts/am335x-sl50.dts | 4 +-
arch/arm/mach-davinci/board-da850-evm.c | 12 +-
arch/arm/mach-imx/cpu-imx31.c | 9 +-
arch/arm/mach-imx/mm-imx3.c | 2 +
arch/arm64/boot/dts/qcom/sdm630.dtsi | 9 +-
arch/arm64/kernel/hw_breakpoint.c | 9 +
arch/arm64/kvm/vgic/vgic-its.c | 15 +-
arch/arm64/kvm/vgic/vgic.c | 11 +-
arch/mips/dec/int-handler.S | 2 +-
arch/mips/dec/prom/init.c | 6 +-
arch/mips/dec/setup.c | 6 -
arch/mips/fw/lib/call_o32.S | 2 +-
arch/mips/include/asm/dec/prom.h | 15 +-
arch/mips/mm/init.c | 12 +-
arch/mips/sgi-ip22/ip22-gio.c | 7 +-
arch/powerpc/kexec/core_64.c | 4 +-
arch/powerpc/perf/core-fsl-emb.c | 3 +-
arch/powerpc/platforms/cell/spufs/file.c | 6 +-
arch/powerpc/platforms/powernv/setup.c | 3 +-
arch/riscv/kernel/stacktrace.c | 2 +-
arch/sparc/kernel/led.c | 2 +-
arch/x86/boot/compressed/acpi.c | 7 +-
arch/x86/boot/early_serial_console.c | 11 +-
arch/x86/events/amd/core.c | 6 +-
arch/x86/kernel/cpu/mce/therm_throt.c | 7 +-
arch/x86/kvm/vmx/vmx.c | 3 +-
arch/x86/mm/numa_emulation.c | 17 +-
arch/x86/platform/olpc/olpc-xo15-sci.c | 1 +
block/partitions/aix.c | 9 +
certs/common.c | 2 +-
crypto/af_alg.c | 54 +-
crypto/algif_skcipher.c | 49 +-
crypto/asymmetric_keys/verify_pefile.c | 2 +
crypto/drbg.c | 4 +-
crypto/ecc.c | 31 +-
crypto/ecrdsa.c | 2 +-
crypto/pcrypt.c | 4 +
crypto/rng.c | 11 +
drivers/acpi/acpi_ipmi.c | 2 +-
drivers/acpi/nfit/core.c | 15 +-
drivers/acpi/resource.c | 6 +-
drivers/android/binder.c | 19 +-
drivers/ata/pata_pxa.c | 1 +
drivers/ata/sata_gemini.c | 2 +-
drivers/base/firmware_loader/main.c | 3 +-
drivers/base/power/main.c | 6 +-
drivers/base/property.c | 4 +-
drivers/block/drbd/drbd_receiver.c | 5 +
drivers/bluetooth/bpa10x.c | 8 +-
drivers/bluetooth/btintel.c | 105 +-
drivers/bluetooth/btintel.h | 5 +-
drivers/bluetooth/btrtl.c | 5 +-
drivers/bluetooth/btusb.c | 44 +-
drivers/bluetooth/hci_intel.c | 7 +-
drivers/bus/mhi/host/main.c | 3 +-
drivers/bus/sunxi-rsb.c | 3 +
drivers/char/hw_random/virtio-rng.c | 23 +-
drivers/char/tlclk.c | 4 +
drivers/char/tpm/eventlog/tpm1.c | 4 +-
drivers/char/tpm/tpm-dev.c | 2 +-
drivers/char/tpm/tpmrm-dev.c | 2 +-
drivers/clk/clk-scmi.c | 4 +-
drivers/clk/imx/clk.c | 2 +
drivers/clk/qcom/a53-pll.c | 2 +-
drivers/cpufreq/cpufreq.c | 2 +
drivers/cpufreq/cpufreq_conservative.c | 12 +-
drivers/cpufreq/intel_pstate.c | 6 +-
drivers/cpufreq/pcc-cpufreq.c | 2 +
drivers/crypto/amcc/crypto4xx_alg.c | 114 +-
drivers/crypto/amcc/crypto4xx_core.c | 148 +-
drivers/crypto/amcc/crypto4xx_core.h | 15 +-
drivers/crypto/amcc/crypto4xx_reg_def.h | 19 +-
drivers/crypto/amcc/crypto4xx_sa.h | 18 +-
drivers/crypto/amcc/crypto4xx_trng.h | 2 +-
drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +-
drivers/crypto/atmel-ecc.c | 2 +-
drivers/crypto/atmel-sha204a.c | 29 +-
drivers/crypto/caam/caamalg.c | 12 +-
drivers/crypto/caam/caamalg_qi.c | 12 +-
drivers/crypto/caam/caamalg_qi2.c | 12 +-
drivers/crypto/caam/caamhash.c | 4 +-
drivers/crypto/caam/key_gen.c | 4 +-
drivers/crypto/cavium/cpt/cptvf_reqmanager.c | 4 +-
drivers/crypto/ccp/sev-dev.c | 3 +-
drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c | 4 +-
drivers/crypto/qat/qat_common/adf_accel_devices.h | 2 +
drivers/crypto/qat/qat_common/adf_aer.c | 7 +-
drivers/crypto/qat/qat_common/adf_common_drv.h | 4 +
drivers/crypto/qat/qat_common/adf_isr.c | 18 +
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 22 +
drivers/crypto/qat/qat_common/adf_sriov.c | 38 +-
drivers/crypto/qat/qat_common/qat_asym_algs.c | 10 +-
drivers/crypto/talitos.c | 26 +-
drivers/dma-buf/udmabuf.c | 5 +-
drivers/dma/dmaengine.c | 3 +-
drivers/gpio/gpio-eic-sprd.c | 8 +-
drivers/gpio/gpio-htc-egpio.c | 6 +-
drivers/gpio/gpio-mvebu.c | 5 +-
drivers/gpio/gpio-palmas.c | 19 +
drivers/gpio/gpio-pca953x.c | 11 +-
drivers/gpio/gpio-timberdale.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 +-
drivers/gpu/drm/drm_edid.c | 8 +
drivers/gpu/drm/i2c/sil164_drv.c | 7 -
drivers/gpu/drm/msm/dp/dp_display.c | 4 +-
drivers/gpu/drm/msm/dp/dp_reg.h | 4 +-
drivers/gpu/drm/radeon/radeon_ring.c | 4 +-
drivers/gpu/drm/tegra/dc.c | 4 +-
drivers/gpu/drm/tidss/tidss_kms.c | 2 -
drivers/gpu/host1x/bus.c | 2 +-
drivers/hid/hid-appleir.c | 45 +-
drivers/hid/hid-core.c | 7 +
drivers/hid/hid-lg-g15.c | 16 +
drivers/hid/hid-logitech-hidpp.c | 1 -
drivers/hid/hid-multitouch.c | 32 +-
drivers/hid/hid-picolcd_core.c | 3 +-
drivers/hid/hid-sensor-hub.c | 77 +-
drivers/hid/wacom_sys.c | 12 +-
drivers/hwmon/asus_atk0110.c | 3 +
drivers/hwmon/pmbus/adm1275.c | 2 +-
drivers/hwmon/w83627hf.c | 4 +
drivers/hwmon/w83793.c | 1 +
drivers/hwspinlock/qcom_hwspinlock.c | 5 +-
.../hwtracing/coresight/coresight-cti-platform.c | 1 +
drivers/hwtracing/coresight/coresight-etb10.c | 6 +-
drivers/i2c/busses/i2c-mlxbf.c | 4 +-
drivers/i2c/busses/i2c-mt65xx.c | 2 +-
drivers/i2c/busses/i2c-stm32f7.c | 9 +-
drivers/i2c/i2c-core-base.c | 82 +-
drivers/i3c/master.c | 19 +-
drivers/iio/accel/bmc150-accel-core.c | 2 +
drivers/iio/accel/kxsd9.c | 5 +-
drivers/iio/accel/mma8452.c | 2 +
drivers/iio/adc/lpc32xx_adc.c | 4 +-
drivers/iio/adc/spear_adc.c | 4 +-
drivers/iio/adc/ti-ads124s08.c | 3 +-
drivers/iio/chemical/scd30_core.c | 19 +-
drivers/iio/common/Kconfig | 1 +
drivers/iio/common/Makefile | 1 +
drivers/iio/common/inv_sensors/Kconfig | 7 +
drivers/iio/common/inv_sensors/Makefile | 6 +
.../inv_sensors/inv_sensors_timestamp.c} | 120 +-
drivers/iio/common/st_sensors/st_sensors_core.c | 23 +-
drivers/iio/gyro/bmg160_core.c | 16 +-
drivers/iio/imu/adis_trigger.c | 2 +-
drivers/iio/imu/bmi160/bmi160_core.c | 3 +-
drivers/iio/imu/inv_icm42600/Kconfig | 1 +
drivers/iio/imu/inv_icm42600/Makefile | 1 -
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 35 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 61 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 3 +
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 24 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 35 +-
.../iio/imu/inv_icm42600/inv_icm42600_timestamp.h | 85 -
drivers/iio/imu/inv_mpu6050/Kconfig | 1 +
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 30 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 18 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 85 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 11 +-
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 +-
drivers/iio/industrialio-event.c | 5 +-
drivers/iio/light/al3010.c | 2 +-
drivers/iio/light/gp2ap002.c | 2 +-
drivers/iio/light/opt3001.c | 6 +-
drivers/iio/light/si1133.c | 14 +-
drivers/iio/light/veml6030.c | 8 +-
drivers/iio/magnetometer/ak8975.c | 15 +
drivers/iio/orientation/hid-sensor-rotation.c | 40 +-
drivers/iio/temperature/ltc2983.c | 5 +-
drivers/infiniband/hw/hns/hns_roce_hem.c | 8 +-
drivers/infiniband/hw/hns/hns_roce_main.c | 2 +-
drivers/infiniband/hw/mlx4/mlx4_ib.h | 1 +
drivers/infiniband/hw/mlx4/mr.c | 9 +-
drivers/infiniband/hw/mlx4/sysfs.c | 45 +-
drivers/infiniband/hw/mlx5/devx.c | 30 +-
drivers/infiniband/hw/mlx5/qp.c | 11 +-
drivers/infiniband/sw/siw/siw_qp_rx.c | 9 +
drivers/infiniband/ulp/srpt/ib_srpt.c | 5 +-
drivers/input/joystick/iforce/iforce-packets.c | 18 +-
drivers/input/joystick/maplecontrol.c | 3 +-
drivers/input/keyboard/maple_keyb.c | 4 +-
drivers/input/misc/ims-pcu.c | 115 +-
drivers/input/mouse/elan_i2c_core.c | 36 +-
drivers/input/mouse/maplemouse.c | 9 +-
drivers/input/rmi4/rmi_bus.c | 4 +-
drivers/input/rmi4/rmi_f30.c | 2 +-
drivers/input/rmi4/rmi_f3a.c | 2 +-
drivers/input/touchscreen/goodix.c | 3 +-
drivers/input/touchscreen/mms114.c | 2 +-
drivers/input/touchscreen/touchwin.c | 15 +-
drivers/iommu/amd/amd_iommu_types.h | 11 +-
drivers/irqchip/irq-crossbar.c | 10 +-
drivers/leds/leds-lm3601x.c | 11 +-
drivers/leds/leds-lm3697.c | 4 +-
drivers/leds/uleds.c | 3 +-
drivers/md/dm-bufio.c | 4 +-
drivers/md/dm-era-target.c | 10 +-
drivers/md/dm-ioctl.c | 7 +-
drivers/md/dm-log.c | 3 +
drivers/md/dm-stats.c | 10 +-
drivers/md/dm-thin-metadata.c | 67 +-
drivers/md/dm-verity-target.c | 2 +-
drivers/media/platform/qcom/venus/helpers.c | 4 +-
drivers/media/platform/rockchip/rga/rga-hw.c | 2 +-
drivers/media/platform/rockchip/rga/rga-hw.h | 2 +-
drivers/media/usb/uvc/uvc_video.c | 30 +-
drivers/memstick/core/ms_block.c | 4 +
drivers/mfd/cros_ec_dev.c | 3 +-
drivers/mfd/sm501.c | 4 +-
drivers/mfd/tps6586x.c | 2 +-
drivers/mmc/host/renesas_sdhi_core.c | 1 +
drivers/mmc/host/vub300.c | 26 +-
drivers/mtd/devices/slram.c | 22 +-
drivers/mtd/maps/vmu-flash.c | 1 +
drivers/mtd/nand/onenand/onenand_samsung.c | 7 +-
drivers/mtd/nand/raw/fsl_ifc_nand.c | 9 +-
drivers/mtd/nand/raw/lpc32xx_mlc.c | 12 +-
drivers/mtd/nand/raw/lpc32xx_slc.c | 12 +-
drivers/mtd/nand/raw/nand_base.c | 2 +-
drivers/mtd/spi-nor/Kconfig | 1 -
drivers/net/bonding/bond_3ad.c | 1 +
drivers/net/dsa/sja1105/sja1105_ptp.c | 2 +-
drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +-
.../ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 +-
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 -
drivers/net/ethernet/freescale/fman/fman.c | 4 +-
drivers/net/ethernet/marvell/mvneta.c | 3 +
.../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 +
.../net/ethernet/mellanox/mlx5/core/lib/port_tun.c | 3 +-
.../net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 +
drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 5 +
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h | 20 +
.../net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 53 +-
drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h | 22 +-
.../ethernet/qualcomm/rmnet/rmnet_map_command.c | 11 +-
.../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 334 +++-
drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c | 9 +-
drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h | 1 +
drivers/net/ethernet/sun/sungem.c | 13 +-
drivers/net/ieee802154/ca8210.c | 9 +-
drivers/net/macsec.c | 7 +-
drivers/net/usb/gl620a.c | 6 +-
drivers/net/usb/kalmia.c | 8 +
drivers/net/usb/lan78xx.c | 18 +-
drivers/net/usb/net1080.c | 2 +-
drivers/net/virtio_net.c | 3 +
drivers/net/wan/hdlc_ppp.c | 15 +-
drivers/net/wireless/ath/ath9k/xmit.c | 5 +
drivers/net/wireless/ath/wcn36xx/smd.c | 6 +
drivers/net/wireless/marvell/mwifiex/join.c | 1 -
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 +-
drivers/net/wireless/realtek/rtw88/pci.c | 5 +
drivers/nvdimm/btt.c | 14 +-
drivers/nvme/host/core.c | 2 +-
drivers/nvme/target/rdma.c | 18 +-
drivers/nvme/target/tcp.c | 33 +-
drivers/pci/Makefile | 2 +-
drivers/pci/controller/dwc/pci-imx6.c | 5 +-
drivers/pci/controller/dwc/pcie-designware-host.c | 2 +-
.../pci/controller/mobiveil/pcie-mobiveil-host.c | 8 +-
drivers/pci/controller/pci-host-common.c | 4 +
drivers/pci/controller/pcie-altera-msi.c | 2 +-
drivers/pci/controller/pcie-altera.c | 32 +-
drivers/pci/controller/pcie-mediatek.c | 117 +-
drivers/pci/controller/pcie-rcar-host.c | 1 -
drivers/pci/controller/pcie-xilinx-nwl.c | 2 +-
drivers/pci/pci.c | 135 --
drivers/pci/pci.h | 4 +
drivers/pci/rebar.c | 217 +++
drivers/pci/setup-bus.c | 100 +-
drivers/pci/setup-res.c | 53 -
drivers/pinctrl/mediatek/pinctrl-mt8167.c | 2 +-
drivers/pinctrl/mediatek/pinctrl-mt8516.c | 2 +-
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 +-
drivers/platform/x86/xo15-ebook.c | 7 +-
drivers/power/supply/charger-manager.c | 6 +-
drivers/pwm/pwm-imx27.c | 8 +-
drivers/rapidio/devices/tsi721.c | 3 +-
drivers/regulator/core.c | 29 +-
drivers/regulator/ltc3676.c | 10 +-
drivers/reset/reset-imx7.c | 6 +
drivers/reset/reset-sunxi.c | 4 +-
drivers/rtc/rtc-abx80x.c | 3 +-
drivers/rtc/rtc-cmos.c | 6 +
drivers/rtc/rtc-ds1307.c | 30 +-
drivers/s390/char/monwriter.c | 3 +
drivers/s390/net/qeth_l3_main.c | 6 +-
drivers/scsi/hpsa.c | 4 +
drivers/scsi/pm8001/pm8001_ctl.c | 5 +-
drivers/scsi/scsi_scan.c | 2 +-
drivers/scsi/scsi_transport_sas.c | 60 +-
drivers/scsi/sg.c | 7 +-
drivers/scsi/smartpqi/smartpqi_init.c | 2 +-
drivers/soc/fsl/qe/qe.c | 3 +
drivers/soc/ti/k3-ringacc.c | 4 +-
drivers/spi/spi-ep93xx.c | 1 +
drivers/spi/spi-fsl-lpspi.c | 18 +-
drivers/spi/spi-sh-msiof.c | 10 +-
drivers/spi/spi-uniphier.c | 4 +-
drivers/spi/spi-xilinx.c | 11 +-
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 6 +-
.../media/atomisp/pci/atomisp_compat_css20.c | 2 +-
.../atomisp/pci/runtime/isys/src/virtual_isys.c | 12 +-
drivers/staging/media/atomisp/pci/sh_css.c | 1946 +++++++++-----------
drivers/staging/media/ipu3/ipu3-css-params.c | 8 +-
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +-
drivers/staging/most/video/video.c | 7 +-
drivers/staging/nvec/nvec.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_ap.c | 31 +-
drivers/staging/rtl8723bs/core/rtw_cmd.c | 96 +-
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 22 +-
drivers/staging/rtl8723bs/core/rtw_ioctl_set.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_mlme.c | 16 +-
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 349 ++--
drivers/staging/rtl8723bs/core/rtw_recv.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_security.c | 6 +-
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 14 +-
drivers/staging/rtl8723bs/hal/hal_com_phycfg.c | 34 -
drivers/staging/rtl8723bs/hal/odm.c | 30 -
drivers/staging/rtl8723bs/hal/odm.h | 3 -
drivers/staging/rtl8723bs/hal/odm_EdcaTurboCheck.c | 4 +-
drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 1 -
drivers/staging/rtl8723bs/hal/sdio_halinit.c | 10 -
drivers/staging/rtl8723bs/include/hal_phy.h | 3 -
drivers/staging/rtl8723bs/include/ieee80211.h | 22 +-
drivers/staging/rtl8723bs/include/rtw_mlme_ext.h | 6 +-
drivers/staging/rtl8723bs/include/wifi.h | 1 -
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 118 +-
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 41 +-
drivers/staging/rtl8723bs/os_dep/os_intfs.c | 6 +-
drivers/target/target_core_pr.c | 8 +-
drivers/thermal/thermal_hwmon.c | 5 +-
drivers/tty/serial/8250/8250_mid.c | 31 +-
drivers/tty/serial/8250/8250_omap.c | 3 +-
drivers/tty/serial/msm_serial.c | 3 +-
drivers/usb/atm/ueagle-atm.c | 36 +-
drivers/usb/class/cdc-acm.c | 3 +
drivers/usb/common/ulpi.c | 23 +-
drivers/usb/core/quirks.c | 6 +
drivers/usb/gadget/composite.c | 5 +-
drivers/usb/gadget/function/f_fs.c | 5 +-
drivers/usb/gadget/function/f_printer.c | 10 +-
drivers/usb/gadget/function/rndis.c | 20 +-
drivers/usb/host/ehci-sched.c | 11 +-
drivers/usb/host/fotg210-hcd.c | 6 +-
drivers/usb/host/max3421-hcd.c | 8 +
drivers/usb/host/sl811-hcd.c | 1 +
drivers/usb/host/xhci.c | 11 +-
drivers/usb/misc/chaoskey.c | 1 -
drivers/usb/misc/idmouse.c | 45 +-
drivers/usb/misc/iowarrior.c | 21 +-
drivers/usb/misc/ldusb.c | 38 +-
drivers/usb/misc/legousbtower.c | 37 +-
drivers/usb/misc/uss720.c | 5 +-
drivers/usb/mtu3/mtu3_gadget.c | 1 +
drivers/usb/serial/digi_acceleport.c | 43 +-
drivers/usb/serial/option.c | 16 +
drivers/usb/storage/ene_ub6250.c | 3 +-
drivers/usb/storage/usb.c | 2 +-
drivers/usb/typec/tcpm/tcpm.c | 7 +-
drivers/usb/typec/ucsi/displayport.c | 7 +-
drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +-
drivers/usb/usbip/vudc.h | 1 -
drivers/usb/usbip/vudc_dev.c | 4 +-
drivers/vfio/pci/vfio_pci.c | 1 +
drivers/vhost/vdpa.c | 29 +-
drivers/video/fbdev/aty/radeon_base.c | 1 +
drivers/video/fbdev/carminefb.c | 1 +
drivers/video/fbdev/core/fbcon.c | 7 +
drivers/video/fbdev/i740fb.c | 1 +
drivers/video/fbdev/nvidia/nvidia.c | 1 +
drivers/video/fbdev/s3fb.c | 1 +
drivers/video/fbdev/sm501fb.c | 16 +-
drivers/video/fbdev/sm712.h | 2 +-
drivers/video/fbdev/tdfxfb.c | 1 +
drivers/video/fbdev/tridentfb.c | 1 +
drivers/video/fbdev/uvesafb.c | 4 +-
drivers/virtio/virtio_mmio.c | 26 +-
drivers/watchdog/sprd_wdt.c | 5 +-
drivers/xen/gntdev.c | 8 +-
fs/afs/cell.c | 2 +
fs/afs/cmservice.c | 2 -
fs/afs/rxrpc.c | 11 +-
fs/afs/super.c | 3 +-
fs/afs/vl_list.c | 10 +-
fs/btrfs/extent-tree.c | 17 +-
fs/cifs/cifs_debug.c | 2 +-
fs/cifs/cifsacl.c | 2 +-
fs/cifs/cifsfs.c | 1 -
fs/cifs/cifsglob.h | 5 +-
fs/cifs/cifsproto.h | 2 +-
fs/cifs/connect.c | 17 +-
fs/cifs/misc.c | 4 +-
fs/cifs/netmisc.c | 2 +-
fs/cifs/readdir.c | 6 +-
fs/cifs/smb2maperror.c | 16 +-
fs/cifs/smb2misc.c | 123 +-
fs/cifs/smb2ops.c | 107 +-
fs/cifs/smb2pdu.c | 114 +-
fs/cifs/smb2pdu.h | 365 +---
fs/cifs/smb2proto.h | 4 +-
fs/cifs/smb2transport.c | 36 +-
fs/configfs/dir.c | 54 +-
fs/efs/file.c | 21 +-
fs/exfat/dir.c | 13 +-
fs/ext4/ioctl.c | 12 +-
fs/f2fs/checkpoint.c | 13 +-
fs/f2fs/data.c | 29 +
fs/f2fs/debug.c | 2 +-
fs/f2fs/f2fs.h | 1 +
fs/f2fs/file.c | 15 +-
fs/f2fs/gc.c | 4 +-
fs/f2fs/inode.c | 13 +-
fs/f2fs/segment.c | 14 +-
fs/f2fs/segment.h | 8 +-
fs/f2fs/xattr.c | 4 +-
fs/fs-writeback.c | 20 +-
fs/fuse/cuse.c | 4 +-
fs/fuse/dev.c | 2 +-
fs/hfs/bfind.c | 2 +-
fs/hfs/bnode.c | 56 +-
fs/hfs/brec.c | 2 +-
fs/hfs/btree.c | 2 +-
fs/hfs/btree.h | 71 +-
fs/hfs/hfs_fs.h | 83 +-
fs/hfs/inode.c | 2 +-
fs/hfsplus/bfind.c | 2 +-
fs/hfsplus/bnode.c | 62 +-
fs/hfsplus/brec.c | 2 +-
fs/hfsplus/btree.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 40 +-
fs/isofs/rock.c | 11 +
fs/lockd/svcsubs.c | 4 +-
fs/nfs/callback_proc.c | 9 +-
fs/nfs/dir.c | 2 +
fs/nfs/filelayout/filelayout.c | 2 +
fs/nfs/flexfilelayout/flexfilelayout.c | 33 +
fs/nfs/flexfilelayout/flexfilelayout.h | 16 +
fs/nfs/pnfs.c | 4 +-
fs/nfsd/nfs4layouts.c | 4 +-
fs/nfsd/nfs4recover.c | 120 +-
fs/nfsd/nfs4state.c | 22 +-
fs/nfsd/vfs.c | 9 +-
fs/nilfs2/segment.c | 22 +
fs/ocfs2/alloc.c | 2 +-
fs/ocfs2/aops.c | 13 +-
fs/ocfs2/buffer_head_io.c | 7 +-
fs/ocfs2/dlm/dlmdebug.c | 16 +-
fs/ocfs2/dlmglue.c | 17 +
fs/ocfs2/inode.c | 150 +-
fs/ocfs2/journal.c | 13 +-
fs/ocfs2/move_extents.c | 4 +-
fs/ocfs2/ocfs2.h | 2 -
fs/ocfs2/quota_local.c | 2 +-
fs/ocfs2/stack_user.c | 10 +-
fs/ocfs2/super.c | 2 -
fs/ocfs2/sysfile.c | 9 +-
fs/orangefs/dir.c | 7 +-
fs/proc/array.c | 6 +
fs/proc/base.c | 184 +-
fs/proc/fd.c | 29 +-
fs/proc/generic.c | 9 +-
fs/proc/internal.h | 4 +-
fs/proc/namespaces.c | 16 +-
fs/proc/proc_net.c | 1 +
fs/smbfs_common/smb2pdu.h | 318 ++++
fs/sysfs/file.c | 4 +
fs/udf/balloc.c | 5 +-
fs/udf/super.c | 11 +-
fs/userfaultfd.c | 14 +-
fs/xfs/libxfs/xfs_format.h | 2 +-
fs/xfs/libxfs/xfs_sb.c | 64 +
fs/xfs/libxfs/xfs_sb.h | 1 +
fs/xfs/xfs_dquot.c | 16 +-
fs/xfs/xfs_log_recover.c | 6 +-
fs/xfs/xfs_mount.c | 1 +
fs/xfs/xfs_mount.h | 75 +
fs/xfs/xfs_rtalloc.c | 3 +
include/crypto/drbg.h | 18 +-
include/linux/audit.h | 8 +
include/linux/bitops.h | 2 +
include/linux/device.h | 5 +-
include/linux/glob.h | 1 +
include/linux/hid-sensor-hub.h | 25 +
include/linux/hid.h | 29 +
include/linux/if_rmnet.h | 70 +-
include/linux/iio/common/inv_sensors_timestamp.h | 94 +
include/linux/pci.h | 4 +-
include/linux/platform_data/pca953x.h | 2 +-
include/linux/skmsg.h | 22 +-
include/net/addrconf.h | 12 +-
include/net/bluetooth/hci.h | 5 +-
include/net/bluetooth/l2cap.h | 2 +-
include/net/fib_rules.h | 5 +
include/net/gue.h | 2 +-
include/net/if_inet6.h | 37 +-
include/net/ip_fib.h | 7 +-
include/net/ip_vs.h | 3 +-
include/net/mld.h | 3 +
include/net/ndisc.h | 4 +-
include/net/rtnetlink.h | 2 +
include/net/sctp/sctp.h | 3 +-
include/net/sock.h | 2 +-
include/net/xfrm.h | 7 +
include/uapi/linux/if_link.h | 1 +
io_uring/io-wq.c | 2 +-
kernel/audit.c | 85 +-
kernel/bpf/verifier.c | 3 +-
kernel/cgroup/cpuset.c | 7 +-
kernel/cpu.c | 8 +-
kernel/locking/rtmutex.c | 16 +-
kernel/sched/fair.c | 2 +-
kernel/sched/features.h | 8 +
kernel/time/posix-cpu-timers.c | 3 +-
kernel/time/time.c | 2 +-
kernel/trace/ring_buffer.c | 3 +-
kernel/trace/trace_events_filter.c | 6 +-
kernel/trace/trace_probe.c | 3 +-
kernel/trace/trace_probe.h | 2 +-
kernel/workqueue.c | 2 +-
lib/debugobjects.c | 17 +
lib/glob.c | 31 +-
lib/test_meminit.c | 2 +-
net/6lowpan/nhc.c | 2 +-
net/9p/trans_rdma.c | 19 +-
net/atm/common.c | 2 +
net/batman-adv/distributed-arp-table.c | 30 +-
net/batman-adv/fragmentation.c | 8 +-
net/batman-adv/gateway_client.c | 3 +-
net/batman-adv/main.c | 22 +-
net/batman-adv/multicast.c | 6 +-
net/batman-adv/routing.c | 3 +-
net/batman-adv/soft-interface.c | 11 +-
net/batman-adv/soft-interface.h | 2 +
net/batman-adv/translation-table.c | 5 +-
net/batman-adv/types.h | 7 +
net/bluetooth/af_bluetooth.c | 17 +-
net/bluetooth/bnep/core.c | 27 +-
net/bluetooth/l2cap_core.c | 123 +-
net/bluetooth/l2cap_sock.c | 4 +-
net/bridge/netfilter/ebtables.c | 22 +-
net/bridge/netfilter/nft_meta_bridge.c | 4 +-
net/can/bcm.c | 90 +-
net/can/isotp.c | 9 +-
net/core/fib_rules.c | 6 +-
net/core/filter.c | 38 +-
net/core/lwt_bpf.c | 12 +
net/core/rtnetlink.c | 8 +
net/core/skbuff.c | 23 +-
net/core/skmsg.c | 2 +
net/ieee802154/core.c | 2 +-
net/ieee802154/header_ops.c | 9 +-
net/ieee802154/ieee802154.h | 17 +
net/ieee802154/netlink.c | 36 +-
net/ife/ife.c | 2 +-
net/ipv4/igmp.c | 1 +
net/ipv4/ip_gre.c | 6 +
net/ipv4/ip_vti.c | 3 +
net/ipv4/netfilter/nf_log_ipv4.c | 4 +-
net/ipv4/sysctl_net_ipv4.c | 10 +-
net/ipv4/tcp_output.c | 4 +-
net/ipv6/addrconf.c | 38 +-
net/ipv6/addrconf_core.c | 2 +-
net/ipv6/af_inet6.c | 2 +-
net/ipv6/icmp.c | 4 +-
net/ipv6/ip6_gre.c | 6 +
net/ipv6/ip6_vti.c | 3 +
net/ipv6/mcast.c | 1184 +++++++-----
net/ipv6/netfilter.c | 4 +-
net/ipv6/netfilter/ip6t_ah.c | 5 +
net/ipv6/netfilter/ip6t_hbh.c | 1 +
net/ipv6/netfilter/ip6t_rt.c | 3 +-
net/ipv6/netfilter/nf_conntrack_reasm.c | 3 +-
net/ipv6/netfilter/nf_log_ipv6.c | 4 +-
net/ipv6/route.c | 9 +-
net/ipv6/seg6.c | 3 +
net/ipv6/sit.c | 3 +
net/kcm/kcmsock.c | 8 +-
net/key/af_key.c | 1 +
net/llc/af_llc.c | 1 +
net/llc/llc_conn.c | 1 -
net/mac80211/main.c | 3 +-
net/mac80211/tx.c | 17 +-
net/mac802154/iface.c | 2 +-
net/netfilter/ipset/ip_set_core.c | 12 +-
net/netfilter/ipvs/ip_vs_app.c | 10 +-
net/netfilter/ipvs/ip_vs_conn.c | 4 +-
net/netfilter/ipvs/ip_vs_core.c | 36 +-
net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 11 +-
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 +-
net/netfilter/nf_conncount.c | 23 +-
net/netfilter/nf_conntrack_core.c | 18 +-
net/netfilter/nf_conntrack_irc.c | 6 +-
net/netfilter/nf_conntrack_seqadj.c | 2 +
net/netfilter/nf_nat_sip.c | 9 +
net/netfilter/nfnetlink_cthelper.c | 4 +-
net/netfilter/nfnetlink_osf.c | 6 +-
net/netfilter/nft_log.c | 58 +-
net/netfilter/nft_synproxy.c | 9 +-
net/netfilter/xt_AUDIT.c | 58 +-
net/netfilter/xt_cluster.c | 2 +-
net/netfilter/xt_nat.c | 9 +
net/netfilter/xt_rateest.c | 2 +-
net/netfilter/xt_u32.c | 12 +-
net/openvswitch/conntrack.c | 2 +-
net/psample/psample.c | 6 +-
net/qrtr/af_qrtr.c | 2 +-
net/sched/cls_bpf.c | 10 +-
net/sched/sch_cake.c | 5 +-
net/sched/sch_codel.c | 48 +-
net/sched/sch_drr.c | 8 +-
net/sched/sch_fq_codel.c | 41 +-
net/sched/sch_hfsc.c | 24 +-
net/sched/sch_hhf.c | 27 +
net/sched/sch_htb.c | 8 +-
net/sched/sch_multiq.c | 2 +-
net/sctp/diag.c | 67 +-
net/sctp/sm_make_chunk.c | 10 +-
net/sctp/sm_statefuns.c | 23 +-
net/sctp/socket.c | 29 +-
net/smc/smc_cdc.c | 15 +-
net/socket.c | 2 +-
net/tipc/bcast.c | 22 +-
net/tipc/bcast.h | 2 +-
net/tipc/bearer.c | 1 +
net/tipc/netlink.c | 12 +
net/tipc/node.c | 15 +-
net/tipc/socket.c | 3 +
net/tipc/udp_media.c | 2 +
net/tls/tls_sw.c | 4 +
net/xfrm/xfrm_interface_core.c | 3 +
net/xfrm/xfrm_policy.c | 3 +
net/xfrm/xfrm_state.c | 11 +-
net/xfrm/xfrm_user.c | 2 +-
samples/trace_events/trace-events-sample.c | 4 +
scripts/kconfig/conf.c | 6 +-
security/apparmor/domain.c | 58 +-
security/apparmor/include/policy_unpack.h | 19 +
security/apparmor/label.c | 2 +-
security/apparmor/lsm.c | 18 +-
security/apparmor/net.c | 1 +
security/apparmor/policy.c | 14 +-
security/apparmor/procattr.c | 2 +
security/keys/keyring.c | 2 +-
sound/aoa/fabrics/layout.c | 6 +
sound/firewire/isight.c | 3 +-
sound/pci/es1938.c | 2 +
sound/soc/fsl/fsl_audmix.c | 6 +
sound/soc/tegra/tegra210_ahub.c | 4 +-
sound/usb/caiaq/input.c | 2 +-
sound/usb/mixer_quirks.c | 101 +-
sound/usb/mixer_scarlett.c | 4 +-
sound/usb/mixer_us16x08.c | 127 +-
tools/bpf/bpftool/net.c | 4 +-
tools/include/linux/bitops.h | 2 +
tools/lib/api/fs/fs.c | 19 +-
tools/lib/symbol/kallsyms.c | 5 +-
tools/perf/builtin-c2c.c | 1 +
tools/perf/builtin-sched.c | 37 +-
tools/perf/trace/beauty/fcntl.c | 16 +
tools/perf/util/bpf-event.c | 18 +-
tools/perf/util/cpumap.c | 6 +
tools/perf/util/event.c | 15 +-
tools/perf/util/hist.c | 7 +-
tools/perf/util/machine.c | 10 +-
tools/perf/util/mmap.c | 10 +-
tools/perf/util/pmu.c | 4 +-
tools/perf/util/probe-finder.c | 4 +-
tools/perf/util/symbol-elf.c | 48 +-
tools/perf/util/symbol-minimal.c | 11 +-
tools/perf/util/symbol.c | 2 +-
tools/perf/util/thread.c | 5 +
tools/testing/selftests/vm/compaction_test.c | 3 +
tools/testing/selftests/vm/hmm-tests.c | 32 +-
tools/usb/usbip/libsrc/usbip_common.c | 2 +
tools/usb/usbip/libsrc/usbip_device_driver.c | 4 +
tools/usb/usbip/libsrc/vhci_driver.c | 1 +
tools/virtio/vringh_test.c | 5 +
tools/vm/slabinfo.c | 4 +-
virt/kvm/eventfd.c | 12 +-
virt/kvm/kvm_main.c | 16 +-
689 files changed, 8712 insertions(+), 5883 deletions(-)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 001/699] nvmet-tcp: fix race between ICReq handling and queue teardown
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 002/699] nfsd: release layout stid on setlease failure Greg Kroah-Hartman
` (701 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shivam Kumar, Shivam Kumar,
Chaitanya Kulkarni, Keith Busch, Philo Lu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaitanya Kulkarni <kch@nvidia.com>
commit 5293a8882c549fab4a878bc76b0b6c951f980a61 upstream.
nvmet_tcp_handle_icreq() updates queue->state after sending an
Initialization Connection Response (ICResp), but it does so without
serializing against target-side queue teardown.
If an NVMe/TCP host sends an Initialization Connection Request
(ICReq) and immediately closes the connection, target-side teardown
may start in softirq context before io_work drains the already
buffered ICReq. In that case, nvmet_tcp_schedule_release_queue()
sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue
reference under state_lock.
If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can
still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the
DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and
allows a later socket state change to re-enter teardown and issue a
second kref_put() on an already released queue.
The ICResp send failure path has the same problem. If teardown has
already moved the queue to DISCONNECTING, a send error can still
overwrite the state with NVMET_TCP_Q_FAILED, again reopening the
window for a second teardown path to drop the queue reference.
Fix this by serializing both post-send state transitions with
state_lock and bailing out if teardown has already started.
Use -ESHUTDOWN as an internal sentinel for that bail-out path rather
than propagating it as a transport error like -ECONNRESET. Keep
nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before
honoring that sentinel so receive-side parsing stays quiesced until the
existing release path completes.
Fixes: c46a6465bac2 ("nvmet-tcp: add NVMe over TCP target driver")
Cc: stable@vger.kernel.org
Reported-by: Shivam Kumar <skumar47@syr.edu>
Tested-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
[ context diff adaptation: drop `queue->state = NVMET_TCP_Q_FAILED` since
the enum introduced in 6.7, 675b453e0241 ("nvmet-tcp: enable TLS handshake
upcall" ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index edcc0662c3e571..4bd82e9b113ff5 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -345,6 +345,19 @@ static void nvmet_tcp_build_pdu_iovec(struct nvmet_tcp_cmd *cmd)
static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue)
{
+ /*
+ * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path.
+ * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has
+ * already been consumed and queue teardown has started.
+ *
+ * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues
+ * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work()
+ * cancels it, the queue must not keep that old receive state.
+ * Otherwise the next nvmet_tcp_io_work() run can reach
+ * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again.
+ *
+ * That is why queue->rcv_state needs to be updated before we return.
+ */
queue->rcv_state = NVMET_TCP_RECV_ERR;
if (queue->nvme_sq.ctrl)
nvmet_ctrl_fatal_error(queue->nvme_sq.ctrl);
@@ -888,10 +901,24 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
iov.iov_base = icresp;
iov.iov_len = sizeof(*icresp);
ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
- if (ret < 0)
+ if (ret < 0) {
+ spin_lock_bh(&queue->state_lock);
+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+ spin_unlock_bh(&queue->state_lock);
+ return -ESHUTDOWN;
+ }
+ spin_unlock_bh(&queue->state_lock);
return ret; /* queue removal will cleanup */
+ }
+ spin_lock_bh(&queue->state_lock);
+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) {
+ spin_unlock_bh(&queue->state_lock);
+ /* Tell nvmet_tcp_socket_error() teardown is in progress. */
+ return -ESHUTDOWN;
+ }
queue->state = NVMET_TCP_Q_LIVE;
+ spin_unlock_bh(&queue->state_lock);
nvmet_prepare_receive_pdu(queue);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 002/699] nfsd: release layout stid on setlease failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 001/699] nvmet-tcp: fix race between ICReq handling and queue teardown Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 003/699] nfsd: reset write verifier on deferred writeback errors Greg Kroah-Hartman
` (700 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever, Chuck Lever, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 upstream.
nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via
idr_alloc_cyclic() under cl_lock before returning to
nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then
fails, the error path frees the layout stateid directly with
kmem_cache_free() without ever calling idr_remove(), leaving the
IDR slot pointing at freed slab memory. Any subsequent IDR walker
(states_show, client teardown) dereferences the dangling pointer.
The correct teardown for an IDR-published stid is nfs4_put_stid(),
which removes the IDR slot under cl_lock, dispatches sc_free
(nfsd4_free_layout_stateid) to release ls->ls_file via
nfsd4_close_layout(), and drops the nfs4_file reference in its
tail.
A second issue blocks that switch: nfsd4_free_layout_stateid()
unconditionally inspects ls->ls_fence_work via
delayed_work_pending() under ls_lock, but
INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only
after the setlease call. On the setlease-failure path the
destructor would touch an uninitialized delayed_work.
nfsd4_alloc_layout_stateid()
nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */
nfsd4_layout_setlease() /* fails */
nfs4_put_stid()
nfsd4_free_layout_stateid()
delayed_work_pending(&ls->ls_fence_work) /* needs INIT */
nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */
put_nfs4_file()
Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK
initialization above the nfsd4_layout_setlease() call, and replace
the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup
with a single nfs4_put_stid(stp).
Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ cel: no ls_fence_work in 5.10.y; dropped INIT_DELAYED_WORK hunk ]
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4layouts.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c
index d0fbbd34db689c..bcf16dd07d4883 100644
--- a/fs/nfsd/nfs4layouts.c
+++ b/fs/nfsd/nfs4layouts.c
@@ -241,9 +241,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate,
BUG_ON(!ls->ls_file);
if (nfsd4_layout_setlease(ls)) {
- nfsd_file_put(ls->ls_file);
- put_nfs4_file(fp);
- kmem_cache_free(nfs4_layout_stateid_cache, ls);
+ nfs4_put_stid(stp);
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 003/699] nfsd: reset write verifier on deferred writeback errors
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 001/699] nvmet-tcp: fix race between ICReq handling and queue teardown Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 002/699] nfsd: release layout stid on setlease failure Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 004/699] userfaultfd: gate must_wait writability check on pte_present() Greg Kroah-Hartman
` (699 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever, Chuck Lever, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 2090b05803faab8a9fa62fbff871007862cac1b7 upstream.
nfsd_vfs_write() and nfsd_commit() both call filemap_check_wb_err() to
detect deferred writeback errors, but neither rotates the server's write
verifier (nn->writeverf) when this check fails. Every other
durable-storage-failure path in these functions calls
commit_reset_write_verifier() before returning an error.
The missing rotation means clients holding UNSTABLE write data under the
current verifier will COMMIT, receive the unchanged verifier back, and
conclude their data is durable — silently dropping data that failed
writeback. This violates the UNSTABLE+COMMIT durability contract
(RFC 1813 §3.3.7, RFC 8881 §18.32).
Add commit_reset_write_verifier() calls at both filemap_check_wb_err()
error sites, matching the pattern used by adjacent error paths in the
same functions. The helper already filters -EAGAIN and -ESTALE
internally, so the calls are unconditionally safe.
Reported-by: Chris Mason <clm@meta.com>
Fixes: 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[ cel: open-code the reset; commit_reset_write_verifier() is v6.7 ]
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/vfs.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 19468142486671..c8eebd03784a21 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1149,8 +1149,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
nfsd_stats_io_write_add(nn, exp, *cnt);
fsnotify_modify(file);
host_err = filemap_check_wb_err(file->f_mapping, since);
- if (host_err < 0)
+ if (host_err < 0) {
+ nfsd_reset_write_verifier(nn);
+ trace_nfsd_writeverf_reset(nn, rqstp, host_err);
goto out_nfserr;
+ }
if (stable && use_wgather) {
host_err = wait_for_concurrent_writes(file);
@@ -1286,6 +1289,10 @@ nfsd_commit(struct svc_rqst *rqstp, struct svc_fh *fhp, struct nfsd_file *nf,
nfsd_copy_write_verifier(verf, nn);
err2 = filemap_check_wb_err(nf->nf_file->f_mapping,
since);
+ if (err2 < 0) {
+ nfsd_reset_write_verifier(nn);
+ trace_nfsd_writeverf_reset(nn, rqstp, err2);
+ }
err = nfserrno(err2);
break;
case -EINVAL:
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 004/699] userfaultfd: gate must_wait writability check on pte_present()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 003/699] nfsd: reset write verifier on deferred writeback errors Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 005/699] clk: imx: Add check for kcalloc Greg Kroah-Hartman
` (698 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau, Sashiko AI review,
Lorenzo Stoakes, David Hildenbrand, Michal Hocko, Mike Rapoport,
Peter Xu, Suren Baghdasaryan, Vlastimil Babka, Balbir Singh,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau <kas@kernel.org>
[ Upstream commit 8e80af52db652fbc41320eee45a4f73bc029faf2 ]
userfaultfd_must_wait() and userfaultfd_huge_must_wait() read the PTE
without taking the page table lock and then apply pte_write() /
huge_pte_write() to it. Those accessors decode bits from the present
encoding only; on a swap or migration entry they read the offset bits that
happen to share the same position and return an undefined result.
The intent of the check is "is this fault still WP-blocked?". A
non-marker swap entry means the page is in transit -- the userfault
context the original fault delivered against is no longer the same, and
the swap-in or migration completion path will re-deliver a fresh fault if
userspace still needs to handle it. Worst case under the current code the
garbage write bit says "wait", and the thread stays asleep until a
UFFDIO_WAKE that may never arrive.
Gate the writability check on pte_present() so the lockless re-check only
inspects present-PTE bits when the entry is actually present. The
non-present, non-marker case returns "don't wait" and lets the fault path
retry.
Link: https://lore.kernel.org/20260529172331.356655-6-kas@kernel.org
Fixes: 369cd2121be4 ("userfaultfd: hugetlbfs: userfaultfd_huge_must_wait for hugepmd ranges")
Fixes: 63b2d4174c4a ("userfaultfd: wp: add the writeprotect API to userfaultfd ioctl")
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Reported-by: Sashiko AI review <sashiko-bot@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ kas: apply to fs/userfaultfd.c and fold the pte_present()/
huge_pte_present() gate into the existing writability checks; this tree
predates the marker/return-style refactor of these functions ]
Signed-off-by: Kiryl Shutsemau <kas@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/userfaultfd.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 0d6c00e9b49316..6773227fbe889e 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -251,7 +251,12 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,
*/
if (huge_pte_none(pte))
ret = true;
- if (!huge_pte_write(pte) && (reason & VM_UFFD_WP))
+ /*
+ * Gate the writability check on pte_present(): huge_pte_write() on a
+ * non-present migration entry decodes random offset bits. The
+ * migration completion path re-delivers the fault if still needed.
+ */
+ if (pte_present(pte) && !huge_pte_write(pte) && (reason & VM_UFFD_WP))
ret = true;
out:
return ret;
@@ -332,7 +337,12 @@ static inline bool userfaultfd_must_wait(struct userfaultfd_ctx *ctx,
*/
if (pte_none(*pte))
ret = true;
- if (!pte_write(*pte) && (reason & VM_UFFD_WP))
+ /*
+ * Gate the writability check on pte_present(): pte_write() on a
+ * non-present swap/migration entry decodes random offset bits. The
+ * page-in path re-delivers the fault if it still needs userspace.
+ */
+ if (pte_present(*pte) && !pte_write(*pte) && (reason & VM_UFFD_WP))
ret = true;
pte_unmap(pte);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 005/699] clk: imx: Add check for kcalloc
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 004/699] userfaultfd: gate must_wait writability check on pte_present() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 006/699] nfsd: move name lookup out of nfsd4_list_rec_dir() Greg Kroah-Hartman
` (697 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Abel Vesa,
Alexandra Diupina, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
commit ed713e2bc093239ccd380c2ce8ae9e4162f5c037 upstream.
As the potential failure of the kcalloc(),
it should be better to check it in order to
avoid the dereference of the NULL pointer.
Fixes: 379c9a24cc23 ("clk: imx: Fix reparenting of UARTs not associated with stdout")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Abel Vesa <abel.vesa@nxp.com>
Link: https://lore.kernel.org/r/20220310080257.1988412-1-jiasheng@iscas.ac.cn
Signed-off-by: Abel Vesa <abel.vesa@nxp.com>
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/clk/imx/clk.c b/drivers/clk/imx/clk.c
index d4cf0c7045ab27..be0493e5b494e6 100644
--- a/drivers/clk/imx/clk.c
+++ b/drivers/clk/imx/clk.c
@@ -173,6 +173,8 @@ void imx_register_uart_clocks(unsigned int clk_count)
int i;
imx_uart_clocks = kcalloc(clk_count, sizeof(struct clk *), GFP_KERNEL);
+ if (!imx_uart_clocks)
+ return;
if (!of_stdout)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 006/699] nfsd: move name lookup out of nfsd4_list_rec_dir()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 005/699] clk: imx: Add check for kcalloc Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 007/699] nfsd: change nfs4_client_to_reclaim() to allocate data Greg Kroah-Hartman
` (696 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@ownmail.net>
[ Upstream commit 89bd77cf436bf25e448817a662ebf76515f22863 ]
nfsd4_list_rec_dir() is called with two different callbacks.
One of the callbacks uses vfs_rmdir() to remove the directory.
The other doesn't use the dentry at all, just the name.
As only one callback needs the dentry, this patch moves the lookup into
that callback. This prepares of changes to how directory operations
are locked.
Signed-off-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Stable-dep-of: 4552f4e3f2c9 ("nfsd: change nfs4_client_to_reclaim() to allocate data")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4recover.c | 55 ++++++++++++++++++++++---------------------
1 file changed, 28 insertions(+), 27 deletions(-)
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index 8ea55b2621ee41..c74c4023770694 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -254,7 +254,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
nfs4_reset_creds(original_cred);
}
-typedef int (recdir_func)(struct dentry *, struct dentry *, struct nfsd_net *);
+typedef int (recdir_func)(struct dentry *, char *, struct nfsd_net *);
struct name_list {
char name[HEXDIR_LEN];
@@ -308,23 +308,14 @@ nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn)
}
status = iterate_dir(nn->rec_file, &ctx.ctx);
- inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
list_for_each_entry_safe(entry, tmp, &ctx.names, list) {
- if (!status) {
- struct dentry *dentry;
- dentry = lookup_one_len(entry->name, dir, HEXDIR_LEN-1);
- if (IS_ERR(dentry)) {
- status = PTR_ERR(dentry);
- break;
- }
- status = f(dir, dentry, nn);
- dput(dentry);
- }
+ if (!status)
+ status = f(dir, entry->name, nn);
+
list_del(&entry->list);
kfree(entry);
}
- inode_unlock(d_inode(dir));
nfs4_reset_creds(original_cred);
list_for_each_entry_safe(entry, tmp, &ctx.names, list) {
@@ -422,18 +413,19 @@ nfsd4_remove_clid_dir(struct nfs4_client *clp)
}
static int
-purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+purge_old(struct dentry *parent, char *cname, struct nfsd_net *nn)
{
int status;
+ struct dentry *child;
struct xdr_netobj name;
- if (child->d_name.len != HEXDIR_LEN - 1) {
- printk("%s: illegal name %pd in recovery directory\n",
- __func__, child);
+ if (strlen(cname) != HEXDIR_LEN - 1) {
+ printk("%s: illegal name %s in recovery directory\n",
+ __func__, cname);
/* Keep trying; maybe the others are OK: */
return 0;
}
- name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+ name.data = kstrdup(cname, GFP_KERNEL);
if (!name.data) {
dprintk("%s: failed to allocate memory for name.data!\n",
__func__);
@@ -443,10 +435,17 @@ purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
if (nfs4_has_reclaimed_state(name, nn))
goto out_free;
- status = vfs_rmdir(d_inode(parent), child);
- if (status)
- printk("failed to remove client recovery directory %pd\n",
- child);
+ inode_lock_nested(d_inode(parent), I_MUTEX_PARENT);
+ child = lookup_one_len(cname, parent, HEXDIR_LEN - 1);
+ if (!IS_ERR(child)) {
+ status = vfs_rmdir(d_inode(parent), child);
+ if (status)
+ printk("failed to remove client recovery directory %pd\n",
+ child);
+ dput(child);
+ }
+ inode_unlock(d_inode(parent));
+
out_free:
kfree(name.data);
out:
@@ -477,18 +476,18 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
}
static int
-load_recdir(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
+load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
{
struct xdr_netobj name;
struct xdr_netobj princhash = { .len = 0, .data = NULL };
- if (child->d_name.len != HEXDIR_LEN - 1) {
- printk("%s: illegal name %pd in recovery directory\n",
- __func__, child);
+ if (strlen(cname) != HEXDIR_LEN - 1) {
+ printk("%s: illegal name %s in recovery directory\n",
+ __func__, cname);
/* Keep trying; maybe the others are OK: */
return 0;
}
- name.data = kmemdup_nul(child->d_name.name, child->d_name.len, GFP_KERNEL);
+ name.data = kstrdup(cname, GFP_KERNEL);
if (!name.data) {
dprintk("%s: failed to allocate memory for name.data!\n",
__func__);
@@ -843,11 +842,13 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
return PTR_ERR(name.data);
name.len = namelen;
}
+#ifdef CONFIG_NFSD_V4
if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
name.len = name.len - 5;
memmove(name.data, name.data + 5, name.len);
cn->cn_has_legacy = true;
}
+#endif
if (!nfs4_client_to_reclaim(name, princhash, nn)) {
kfree(name.data);
kfree(princhash.data);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 007/699] nfsd: change nfs4_client_to_reclaim() to allocate data
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 006/699] nfsd: move name lookup out of nfsd4_list_rec_dir() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 008/699] mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC Greg Kroah-Hartman
` (695 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neil@brown.name>
[ Upstream commit 4552f4e3f2c96597914f07b060d5c5db84420ddd ]
The calling convention for nfs4_client_to_reclaim() is clumsy in that
the caller needs to free memory if the function fails. It is much
cleaner if the function frees its own memory.
This patch changes nfs4_client_to_reclaim() to re-allocate the .data
fields to be stored in the newly allocated struct nfs4_client_reclaim,
and to free everything on failure.
__cld_pipe_inprogress_downcall() needs to allocate the data anyway to
copy it from user-space, so now that data is allocated twice. I think
that is a small price to pay for a cleaner interface.
Signed-off-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfs4recover.c | 67 +++++++++++++++----------------------------
fs/nfsd/nfs4state.c | 22 ++++++++++++--
2 files changed, 42 insertions(+), 47 deletions(-)
diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
index c74c4023770694..8ff61f6184e24d 100644
--- a/fs/nfsd/nfs4recover.c
+++ b/fs/nfsd/nfs4recover.c
@@ -167,24 +167,13 @@ legacy_recdir_name_error(struct nfs4_client *clp, int error)
static void
__nfsd4_create_reclaim_record_grace(struct nfs4_client *clp,
- const char *dname, int len, struct nfsd_net *nn)
+ char *dname, struct nfsd_net *nn)
{
- struct xdr_netobj name;
+ struct xdr_netobj name = { .len = strlen(dname), .data = dname };
struct xdr_netobj princhash = { .len = 0, .data = NULL };
struct nfs4_client_reclaim *crp;
- name.data = kmemdup(dname, len, GFP_KERNEL);
- if (!name.data) {
- dprintk("%s: failed to allocate memory for name.data!\n",
- __func__);
- return;
- }
- name.len = len;
crp = nfs4_client_to_reclaim(name, princhash, nn);
- if (!crp) {
- kfree(name.data);
- return;
- }
crp->cr_clp = clp;
}
@@ -240,8 +229,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp)
inode_unlock(d_inode(dir));
if (status == 0) {
if (nn->in_grace)
- __nfsd4_create_reclaim_record_grace(clp, dname,
- HEXDIR_LEN, nn);
+ __nfsd4_create_reclaim_record_grace(clp, dname, nn);
vfs_fsync(nn->rec_file, 0);
} else {
printk(KERN_ERR "NFSD: failed to write recovery record"
@@ -478,7 +466,7 @@ nfsd4_recdir_purge_old(struct nfsd_net *nn)
static int
load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
{
- struct xdr_netobj name;
+ struct xdr_netobj name = { .len = HEXDIR_LEN, .data = cname };
struct xdr_netobj princhash = { .len = 0, .data = NULL };
if (strlen(cname) != HEXDIR_LEN - 1) {
@@ -487,16 +475,7 @@ load_recdir(struct dentry *parent, char *cname, struct nfsd_net *nn)
/* Keep trying; maybe the others are OK: */
return 0;
}
- name.data = kstrdup(cname, GFP_KERNEL);
- if (!name.data) {
- dprintk("%s: failed to allocate memory for name.data!\n",
- __func__);
- goto out;
- }
- name.len = HEXDIR_LEN;
- if (!nfs4_client_to_reclaim(name, princhash, nn))
- kfree(name.data);
-out:
+ nfs4_client_to_reclaim(name, princhash, nn);
return 0;
}
@@ -792,6 +771,8 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
{
uint8_t cmd, princhashlen;
struct xdr_netobj name, princhash = { .len = 0, .data = NULL };
+ char *namecopy __free(kfree) = NULL;
+ char *princhashcopy __free(kfree) = NULL;
uint16_t namelen;
struct cld_net *cn = nn->cld_net;
@@ -810,20 +791,20 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
dprintk("%s: namelen should not be zero", __func__);
return -EINVAL;
}
- name.data = memdup_user(&ci->cc_name.cn_id, namelen);
- if (IS_ERR(name.data))
- return PTR_ERR(name.data);
+ namecopy = memdup_user(&ci->cc_name.cn_id, namelen);
+ if (IS_ERR(namecopy))
+ return PTR_ERR(namecopy);
+ name.data = namecopy;
name.len = namelen;
if (get_user(princhashlen, &ci->cc_princhash.cp_len))
return -EFAULT;
if (princhashlen > 0) {
- princhash.data = memdup_user(
- &ci->cc_princhash.cp_data,
- princhashlen);
- if (IS_ERR(princhash.data)) {
- kfree(name.data);
- return PTR_ERR(princhash.data);
- }
+ princhashcopy = memdup_user(
+ &ci->cc_princhash.cp_data,
+ princhashlen);
+ if (IS_ERR(princhashcopy))
+ return PTR_ERR(princhashcopy);
+ princhash.data = princhashcopy;
princhash.len = princhashlen;
} else
princhash.len = 0;
@@ -837,23 +818,21 @@ __cld_pipe_inprogress_downcall(const struct cld_msg_v2 __user *cmsg,
dprintk("%s: namelen should not be zero", __func__);
return -EINVAL;
}
- name.data = memdup_user(&cnm->cn_id, namelen);
- if (IS_ERR(name.data))
- return PTR_ERR(name.data);
+ namecopy = memdup_user(&cnm->cn_id, namelen);
+ if (IS_ERR(namecopy))
+ return PTR_ERR(namecopy);
+ name.data = namecopy;
name.len = namelen;
}
#ifdef CONFIG_NFSD_V4
if (name.len > 5 && memcmp(name.data, "hash:", 5) == 0) {
name.len = name.len - 5;
- memmove(name.data, name.data + 5, name.len);
+ name.data = name.data + 5;
cn->cn_has_legacy = true;
}
#endif
- if (!nfs4_client_to_reclaim(name, princhash, nn)) {
- kfree(name.data);
- kfree(princhash.data);
+ if (!nfs4_client_to_reclaim(name, princhash, nn))
return -EFAULT;
- }
return nn->client_tracking_ops->msglen;
}
return -EFAULT;
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 6b34bfac6194bb..c61e1a4ab620cc 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -8037,9 +8037,6 @@ nfs4_has_reclaimed_state(struct xdr_netobj name, struct nfsd_net *nn)
/*
* failure => all reset bets are off, nfserr_no_grace...
- *
- * The caller is responsible for freeing name.data if NULL is returned (it
- * will be freed in nfs4_remove_reclaim_record in the normal case).
*/
struct nfs4_client_reclaim *
nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
@@ -8048,6 +8045,22 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
unsigned int strhashval;
struct nfs4_client_reclaim *crp;
+ name.data = kmemdup(name.data, name.len, GFP_KERNEL);
+ if (!name.data) {
+ dprintk("%s: failed to allocate memory for name.data!\n",
+ __func__);
+ return NULL;
+ }
+ if (princhash.len) {
+ princhash.data = kmemdup(princhash.data, princhash.len, GFP_KERNEL);
+ if (!princhash.data) {
+ dprintk("%s: failed to allocate memory for princhash.data!\n",
+ __func__);
+ kfree(name.data);
+ return NULL;
+ }
+ } else
+ princhash.data = NULL;
crp = alloc_reclaim();
if (crp) {
strhashval = clientstr_hashval(name);
@@ -8059,6 +8072,9 @@ nfs4_client_to_reclaim(struct xdr_netobj name, struct xdr_netobj princhash,
crp->cr_princhash.len = princhash.len;
crp->cr_clp = NULL;
nn->reclaim_str_hashtbl_size++;
+ } else {
+ kfree(name.data);
+ kfree(princhash.data);
}
return crp;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 008/699] mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 007/699] nfsd: change nfs4_client_to_reclaim() to allocate data Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 009/699] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Greg Kroah-Hartman
` (694 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
The RZ/G2H (R8A774E1) SoC uses the same SDHI IP as the R-Car H3-N
(R8A77951) and requires the sdhi_quirks_bad_taps2367 quirk.
The 5.10 stable backport of commit 77fa80a1b732 ("mmc: renesas_sdhi:
Add OF entry for RZ/G2H SoC") adds an OF match entry for RZ/G2H.
However, unlike upstream, the 5.10 driver applies SoC-specific quirks
through the sdhi_quirks_match table. As a result, the required quirk is
not applied for RZ/G2H.
Add the missing sdhi_quirks_match entry for RZ/G2H ES3.x.
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/renesas_sdhi_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
index c0acb309e3243b..f02f9ef5cfbc80 100644
--- a/drivers/mmc/host/renesas_sdhi_core.c
+++ b/drivers/mmc/host/renesas_sdhi_core.c
@@ -903,6 +903,7 @@ static const struct renesas_sdhi_quirks sdhi_quirks_r8a77990 = {
*/
static const struct soc_device_attribute sdhi_quirks_match[] = {
{ .soc_id = "r8a774a1", .revision = "ES1.[012]", .data = &sdhi_quirks_4tap_nohs400 },
+ { .soc_id = "r8a774e1", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps2367 },
{ .soc_id = "r8a7795", .revision = "ES1.*", .data = &sdhi_quirks_4tap_nohs400 },
{ .soc_id = "r8a7795", .revision = "ES2.0", .data = &sdhi_quirks_4tap },
{ .soc_id = "r8a7795", .revision = "ES3.*", .data = &sdhi_quirks_bad_taps2367 },
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 009/699] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 008/699] mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 010/699] perf trace beauty fcntl: Fix build with older kernel headers Greg Kroah-Hartman
` (693 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Paolo Bonzini,
Darshit Shah, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit f1edbed787ba67988ed34e0132ca128b052b6ce8 upstream.
Drop a BUG_ON() that has been reachable since it was first added, way back
in 2009, and instead use get_unaligned() to perform potentially-unaligned
accesses.
For a given store, KVM x86's emulator tracks the entire value in the
destination operand, x86_emulate_ctxt.dst. If the destination is memory,
and the target splits multiple pages and/or is emulated MMIO, then KVM
handles each fragment independently. E.g. on a page split starting at page
offset 0xffc, KVM writes 4 bytes to the first page, then the remaining
bytes to the second page, using ctxt->dst as the source for both (with
appropriate offsets).
If the destination splits a page *and* hits emulated MMIO on the second
page, then KVM will complete the write to the first page, then emulate the
MMIO access to the second page. If there is a datamatch-enabled ioeventfd
at offset 0 of the second page, then KVM will process the remainder of the
store as a potential ioeventfd signal.
Putting it all together, if the guest emits a store that splits a page
starting at page offset N, and the second page has a datamatch-enabled
ioeventfd at offset 0, then KVM will check for datamatch using
&dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being
32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.
E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8,
all initial checks in ioeventfd_in_range() will succeed, and the BUG_ON()
fires due to @val being 4-byte aligned, but not 8-byte aligned.
------------[ cut here ]------------
kernel BUG at arch/x86/kvm/../../../virt/kvm/eventfd.c:783!
Oops: invalid opcode: 0000 [#1] SMP
CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
RIP: 0010:ioeventfd_write+0x6c/0x70 [kvm]
Call Trace:
<TASK>
__kvm_io_bus_write+0x85/0xb0 [kvm]
kvm_io_bus_write+0x53/0x80 [kvm]
vcpu_mmio_write+0x66/0xf0 [kvm]
emulator_read_write_onepage+0x12a/0x540 [kvm]
emulator_read_write+0x109/0x2b0 [kvm]
x86_emulate_insn+0x4f8/0xfb0 [kvm]
x86_emulate_instruction+0x181/0x790 [kvm]
kvm_mmu_page_fault+0x313/0x630 [kvm]
vmx_handle_exit+0x18a/0x590 [kvm_intel]
kvm_arch_vcpu_ioctl_run+0xc81/0x1c90 [kvm]
kvm_vcpu_ioctl+0x2d5/0x970 [kvm]
__x64_sys_ioctl+0x8a/0xd0
do_syscall_64+0xb7/0x890
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f19c931a9bf
</TASK>
Modules linked in: kvm_intel kvm irqbypass
---[ end trace 0000000000000000 ]---
In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM
x86 doesn't perform alignment checks on "normal" memory accesses at CPL0.
Sadly, C99 ruins all the fun; while the x86 architecture plays nice,
dereferencing an unaligned pointer directly is undefined behavior in C,
e.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.
Fixes: d34e6b175e61 ("KVM: add ioeventfd support")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260612225241.678509-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ Use the old <asm/unaligned.h> header instead ]
Signed-off-by: Darshit Shah <darnshah@amazon.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
virt/kvm/eventfd.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 4702b71aad0831..ff0ef5f7246e93 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -24,6 +24,7 @@
#include <linux/slab.h>
#include <linux/seqlock.h>
#include <linux/irqbypass.h>
+#include <asm/unaligned.h>
#include <trace/events/kvm.h>
#include <kvm/iodev.h>
@@ -695,21 +696,18 @@ ioeventfd_in_range(struct _ioeventfd *p, gpa_t addr, int len, const void *val)
return true;
/* otherwise, we have to actually compare the data */
-
- BUG_ON(!IS_ALIGNED((unsigned long)val, len));
-
switch (len) {
case 1:
- _val = *(u8 *)val;
+ _val = get_unaligned((u8 *)val);
break;
case 2:
- _val = *(u16 *)val;
+ _val = get_unaligned((u16 *)val);
break;
case 4:
- _val = *(u32 *)val;
+ _val = get_unaligned((u32 *)val);
break;
case 8:
- _val = *(u64 *)val;
+ _val = get_unaligned((u64 *)val);
break;
default:
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 010/699] perf trace beauty fcntl: Fix build with older kernel headers
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 009/699] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 011/699] bus: mhi: host: Add alignment check for event ring read pointer Greg Kroah-Hartman
` (692 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Florian Fainelli,
Adrian Hunter, Alexander Shishkin, Ingo Molnar, James Clark,
Jiri Olsa, Mark Rutland, Markus Mayer, Namhyung Kim,
Peter Zijlstra, Arnaldo Carvalho de Melo
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <florian.fainelli@broadcom.com>
commit 7ee7f48413c42b90230de4a8e40898b757bc8e82 upstream.
Toolchains with older kernel headers that do not include upstream commit
c75b1d9421f80f41 ("fs: add fcntl() interface for setting/getting write
life time hints") will now fail to build perf due to missing definitions
for F_GET_RW_HINT/F_SET_RW_HINT/F_GET_FILE_RW_HINT/F_SET_FILE_RW_HINT.
Provide a fallback definition for these when they are not already
defined.
Fixes: 9c47f66748381ecb ("perf trace beauty fcntl: Basic 'arg' beautifier")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Markus Mayer <mmayer@broadcom.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/trace/beauty/fcntl.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/tools/perf/trace/beauty/fcntl.c
+++ b/tools/perf/trace/beauty/fcntl.c
@@ -9,6 +9,22 @@
#include <linux/kernel.h>
#include <uapi/linux/fcntl.h>
+#ifndef F_GET_RW_HINT
+#define F_GET_RW_HINT (F_LINUX_SPECIFIC_BASE + 11)
+#endif
+
+#ifndef F_SET_RW_HINT
+#define F_SET_RW_HINT (F_LINUX_SPECIFIC_BASE + 12)
+#endif
+
+#ifndef F_GET_FILE_RW_HINT
+#define F_GET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 13)
+#endif
+
+#ifndef F_SET_FILE_RW_HINT
+#define F_SET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 14)
+#endif
+
static size_t fcntl__scnprintf_getfd(unsigned long val, char *bf, size_t size, bool show_prefix)
{
return val ? scnprintf(bf, size, "%s", "0") :
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 011/699] bus: mhi: host: Add alignment check for event ring read pointer
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 010/699] perf trace beauty fcntl: Fix build with older kernel headers Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 012/699] netfilter: nf_log: validate MAC header was set before dumping it Greg Kroah-Hartman
` (691 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna chaitanya chundru,
Jeffrey Hugo, Manivannan Sadhasivam, Alexander Martyniuk
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna chaitanya chundru <quic_krichai@quicinc.com>
commit eff9704f5332a13b08fbdbe0f84059c9e7051d5f upstream.
Though we do check the event ring read pointer by "is_valid_ring_ptr"
to make sure it is in the buffer range, but there is another risk the
pointer may be not aligned. Since we are expecting event ring elements
are 128 bits(struct mhi_ring_element) aligned, an unaligned read pointer
could lead to multiple issues like DoS or ring buffer memory corruption.
So add a alignment check for event ring read pointer.
Fixes: ec32332df764 ("bus: mhi: core: Sanity check values from remote device before use")
cc: stable@vger.kernel.org
Signed-off-by: Krishna chaitanya chundru <quic_krichai@quicinc.com>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20231031-alignment_check-v2-1-1441db7c5efd@quicinc.com
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/mhi/host/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/bus/mhi/host/main.c
+++ b/drivers/bus/mhi/host/main.c
@@ -222,7 +222,8 @@ static void mhi_del_ring_element(struct
static bool is_valid_ring_ptr(struct mhi_ring *ring, dma_addr_t addr)
{
- return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len;
+ return addr >= ring->iommu_base && addr < ring->iommu_base + ring->len &&
+ !(addr & (sizeof(struct mhi_tre) - 1));
}
int mhi_destroy_device(struct device *dev, void *data)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 012/699] netfilter: nf_log: validate MAC header was set before dumping it
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 011/699] bus: mhi: host: Add alignment check for event ring read pointer Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 013/699] skmsg: convert struct sk_msg_sg::copy to a bitmap Greg Kroah-Hartman
` (690 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Pablo Neira Ayuso, Alexander Martyniuk
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit a84b6fedbc97078788be78dbdd7517d143ad1a77 upstream.
The fallback path of dump_mac_header() guards the MAC header access
only with "skb->mac_header != skb->network_header", without checking
skb_mac_header_was_set(). When the MAC header is unset, mac_header is
0xffff, so the test passes and skb_mac_header(skb) returns
skb->head + 0xffff, ~64 KiB past the buffer; the loop then reads
dev->hard_header_len bytes out of bounds into the kernel log.
This is reachable via the netdev logger: nf_log_unknown_packet() calls
dump_mac_header() unconditionally, and an skb sent through AF_PACKET
with PACKET_QDISC_BYPASS reaches the egress hook with mac_header still
unset (__dev_queue_xmit(), which would reset it, is bypassed).
Add the skb_mac_header_was_set() check the ARPHRD_ETHER path already
uses, and replace the open-coded MAC header length test with
skb_mac_header_len(). Only skbs with an unset MAC header are affected;
valid ones are dumped as before.
BUG: KASAN: slab-out-of-bounds in dump_mac_header (net/netfilter/nf_log_syslog.c:831)
Read of size 1 at addr ffff88800ea49d3f by task exploit/148
Call Trace:
kasan_report (mm/kasan/report.c:595)
dump_mac_header (net/netfilter/nf_log_syslog.c:831)
nf_log_netdev_packet (net/netfilter/nf_log_syslog.c:938 net/netfilter/nf_log_syslog.c:963)
nf_log_packet (net/netfilter/nf_log.c:260)
nft_log_eval (net/netfilter/nft_log.c:60)
nft_do_chain (net/netfilter/nf_tables_core.c:285)
nft_do_chain_netdev (net/netfilter/nft_chain_filter.c:307)
nf_hook_slow (net/netfilter/core.c:619)
nf_hook_direct_egress (net/packet/af_packet.c:257)
packet_xmit (net/packet/af_packet.c:280)
packet_sendmsg (net/packet/af_packet.c:3114)
__sys_sendto (net/socket.c:2265)
Fixes: 7eb9282cd0ef ("netfilter: ipt_LOG/ip6t_LOG: add option to print decoded MAC header")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/nf_log_ipv4.c | 4 ++--
net/ipv6/netfilter/nf_log_ipv6.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/net/ipv4/netfilter/nf_log_ipv4.c
+++ b/net/ipv4/netfilter/nf_log_ipv4.c
@@ -296,8 +296,8 @@ static void dump_ipv4_mac_header(struct
fallback:
nf_log_buf_add(m, "MAC=");
- if (dev->hard_header_len &&
- skb->mac_header != skb->network_header) {
+ if (dev->hard_header_len && skb_mac_header_was_set(skb) &&
+ skb_mac_header_len(skb) != 0) {
const unsigned char *p = skb_mac_header(skb);
unsigned int i;
--- a/net/ipv6/netfilter/nf_log_ipv6.c
+++ b/net/ipv6/netfilter/nf_log_ipv6.c
@@ -309,8 +309,8 @@ static void dump_ipv6_mac_header(struct
fallback:
nf_log_buf_add(m, "MAC=");
- if (dev->hard_header_len &&
- skb->mac_header != skb->network_header) {
+ if (dev->hard_header_len && skb_mac_header_was_set(skb) &&
+ skb_mac_header_len(skb) != 0) {
const unsigned char *p = skb_mac_header(skb);
unsigned int len = dev->hard_header_len;
unsigned int i;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 013/699] skmsg: convert struct sk_msg_sg::copy to a bitmap
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 012/699] netfilter: nf_log: validate MAC header was set before dumping it Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 014/699] net: skmsg: preserve sg.copy across SG transforms Greg Kroah-Hartman
` (689 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 5a8fb33e530512ee67a11b30f3451a4f030f4b01 ]
We have plans for increasing MAX_SKB_FRAGS, but sk_msg_sg::copy
is currently an unsigned long, limiting MAX_SKB_FRAGS to 30 on 32bit arches.
Convert it to a bitmap, as Jakub suggested.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 406e8a651a7b ("net: skmsg: preserve sg.copy across SG transforms")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/skmsg.h | 11 +++++------
net/core/filter.c | 4 ++--
2 files changed, 7 insertions(+), 8 deletions(-)
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -29,7 +29,7 @@ struct sk_msg_sg {
u32 end;
u32 size;
u32 copybreak;
- unsigned long copy;
+ DECLARE_BITMAP(copy, MAX_MSG_FRAGS + 2);
/* The extra two elements:
* 1) used for chaining the front and sections when the list becomes
* partitioned (e.g. end < start). The crypto APIs require the
@@ -38,7 +38,6 @@ struct sk_msg_sg {
*/
struct scatterlist data[MAX_MSG_FRAGS + 2];
};
-static_assert(BITS_PER_LONG >= NR_MSG_FRAG_IDS);
/* UAPI in filter.c depends on struct sk_msg_sg being first element. */
struct sk_msg {
@@ -235,7 +234,7 @@ static inline void sk_msg_compute_data_p
{
struct scatterlist *sge = sk_msg_elem(msg, msg->sg.start);
- if (test_bit(msg->sg.start, &msg->sg.copy)) {
+ if (test_bit(msg->sg.start, msg->sg.copy)) {
msg->data = NULL;
msg->data_end = NULL;
} else {
@@ -254,7 +253,7 @@ static inline void sk_msg_page_add(struc
sg_set_page(sge, page, len, offset);
sg_unmark_end(sge);
- __set_bit(msg->sg.end, &msg->sg.copy);
+ __set_bit(msg->sg.end, msg->sg.copy);
msg->sg.size += len;
sk_msg_iter_next(msg, end);
}
@@ -263,9 +262,9 @@ static inline void sk_msg_sg_copy(struct
{
do {
if (copy_state)
- __set_bit(i, &msg->sg.copy);
+ __set_bit(i, msg->sg.copy);
else
- __clear_bit(i, &msg->sg.copy);
+ __clear_bit(i, msg->sg.copy);
sk_msg_iter_var_next(i);
if (i == msg->sg.end)
break;
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2677,7 +2677,7 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
* account for the headroom.
*/
bytes_sg_total = start - offset + bytes;
- if (!test_bit(i, &msg->sg.copy) && bytes_sg_total <= len)
+ if (!test_bit(i, msg->sg.copy) && bytes_sg_total <= len)
goto out;
/* At this point we need to linearize multiple scatterlist
@@ -2900,7 +2900,7 @@ place_new:
/* Place newly allocated data buffer */
sk_mem_charge(msg->sk, len);
msg->sg.size += len;
- __clear_bit(new, &msg->sg.copy);
+ __clear_bit(new, msg->sg.copy);
sg_set_page(&msg->sg.data[new], page, len + copy, 0);
if (rsge.length) {
get_page(sg_page(&rsge));
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 014/699] net: skmsg: preserve sg.copy across SG transforms
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 013/699] skmsg: convert struct sk_msg_sg::copy to a bitmap Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 015/699] apparmor: fix use-after-free in rawdata dedup loop Greg Kroah-Hartman
` (688 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiming Qian, Keenan Dong,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yiming Qian <yimingqian591@gmail.com>
[ Upstream commit 406e8a651a7b854c41fecd5117bb282b3a6c2c6b ]
The sk_msg sg.copy bitmap is part of the scatterlist entry ownership
state. A set bit tells sk_msg_compute_data_pointers() not to expose the
entry through writable BPF ctx->data. This protects entries backed by
pages that are not private to the sk_msg, such as splice-backed file
page-cache pages.
Several sk_msg transform paths move, copy, split, or compact
msg->sg.data[] entries without moving the matching sg.copy bit. This can
make an externally backed entry arrive at a new slot with a clear copy
bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable
ctx->data and BPF stores can modify the original page cache.
Keep sg.copy synchronized with sg.data[] whenever entries are
transferred, shifted, split, or copied into a new sk_msg. Clear the bit
when an entry is replaced by a newly allocated private page or freed.
This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(),
sk_msg_xfer(), and tls_split_open_record(), including the partial tail
entry created during TLS open-record splitting.
Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling")
Cc: stable@vger.kernel.org
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Reported-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Yiming Qian <yimingqian591@gmail.com>
Link: https://patch.msgid.link/20260610062137.49075-1-yimingqian591@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/skmsg.h | 15 +++++++++++----
net/core/filter.c | 27 +++++++++++++++++++++++++++
net/core/skmsg.c | 2 ++
net/tls/tls_sw.c | 4 ++++
4 files changed, 44 insertions(+), 4 deletions(-)
--- a/include/linux/skmsg.h
+++ b/include/linux/skmsg.h
@@ -4,6 +4,7 @@
#ifndef _LINUX_SKMSG_H
#define _LINUX_SKMSG_H
+#include <linux/bitops.h>
#include <linux/bpf.h>
#include <linux/filter.h>
#include <linux/scatterlist.h>
@@ -187,11 +188,14 @@ static inline void sk_msg_xfer(struct sk
int which, u32 size)
{
dst->sg.data[which] = src->sg.data[which];
+ __assign_bit(which, dst->sg.copy, test_bit(which, src->sg.copy));
dst->sg.data[which].length = size;
dst->sg.size += size;
src->sg.size -= size;
src->sg.data[which].length -= size;
src->sg.data[which].offset += size;
+ if (!src->sg.data[which].length)
+ __clear_bit(which, src->sg.copy);
}
static inline void sk_msg_xfer_full(struct sk_msg *dst, struct sk_msg *src)
@@ -261,16 +265,19 @@ static inline void sk_msg_page_add(struc
static inline void sk_msg_sg_copy(struct sk_msg *msg, u32 i, bool copy_state)
{
do {
- if (copy_state)
- __set_bit(i, msg->sg.copy);
- else
- __clear_bit(i, msg->sg.copy);
+ __assign_bit(i, msg->sg.copy, copy_state);
sk_msg_iter_var_next(i);
if (i == msg->sg.end)
break;
} while (1);
}
+static inline void sk_msg_sg_copy_assign(struct sk_msg *dst, u32 dst_i,
+ const struct sk_msg *src, u32 src_i)
+{
+ __assign_bit(dst_i, dst->sg.copy, test_bit(src_i, src->sg.copy));
+}
+
static inline void sk_msg_sg_copy_set(struct sk_msg *msg, u32 start)
{
sk_msg_sg_copy(msg, start, true);
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2718,11 +2718,13 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
poffset += len;
sge->length = 0;
put_page(sg_page(sge));
+ __clear_bit(i, msg->sg.copy);
sk_msg_iter_var_next(i);
} while (i != last_sge);
sg_set_page(&msg->sg.data[first_sge], page, copy, 0);
+ __clear_bit(first_sge, msg->sg.copy);
/* To repair sg ring we need to shift entries. If we only
* had a single entry though we can just replace it and
@@ -2748,9 +2750,11 @@ BPF_CALL_4(bpf_msg_pull_data, struct sk_
break;
msg->sg.data[i] = msg->sg.data[move_from];
+ sk_msg_sg_copy_assign(msg, i, msg, move_from);
msg->sg.data[move_from].length = 0;
msg->sg.data[move_from].page_link = 0;
msg->sg.data[move_from].offset = 0;
+ __clear_bit(move_from, msg->sg.copy);
sk_msg_iter_var_next(i);
} while (1);
@@ -2779,6 +2783,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
{
struct scatterlist sge, nsge, nnsge, rsge = {0}, *psge;
u32 new, i = 0, l = 0, space, copy = 0, offset = 0;
+ bool sge_copy, nsge_copy, nnsge_copy, rsge_copy = false;
u8 *raw, *to, *from;
struct page *page;
@@ -2851,6 +2856,7 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
sk_msg_iter_var_prev(i);
psge = sk_msg_elem(msg, i);
rsge = sk_msg_elem_cpy(msg, i);
+ rsge_copy = test_bit(i, msg->sg.copy);
psge->length = start - offset;
rsge.length -= psge->length;
@@ -2875,24 +2881,32 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_
/* Shift one or two slots as needed */
sge = sk_msg_elem_cpy(msg, new);
+ sge_copy = test_bit(new, msg->sg.copy);
sg_unmark_end(&sge);
nsge = sk_msg_elem_cpy(msg, i);
+ nsge_copy = test_bit(i, msg->sg.copy);
if (rsge.length) {
sk_msg_iter_var_next(i);
nnsge = sk_msg_elem_cpy(msg, i);
+ nnsge_copy = test_bit(i, msg->sg.copy);
sk_msg_iter_next(msg, end);
}
while (i != msg->sg.end) {
msg->sg.data[i] = sge;
+ __assign_bit(i, msg->sg.copy, sge_copy);
sge = nsge;
+ sge_copy = nsge_copy;
sk_msg_iter_var_next(i);
if (rsge.length) {
nsge = nnsge;
+ nsge_copy = nnsge_copy;
nnsge = sk_msg_elem_cpy(msg, i);
+ nnsge_copy = test_bit(i, msg->sg.copy);
} else {
nsge = sk_msg_elem_cpy(msg, i);
+ nsge_copy = test_bit(i, msg->sg.copy);
}
}
@@ -2906,6 +2920,7 @@ place_new:
get_page(sg_page(&rsge));
sk_msg_iter_var_next(new);
msg->sg.data[new] = rsge;
+ __assign_bit(new, msg->sg.copy, rsge_copy);
}
sk_msg_reset_curr(msg);
@@ -2933,25 +2948,33 @@ static void sk_msg_shift_left(struct sk_
prev = i;
sk_msg_iter_var_next(i);
msg->sg.data[prev] = msg->sg.data[i];
+ sk_msg_sg_copy_assign(msg, prev, msg, i);
} while (i != msg->sg.end);
sk_msg_iter_prev(msg, end);
+ __clear_bit(msg->sg.end, msg->sg.copy);
}
static void sk_msg_shift_right(struct sk_msg *msg, int i)
{
struct scatterlist tmp, sge;
+ bool tmp_copy, sge_copy;
sk_msg_iter_next(msg, end);
sge = sk_msg_elem_cpy(msg, i);
+ sge_copy = test_bit(i, msg->sg.copy);
sk_msg_iter_var_next(i);
tmp = sk_msg_elem_cpy(msg, i);
+ tmp_copy = test_bit(i, msg->sg.copy);
while (i != msg->sg.end) {
msg->sg.data[i] = sge;
+ __assign_bit(i, msg->sg.copy, sge_copy);
sk_msg_iter_var_next(i);
sge = tmp;
+ sge_copy = tmp_copy;
tmp = sk_msg_elem_cpy(msg, i);
+ tmp_copy = test_bit(i, msg->sg.copy);
}
}
@@ -3011,6 +3034,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
struct scatterlist *nsge, *sge = sk_msg_elem(msg, i);
int a = start - offset;
int b = sge->length - pop - a;
+ u32 sge_i = i;
+ bool sge_copy = test_bit(i, msg->sg.copy);
sk_msg_iter_var_next(i);
@@ -3023,6 +3048,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
sg_set_page(nsge,
sg_page(sge),
b, sge->offset + pop + a);
+ __assign_bit(i, msg->sg.copy, sge_copy);
} else {
struct page *page, *orig;
u8 *to, *from;
@@ -3039,6 +3065,7 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_m
memcpy(to, from, a);
memcpy(to + a, from + a + pop, b);
sg_set_page(sge, page, a + b, 0);
+ __clear_bit(sge_i, msg->sg.copy);
put_page(orig);
}
pop = 0;
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -65,6 +65,7 @@ int sk_msg_alloc(struct sock *sk, struct
sge = &msg->sg.data[msg->sg.end];
sg_unmark_end(sge);
sg_set_page(sge, pfrag->page, use, orig_offset);
+ __clear_bit(msg->sg.end, msg->sg.copy);
get_page(pfrag->page);
sk_msg_iter_next(msg, end);
}
@@ -185,6 +186,7 @@ static int sk_msg_free_elem(struct sock
sk_mem_uncharge(sk, len);
put_page(sg_page(sge));
}
+ __clear_bit(i, msg->sg.copy);
memset(sge, 0, sizeof(*sge));
return len;
}
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -564,6 +564,7 @@ static int tls_split_open_record(struct
struct scatterlist *sge, *osge, *nsge;
u32 orig_size = msg_opl->sg.size;
struct scatterlist tmp = { };
+ u32 tmp_i = 0;
struct sk_msg *msg_npl;
struct tls_rec *new;
int ret;
@@ -585,6 +586,7 @@ static int tls_split_open_record(struct
if (sge->length > apply) {
u32 len = sge->length - apply;
+ tmp_i = i;
get_page(sg_page(sge));
sg_set_page(&tmp, sg_page(sge), len,
sge->offset + apply);
@@ -616,6 +618,7 @@ static int tls_split_open_record(struct
nsge = sk_msg_elem(msg_npl, j);
if (tmp.length) {
memcpy(nsge, &tmp, sizeof(*nsge));
+ sk_msg_sg_copy_assign(msg_npl, j, msg_opl, tmp_i);
sk_msg_iter_var_next(j);
nsge = sk_msg_elem(msg_npl, j);
}
@@ -623,6 +626,7 @@ static int tls_split_open_record(struct
osge = sk_msg_elem(msg_opl, i);
while (osge->length) {
memcpy(nsge, osge, sizeof(*nsge));
+ sk_msg_sg_copy_assign(msg_npl, j, msg_opl, i);
sg_unmark_end(nsge);
sk_msg_iter_var_next(i);
sk_msg_iter_var_next(j);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 015/699] apparmor: fix use-after-free in rawdata dedup loop
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 014/699] net: skmsg: preserve sg.copy across SG transforms Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 016/699] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
` (687 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King, Ruslan Valiyev,
John Johansen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruslan Valiyev <linuxoid@gmail.com>
[ Upstream commit 6f060496d03e4dc560a40f73770bd08335cb7a27 ]
aa_replace_profiles() walks ns->rawdata_list to dedup the incoming
policy blob against entries already attached to existing profiles.
Per the kernel-doc on struct aa_loaddata, list membership does not
hold a reference: profiles hold pcount, and when the last pcount
drops, do_ploaddata_rmfs() is queued on a workqueue that takes
ns->lock and removes the entry. Between dropping the last pcount
and the workqueue running, an entry remains on the list with
pcount == 0.
aa_get_profile_loaddata() is an unconditional kref_get() on
pcount, so when the dedup loop hits such an entry, refcount
hardening reports
refcount_t: addition on 0; use-after-free.
inside aa_replace_profiles(), and the poisoned counter then
trips "saturated" and "underflow" warnings on the subsequent
uses of the same loaddata.
Before commit a0b7091c4de4 ("apparmor: fix race on rawdata
dereference") the dedup path used a get_unless_zero-style helper
on a single counter, so the existing "if (tmp)" guard was
meaningful. The split-refcount refactor introduced
aa_get_profile_loaddata(), which has plain kref_get() semantics,
and the guard quietly became a no-op.
Introduce aa_get_profile_loaddata_not0(), matching the existing
_not0 convention used by aa_get_profile_not0(), and use it for
the rawdata_list dedup lookup so dying entries are skipped.
Reproduced on x86_64 with v7.1-rc5 in QEMU+KVM running Ubuntu
24.04 + stress-ng 0.17.06:
stress-ng --apparmor 1 --klog-check --timeout 60s
Without this patch the three refcount_t warnings fire within a
few seconds. With it the same 60 s run is clean. Coverage is a
smoke-test only; a longer soak with CONFIG_KASAN, CONFIG_KCSAN
and CONFIG_PROVE_LOCKING would be welcome from anyone with the
cycles.
Fixes: a0b7091c4de4 ("apparmor: fix race on rawdata dereference")
Reported-by: Colin Ian King <colin.i.king@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221513
Cc: stable@vger.kernel.org
Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/include/policy_unpack.h | 19 +++++++++++++++++++
security/apparmor/policy.c | 8 ++++++--
2 files changed, 25 insertions(+), 2 deletions(-)
--- a/security/apparmor/include/policy_unpack.h
+++ b/security/apparmor/include/policy_unpack.h
@@ -122,6 +122,25 @@ aa_get_profile_loaddata(struct aa_loadda
return data;
}
+/**
+ * aa_get_profile_loaddata_not0 - get a profile reference count if not zero
+ * @data: reference to get a count on
+ *
+ * Like aa_get_profile_loaddata(), but safe to call on an entry that may
+ * be on a list (e.g. ns->rawdata_list) where the last pcount has already
+ * dropped and the deferred cleanup has not yet run.
+ *
+ * Returns: pointer to reference, or %NULL if @data is NULL or its
+ * profile refcount has already reached zero.
+ */
+static inline struct aa_loaddata *
+aa_get_profile_loaddata_not0(struct aa_loaddata *data)
+{
+ if (data && kref_get_unless_zero(&data->pcount))
+ return data;
+ return NULL;
+}
+
void __aa_loaddata_update(struct aa_loaddata *data, long revision);
bool aa_rawdata_eq(struct aa_loaddata *l, struct aa_loaddata *r);
void aa_loaddata_kref(struct kref *kref);
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -976,8 +976,12 @@ ssize_t aa_replace_profiles(struct aa_ns
if (aa_rawdata_eq(rawdata_ent, udata)) {
struct aa_loaddata *tmp;
- tmp = aa_get_profile_loaddata(rawdata_ent);
- /* check we didn't fail the race */
+ /*
+ * Entries remain on rawdata_list with
+ * pcount == 0 until do_ploaddata_rmfs()
+ * runs; only take a live profile ref.
+ */
+ tmp = aa_get_profile_loaddata_not0(rawdata_ent);
if (tmp) {
aa_put_profile_loaddata(udata);
udata = tmp;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 016/699] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 015/699] apparmor: fix use-after-free in rawdata dedup loop Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 017/699] apparmor: mediate the implicit connect of TCP fast open sendmsg Greg Kroah-Hartman
` (686 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Liang, Maoyi Xie,
Kuniyuki Iwashima, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
[ Upstream commit 8165f7ff57d9667d2bb477ef6af83ede7fed4ad7 ]
A tunnel changelink() operates on at most two netns, dev_net(dev) and
the tunnel link netns t->net. They differ once the device is created in
or moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.
Add rtnl_dev_link_net_capable() next to rtnl_get_net_ns_capable() in
net/core/rtnetlink.c. It requires CAP_NET_ADMIN in the link netns and is
skipped when the link netns is dev_net(dev), where the rtnl path already
checked it. The other patches in this series use the same helper.
Gate ipgre_changelink() and erspan_changelink() with it, at the top of
the op before any attribute is parsed, because the parsers update live
tunnel fields first. ipgre_netlink_parms() sets t->collect_md before
ip_tunnel_changelink() runs.
Commit 8b484efd5cb4 ("ip6: vti: Use ip6_tnl.net in
vti6_siocdevprivate().") added the same check on the ioctl path. This
adds it on RTM_NEWLINK.
Reported-by: Xiao Liang <shaw.leon@gmail.com>
Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
Fixes: b57708add314 ("gre: add x-netns support")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612085941.3158249-2-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/rtnetlink.h | 2 ++
net/core/rtnetlink.c | 8 ++++++++
net/ipv4/ip_gre.c | 6 ++++++
3 files changed, 16 insertions(+)
--- a/include/net/rtnetlink.h
+++ b/include/net/rtnetlink.h
@@ -183,6 +183,8 @@ int rtnl_configure_link(struct net_devic
int rtnl_nla_parse_ifinfomsg(struct nlattr **tb, const struct nlattr *nla_peer,
struct netlink_ext_ack *exterr);
struct net *rtnl_get_net_ns_capable(struct sock *sk, int netnsid);
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+ const struct net *link_net);
#define MODULE_ALIAS_RTNL_LINK(kind) MODULE_ALIAS("rtnl-link-" kind)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2024,6 +2024,14 @@ struct net *rtnl_get_net_ns_capable(stru
}
EXPORT_SYMBOL_GPL(rtnl_get_net_ns_capable);
+bool rtnl_dev_link_net_capable(const struct net_device *dev,
+ const struct net *link_net)
+{
+ return net_eq(link_net, dev_net(dev)) ||
+ ns_capable(link_net->user_ns, CAP_NET_ADMIN);
+}
+EXPORT_SYMBOL_GPL(rtnl_dev_link_net_capable);
+
static int rtnl_valid_dump_ifinfo_req(const struct nlmsghdr *nlh,
bool strict_check, struct nlattr **tb,
struct netlink_ext_ack *extack)
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1407,6 +1407,9 @@ static int ipgre_changelink(struct net_d
struct ip_tunnel_parm p;
int err;
+ if (!rtnl_dev_link_net_capable(dev, t->net))
+ return -EPERM;
+
err = ipgre_newlink_encap_setup(dev, data);
if (err)
return err;
@@ -1436,6 +1439,9 @@ static int erspan_changelink(struct net_
struct ip_tunnel_parm p;
int err;
+ if (!rtnl_dev_link_net_capable(dev, t->net))
+ return -EPERM;
+
err = ipgre_newlink_encap_setup(dev, data);
if (err)
return err;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 017/699] apparmor: mediate the implicit connect of TCP fast open sendmsg
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 016/699] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 018/699] f2fs: adjust zone capacity when considering valid block count Greg Kroah-Hartman
` (685 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, John Johansen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit 4d587cd8a72155089a627130bbd4716ec0856e21 ]
sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and
write(2): it opens the connection in the SYN. apparmor_socket_sendmsg()
only checks AA_MAY_SEND, so a profile that grants send but denies connect
lets a confined task open an outbound TCP/MPTCP connection that connect(2)
would have refused, bypassing connect mediation.
Mediate the implicit connect when MSG_FASTOPEN is set and a destination
is supplied. Add it to apparmor_socket_sendmsg() (not the shared
aa_sock_msg_perm() helper, which recvmsg also uses) and call aa_sk_perm()
directly, mirroring the selinux and tomoyo fixes. sk_is_tcp() does not
cover MPTCP fast open, so the SOCK_STREAM/IPPROTO_MPTCP arm is explicit.
Fixes: cf60af03ca4e ("net-tcp: Fast Open client - sendmsg(MSG_FASTOPEN)")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: John Johansen <john.johansen@canonical.com>
[ inlined absent sk_is_tcp()/sk_is_inet() helpers into the equivalent family/type/protocol checks ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/apparmor/lsm.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -951,7 +951,23 @@ static int aa_sock_msg_perm(const char *
static int apparmor_socket_sendmsg(struct socket *sock,
struct msghdr *msg, int size)
{
- return aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
+ int error = aa_sock_msg_perm(OP_SENDMSG, AA_MAY_SEND, sock, msg, size);
+
+ if (error)
+ return error;
+
+ /* TCP fast open carries connect() semantics in sendmsg(); mediate
+ * the implicit connect so it cannot bypass the connect permission.
+ */
+ if ((msg->msg_flags & MSG_FASTOPEN) && msg->msg_name &&
+ (sock->sk->sk_family == AF_INET ||
+ sock->sk->sk_family == AF_INET6) &&
+ sock->sk->sk_type == SOCK_STREAM &&
+ (sock->sk->sk_protocol == IPPROTO_TCP ||
+ sock->sk->sk_protocol == IPPROTO_MPTCP))
+ error = aa_sk_perm(OP_CONNECT, AA_MAY_CONNECT, sock->sk);
+
+ return error;
}
/**
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 018/699] f2fs: adjust zone capacity when considering valid block count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 017/699] apparmor: mediate the implicit connect of TCP fast open sendmsg Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 019/699] f2fs: fix to round down start offset of fallocate for pin file Greg Kroah-Hartman
` (684 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <jaegeuk@kernel.org>
[ Upstream commit 074b5ea2900ea8e40f8e7a3fd37e0a55ad3d5874 ]
This patch fixes counting unusable blocks set by zone capacity when
checking the valid block count in a section.
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Stable-dep-of: 4275b59673eb ("f2fs: fix to round down start offset of fallocate for pin file")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/debug.c | 2 +-
fs/f2fs/file.c | 6 +++---
fs/f2fs/gc.c | 4 ++--
fs/f2fs/segment.c | 7 +++----
fs/f2fs/segment.h | 8 ++++----
5 files changed, 13 insertions(+), 14 deletions(-)
--- a/fs/f2fs/debug.c
+++ b/fs/f2fs/debug.c
@@ -39,7 +39,7 @@ void f2fs_update_sit_info(struct f2fs_sb
bimodal = 0;
total_vblocks = 0;
- blks_per_sec = BLKS_PER_SEC(sbi);
+ blks_per_sec = CAP_BLKS_PER_SEC(sbi);
hblks_per_sec = blks_per_sec / 2;
for (segno = 0; segno < MAIN_SEGS(sbi); segno += sbi->segs_per_sec) {
vblocks = get_valid_blocks(sbi, segno, true);
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1681,7 +1681,7 @@ static int expand_inode_data(struct inod
return 0;
if (f2fs_is_pinned_file(inode)) {
- block_t sec_blks = BLKS_PER_SEC(sbi);
+ block_t sec_blks = CAP_BLKS_PER_SEC(sbi);
block_t sec_len = roundup(map.m_len, sec_blks);
map.m_len = sec_blks;
@@ -2595,7 +2595,7 @@ do_more:
ret = -EAGAIN;
goto out;
}
- range->start += BLKS_PER_SEC(sbi);
+ range->start += CAP_BLKS_PER_SEC(sbi);
if (range->start <= end)
goto do_more;
out:
@@ -2717,7 +2717,7 @@ static int f2fs_defragment_range(struct
goto out;
}
- sec_num = DIV_ROUND_UP(total, BLKS_PER_SEC(sbi));
+ sec_num = DIV_ROUND_UP(total, CAP_BLKS_PER_SEC(sbi));
/*
* make sure there are enough free section for LFS allocation, this can
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -441,7 +441,7 @@ static void atgc_lookup_victim(struct f2
unsigned long long age, u, accu;
unsigned long long max_mtime = sit_i->dirty_max_mtime;
unsigned long long min_mtime = sit_i->dirty_min_mtime;
- unsigned int sec_blocks = BLKS_PER_SEC(sbi);
+ unsigned int sec_blocks = CAP_BLKS_PER_SEC(sbi);
unsigned int vblocks;
unsigned int dirty_threshold = max(am->max_candidate_count,
am->candidate_ratio *
@@ -1421,7 +1421,7 @@ next_step:
*/
if ((gc_type == BG_GC && has_not_enough_free_secs(sbi, 0, 0)) ||
(!force_migrate && get_valid_blocks(sbi, segno, true) ==
- BLKS_PER_SEC(sbi)))
+ CAP_BLKS_PER_SEC(sbi)))
return submitted;
if (check_valid_map(sbi, segno, off) == 0)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -820,7 +820,7 @@ static void __locate_dirty_segment(struc
get_valid_blocks(sbi, segno, true);
f2fs_bug_on(sbi, unlikely(!valid_blocks ||
- valid_blocks == BLKS_PER_SEC(sbi)));
+ valid_blocks == CAP_BLKS_PER_SEC(sbi)));
if (!IS_CURSEC(sbi, secno))
set_bit(secno, dirty_i->dirty_secmap);
@@ -856,7 +856,7 @@ static void __remove_dirty_segment(struc
unsigned int secno = GET_SEC_FROM_SEG(sbi, segno);
if (!valid_blocks ||
- valid_blocks == BLKS_PER_SEC(sbi)) {
+ valid_blocks == CAP_BLKS_PER_SEC(sbi)) {
clear_bit(secno, dirty_i->dirty_secmap);
return;
}
@@ -4577,7 +4577,6 @@ static void init_dirty_segmap(struct f2f
struct free_segmap_info *free_i = FREE_I(sbi);
unsigned int segno = 0, offset = 0, secno;
block_t valid_blocks, usable_blks_in_seg;
- block_t blks_per_sec = BLKS_PER_SEC(sbi);
while (1) {
/* find dirty segment based on free segmap */
@@ -4606,7 +4605,7 @@ static void init_dirty_segmap(struct f2f
valid_blocks = get_valid_blocks(sbi, segno, true);
secno = GET_SEC_FROM_SEG(sbi, segno);
- if (!valid_blocks || valid_blocks == blks_per_sec)
+ if (!valid_blocks || valid_blocks == CAP_BLKS_PER_SEC(sbi))
continue;
if (IS_CURSEC(sbi, secno))
continue;
--- a/fs/f2fs/segment.h
+++ b/fs/f2fs/segment.h
@@ -608,10 +608,10 @@ static inline bool has_not_enough_free_s
get_pages(sbi, F2FS_DIRTY_DENTS) +
get_pages(sbi, F2FS_DIRTY_IMETA);
unsigned int total_dent_blocks = get_pages(sbi, F2FS_DIRTY_DENTS);
- unsigned int node_secs = total_node_blocks / BLKS_PER_SEC(sbi);
- unsigned int dent_secs = total_dent_blocks / BLKS_PER_SEC(sbi);
- unsigned int node_blocks = total_node_blocks % BLKS_PER_SEC(sbi);
- unsigned int dent_blocks = total_dent_blocks % BLKS_PER_SEC(sbi);
+ unsigned int node_secs = total_node_blocks / CAP_BLKS_PER_SEC(sbi);
+ unsigned int dent_secs = total_dent_blocks / CAP_BLKS_PER_SEC(sbi);
+ unsigned int node_blocks = total_node_blocks % CAP_BLKS_PER_SEC(sbi);
+ unsigned int dent_blocks = total_dent_blocks % CAP_BLKS_PER_SEC(sbi);
unsigned int free, need_lower, need_upper;
if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING)))
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 019/699] f2fs: fix to round down start offset of fallocate for pin file
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 018/699] f2fs: adjust zone capacity when considering valid block count Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 020/699] f2fs: validate orphan inode entry count Greg Kroah-Hartman
` (683 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yunji Kang, Yeongjin Gil,
Sungjong Seo, Sunmin Jeong, Chao Yu, Jaegeuk Kim, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunmin Jeong <s_min.jeong@samsung.com>
[ Upstream commit 4275b59673eb60b02eec3997816c83f1f4b909c4 ]
Currently, the length of fallocate for pin file is section-aligned to
keep allocated sections from being selected as victims of GC. However,
for the case that the start offset of fallocate is not aligned in
section, the allocated sections can't be fully utilized. It's because a
new section is allocated by f2fs_allocate_pinning_section() after using
blks_per_sec blocks regardless of the start offset. As a result, several
unexpected dirty segments may be created, including blocks assigned to
the pinned file.
To address this issue, let's round down the start offset of fallocate
to the length of section.
The reproducing scenario is as below
chunk=$(((2<<20)+4096)) # 2MB + 4KB
touch test
f2fs_io pinfile set test
f2fs_io fallocate 0 0 $chunk test
f2fs_io fallocate 0 $chunk $chunk test
f2fs_io fallocate 0 $((chunk*2)) $chunk test
f2fs_io fiemap 0 $((chunk*3)) test
Fiemap: offset = 0 len = 12288
logical addr. physical addr. length flags
0 0000000000000000 000000068c600000 0000000000400000 00001088
1 0000000000400000 000000003d400000 0000000000001000 00001088
2 0000000000401000 00000003eb200000 0000000000200000 00001088
3 0000000000601000 00000005e4200000 0000000000001000 00001088
4 0000000000602000 0000000605400000 0000000000200000 00001089
Cc: stable@vger.kernel.org
Fixes: f5a53edcf01e ("f2fs: support aligned pinned file")
Reviewed-by: Yunji Kang <yunji0.kang@samsung.com>
Reviewed-by: Yeongjin Gil <youngjin.gil@samsung.com>
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Signed-off-by: Sunmin Jeong <s_min.jeong@samsung.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/file.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1682,8 +1682,15 @@ static int expand_inode_data(struct inod
if (f2fs_is_pinned_file(inode)) {
block_t sec_blks = CAP_BLKS_PER_SEC(sbi);
- block_t sec_len = roundup(map.m_len, sec_blks);
+ block_t sec_len;
+ if (map.m_lblk % sec_blks) {
+ map.m_lblk = rounddown(map.m_lblk, sec_blks);
+ map.m_len = pg_end - map.m_lblk;
+ if (off_end)
+ map.m_len++;
+ }
+ sec_len = roundup(map.m_len, sec_blks);
map.m_len = sec_blks;
next_alloc:
if (has_not_enough_free_secs(sbi, 0,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 020/699] f2fs: validate orphan inode entry count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 019/699] f2fs: fix to round down start offset of fallocate for pin file Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 021/699] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Greg Kroah-Hartman
` (682 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Wenjie Qi, Chao Yu,
Jaegeuk Kim, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjie Qi <qwjhust@gmail.com>
[ Upstream commit 846c499a65816d13f1186e3090e825e8bb8bcb8b ]
f2fs_recover_orphan_inodes() trusts the orphan block entry_count when
replaying orphan inodes from the checkpoint pack. A corrupted entry_count
larger than F2FS_ORPHANS_PER_BLOCK makes the recovery loop read past the
ino[] array and interpret footer or following data as inode numbers.
On a crafted image, mounting an unpatched kernel can drive orphan recovery
into f2fs_bug_on() and panic the kernel. Validate entry_count before
consuming entries so corrupted checkpoint data fails the mount with
-EFSCORRUPTED and requests fsck instead.
Set ERROR_INCONSISTENT_ORPHAN as well, so the corruption reason can be
recorded in the superblock s_errors[] field. This gives fsck a persistent
hint even though mount-time orphan recovery failure may leave no chance to
persist SBI_NEED_FSCK through a checkpoint.
Cc: stable@kernel.org
Fixes: 127e670abfa7 ("f2fs: add checkpoint operations")
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[ Folio API ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/checkpoint.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -723,6 +723,7 @@ int f2fs_recover_orphan_inodes(struct f2
for (i = 0; i < orphan_blocks; i++) {
struct page *page;
struct f2fs_orphan_block *orphan_blk;
+ unsigned int entry_count;
page = f2fs_get_meta_page(sbi, start_blk + i);
if (IS_ERR(page)) {
@@ -731,7 +732,17 @@ int f2fs_recover_orphan_inodes(struct f2
}
orphan_blk = (struct f2fs_orphan_block *)page_address(page);
- for (j = 0; j < le32_to_cpu(orphan_blk->entry_count); j++) {
+ entry_count = le32_to_cpu(orphan_blk->entry_count);
+ if (entry_count > F2FS_ORPHANS_PER_BLOCK) {
+ f2fs_err(sbi, "invalid orphan inode entry count %u",
+ entry_count);
+ set_sbi_flag(sbi, SBI_NEED_FSCK);
+ err = -EFSCORRUPTED;
+ f2fs_put_page(page, 1);
+ goto out;
+ }
+
+ for (j = 0; j < entry_count; j++) {
nid_t ino = le32_to_cpu(orphan_blk->ino[j]);
err = recover_orphan_inode(sbi, ino);
if (err) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 021/699] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 020/699] f2fs: validate orphan inode entry count Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 022/699] f2fs: fix potential deadlock in f2fs_balance_fs() Greg Kroah-Hartman
` (681 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Chao Yu, Jaegeuk Kim,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
[ Upstream commit 378acf3cf19b6af6cba55e8dd1154c4e1504bae8 ]
When the flexible_inline_xattr feature is enabled, do_read_inode() loads
the on-disk i_inline_xattr_size unconditionally:
if (f2fs_sb_has_flexible_inline_xattr(sbi))
fi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);
but sanity_check_inode() only range-checks it when the inode also has the
FI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline
data but not FI_INLINE_XATTR -- the normal layout for an inline
directory -- therefore keeps a fully attacker-controlled
i_inline_xattr_size from a crafted image.
get_inline_xattr_addrs() returns that value with no flag gating, so it
feeds the inode geometry:
MAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE - i_inline_xattr_size - 1)
NR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE / (...)
addrs_per_page() = CUR_ADDRS_PER_INODE - i_inline_xattr_size
A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()
negative, so make_dentry_ptr_inline() sets d->max (int) to a negative
value. The inline directory walk then compares an unsigned long bit_pos
against that negative d->max, which is promoted to a huge unsigned bound,
and reads far past the inline area:
while (bit_pos < d->max) /* fs/f2fs/dir.c */
... test_bit_le(bit_pos, d->bitmap) / d->dentry[bit_pos] ...
Mounting a crafted image and reading such a directory triggers an
out-of-bounds read in f2fs_fill_dentries(); the same underflow also
corrupts ADDRS_PER_INODE for regular files.
Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the
flexible_inline_xattr feature is enabled -- i.e. whenever the value is
loaded from disk and consumed -- and keep the lower MIN_INLINE_XATTR_SIZE
bound gated on inodes that actually carry an inline xattr, so legitimate
inodes with i_inline_xattr_size == 0 are still accepted.
Cc: stable@vger.kernel.org
Fixes: 6afc662e68b5 ("f2fs: support flexible inline xattr size")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/inode.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -254,14 +254,15 @@ static bool sanity_check_inode(struct in
return false;
}
- if (f2fs_has_extra_attr(inode) &&
- f2fs_sb_has_flexible_inline_xattr(sbi) &&
- f2fs_has_inline_xattr(inode) &&
- (!fi->i_inline_xattr_size ||
- fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE)) {
+ if (f2fs_sb_has_flexible_inline_xattr(sbi) &&
+ (fi->i_inline_xattr_size > MAX_INLINE_XATTR_SIZE ||
+ (f2fs_has_inline_xattr(inode) &&
+ fi->i_inline_xattr_size <
+ sizeof(struct f2fs_xattr_header) / sizeof(__le32)))) {
set_sbi_flag(sbi, SBI_NEED_FSCK);
- f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, max: %zu",
+ f2fs_warn(sbi, "%s: inode (ino=%lx) has corrupted i_inline_xattr_size: %d, min: %zu, max: %zu",
__func__, inode->i_ino, fi->i_inline_xattr_size,
+ sizeof(struct f2fs_xattr_header) / sizeof(__le32),
MAX_INLINE_XATTR_SIZE);
return false;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 022/699] f2fs: fix potential deadlock in f2fs_balance_fs()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 021/699] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 023/699] f2fs: fix listxattr handling of corrupted xattr entries Greg Kroah-Hartman
` (680 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chao Yu, Ruipeng Qi, Jaegeuk Kim,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruipeng Qi <ruipengqi3@gmail.com>
[ Upstream commit dd3114870771562036fdcf5abe813956f36d224d ]
When the f2fs filesystem space is nearly exhausted, we encounter deadlock
issues as below:
INFO: task A:1890 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:A state:D stack:0 pid:1890 tgid:1626 ppid:1153 flags:0x00000204
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
io_schedule+0x44/0x68
folio_wait_bit_common+0x174/0x370
folio_wait_bit+0x20/0x38
folio_wait_writeback+0x54/0xc8
truncate_inode_partial_folio+0x70/0x1e0
truncate_inode_pages_range+0x1b0/0x450
truncate_pagecache+0x54/0x88
f2fs_file_write_iter+0x3e8/0xb80
do_iter_readv_writev+0xf0/0x1e0
vfs_writev+0x138/0x2c8
do_writev+0x88/0x130
__arm64_sys_writev+0x28/0x40
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
INFO: task kworker/u8:11:2680853 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:11 state:D stack:0 pid:2680853 tgid:2680853 ppid:2 flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
io_schedule+0x44/0x68
folio_wait_bit_common+0x174/0x370
__filemap_get_folio+0x214/0x348
pagecache_get_page+0x20/0x70
f2fs_get_read_data_page+0x150/0x3e8
f2fs_get_lock_data_page+0x2c/0x160
move_data_page+0x50/0x478
do_garbage_collect+0xd38/0x1528
f2fs_gc+0x240/0x7e0
f2fs_balance_fs+0x1a0/0x208
f2fs_write_single_data_page+0x6e4/0x730
f2fs_write_cache_pages+0x378/0x9b0
f2fs_write_data_pages+0x2e4/0x388
do_writepages+0x8c/0x2c8
__writeback_single_inode+0x4c/0x498
writeback_sb_inodes+0x234/0x4a8
__writeback_inodes_wb+0x58/0x118
wb_writeback+0x2f8/0x3c0
wb_workfn+0x2c4/0x508
process_one_work+0x180/0x408
worker_thread+0x258/0x368
kthread+0x118/0x128
ret_from_fork+0x10/0x200
INFO: task kworker/u8:8:2641297 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:8 state:D stack:0 pid:2641297 tgid:2641297 ppid:2 flags:0x00000208
Workqueue: writeback wb_workfn (flush-254:0)
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
rt_mutex_schedule+0x30/0x60
__rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
rwbase_write_lock+0x24c/0x378
down_write+0x1c/0x30
f2fs_balance_fs+0x184/0x208
f2fs_write_inode+0xf4/0x328
__writeback_single_inode+0x370/0x498
writeback_sb_inodes+0x234/0x4a8
__writeback_inodes_wb+0x58/0x118
wb_writeback+0x2f8/0x3c0
wb_workfn+0x2c4/0x508
process_one_work+0x180/0x408
worker_thread+0x258/0x368
kthread+0x118/0x128
ret_from_fork+0x10/0x20
INFO: task B:1902 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:B state:D stack:0 pid:1902 tgid:1626 ppid:1153 flags:0x0000020c
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
rt_mutex_schedule+0x30/0x60
__rt_mutex_slowlock_locked.constprop.0+0x460/0x8a8
rwbase_write_lock+0x24c/0x378
down_write+0x1c/0x30
f2fs_balance_fs+0x184/0x208
f2fs_map_blocks+0x94c/0x1110
f2fs_file_write_iter+0x228/0xb80
do_iter_readv_writev+0xf0/0x1e0
vfs_writev+0x138/0x2c8
do_writev+0x88/0x130
__arm64_sys_writev+0x28/0x40
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
INFO: task sync:2769849 blocked for more than 120 seconds.
Tainted: G O 6.12.41-g3fe07ddf05ab #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:sync state:D stack:0 pid:2769849 tgid:2769849 ppid:736 flags:0x0000020c
Call trace:
__switch_to+0xf4/0x158
__schedule+0x27c/0x908
schedule+0x3c/0x118
wb_wait_for_completion+0xb0/0xe8
sync_inodes_sb+0xc8/0x2b0
sync_inodes_one_sb+0x24/0x38
iterate_supers+0xa8/0x138
ksys_sync+0x54/0xc8
__arm64_sys_sync+0x18/0x30
invoke_syscall+0x50/0x120
el0_svc_common.constprop.0+0xc8/0xf0
do_el0_svc+0x24/0x38
el0_svc+0x30/0xf8
el0t_64_sync_handler+0x120/0x130
el0t_64_sync+0x190/0x198
The root cause is a potential deadlock between the following tasks:
kworker/u8:11 Thread A
- f2fs_write_single_data_page
- f2fs_do_write_data_page
- folio_start_writeback(X)
- f2fs_outplace_write_data
- bio_add_folio(X)
- folio_unlock(X)
- truncate_inode_pages_range
- __filemap_get_folio(X, FGP_LOCK)
- truncate_inode_partial_folio(X)
- folio_wait_writeback(X)
- f2fs_balance_fs
- f2fs_gc
- do_garbage_collect
- move_data_page
- f2fs_get_lock_data_page
- __filemap_get_folio(X, FGP_LOCK)
Both threads try to access folio X. Thread A holds the lock but waits
for writeback, while kworker waits for the lock. This causes a deadlock.
Other threads also enter D state, waiting for locks such as gc_lock and
writepages.
OPU/IPU DATA folio are all affected by this issue. To avoid such
potential deadlocks, always commit these cached folios before
triggering f2fs_gc() in f2fs_balance_fs().
Suggested-by: Chao Yu <chao@kernel.org>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Ruipeng Qi <ruipengqi3@gmail.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Stable-dep-of: 8b4468ec023d ("f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 29 +++++++++++++++++++++++++++++
fs/f2fs/f2fs.h | 1 +
fs/f2fs/segment.c | 7 +++++++
3 files changed, 37 insertions(+)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -906,6 +906,35 @@ void f2fs_submit_merged_ipu_write(struct
}
}
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi)
+{
+ struct bio_entry *be, *tmp;
+ struct f2fs_bio_info *io;
+ enum temp_type temp;
+
+ for (temp = HOT; temp < NR_TEMP_TYPE; temp++) {
+ LIST_HEAD(list);
+
+ io = sbi->write_io[DATA] + temp;
+
+ /* A lockless list_empty() check is safe here: any bios from
+ * other kworkers that we miss will be submitted by those
+ * kworkers accordingly.
+ */
+ if (list_empty(&io->bio_list))
+ continue;
+
+ down_write(&io->bio_list_lock);
+ list_splice_init(&io->bio_list, &list);
+ up_write(&io->bio_list_lock);
+
+ list_for_each_entry_safe(be, tmp, &list, list) {
+ __submit_bio(sbi, be->bio, DATA);
+ del_bio_entry(be);
+ }
+ }
+}
+
int f2fs_merge_page_bio(struct f2fs_io_info *fio)
{
struct bio *bio = *fio->bio;
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -3475,6 +3475,7 @@ void f2fs_submit_merged_write_cond(struc
nid_t ino, enum page_type type);
void f2fs_submit_merged_ipu_write(struct f2fs_sb_info *sbi,
struct bio **bio, struct page *page);
+void f2fs_submit_all_merged_ipu_writes(struct f2fs_sb_info *sbi);
void f2fs_flush_merged_writes(struct f2fs_sb_info *sbi);
int f2fs_submit_page_bio(struct f2fs_io_info *fio);
int f2fs_merge_page_bio(struct f2fs_io_info *fio);
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -513,6 +513,13 @@ void f2fs_balance_fs(struct f2fs_sb_info
* dir/node pages without enough free segments.
*/
if (has_not_enough_free_secs(sbi, 0, 0)) {
+ /*
+ * Submit all cached OPU/IPU DATA bios before triggering
+ * foreground GC to avoid potential deadlocks.
+ */
+ f2fs_submit_merged_write(sbi, DATA);
+ f2fs_submit_all_merged_ipu_writes(sbi);
+
down_write(&sbi->gc_lock);
f2fs_gc(sbi, false, false, false, NULL_SEGNO);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 023/699] f2fs: fix listxattr handling of corrupted xattr entries
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 022/699] f2fs: fix potential deadlock in f2fs_balance_fs() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 024/699] NFSv4/flexfiles: reject zero filehandle version count Greg Kroah-Hartman
` (679 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Keshav Verma,
Jaegeuk Kim, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keshav Verma <iganschel@gmail.com>
[ Upstream commit 5ef5bc304f23c3fe255d4936472378dcb74d0e94 ]
Validate the xattr entry before reading its fields in f2fs_listxattr().
Return -EFSCORRUPTED when the entry is outside the valid xattr storage
area instead of returning a successful partial result.
Fixes: 688078e7f36c ("f2fs: fix to avoid memory leakage in f2fs_listxattr")
Cc: stable@kernel.org
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Keshav Verma <iganschel@gmail.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/xattr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c
@@ -575,8 +575,7 @@ ssize_t f2fs_listxattr(struct dentry *de
last_base_addr = (void *)base_addr + XATTR_SIZE(inode);
list_for_each_xattr(entry, base_addr) {
- const struct xattr_handler *handler =
- f2fs_xattr_handler(entry->e_name_index);
+ const struct xattr_handler *handler;
const char *prefix;
size_t prefix_len;
size_t size;
@@ -590,6 +589,7 @@ ssize_t f2fs_listxattr(struct dentry *de
goto cleanup;
}
+ handler = f2fs_xattr_handler(entry->e_name_index);
if (!handler || (handler->list && !handler->list(dentry)))
continue;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 024/699] NFSv4/flexfiles: reject zero filehandle version count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 023/699] f2fs: fix listxattr handling of corrupted xattr entries Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 025/699] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Greg Kroah-Hartman
` (678 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 ]
ff_layout_alloc_lseg() decodes the filehandle-version array count
from the flexfiles layout body. The value is used as the count for
kzalloc_objs(), and the current code only rejects NULL.
A zero count yields ZERO_SIZE_PTR, which can be stored in
dss_info->fh_versions even though later flexfiles paths assume that at
least one filehandle version exists.
Reject fh_count == 0 before the allocation, matching the existing zero
version_count validation in the flexfiles GETDEVICEINFO parser.
A QEMU/KASAN run with a malformed flexfiles layout hit:
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750
ff_layout_encode_layoutreturn+0x683/0x970
nfs4_xdr_enc_layoutreturn+0x278/0x3a0
Kernel panic - not syncing: Fatal exception
The patched kernel rejects the malformed layout without KASAN/oops/panic,
and a valid fh_count=1 regression still opens, reads, and unmounts cleanly.
Cc: stable@vger.kernel.org
Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -454,6 +454,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_
if (!p)
goto out_err_free;
fh_count = be32_to_cpup(p);
+ if (fh_count == 0) {
+ rc = -EINVAL;
+ goto out_err_free;
+ }
fls->mirror_array[i]->fh_versions =
kcalloc(fh_count, sizeof(struct nfs_fh),
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 025/699] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 024/699] NFSv4/flexfiles: reject zero filehandle version count Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 026/699] i2c: core: fix irq domain leak on adapter registration failure Greg Kroah-Hartman
` (677 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mingyu Wang, Thomas Zimmermann,
Helge Deller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mingyu Wang <25181214217@stu.xidian.edu.cn>
[ Upstream commit 8fdc8c2057eea08d40ce2c8eed41ff9e451c65c2 ]
When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.
Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.
This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.
Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path.
Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
Cc: stable@vger.kernel.org
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2426,6 +2426,7 @@ static int fbcon_do_set_font(struct vc_d
struct fbcon_display *p = &fb_display[vc->vc_num];
int resize, ret, old_userfont, old_width, old_height, old_charcount;
u8 *old_data = vc->vc_font.data;
+ unsigned short old_hi_font_mask = vc->vc_hi_font_mask;
resize = (w != vc->vc_font.width) || (h != vc->vc_font.height);
vc->vc_font.data = (void *)(p->fontdata = data);
@@ -2479,6 +2480,12 @@ err_out:
vc->vc_font.height = old_height;
vc->vc_font.charcount = old_charcount;
+ /* Restore the hi_font state and screen buffer */
+ if (old_hi_font_mask && !vc->vc_hi_font_mask)
+ set_vc_hi_font(vc, true);
+ else if (!old_hi_font_mask && vc->vc_hi_font_mask)
+ set_vc_hi_font(vc, false);
+
return ret;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 026/699] i2c: core: fix irq domain leak on adapter registration failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 025/699] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 027/699] i2c: core: fix hang " Greg Kroah-Hartman
` (676 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Johan Hovold,
Wolfram Sang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 8ce19524e4cc2462685f596a6402fbd8fb984ab2 ]
Make sure to tear down the host notify irq domain on adapter
registration failure to avoid leaking it.
This issue was flagged by Sashiko when reviewing another adapter
registration fix.
Fixes: 4d5538f5882a ("i2c: use an IRQ to report Host Notify events, not alert")
Cc: stable@vger.kernel.org # 4.10
Cc: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1461,7 +1461,7 @@ static int i2c_register_adapter(struct i
res = device_register(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
- goto out_list;
+ goto err_remove_irq_domain;
}
res = of_i2c_setup_smbus_alert(adap);
@@ -1505,6 +1505,8 @@ out_reg:
init_completion(&adap->dev_released);
device_unregister(&adap->dev);
wait_for_completion(&adap->dev_released);
+err_remove_irq_domain:
+ i2c_host_notify_irq_teardown(adap);
out_list:
mutex_lock(&core_lock);
idr_remove(&i2c_adapter_idr, adap->nr);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 027/699] i2c: core: fix hang on adapter registration failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 026/699] i2c: core: fix irq domain leak on adapter registration failure Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 028/699] i2c: core: fix NULL-deref " Greg Kroah-Hartman
` (675 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phil Reid, Johan Hovold,
Wolfram Sang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 3c7e164344e5bcf6f274bbf59a3274f5caad9bc1 ]
Clients may be registered from bus notifier callbacks when the adapter
is registered. On a subsequent error during registration, the adapter
references taken by such clients prevent the wait for the references to
be released from ever completing.
Fix this by refactoring client deregistration and deregistering also on
late adapter registration failures.
Fixes: f8756c67b3de ("i2c: core: call of_i2c_setup_smbus_alert in i2c_register_adapter")
Cc: stable@vger.kernel.org # 4.15
Cc: Phil Reid <preid@electromag.com.au>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 49 ++++++++++++++++++++++++++------------------
1 file changed, 29 insertions(+), 20 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -61,6 +61,7 @@
static DEFINE_MUTEX(core_lock);
static DEFINE_IDR(i2c_adapter_idr);
+static void i2c_deregister_clients(struct i2c_adapter *adap);
static int i2c_detect(struct i2c_adapter *adapter, struct i2c_driver *driver);
static DEFINE_STATIC_KEY_FALSE(i2c_trace_msg_key);
@@ -1502,6 +1503,7 @@ static int i2c_register_adapter(struct i
return 0;
out_reg:
+ i2c_deregister_clients(adap);
init_completion(&adap->dev_released);
device_unregister(&adap->dev);
wait_for_completion(&adap->dev_released);
@@ -1644,29 +1646,10 @@ static int __process_removed_adapter(str
return 0;
}
-/**
- * i2c_del_adapter - unregister I2C adapter
- * @adap: the adapter being unregistered
- * Context: can sleep
- *
- * This unregisters an I2C adapter which was previously registered
- * by @i2c_add_adapter or @i2c_add_numbered_adapter.
- */
-void i2c_del_adapter(struct i2c_adapter *adap)
+static void i2c_deregister_clients(struct i2c_adapter *adap)
{
- struct i2c_adapter *found;
struct i2c_client *client, *next;
- /* First make sure that this adapter was ever added */
- mutex_lock(&core_lock);
- found = idr_find(&i2c_adapter_idr, adap->nr);
- mutex_unlock(&core_lock);
- if (found != adap) {
- pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
- return;
- }
-
- i2c_acpi_remove_space_handler(adap);
/* Tell drivers about this removal */
mutex_lock(&core_lock);
bus_for_each_drv(&i2c_bus_type, NULL, adap,
@@ -1692,6 +1675,32 @@ void i2c_del_adapter(struct i2c_adapter
* them up properly, so we give them a chance to do that first. */
device_for_each_child(&adap->dev, NULL, __unregister_client);
device_for_each_child(&adap->dev, NULL, __unregister_dummy);
+}
+
+/**
+ * i2c_del_adapter - unregister I2C adapter
+ * @adap: the adapter being unregistered
+ * Context: can sleep
+ *
+ * This unregisters an I2C adapter which was previously registered
+ * by @i2c_add_adapter or @i2c_add_numbered_adapter.
+ */
+void i2c_del_adapter(struct i2c_adapter *adap)
+{
+ struct i2c_adapter *found;
+
+ /* First make sure that this adapter was ever added */
+ mutex_lock(&core_lock);
+ found = idr_find(&i2c_adapter_idr, adap->nr);
+ mutex_unlock(&core_lock);
+ if (found != adap) {
+ pr_debug("attempting to delete unregistered adapter [%s]\n", adap->name);
+ return;
+ }
+
+ i2c_acpi_remove_space_handler(adap);
+
+ i2c_deregister_clients(adap);
#ifdef CONFIG_I2C_COMPAT
class_compat_remove_link(i2c_adapter_compat_class, &adap->dev,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 028/699] i2c: core: fix NULL-deref on adapter registration failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 027/699] i2c: core: fix hang " Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 029/699] i2c: core: fix adapter debugfs creation Greg Kroah-Hartman
` (674 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Hattori, Johan Hovold,
Wolfram Sang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 2295d2bb101faa663fbc45fadbb3fec45f107441 ]
If adapter registration ever fails the release callback would trigger a
NULL-pointer dereference as the completion struct has not been
initialised.
Note that before the offending commit this would instead have resulted
in a minor memory leak of the adapter name.
Fixes: 3f8c4f5e9a57 ("i2c: core: fix reference leak in i2c_register_adapter()")
Cc: stable@vger.kernel.org
Cc: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1462,7 +1462,7 @@ static int i2c_register_adapter(struct i
res = device_register(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
- goto err_remove_irq_domain;
+ goto err_put_adap;
}
res = of_i2c_setup_smbus_alert(adap);
@@ -1504,10 +1504,12 @@ static int i2c_register_adapter(struct i
out_reg:
i2c_deregister_clients(adap);
+ device_del(&adap->dev);
+err_put_adap:
init_completion(&adap->dev_released);
- device_unregister(&adap->dev);
+ put_device(&adap->dev);
wait_for_completion(&adap->dev_released);
-err_remove_irq_domain:
+
i2c_host_notify_irq_teardown(adap);
out_list:
mutex_lock(&core_lock);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 029/699] i2c: core: fix adapter debugfs creation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 028/699] i2c: core: fix NULL-deref " Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 030/699] i2c: core: fix adapter registration race Greg Kroah-Hartman
` (673 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Johan Hovold,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 07d5fb537928aad4369aaff0cbae73ba38a719af ]
Clients can be registered from bus notifier callbacks so the debugfs
directory needs to be created before registering the adapter as clients
use that directory as their debugfs parent.
Move debugfs creation before adapter registration to avoid having
clients create their debugfs directories in the debugfs root (which is
also more likely to fail due to name collisions).
Note that failure to allocate the adapter name must now be handled
explicitly as debugfs_create_dir() cannot handle a NULL name (unlike
device_add() which returns an error).
Fixes: 73febd775bdb ("i2c: create debugfs entry per adapter")
Cc: stable@vger.kernel.org # 6.8
Cc: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Stable-dep-of: ba14d7cf2fe7 ("i2c: core: fix adapter registration race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1456,10 +1456,19 @@ static int i2c_register_adapter(struct i
goto out_list;
}
- dev_set_name(&adap->dev, "i2c-%d", adap->nr);
+ res = dev_set_name(&adap->dev, "i2c-%d", adap->nr);
+ if (res)
+ goto err_remove_irq_domain;
+
adap->dev.bus = &i2c_bus_type;
adap->dev.type = &i2c_adapter_type;
- res = device_register(&adap->dev);
+ device_initialize(&adap->dev);
+
+ pm_runtime_no_callbacks(&adap->dev);
+ pm_suspend_ignore_children(&adap->dev, true);
+ pm_runtime_enable(&adap->dev);
+
+ res = device_add(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
goto err_put_adap;
@@ -1469,10 +1478,6 @@ static int i2c_register_adapter(struct i
if (res)
goto out_reg;
- pm_runtime_no_callbacks(&adap->dev);
- pm_suspend_ignore_children(&adap->dev, true);
- pm_runtime_enable(&adap->dev);
-
res = i2c_init_recovery(adap);
if (res == -EPROBE_DEFER)
goto out_reg;
@@ -1509,7 +1514,7 @@ err_put_adap:
init_completion(&adap->dev_released);
put_device(&adap->dev);
wait_for_completion(&adap->dev_released);
-
+err_remove_irq_domain:
i2c_host_notify_irq_teardown(adap);
out_list:
mutex_lock(&core_lock);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 030/699] i2c: core: fix adapter registration race
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 029/699] i2c: core: fix adapter debugfs creation Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 031/699] hdlc_ppp: sync per-proto timers before freeing hdlc state Greg Kroah-Hartman
` (672 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Wolfram Sang,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit ba14d7cf2fe7284610a29854bdff22b2537d3ce6 ]
Adapters can be looked up based on their id using i2c_get_adapter()
which takes a reference to the embedded struct device.
Make sure that the adapter (including its struct device) has been
initialised before adding it to the IDR to avoid accessing uninitialised
data which could, for example, lead to NULL-pointer dereferences or
use-after-free.
Note that the i2c-dev chardev, which is registered from a bus notifier,
currently uses i2c_get_adapter() so the adapter needs to be added to the
IDR before registration.
Fixes: 6e13e6418418 ("i2c: Add i2c_add_numbered_adapter()")
Cc: stable@vger.kernel.org # 2.6.22
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/i2c-core-base.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -1468,6 +1468,10 @@ static int i2c_register_adapter(struct i
pm_suspend_ignore_children(&adap->dev, true);
pm_runtime_enable(&adap->dev);
+ mutex_lock(&core_lock);
+ idr_replace(&i2c_adapter_idr, adap, adap->nr);
+ mutex_unlock(&core_lock);
+
res = device_add(&adap->dev);
if (res) {
pr_err("adapter '%s': can't register device (%d)\n", adap->name, res);
@@ -1535,7 +1539,7 @@ static int __i2c_add_numbered_adapter(st
int id;
mutex_lock(&core_lock);
- id = idr_alloc(&i2c_adapter_idr, adap, adap->nr, adap->nr + 1, GFP_KERNEL);
+ id = idr_alloc(&i2c_adapter_idr, NULL, adap->nr, adap->nr + 1, GFP_KERNEL);
mutex_unlock(&core_lock);
if (WARN(id < 0, "couldn't get idr"))
return id == -ENOSPC ? -EBUSY : id;
@@ -1571,7 +1575,7 @@ int i2c_add_adapter(struct i2c_adapter *
}
mutex_lock(&core_lock);
- id = idr_alloc(&i2c_adapter_idr, adapter,
+ id = idr_alloc(&i2c_adapter_idr, NULL,
__i2c_first_dynamic_bus_num, 0, GFP_KERNEL);
mutex_unlock(&core_lock);
if (WARN(id < 0, "couldn't get idr"))
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 031/699] hdlc_ppp: sync per-proto timers before freeing hdlc state
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 030/699] i2c: core: fix adapter registration race Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 032/699] xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Greg Kroah-Hartman
` (671 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fan Wu, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit c78a4e41ab5ead6193ad8a2dd92e8906bae659fa ]
Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp
registers a timer via timer_setup(). That struct ppp is the
hdlc->state allocation, which detach_hdlc_protocol() frees with kfree()
in both teardown paths: unregister_hdlc_device() and the re-attach inside
attach_hdlc_protocol().
The ppp proto never registered a .detach callback, so
detach_hdlc_protocol() performs no timer synchronization before the
kfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),
is partial (it does not wait for a running callback) and only runs on the
->CLOSED transition; ppp_stop()/ppp_close() do not sync either. A
ppp_timer callback already executing (blocked on ppp->lock) survives the
kfree and then dereferences proto->state / ppp->lock in freed memory,
leading to a use-after-free.
Fix this by adding a .detach helper that calls timer_shutdown_sync() on
every per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev)
before kfree(hdlc->state), so timer_shutdown_sync()
now runs on both free paths.
timer_shutdown_sync() is used instead of timer_delete_sync() because the
keepalive path re-arms the timer through add_timer()/mod_timer() and
shutdown blocks any re-activation during teardown.
Initialize the per-protocol timers in ppp_ioctl() when the protocol is
attached, and remove the now-redundant timer_setup() from ppp_start(), so
that the timers are initialized exactly once at attach time and
ppp_timer_release() never operates on uninitialized timer_list
structures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so
struct ppp's protos[i].timer is uninitialized garbage until the first
timer_setup(); without this init-at-attach, attaching the PPP protocol
without ever bringing the device up would leave timer_shutdown_sync()
operating on uninitialized memory in .detach. Moving the init out of
ppp_start() (which only runs on NETDEV_UP) into the attach path makes the
initialization unconditional and avoids initializing the same timer_list
twice.
This bug was found by static analysis.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Link: https://patch.msgid.link/20260617020518.116319-1-fanwu01@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ replaced timer_shutdown_sync() with del_timer_sync() since timer_shutdown_sync() is not available in 5.10 ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wan/hdlc_ppp.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -624,7 +624,6 @@ static void ppp_start(struct net_device
for (i = 0; i < IDX_COUNT; i++) {
struct proto *proto = &ppp->protos[i];
proto->dev = dev;
- timer_setup(&proto->timer, ppp_timer, 0);
proto->state = CLOSED;
}
ppp->protos[IDX_LCP].pid = PID_LCP;
@@ -644,6 +643,15 @@ static void ppp_close(struct net_device
ppp_tx_flush();
}
+static void ppp_timer_release(struct net_device *dev)
+{
+ struct ppp *ppp = get_ppp(dev);
+ int i;
+
+ for (i = 0; i < IDX_COUNT; i++)
+ del_timer_sync(&ppp->protos[i].timer);
+}
+
static struct hdlc_proto proto = {
.start = ppp_start,
.stop = ppp_stop,
@@ -652,6 +660,7 @@ static struct hdlc_proto proto = {
.ioctl = ppp_ioctl,
.netif_rx = ppp_rx,
.module = THIS_MODULE,
+ .detach = ppp_timer_release,
};
static const struct header_ops ppp_header_ops = {
@@ -662,7 +671,7 @@ static int ppp_ioctl(struct net_device *
{
hdlc_device *hdlc = dev_to_hdlc(dev);
struct ppp *ppp;
- int result;
+ int i, result;
switch (ifr->ifr_settings.type) {
case IF_GET_PROTO:
@@ -689,6 +698,8 @@ static int ppp_ioctl(struct net_device *
return result;
ppp = get_ppp(dev);
+ for (i = 0; i < IDX_COUNT; i++)
+ timer_setup(&ppp->protos[i].timer, ppp_timer, 0);
spin_lock_init(&ppp->lock);
ppp->req_timeout = 2;
ppp->cr_retries = 10;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 032/699] xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 031/699] hdlc_ppp: sync per-proto timers before freeing hdlc state Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 033/699] usb: gadget: function: rndis: add length check to response query Greg Kroah-Hartman
` (670 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Kosiorek, Steffen Klassert,
Mark Bundschuh, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kosiorek <mkosiorek121@gmail.com>
[ Upstream commit 14acf9652e5690de3c7486c6db5fb8dafd0a32a3 ]
KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s
hlist_del_rcu calls under syzkaller load on linux-6.12.y stable
(reproduced on 6.12.47, also reachable via the same code path on
torvalds/master and on the ipsec tree). Nine unique signatures cluster
in the xfrm_state lifecycle, the load-bearing one being:
BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]
BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]
BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c
Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435
Workqueue: netns cleanup_net
Call Trace:
__hlist_del / hlist_del_rcu
__xfrm_state_delete
xfrm_state_delete
xfrm_state_flush
xfrm_state_fini
ops_exit_list
cleanup_net
The other observed signatures hit the same slab object from
__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB
write variant of __xfrm_state_delete, all on the byseq/byspi
hash chains.
__xfrm_state_delete() guards its byseq and byspi unhashes with
value-based predicates:
if (x->km.seq)
hlist_del_rcu(&x->byseq);
if (x->id.spi)
hlist_del_rcu(&x->byspi);
while everywhere else in the file (e.g. state_cache, state_cache_input)
the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets
x->id.spi = newspi inside xfrm_state_lock and then immediately inserts
into byspi, but a path that observes x->id.spi != 0 outside of
xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently
with whether x is actually on the list. The same holds for x->km.seq
versus byseq, and the bydst/bysrc unhashes have no predicate at all,
so a second __xfrm_state_delete() on the same object writes through
LIST_POISON pprev.
The defensive change here:
- Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,
bysrc, byseq and byspi so a second deletion is a no-op rather
than a write through LIST_POISON pprev. The byseq/byspi nodes
are already initialised in xfrm_state_alloc().
- Test hlist_unhashed() rather than the value predicate for
byseq/byspi, so the unhash decision tracks list state rather than
mutable scalar fields.
Empirical verification: applied this patch on top of v6.12.47, rebuilt,
and re-ran the same syzkaller harness for 1h16m on a previously-crashy
configuration that produced ~100 hits each of slab-use-after-free
Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in
__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at
~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo
confirms the xfrm_state slab is actively allocated and freed during
the run (~143 KiB resident), so the fuzzer is still exercising those
code paths -- they just no longer crash.
Reproduction:
- Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV
- syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db
- 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal
- 9 unique signatures collected in ~9h, all within xfrm_state
lifecycle
Fixes: fe9f1d8779cb ("xfrm: add state hashtable keyed by seq")
Fixes: 7b4dc3600e48 ("[XFRM]: Do not add a state whose SPI is zero to the SPI hash.")
Reported-by: Michal Kosiorek <mkosiorek121@gmail.com>
Tested-by: Michal Kosiorek <mkosiorek121@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Michal Kosiorek <mkosiorek121@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
[ 5.10: drop state_cache{,_input} lines from context because 81a331a
("xfrm: Add an inbound percpu state cache.") does not exist yet, drop
xfrm_nat_keepalive_state_updated line from context because f531d13
("xfrm: support sending NAT keepalives in ESP in UDP states") does not
exist yet, and remove byseq since that optimization in fe9f1d8 ("xfrm:
add state hashtable keyed by seq") does not exist yet ]
Signed-off-by: Mark Bundschuh <mkbund@amazon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_state.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 61a0a5b843d9e7..8c742258952b8a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -659,10 +659,11 @@ int __xfrm_state_delete(struct xfrm_state *x)
x->km.state = XFRM_STATE_DEAD;
spin_lock(&net->xfrm.xfrm_state_lock);
list_del(&x->km.all);
- hlist_del_rcu(&x->bydst);
- hlist_del_rcu(&x->bysrc);
- if (x->id.spi)
- hlist_del_rcu(&x->byspi);
+ hlist_del_init_rcu(&x->bydst);
+ hlist_del_init_rcu(&x->bysrc);
+
+ if (!hlist_unhashed(&x->byspi))
+ hlist_del_init_rcu(&x->byspi);
net->xfrm.state_num--;
spin_unlock(&net->xfrm.xfrm_state_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 033/699] usb: gadget: function: rndis: add length check to response query
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 032/699] xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 034/699] usb: gadget: function: rndis: add length check for header Greg Kroah-Hartman
` (669 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Griffin Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Griffin Kroah-Hartman <griffin@kroah.com>
commit 95f90eea070837f7c72207d5520f805bdefc3bc5 upstream.
Add variable representations for BufLength and BufOffset in
rndis_query_response(), and perform a length check on them.
This is identical to how rndis_set_response() handles these parameters.
Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-1-e77e026dcc6a@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/rndis.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -591,6 +591,7 @@ static int rndis_init_response(struct rn
static int rndis_query_response(struct rndis_params *params,
rndis_query_msg_type *buf)
{
+ u32 BufLength, BufOffset;
rndis_query_cmplt_type *resp;
rndis_resp_t *r;
@@ -598,6 +599,13 @@ static int rndis_query_response(struct r
if (!params->dev)
return -ENOTSUPP;
+ BufLength = le32_to_cpu(buf->InformationBufferLength);
+ BufOffset = le32_to_cpu(buf->InformationBufferOffset);
+ if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
+ (BufOffset > RNDIS_MAX_TOTAL_SIZE) ||
+ (BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
+ return -EINVAL;
+
/*
* we need more memory:
* gen_ndis_query_resp expects enough space for
@@ -614,10 +622,8 @@ static int rndis_query_response(struct r
resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
if (gen_ndis_query_resp(params, le32_to_cpu(buf->OID),
- le32_to_cpu(buf->InformationBufferOffset)
- + 8 + (u8 *)buf,
- le32_to_cpu(buf->InformationBufferLength),
- r)) {
+ BufOffset + 8 + (u8 *)buf,
+ BufLength, r)) {
/* OID not supported */
resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
resp->MessageLength = cpu_to_le32(sizeof *resp);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 034/699] usb: gadget: function: rndis: add length check for header
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 033/699] usb: gadget: function: rndis: add length check to response query Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 035/699] iio: accel: bmc150: clamp the device-reported FIFO frame count Greg Kroah-Hartman
` (668 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Griffin Kroah-Hartman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Griffin Kroah-Hartman <griffin@kroah.com>
commit 21b5bf155435008e0fb0736795289788e63d426f upstream.
Add a length check for the rndis header in rndis_rm_hdr, to ensure that
MessageType, MessageLength, DataOffset, and DataLength fields are
present before they are accessed.
Assisted-by: gkh_clanker_2000
Cc: stable <stable@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Link: https://patch.msgid.link/20260708-usb-gadget-rndis-v1-2-e77e026dcc6a@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/rndis.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/gadget/function/rndis.c
+++ b/drivers/usb/gadget/function/rndis.c
@@ -1080,6 +1080,12 @@ int rndis_rm_hdr(struct gether *port,
/* tmp points to a struct rndis_packet_msg_type */
__le32 *tmp = (void *)skb->data;
+ /* Need at least MessageType, MessageLength, DataOffset, DataLength */
+ if (skb->len < 16) {
+ dev_kfree_skb_any(skb);
+ return -EINVAL;
+ }
+
/* MessageType, MessageLength */
if (cpu_to_le32(RNDIS_MSG_PACKET)
!= get_unaligned(tmp++)) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 035/699] iio: accel: bmc150: clamp the device-reported FIFO frame count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 034/699] usb: gadget: function: rndis: add length check for header Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 036/699] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Greg Kroah-Hartman
` (667 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit ce0e1cae26096fe959a0da5563a6d6d5a801d5fb upstream.
__bmc150_accel_fifo_flush() copies the number of samples the device
reports in its hardware FIFO into an on-stack buffer
u16 buffer[BMC150_ACCEL_FIFO_LENGTH * 3];
which is sized for at most BMC150_ACCEL_FIFO_LENGTH (32) samples. The
frame count is read from the FIFO_STATUS register and only masked to its
7 valid bits:
count = val & 0x7F;
so it can be 0..127. The only other limit applied to it is the optional
caller-supplied sample budget:
if (samples && count > samples)
count = samples;
which does not constrain count on the flush-all path (samples == 0), and
leaves it well above 32 whenever samples is larger. count samples are
then transferred into buffer[]:
bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
bmc150_accel_fifo_transfer() reads count * 6 bytes through regmap, so a
malfunctioning, malicious or counterfeit accelerometer (or an attacker
tampering with the I2C/SPI bus) that reports up to 127 frames writes up
to 762 bytes into the 192-byte buffer: a stack out-of-bounds write of up
to 570 bytes that clobbers the stack canary, saved registers and the
return address.
Clamp count to BMC150_ACCEL_FIFO_LENGTH, the number of samples buffer[]
is sized for, before the transfer, mirroring the watermark clamp already
done in bmc150_accel_set_watermark(). A well-formed flush reports at most
BMC150_ACCEL_FIFO_LENGTH frames, so legitimate devices are unaffected.
Fixes: 3bbec9773389 ("iio: bmc150_accel: add support for hardware fifo")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/bmc150-accel-core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/iio/accel/bmc150-accel-core.c
+++ b/drivers/iio/accel/bmc150-accel-core.c
@@ -919,6 +919,8 @@ static int __bmc150_accel_fifo_flush(str
if (samples && count > samples)
count = samples;
+ count = min_t(u8, count, BMC150_ACCEL_FIFO_LENGTH);
+
ret = bmc150_accel_fifo_transfer(data, (u8 *)buffer, count);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 036/699] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 035/699] iio: accel: bmc150: clamp the device-reported FIFO frame count Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 037/699] iio: adc: lpc32xx: Initialize completion before requesting IRQ Greg Kroah-Hartman
` (666 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biren Pandya, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit 44a5fd874bb6873bdaec59f722c1d57832fbc9df upstream.
kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()
but returns -EINVAL directly when a scale with a non-zero integer part is
requested, skipping the matching pm_runtime_put_autosuspend(). This leaks
a runtime PM usage-counter reference on every such write, after which the
device can no longer autosuspend.
Set the error code and fall through to the existing put instead of
returning early.
Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Assisted-by: Claude:claude-opus-4-8 coccinelle
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kxsd9.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -146,8 +146,9 @@ static int kxsd9_write_raw(struct iio_de
if (mask == IIO_CHAN_INFO_SCALE) {
/* Check no integer component */
if (val)
- return -EINVAL;
- ret = kxsd9_write_scale(indio_dev, val2);
+ ret = -EINVAL;
+ else
+ ret = kxsd9_write_scale(indio_dev, val2);
}
pm_runtime_mark_last_busy(st->dev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 037/699] iio: adc: lpc32xx: Initialize completion before requesting IRQ
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 036/699] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 038/699] iio: adc: ti-ads124s08: Return reset GPIO lookup errors Greg Kroah-Hartman
` (665 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sangyun Kim, Kyungwook Boo,
Jaeyoung Chung, Maxwell Doose, Vladimir Zapolskiy, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
commit e561b35633f450ee607e87a6401d97f156a0cd54 upstream.
In the report from Jaeyoung Chung:
"lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in lpc32xx_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
lpc32xx_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Fixes: 7901b2a1453e ("staging:iio:adc:lpc32xx rename local state structure to _state")
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/lpc32xx_adc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/adc/lpc32xx_adc.c
+++ b/drivers/iio/adc/lpc32xx_adc.c
@@ -176,6 +176,8 @@ static int lpc32xx_adc_probe(struct plat
if (irq <= 0)
return -ENXIO;
+ init_completion(&st->completion);
+
retval = devm_request_irq(&pdev->dev, irq, lpc32xx_adc_isr, 0,
LPC32XXAD_NAME, st);
if (retval < 0) {
@@ -194,8 +196,6 @@ static int lpc32xx_adc_probe(struct plat
platform_set_drvdata(pdev, iodev);
- init_completion(&st->completion);
-
iodev->name = LPC32XXAD_NAME;
iodev->info = &lpc32xx_adc_iio_info;
iodev->modes = INDIO_DIRECT_MODE;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 038/699] iio: adc: ti-ads124s08: Return reset GPIO lookup errors
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 037/699] iio: adc: lpc32xx: Initialize completion before requesting IRQ Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 039/699] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Greg Kroah-Hartman
` (664 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Crofts, Pengpeng Hou,
Andy Shevchenko, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 7dc4de2aa6316f1d044cde21f5acfec5f3ec6b47 upstream.
devm_gpiod_get_optional() returns NULL when the optional GPIO is absent,
but returns an ERR_PTR when the GPIO provider lookup fails, including
probe deferral.
Probe currently logs the ERR_PTR case as if the reset GPIO were simply
absent and keeps the error pointer in reset_gpio. Later ads124s_reset()
treats any non-NULL reset_gpio as a valid descriptor and passes it to
gpiod_set_value_cansleep().
Return the lookup error instead of retaining the ERR_PTR.
Fixes: e717f8c6dfec ("iio: adc: Add the TI ads124s08 ADC code")
Cc: stable@vger.kernel.org
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ti-ads124s08.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/iio/adc/ti-ads124s08.c
+++ b/drivers/iio/adc/ti-ads124s08.c
@@ -323,7 +323,8 @@ static int ads124s_probe(struct spi_devi
ads124s_priv->reset_gpio = devm_gpiod_get_optional(&spi->dev,
"reset", GPIOD_OUT_LOW);
if (IS_ERR(ads124s_priv->reset_gpio))
- dev_info(&spi->dev, "Reset GPIO not defined\n");
+ return dev_err_probe(&spi->dev, PTR_ERR(ads124s_priv->reset_gpio),
+ "Failed to get reset GPIO\n");
ads124s_priv->chip_info = &ads124s_chip_info_tbl[spi_id->driver_data];
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 039/699] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 038/699] iio: adc: ti-ads124s08: Return reset GPIO lookup errors Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 040/699] iio: event: Fix event FIFO reset race Greg Kroah-Hartman
` (663 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko, Maxwell Doose, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
commit 60d877910a43c305b5165131b258a17b1d772d57 upstream.
Include linux/bitfield.h for FIELD_GET().
Create new macros for bit manipulation in combination with manual bit
manipulation being replaced with FIELD_GET().
The current variable declaration and initializations are barely readable
and use comma separations across multiple lines. Refactor the
initializations so that mantissa and exp have separate declarations and
sign gets initialized later.
In addition (and due to the nature of the cleanup), fix a sign-extension
bug where, float32 would get bitwise anded with ~BIT(31)
(which is 0xFFFFFFFF7FFFFFFF) which corrupted the exponent.
Fixes: 64b3d8b1b0f5c ("iio: chemical: scd30: add core driver")
Reported-by: sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260524020309.18618-1-m32285159%40gmail.com
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/chemical/scd30_core.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
--- a/drivers/iio/chemical/scd30_core.c
+++ b/drivers/iio/chemical/scd30_core.c
@@ -4,6 +4,8 @@
*
* Copyright (c) 2020 Tomasz Duszynski <tomasz.duszynski@octakon.com>
*/
+
+#include <linux/bitfield.h>
#include <linux/bits.h>
#include <linux/cleanup.h>
#include <linux/completion.h>
@@ -43,6 +45,11 @@
#define SCD30_TEMP_OFFSET_MAX 655360
#define SCD30_EXTRA_TIMEOUT_PER_S 250
+/* Floating point arithmetic macros */
+#define SCD30_FLOAT_MANTISSA_MSK GENMASK(22, 0)
+#define SCD30_FLOAT_EXP_MSK GENMASK(30, 23)
+#define SCD30_FLOAT_SIGN_MSK BIT(31)
+
enum {
SCD30_CONC,
SCD30_TEMP,
@@ -89,10 +96,14 @@ static int scd30_reset(struct scd30_stat
/* simplified float to fixed point conversion with a scaling factor of 0.01 */
static int scd30_float_to_fp(int float32)
{
- int fraction, shift,
- mantissa = float32 & GENMASK(22, 0),
- sign = (float32 & BIT(31)) ? -1 : 1,
- exp = (float32 & ~BIT(31)) >> 23;
+ int fraction, shift, sign;
+ int mantissa = FIELD_GET(SCD30_FLOAT_MANTISSA_MSK, float32);
+ int exp = FIELD_GET(SCD30_FLOAT_EXP_MSK, float32);
+
+ if (float32 & SCD30_FLOAT_SIGN_MSK)
+ sign = -1;
+ else
+ sign = 1;
/* special case 0 */
if (!exp && !mantissa)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 040/699] iio: event: Fix event FIFO reset race
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 039/699] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 041/699] iio: gyro: bmg160: bail out when bandwidth/filter is not in table Greg Kroah-Hartman
` (662 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Nuno Sá,
Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars-Peter Clausen <lars@metafoo.de>
commit af791d295737ea6b6ff2c8d8488462a49c14af01 upstream.
`iio_event_getfd()` creates the event file descriptor with
`anon_inode_getfd()`, which allocates a new fd, creates the anonymous
file and installs it in the process fd table before returning to the
caller.
The IIO code resets the event FIFO after `anon_inode_getfd()` has returned,
but before `IIO_GET_EVENT_FD_IOCTL` has copied the fd number to userspace.
But since fd tables are shared between threads, another thread can guess
the newly allocated fd number and issue a `read()` on it as soon as the fd
has been installed.
This means the `kfifo_to_user()` in `iio_event_chrdev_read()` can run in
parallel with the `kfifo_reset_out()` in `iio_event_getfd()`.
The kfifo documentation says that `kfifo_reset_out()` is only safe when it
is called from the reader thread and there is only one concurrent reader.
Otherwise it is dangerous and must be handled in the same way as
`kfifo_reset()`.
If that happens, `kfifo_to_user()` can advance the FIFO `out` index based
on state from before the reset, after the reset has already moved the `out`
index to the current `in` index. That can leave the FIFO with an `out`
index past the `in` index. A later `read()` can then see an underflowed
FIFO length and copy more data than the event FIFO buffer contains. This
can result in an out-of-bounds read and leak adjacent kernel memory to
userspace.
Move the FIFO reset before `anon_inode_getfd()`. At that point the event fd is
marked busy, but the new fd has not been installed yet, so userspace cannot
access it while the FIFO is reset.
Fixes: b91accafbb10 ("iio:event: Fix and cleanup locking")
Reported-by: Codex:gpt-5.5
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-event.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/iio/industrialio-event.c
+++ b/drivers/iio/industrialio-event.c
@@ -205,6 +205,8 @@ int iio_event_getfd(struct iio_dev *indi
goto unlock;
}
+ kfifo_reset_out(&ev_int->det_events);
+
iio_device_get(indio_dev);
fd = anon_inode_getfd("iio:event", &iio_event_chrdev_fileops,
@@ -212,10 +214,7 @@ int iio_event_getfd(struct iio_dev *indi
if (fd < 0) {
clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
iio_device_put(indio_dev);
- } else {
- kfifo_reset_out(&ev_int->det_events);
}
-
unlock:
mutex_unlock(&indio_dev->mlock);
return fd;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 041/699] iio: gyro: bmg160: bail out when bandwidth/filter is not in table
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 040/699] iio: event: Fix event FIFO reset race Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 042/699] iio: gyro: bmg160: wait full startup time after mode change at probe Greg Kroah-Hartman
` (661 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Andy Shevchenko,
Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
commit 8320c77e67382d5d55d77043a5f60a867d408a2b upstream.
bmg160_get_filter() walks bmg160_samp_freq_table[] looking for the entry
matching the bw_bits value read from the chip:
for (i = 0; i < ARRAY_SIZE(bmg160_samp_freq_table); ++i) {
if (bmg160_samp_freq_table[i].bw_bits == bw_bits)
break;
}
*val = bmg160_samp_freq_table[i].filter;
If no entry matches, i ends up equal to the array size and the next line
reads one slot past the end. bmg160_set_filter() has the same shape, driven
by 'val' instead of bw_bits.
smatch flags both:
drivers/iio/gyro/bmg160_core.c:204 bmg160_get_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7
drivers/iio/gyro/bmg160_core.c:222 bmg160_set_filter() error:
buffer overflow 'bmg160_samp_freq_table' 7 <= 7
Return -EINVAL when no entry matches.
The set_filter() path is reachable from userspace via the sysfs
in_anglvel_filter_low_pass_3db_frequency interface, so userspace can
trivially trigger the out-of-bounds read with a value that is not in
bmg160_samp_freq_table[].filter.
Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/bmg160_core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -203,6 +203,9 @@ static int bmg160_get_filter(struct bmg1
break;
}
+ if (i == ARRAY_SIZE(bmg160_samp_freq_table))
+ return -EINVAL;
+
*val = bmg160_samp_freq_table[i].filter;
return ret ? ret : IIO_VAL_INT;
@@ -220,6 +223,9 @@ static int bmg160_set_filter(struct bmg1
break;
}
+ if (i == ARRAY_SIZE(bmg160_samp_freq_table))
+ return -EINVAL;
+
ret = regmap_write(data->regmap, BMG160_REG_PMU_BW,
bmg160_samp_freq_table[i].bw_bits);
if (ret < 0) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 042/699] iio: gyro: bmg160: wait full startup time after mode change at probe
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 041/699] iio: gyro: bmg160: bail out when bandwidth/filter is not in table Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 043/699] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Greg Kroah-Hartman
` (660 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
commit 088fcb9b567f8723074ad9eb1bf5cb46f8a0096b upstream.
bmg160_chip_init() calls bmg160_set_mode(BMG160_MODE_NORMAL) and
then waits only 500-1000 us. Per the BMG160 datasheet
(BST-BMG160-DS000-07 Rev. 1.0, May 2013), the start-up and wake-up
times (tsu, twusm) are 30 ms.
The same file already waits BMG160_MAX_STARTUP_TIME_MS (80 ms)
in bmg160_runtime_resume() after the same set_mode(NORMAL)
operation. The 500 us value at probe was likely a unit mix-up;
the old comment said "500 ms" while the code used microseconds.
Reuse the same constant via msleep() and add a code comment
explaining the datasheet basis for the wait. Without this,
register writes that follow the mode change can hit the chip
before it is ready.
Fixes: 22b46c45fb9b ("iio:gyro:bmg160 Gyro Sensor driver")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/bmg160_core.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -266,8 +266,14 @@ static int bmg160_chip_init(struct bmg16
if (ret < 0)
return ret;
- /* Wait upto 500 ms to be ready after changing mode */
- usleep_range(500, 1000);
+ /*
+ * Wait for the chip to be ready after switching to normal mode.
+ * The BMG160 datasheet (BST-BMG160-DS000-07 Rev. 1.0, May 2013)
+ * specifies a start-up / wake-up time (tsu, twusm) of 30 ms; use
+ * BMG160_MAX_STARTUP_TIME_MS (80 ms) as a safety margin, matching
+ * what bmg160_runtime_resume() already does.
+ */
+ msleep(BMG160_MAX_STARTUP_TIME_MS);
/* Set Bandwidth */
ret = bmg160_set_bw(data, BMG160_DEF_BW);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 043/699] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 042/699] iio: gyro: bmg160: wait full startup time after mode change at probe Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 044/699] iio: imu: st_lsm6dsx: deselect shub page before reading whoami Greg Kroah-Hartman
` (659 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit cd5a6a5096b246e10600da3ac47a1274ce9573c8 upstream.
bmi160_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
through devm_request_irq(), but it passes only irq_type and does not add
IRQF_NO_THREAD.
When the kernel is booted with forced IRQ threading, the parent IRQ can
otherwise be threaded by the IRQ core and the subsequent IIO trigger
child IRQ is dispatched from irq/... thread context instead of hardirq
context. Because the handler immediately pushes the event into
iio_trigger_poll(), this violates the hardirq-only IIO trigger helper
contract and can drive downstream trigger consumers through the wrong
execution context.
Add IRQF_NO_THREAD on top of irq_type when registering the BMI160 data-
ready trigger handler.
Fixes: 895bf81e6bbf ("iio:bmi160: add drdy interrupt support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/bmi160/bmi160_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/iio/imu/bmi160/bmi160_core.c
+++ b/drivers/iio/imu/bmi160/bmi160_core.c
@@ -801,7 +801,8 @@ int bmi160_probe_trigger(struct iio_dev
ret = devm_request_irq(&indio_dev->dev, irq,
&iio_trigger_generic_data_rdy_poll,
- irq_type, "bmi160", data->trig);
+ irq_type | IRQF_NO_THREAD,
+ "bmi160", data->trig);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 044/699] iio: imu: st_lsm6dsx: deselect shub page before reading whoami
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 043/699] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 045/699] iio: light: al3010: fix incorrect scale for the highest gain range Greg Kroah-Hartman
` (658 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Kempe, Lorenzo Bianconi,
Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kempe <andreas.kempe@actia.se>
commit aede83625ff5d9539508582036df30c809d51058 upstream.
As part of driver initialization, e.g. st_lsm6dsx_init_shub() selects
the shub register page using st_lsm6dsx_set_page(). Selecting the shub
register page shadows the regular register space so whoami, among other
registers, is no longer accessible.
In applications where the IMU is permanently powered separately from the
processor, there is a window where a reset of the CPU leaves the IMU in
the shub register page. Once this occurs, any subsequent probe attempt
fails because of the register shadowing.
Using the ism330dlc, the error typically looks like
st_lsm6dsx_i2c 3-006a: unsupported whoami [10]
with the unknown whoami read from a reserved register in the shub page.
The reset register is also shadowed by the page select, preventing a
reset from recovering the chip.
Unconditionally clear the shub page before the whoami readout to ensure
normal register access and allow the initialization to proceed.
Place the fix in st_lsm6dsx_check_whoami() before the whoami check
because hw->settings, which st_lsm6dsx_set_page() relies on, is first
assigned in that function.
Placing the fix in a more logical place than the whoami check would
require a bigger restructuring of the code.
Fixes: c91c1c844ebd ("iio: imu: st_lsm6dsx: add i2c embedded controller support")
Signed-off-by: Andreas Kempe <andreas.kempe@actia.se>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c
@@ -1389,6 +1389,26 @@ static int st_lsm6dsx_check_whoami(struc
return -ENODEV;
}
+ hw->settings = &st_lsm6dsx_sensor_settings[i];
+
+ if (hw->settings->shub_settings.page_mux.addr) {
+ /*
+ * If the IMU has the shub page selected on init, for example
+ * after a CPU watchdog reset while the page is selected, the
+ * regular register space is shadowed. While the regular
+ * register space is shadowed, the registers needed for
+ * initializing the IMU are not available.
+ *
+ * Unconditionally clear the shub page selection to ensure
+ * normal register access.
+ */
+ err = st_lsm6dsx_set_page(hw, false);
+ if (err < 0) {
+ dev_err(hw->dev, "failed to clear shub page\n");
+ return err;
+ }
+ }
+
err = regmap_read(hw->regmap, ST_LSM6DSX_REG_WHOAMI_ADDR, &data);
if (err < 0) {
dev_err(hw->dev, "failed to read whoami register\n");
@@ -1401,7 +1421,6 @@ static int st_lsm6dsx_check_whoami(struc
}
*name = st_lsm6dsx_sensor_settings[i].id[j].name;
- hw->settings = &st_lsm6dsx_sensor_settings[i];
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 045/699] iio: light: al3010: fix incorrect scale for the highest gain range
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 044/699] iio: imu: st_lsm6dsx: deselect shub page before reading whoami Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 046/699] iio: light: gp2ap002: fix runtime PM leak on read error Greg Kroah-Hartman
` (657 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vidhu Sarwal, Andy Shevchenko,
Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vidhu Sarwal <vidhu.linux@gmail.com>
commit aa411adc6ce40ad1a55ebc965f255a4cfc0005f8 upstream.
al3010_scales[] encodes the highest gain range as {0, 1187200}.
For IIO_VAL_INT_PLUS_MICRO, the fractional part must be less than
1000000, so the scale 1.1872 should instead be represented as
{ 1, 187200 }.
Since write_raw() compares the value from userspace against this
table, writing the advertised 1.1872 scale never matches the malformed
entry and returns -EINVAL. As a result, the highest gain range cannot
be selected. Reading the scale in that state also reports the malformed
value.
Fixes: c36b5195ab70 ("iio: light: add Dyna-Image AL3010 driver")
Signed-off-by: Vidhu Sarwal <vidhu.linux@gmail.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/al3010.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/light/al3010.c
+++ b/drivers/iio/light/al3010.c
@@ -43,7 +43,7 @@ enum al3xxxx_range {
};
static const int al3010_scales[][2] = {
- {0, 1187200}, {0, 296800}, {0, 74200}, {0, 18600}
+ { 1, 187200 }, { 0, 296800 }, { 0, 74200 }, { 0, 18600 },
};
struct al3010_data {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 046/699] iio: light: gp2ap002: fix runtime PM leak on read error
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 045/699] iio: light: al3010: fix incorrect scale for the highest gain range Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 047/699] iio: light: opt3001: fix missing state reset on timeout Greg Kroah-Hartman
` (656 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biren Pandya, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biren Pandya <birenpandya@gmail.com>
commit 38b72267b7e22768a1f26d9935de4e1752a1dc85 upstream.
gp2ap002_read_raw() calls pm_runtime_get_sync() before reading the
lux value, but if gp2ap002_get_lux() fails, it returns directly. This
skips the pm_runtime_put_autosuspend() call at the "out" label,
permanently leaking a runtime PM reference and preventing the device
from autosuspending.
Replace the direct return with a "goto out" to ensure the reference
is properly dropped on the error path.
Fixes: f6dbf83c17cb ("iio: light: gp2ap002: Take runtime PM reference on light read")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/gp2ap002.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/light/gp2ap002.c
+++ b/drivers/iio/light/gp2ap002.c
@@ -258,7 +258,7 @@ static int gp2ap002_read_raw(struct iio_
case IIO_LIGHT:
ret = gp2ap002_get_lux(gp2ap002);
if (ret < 0)
- return ret;
+ goto out;
*val = ret;
ret = IIO_VAL_INT;
goto out;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 047/699] iio: light: opt3001: fix missing state reset on timeout
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 046/699] iio: light: gp2ap002: fix runtime PM leak on read error Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 048/699] iio: light: veml6030: fix channel type when pushing events Greg Kroah-Hartman
` (655 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Joshua Crofts,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
commit c123ca6ee26ad98f70a866ff428b08145c5a24fe upstream.
Currently in the function opt3001_get_processed(), there is a check
that directly returns -ETIMEDOUT if the conversion IRQ times out,
completely bypassing the err label, leaving ok_to_ignore_lock
permanently true, potentially breaking the device's falling threshold
interrupt detection.
Assign -ETIMEDOUT to the return variable and jump to the error label
to ensure ok_to_ignore_lock is properly reset.
Fixes: 26d90b559057 ("iio: light: opt3001: Fixed timeout error when 0 lux")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260525-opt3001-cleanup-v4-0-65b36a174f78%40gmail.com?part=1
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/opt3001.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/iio/light/opt3001.c
+++ b/drivers/iio/light/opt3001.c
@@ -280,8 +280,10 @@ static int opt3001_get_lux(struct opt300
ret = wait_event_timeout(opt->result_ready_queue,
opt->result_ready,
msecs_to_jiffies(OPT3001_RESULT_READY_LONG));
- if (ret == 0)
- return -ETIMEDOUT;
+ if (ret == 0) {
+ ret = -ETIMEDOUT;
+ goto err;
+ }
} else {
/* Sleep for result ready time */
timeout = (opt->int_time == OPT3001_INT_TIME_SHORT) ?
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 048/699] iio: light: veml6030: fix channel type when pushing events
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 047/699] iio: light: opt3001: fix missing state reset on timeout Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 049/699] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Greg Kroah-Hartman
` (654 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit c52bb33b641ebaae3e209f97714cb1758206f7d9 upstream.
The events are registered for IIO_LIGHT and not for IIO_INTENSITY.
Use the correct channel type.
When at it, fix minor checkpatch code style warning (alignment).
Cc: stable@vger.kernel.org
Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/veml6030.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/iio/light/veml6030.c
+++ b/drivers/iio/light/veml6030.c
@@ -710,9 +710,11 @@ static irqreturn_t veml6030_event_handle
else
evtdir = IIO_EV_DIR_FALLING;
- iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
- 0, IIO_EV_TYPE_THRESH, evtdir),
- iio_get_time_ns(indio_dev));
+ iio_push_event(indio_dev, IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+ 0,
+ IIO_EV_TYPE_THRESH,
+ evtdir),
+ iio_get_time_ns(indio_dev));
return IRQ_HANDLED;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 049/699] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 048/699] iio: light: veml6030: fix channel type when pushing events Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 050/699] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Greg Kroah-Hartman
` (653 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Andy Shevchenko,
Joshua Crofts, Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit e94944d7364d3ddb273539492f9bd9c9a622549a upstream.
On the failure in the ak8975_read_axis() the PM runtime gets unbalanced.
Balance it by calling pm_runtime_put_autosuspend() on error path as well.
Fixes: cde4cb5dd422 ("iio: magn: ak8975: deploy runtime and system PM")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260505-magnetometer-fixes-v5-0-831b9b5550fc%40gmail.com
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Joshua Crofts <joshua.crofts1@gmail.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/ak8975.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -715,6 +715,7 @@ static int ak8975_read_axis(struct iio_d
exit:
mutex_unlock(&data->lock);
+ pm_runtime_put_autosuspend(&data->client->dev);
dev_err(&client->dev, "Error in reading axis\n");
return ret;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 050/699] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 049/699] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 051/699] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Greg Kroah-Hartman
` (652 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liviu Stan, Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liviu Stan <liviu.stan@analog.com>
commit 5cb9fdb446bfc3ae0524496f53fb68e67051701b upstream.
reinit_completion() was called after regmap_write() initiated the hardware
conversion, creating a race window where the interrupt could fire and call
complete() before reinit_completion() reset the completion.
Move reinit_completion() before the regmap_write() to close the race.
ltc2983_eeprom_cmd() already does it in the correct order.
Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983")
Signed-off-by: Liviu Stan <liviu.stan@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/temperature/ltc2983.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/iio/temperature/ltc2983.c
+++ b/drivers/iio/temperature/ltc2983.c
@@ -1147,12 +1147,11 @@ static int ltc2983_chan_read(struct ltc2
start_conversion |= LTC2983_STATUS_CHAN_SEL(sensor->chan);
dev_dbg(&st->spi->dev, "Start conversion on chan:%d, status:%02X\n",
sensor->chan, start_conversion);
+ reinit_completion(&st->completion);
/* start conversion */
ret = regmap_write(st->regmap, LTC2983_STATUS_REG, start_conversion);
if (ret)
return ret;
-
- reinit_completion(&st->completion);
/*
* wait for conversion to complete.
* 300 ms should be more than enough to complete the conversion.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 051/699] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 050/699] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 052/699] ALSA: es1938: check snd_ctl_new1() return value Greg Kroah-Hartman
` (651 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit f7f3f9fd81e7adbaa12c2e62ee07f0e094a543fd upstream.
snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every
iteration it advances buf and subtracts the block size while looping on
"while (len)".
len is urb->actual_length. That value is supplied by the device and is
not guaranteed to be a multiple of 16. When a final short block leaves
len between 1 and 15, the loop runs once more, reads up to buf[15], and
then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows
to a huge value. The loop then keeps iterating and walking buf far past
the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus
block id happens to be hit.
Iterate only while a full message block is available. This stops the
unsigned underflow and silently drops any trailing partial block, which
carries no complete control value anyway.
The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1
and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
urb->actual_length before dispatching.
Fixes: 15c5ab607045 ("ALSA: snd-usb-caiaq: Add support for Traktor Kontrol S4")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/178176259547.3343534.2724779296835237429@maoyixie.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/caiaq/input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/usb/caiaq/input.c
+++ b/sound/usb/caiaq/input.c
@@ -330,7 +330,7 @@ static void snd_usb_caiaq_tks4_dispatch(
{
struct device *dev = caiaqdev_to_dev(cdev);
- while (len) {
+ while (len >= TKS4_MSGBLOCK_SIZE) {
unsigned int i, block_id = (buf[0] << 8) | buf[1];
switch (block_id) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 052/699] ALSA: es1938: check snd_ctl_new1() return value
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 051/699] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 053/699] ALSA: firewire: isight: bound the sample count to the packet payload Greg Kroah-Hartman
` (650 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
commit 1edd1f02dddd20aeb6066ded41017615766ea42f upstream.
snd_ctl_new1() can return NULL when memory allocation fails.
snd_es1938_mixer() does not check the return value before dereferencing
the pointer, which can lead to a NULL pointer dereference.
Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_E0DC65165FDF2C8982BAFB6794B854B53B0A@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/es1938.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/es1938.c
+++ b/sound/pci/es1938.c
@@ -1718,6 +1718,8 @@ static int snd_es1938_mixer(struct es193
for (idx = 0; idx < ARRAY_SIZE(snd_es1938_controls); idx++) {
struct snd_kcontrol *kctl;
kctl = snd_ctl_new1(&snd_es1938_controls[idx], chip);
+ if (!kctl)
+ return -ENOMEM;
switch (idx) {
case 0:
chip->master_volume = kctl;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 053/699] ALSA: firewire: isight: bound the sample count to the packet payload
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 052/699] ALSA: es1938: check snd_ctl_new1() return value Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 054/699] ALSA: usb-audio: avoid kobject path lookup in DualSense match Greg Kroah-Hartman
` (649 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Takashi Sakamoto, Maoyi Xie,
Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 29b9667982e4df2ed7744f86b1144f8bb58eb698 upstream.
isight_packet() takes the frame count from the device iso packet and
checks it only against the device claimed iso length.
count = be32_to_cpu(payload->sample_count);
if (likely(count <= (length - 16) / 4))
isight_samples(isight, payload->samples, count);
length is the iso header data_length. It can be up to 0xffff. So the
gate allows a count up to about 16379. isight_samples() then copies
count frames out of payload->samples into the PCM DMA buffer.
payload->samples holds only 2 * MAX_FRAMES_PER_PACKET values. The
device multiplexes two samples per frame. A count past
MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer
size writes past runtime->dma_area. The smallest PCM buffer is larger
than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET
keeps both the read and the write in range.
A malicious or faulty Apple iSight on the FireWire bus reaches this
during a normal capture.
Add the MAX_FRAMES_PER_PACKET bound to the gate.
Fixes: 3a691b28a0ca ("ALSA: add Apple iSight microphone driver")
Suggested-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/178205454729.1900991.7807310178296762772@maoyixie.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/firewire/isight.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/firewire/isight.c
+++ b/sound/firewire/isight.c
@@ -179,7 +179,8 @@ static void isight_packet(struct fw_iso_
if (likely(length >= 16 &&
payload->signature == cpu_to_be32(0x73676874/*"sght"*/))) {
count = be32_to_cpu(payload->sample_count);
- if (likely(count <= (length - 16) / 4)) {
+ if (likely(count <= (length - 16) / 4 &&
+ count <= MAX_FRAMES_PER_PACKET)) {
total = be32_to_cpu(payload->sample_total);
if (unlikely(total != isight->total_samples)) {
if (!isight->first_packet)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 054/699] ALSA: usb-audio: avoid kobject path lookup in DualSense match
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 053/699] ALSA: firewire: isight: bound the sample count to the packet payload Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 055/699] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Greg Kroah-Hartman
` (648 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Darvell Long, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darvell Long <contact@darvell.me>
commit 7693c0cc415f3a16a7a3355f245474a5e661be4e upstream.
The DualSense jack-detection input handler verifies that a matching input
device belongs to the same physical controller by building kobject path
strings for both the input device and the USB audio device, then comparing
the path prefix.
This was observed when a weak physical connection caused the controller
to rapidly disconnect and reconnect. During that repeated hotplug,
snd_dualsense_ih_match() can run while the controller's USB device is
being disconnected. kobject_get_path() walks ancestor kobjects and
dereferences their names; if the USB device kobject name is no longer
valid, this can fault in strlen():
RIP: 0010:strlen+0x10/0x30
Call Trace:
kobject_get_path+0x34/0x150
snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]
input_register_device+0x566/0x6a0
ps_probe+0xb89/0x1590 [hid_playstation]
The same ownership check can be done without building kobject path
strings. The input device is parented below the HID device, USB interface
and USB device, so walking the input device parent chain and comparing
against the mixer USB device preserves the check without dereferencing
kobject names during disconnect.
Fixes: 79d561c4ec04 ("ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5")
Cc: <stable@vger.kernel.org>
Assisted-by: Cute:gpt-5.5
Signed-off-by: Darvell Long <contact@darvell.me>
Link: https://patch.msgid.link/20260624143723.2986353-1-contact@darvell.me
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_quirks.c | 40 ++++++++++++----------------------------
1 file changed, 12 insertions(+), 28 deletions(-)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -573,46 +573,30 @@ static bool snd_dualsense_ih_match(struc
{
struct dualsense_mixer_elem_info *mei;
struct usb_device *snd_dev;
- char *input_dev_path, *usb_dev_path;
- size_t usb_dev_path_len;
- bool match = false;
+ struct device *parent;
mei = container_of(handler, struct dualsense_mixer_elem_info, ih);
snd_dev = mei->info.head.mixer->chip->dev;
- input_dev_path = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
- if (!input_dev_path) {
- dev_warn(&snd_dev->dev, "Failed to get input dev path\n");
- return false;
- }
-
- usb_dev_path = kobject_get_path(&snd_dev->dev.kobj, GFP_KERNEL);
- if (!usb_dev_path) {
- dev_warn(&snd_dev->dev, "Failed to get USB dev path\n");
- goto free_paths;
- }
-
/*
* Ensure the VID:PID matched input device supposedly owned by the
* hid-playstation driver belongs to the actual hardware handled by
- * the current USB audio device, which implies input_dev_path being
- * a subpath of usb_dev_path.
+ * the current USB audio device.
*
* This verification is necessary when there is more than one identical
* controller attached to the host system.
+ *
+ * The input device is registered below the HID device, USB interface and
+ * USB device, so compare the parent chain directly instead of building
+ * kobject path strings. This avoids dereferencing kobject names while the
+ * USB device hierarchy is being torn down during disconnect.
*/
- usb_dev_path_len = strlen(usb_dev_path);
- if (usb_dev_path_len >= strlen(input_dev_path))
- goto free_paths;
-
- usb_dev_path[usb_dev_path_len] = '/';
- match = !memcmp(input_dev_path, usb_dev_path, usb_dev_path_len + 1);
-
-free_paths:
- kfree(input_dev_path);
- kfree(usb_dev_path);
+ for (parent = dev->dev.parent; parent; parent = parent->parent) {
+ if (parent == &snd_dev->dev)
+ return true;
+ }
- return match;
+ return false;
}
static int snd_dualsense_ih_connect(struct input_handler *handler,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 055/699] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 054/699] ALSA: usb-audio: avoid kobject path lookup in DualSense match Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 056/699] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Greg Kroah-Hartman
` (647 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 0f25cf1f02e3dba626791d949c759a48c0a44996 upstream.
scarlett_ctl_enum_put() ignores the return value from
snd_usb_set_cur_mix_value() and reports success whenever the
requested enum value differs from the current one.
If the SET_CUR request fails, the callback still returns success even
though neither the hardware state nor the cached mixer value changed.
Fixes: 76b188c4b370 ("ALSA: usb-audio: Scarlett mixer interface for 6i6, 18i6, 18i8 and 18i20")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-2-5a3bd4a673ae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_scarlett.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/usb/mixer_scarlett.c
+++ b/sound/usb/mixer_scarlett.c
@@ -438,7 +438,9 @@ static int scarlett_ctl_enum_put(struct
val = ucontrol->value.integer.value[0];
val = val + opt->start;
if (val != oval) {
- snd_usb_set_cur_mix_value(elem, 0, 0, val);
+ err = snd_usb_set_cur_mix_value(elem, 0, 0, val);
+ if (err < 0)
+ return err;
return 1;
}
return 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 056/699] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 055/699] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 057/699] ALSA: usb-audio: Roll back quirk control caches on write errors Greg Kroah-Hartman
` (646 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 3c06aec8abda6ba068b58a8b7119cdb2a48456b1 upstream.
Several US-16x08 mixer put callbacks log failed control URBs but
still return success to userspace. That hides device write failures
even though the requested value was not applied.
Return the negative write error instead in the route, master, bus,
channel, and EQ switch put callbacks.
Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-3-5a3bd4a673ae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_us16x08.c | 49 ++++++++++++++++++++++------------------------
1 file changed, 24 insertions(+), 25 deletions(-)
--- a/sound/usb/mixer_us16x08.c
+++ b/sound/usb/mixer_us16x08.c
@@ -225,14 +225,14 @@ static int snd_us16x08_route_put(struct
err = snd_us16x08_send_urb(chip, buf, sizeof(route_msg));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set routing, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
+ return 1;
}
static int snd_us16x08_master_info(struct snd_kcontrol *kcontrol,
@@ -284,14 +284,14 @@ static int snd_us16x08_master_put(struct
buf[5] = index + 1;
err = snd_us16x08_send_urb(chip, buf, sizeof(mix_msg_out));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set master, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
+ return 1;
}
static int snd_us16x08_bus_put(struct snd_kcontrol *kcontrol,
@@ -325,14 +325,14 @@ static int snd_us16x08_bus_put(struct sn
break;
}
- if (err > 0) {
- elem->cached |= 1;
- elem->cache_val[0] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set bus parameter, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1;
+ elem->cache_val[0] = val;
+ return 1;
}
static int snd_us16x08_bus_get(struct snd_kcontrol *kcontrol,
@@ -393,14 +393,14 @@ static int snd_us16x08_channel_put(struc
err = snd_us16x08_send_urb(chip, buf, sizeof(mix_msg_in));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set channel, err:%d\n", err);
+ return err;
}
- return err > 0 ? 1 : 0;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
+ return 1;
}
static int snd_us16x08_mix_info(struct snd_kcontrol *kcontrol,
@@ -530,13 +530,13 @@ static int snd_us16x08_eqswitch_put(stru
msleep(15);
}
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set eq switch, err:%d\n", err);
+ return err;
}
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
return 1;
}
@@ -1419,4 +1419,3 @@ int snd_us16x08_controls_create(struct u
return 0;
}
-
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 057/699] ALSA: usb-audio: Roll back quirk control caches on write errors
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 056/699] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 058/699] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Greg Kroah-Hartman
` (645 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit 6380957fa24251856a532e48a46a4dc3d1ae26b6 upstream.
Several mixer quirk callbacks cache the requested
control value in kcontrol->private_value before
issuing a single vendor or class write.
Their paired get and resume paths consume that cache
directly, so a failed write currently leaves software
state changed even though the update did not succeed.
That can make later reads report a value the device
never accepted and can replay the stale cache on resume.
Restore the previous cached value on failure in
the Audigy2NX LED, Emu0204 channel switch,
Xonar U1 output switch, Native Instruments controls,
FTU effect program switch, and Sound Blaster E1 input source switch.
Fixes: 9cf3689bfe07 ("ALSA: usb-audio: Add audigy2nx resume support")
Fixes: 5f503ee9e270 ("ALSA: usb-audio: Add Emu0204 channel switch resume support")
Fixes: 2bfb14c3b8fb ("ALSA: usb-audio: Add Xonar U1 resume support")
Fixes: da6d276957ea ("ALSA: usb-audio: Add resume support for Native Instruments controls")
Fixes: 0b4e9cfcef05 ("ALSA: usb-audio: Add resume support for FTU controls")
Fixes: 388fdb8f882a ("ALSA: usb-audio: Support changing input on Sound Blaster E1")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260429-alsa-usb-quirks-cache-rollback-v1-1-01b35c688b80@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_quirks.c | 45 +++++++++++++++++++++++++++++++++++++--------
1 file changed, 37 insertions(+), 8 deletions(-)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -335,6 +335,7 @@ static int snd_audigy2nx_led_put(struct
int index = kcontrol->private_value & 0xff;
unsigned int value = ucontrol->value.integer.value[0];
int old_value = kcontrol->private_value >> 8;
+ unsigned long old_pval = kcontrol->private_value;
int err;
if (value > 1)
@@ -343,7 +344,11 @@ static int snd_audigy2nx_led_put(struct
return 0;
kcontrol->private_value = (value << 8) | index;
err = snd_audigy2nx_led_update(mixer, value, index);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_audigy2nx_led_resume(struct usb_mixer_elem_list *list)
@@ -493,6 +498,7 @@ static int snd_emu0204_ch_switch_put(str
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
struct usb_mixer_interface *mixer = list->mixer;
unsigned int value = ucontrol->value.enumerated.item[0];
+ unsigned long old_pval = kcontrol->private_value;
int err;
if (value > 1)
@@ -503,7 +509,11 @@ static int snd_emu0204_ch_switch_put(str
kcontrol->private_value = value;
err = snd_emu0204_ch_switch_update(mixer, value);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_emu0204_ch_switch_resume(struct usb_mixer_elem_list *list)
@@ -814,7 +824,11 @@ static int snd_xonar_u1_switch_put(struc
kcontrol->private_value = new_status;
err = snd_xonar_u1_switch_update(list->mixer, new_status);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_status;
+ return err;
+ }
+ return 1;
}
static int snd_xonar_u1_switch_resume(struct usb_mixer_elem_list *list)
@@ -1022,7 +1036,8 @@ static int snd_nativeinstruments_control
struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
- u8 oldval = (kcontrol->private_value >> 24) & 0xff;
+ unsigned long old_pval = kcontrol->private_value;
+ u8 oldval = (old_pval >> 24) & 0xff;
u8 newval = ucontrol->value.integer.value[0];
int err;
@@ -1032,7 +1047,11 @@ static int snd_nativeinstruments_control
kcontrol->private_value &= ~(0xff << 24);
kcontrol->private_value |= (unsigned int)newval << 24;
err = snd_ni_update_cur_val(list);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static const struct snd_kcontrol_new snd_nativeinstruments_ta6_mixers[] = {
@@ -1190,7 +1209,8 @@ static int snd_ftu_eff_switch_put(struct
struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kctl);
- unsigned int pval = list->kctl->private_value;
+ unsigned long old_pval = list->kctl->private_value;
+ unsigned int pval = old_pval;
int cur_val, err, new_val;
cur_val = pval >> 24;
@@ -1201,7 +1221,11 @@ static int snd_ftu_eff_switch_put(struct
kctl->private_value &= ~(0xff << 24);
kctl->private_value |= new_val << 24;
err = snd_ftu_eff_switch_update(list);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kctl->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
@@ -1999,13 +2023,18 @@ static int snd_soundblaster_e1_switch_pu
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
unsigned char value = !!ucontrol->value.integer.value[0];
+ unsigned long old_pval = kcontrol->private_value;
int err;
if (kcontrol->private_value == value)
return 0;
kcontrol->private_value = value;
err = snd_soundblaster_e1_switch_update(list->mixer, value);
- return err < 0 ? err : 1;
+ if (err < 0) {
+ kcontrol->private_value = old_pval;
+ return err;
+ }
+ return 1;
}
static int snd_soundblaster_e1_switch_resume(struct usb_mixer_elem_list *list)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 058/699] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 057/699] ALSA: usb-audio: Roll back quirk control caches on write errors Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 059/699] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state " Greg Kroah-Hartman
` (644 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit d8f802ccf1fdbeb89d62748d6a0d0fbd442c8127 upstream.
snd_bbfpro_ctl_put() and snd_bbfpro_vol_put()
cache the requested packed control state in
kcontrol->private_value before issuing the USB write.
Their get and resume paths use that cached value directly,
so a failed write can leave the driver reporting and later
replaying a setting the hardware never accepted.
Update the cached state only after a successful USB write.
Fixes: 3e8f3bd04716 ("ALSA: usb-audio: RME Babyface Pro mixer patch")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Link: https://patch.msgid.link/20260429-alsa-usb-quirks-cache-rollback-v1-2-01b35c688b80@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_quirks.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -2791,12 +2791,14 @@ static int snd_bbfpro_ctl_put(struct snd
if (val == old_value)
return 0;
+ err = snd_bbfpro_ctl_update(mixer, reg, idx, val);
+ if (err < 0)
+ return err;
+
kcontrol->private_value = reg
| ((idx & SND_BBFPRO_CTL_IDX_MASK) << SND_BBFPRO_CTL_IDX_SHIFT)
| ((val & SND_BBFPRO_CTL_VAL_MASK) << SND_BBFPRO_CTL_VAL_SHIFT);
-
- err = snd_bbfpro_ctl_update(mixer, reg, idx, val);
- return err < 0 ? err : 1;
+ return 1;
}
static int snd_bbfpro_ctl_resume(struct usb_mixer_elem_list *list)
@@ -2881,11 +2883,13 @@ static int snd_bbfpro_vol_put(struct snd
new_val = uvalue & SND_BBFPRO_MIXER_VAL_MASK;
+ err = snd_bbfpro_vol_update(mixer, idx, new_val);
+ if (err < 0)
+ return err;
+
kcontrol->private_value = idx
| (new_val << SND_BBFPRO_MIXER_VAL_SHIFT);
-
- err = snd_bbfpro_vol_update(mixer, idx, new_val);
- return err < 0 ? err : 1;
+ return 1;
}
static int snd_bbfpro_vol_resume(struct usb_mixer_elem_list *list)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 059/699] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 058/699] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 060/699] Bluetooth: btusb: fix use-after-free on registration failure Greg Kroah-Hartman
` (643 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cássio Gabriel, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cássio Gabriel <cassiogabrielcontato@gmail.com>
commit a440c17869ecd71da0f295b62868fc742d09a8ba upstream.
snd_us16x08_comp_put() and snd_us16x08_eq_put() update their
software stores before sending the USB write. If the transfer
fails, later get callbacks report a value the hardware never
accepted.
Build the outgoing message from the current store plus the
pending value, then commit the store only after a successful
write.
Fixes: d2bb390a2081 ("ALSA: usb-audio: Tascam US-16x08 DSP mixer quirk")
Cc: stable@vger.kernel.org
Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260419-usb-write-error-propagation-v1-4-5a3bd4a673ae@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_us16x08.c | 78 ++++++++++++++++++++++++++++++----------------
1 file changed, 52 insertions(+), 26 deletions(-)
--- a/sound/usb/mixer_us16x08.c
+++ b/sound/usb/mixer_us16x08.c
@@ -436,6 +436,7 @@ static int snd_us16x08_comp_put(struct s
int index = ucontrol->id.index;
char buf[sizeof(comp_msg)];
int val_idx, val;
+ int threshold, ratio, attack, release, gain, switch_on;
int err;
val = ucontrol->value.integer.value[0];
@@ -448,36 +449,61 @@ static int snd_us16x08_comp_put(struct s
/* new control value incl. bias*/
val_idx = elem->head.id - SND_US16X08_ID_COMP_BASE;
- store->val[val_idx][index] = ucontrol->value.integer.value[0];
+ threshold = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD)]
+ [index];
+ ratio = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO)][index];
+ attack = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK)][index];
+ release = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE)]
+ [index];
+ gain = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN)][index];
+ switch_on = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)]
+ [index];
+
+ switch (val_idx) {
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD):
+ threshold = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO):
+ ratio = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK):
+ attack = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE):
+ release = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN):
+ gain = val;
+ break;
+ case COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH):
+ switch_on = val;
+ break;
+ }
/* prepare compressor URB message from template */
memcpy(buf, comp_msg, sizeof(comp_msg));
/* place comp values in message buffer watch bias! */
- buf[8] = store->val[
- COMP_STORE_IDX(SND_US16X08_ID_COMP_THRESHOLD)][index]
- - SND_US16X08_COMP_THRESHOLD_BIAS;
- buf[11] = ratio_map[store->val[
- COMP_STORE_IDX(SND_US16X08_ID_COMP_RATIO)][index]];
- buf[14] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_ATTACK)][index]
- + SND_US16X08_COMP_ATTACK_BIAS;
- buf[17] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_RELEASE)][index]
- + SND_US16X08_COMP_RELEASE_BIAS;
- buf[20] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_GAIN)][index];
- buf[26] = store->val[COMP_STORE_IDX(SND_US16X08_ID_COMP_SWITCH)][index];
+ buf[8] = threshold - SND_US16X08_COMP_THRESHOLD_BIAS;
+ buf[11] = ratio_map[ratio];
+ buf[14] = attack + SND_US16X08_COMP_ATTACK_BIAS;
+ buf[17] = release + SND_US16X08_COMP_RELEASE_BIAS;
+ buf[20] = gain;
+ buf[26] = switch_on;
/* place channel selector in message buffer */
buf[5] = index + 1;
err = snd_us16x08_send_urb(chip, buf, sizeof(comp_msg));
- if (err > 0) {
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set compressor, err:%d\n", err);
+ return err;
}
+ store->val[val_idx][index] = val;
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
return 1;
}
@@ -579,11 +605,10 @@ static int snd_us16x08_eq_put(struct snd
/* copy URB buffer from EQ template */
memcpy(buf, eqs_msq, sizeof(eqs_msq));
- store->val[b_idx][p_idx][index] = val;
- buf[20] = store->val[b_idx][3][index];
- buf[17] = store->val[b_idx][2][index];
- buf[14] = store->val[b_idx][1][index];
- buf[11] = store->val[b_idx][0][index];
+ buf[20] = p_idx == 3 ? val : store->val[b_idx][3][index];
+ buf[17] = p_idx == 2 ? val : store->val[b_idx][2][index];
+ buf[14] = p_idx == 1 ? val : store->val[b_idx][1][index];
+ buf[11] = p_idx == 0 ? val : store->val[b_idx][0][index];
/* place channel index in URB buffer */
buf[5] = index + 1;
@@ -593,14 +618,15 @@ static int snd_us16x08_eq_put(struct snd
err = snd_us16x08_send_urb(chip, buf, sizeof(eqs_msq));
- if (err > 0) {
- /* store new value in EQ band cache */
- elem->cached |= 1 << index;
- elem->cache_val[index] = val;
- } else {
+ if (err < 0) {
usb_audio_dbg(chip, "Failed to set eq param, err:%d\n", err);
+ return err;
}
+ store->val[b_idx][p_idx][index] = val;
+ /* store new value in EQ band cache */
+ elem->cached |= 1 << index;
+ elem->cache_val[index] = val;
return 1;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 060/699] Bluetooth: btusb: fix use-after-free on registration failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 059/699] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state " Greg Kroah-Hartman
@ 2026-07-21 15:16 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 061/699] binder: fix UAF in binder_thread_release() Greg Kroah-Hartman
` (642 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Johan Hovold,
Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit eedc6867ebad73edbfaf9a0a65fbef7115cc4753 upstream.
Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver")
Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
Cc: stable@vger.kernel.org # 2.6.27
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4369,12 +4369,21 @@ static int btusb_probe(struct usb_interf
err = hci_register_dev(hdev);
if (err < 0)
- goto out_free_dev;
+ goto err_release_siblings;
usb_set_intfdata(intf, data);
return 0;
+err_release_siblings:
+ if (data->diag) {
+ usb_set_intfdata(data->diag, NULL);
+ usb_driver_release_interface(&btusb_driver, data->diag);
+ }
+ if (data->isoc) {
+ usb_set_intfdata(data->isoc, NULL);
+ usb_driver_release_interface(&btusb_driver, data->isoc);
+ }
out_free_dev:
if (data->reset_gpio)
gpiod_put(data->reset_gpio);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 061/699] binder: fix UAF in binder_thread_release()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-07-21 15:16 ` [PATCH 5.10 060/699] Bluetooth: btusb: fix use-after-free on registration failure Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 062/699] usb: xhci: Fix sleep in atomic context in xhci_free_streams() Greg Kroah-Hartman
` (641 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alice Ryhl, Carlos Llamas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 114a116aaa5f0295376cdf12da743c5bce3b20ce upstream.
When a thread exits, binder_thread_release() walks its transaction stack
to clear the t->from and t->to_proc that correspond with the exiting
thread. However, a process dying in parallel might attempt to kfree some
of these transactions. And if one of them has no associated t->to_proc,
the t->to_proc->inner_lock will not be acquired.
This means that transaction accesses in binder_thread_release() after
t->to_proc has been cleared might race with binder_free_transaction()
and cause a use-after-free error as reported by KASAN:
==================================================================
BUG: KASAN: slab-use-after-free in binder_thread_release+0x5d0/0x798
Write of size 8 at addr ffff000016627500 by task X/715
CPU: 17 UID: 0 PID: 715 Comm: X Not tainted 7.1.0-rc5-00149-g8fde5d1d47f6 #30 PREEMPT
Hardware name: linux,dummy-virt (DT)
Call trace:
binder_thread_release+0x5d0/0x798
binder_ioctl+0x12c0/0x299c
[...]
Allocated by task 717 on cpu 18 at 67.267803s:
__kasan_kmalloc+0xa0/0xbc
__kmalloc_cache_noprof+0x174/0x444
binder_transaction+0x554/0x8150
binder_thread_write+0xa30/0x4354
binder_ioctl+0x20f0/0x299c
[...]
Freed by task 202 on cpu 18 at 90.416221s:
__kasan_slab_free+0x58/0x80
kfree+0x1a0/0x4a4
binder_free_transaction+0x150/0x294
binder_send_failed_reply+0x398/0x6d8
binder_release_work+0x3e4/0x4ec
binder_deferred_func+0xbd8/0x104c
[...]
==================================================================
In order to avoid this, make sure that binder_free_transaction() reads
the t->to_proc under the transaction lock. This will serialize the
transaction release with the accesses in binder_thread_release(). Plus,
it matches the documented locking rules for @to_proc.
Cc: stable <stable@kernel.org>
Fixes: 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://patch.msgid.link/20260619185233.2194678-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1909,7 +1909,11 @@ static void binder_free_txn_fixups(struc
static void binder_free_transaction(struct binder_transaction *t)
{
- struct binder_proc *target_proc = t->to_proc;
+ struct binder_proc *target_proc;
+
+ spin_lock(&t->lock);
+ target_proc = t->to_proc;
+ spin_unlock(&t->lock);
if (target_proc) {
binder_inner_proc_lock(target_proc);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 062/699] usb: xhci: Fix sleep in atomic context in xhci_free_streams()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 061/699] binder: fix UAF in binder_thread_release() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 063/699] PCI: altera: Do not dispose parent IRQ mapping Greg Kroah-Hartman
` (640 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Lianqin Hu, Mathias Nyman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: 胡连勤 <hulianqin@vivo.com>
commit 42c37c4b75d38b51d84f31a8e29427f5e06a7c2a upstream.
When a USB device with active stream endpoints is disconnected,
xhci_free_streams() is called from the hub_event workqueue to
free the stream resources. It calls xhci_free_stream_info()
while holding xhci->lock with irqs disabled.
xhci_free_stream_info() invokes xhci_free_stream_ctx(), which
calls dma_free_coherent() for large stream context arrays.
dma_free_coherent() can sleep (e.g. via vunmap), triggering
a BUG when called from atomic context.
Call trace:
dma_free_attrs+0x174/0x220
xhci_free_stream_info+0xd0/0x11c
xhci_free_streams+0x278/0x37c
usb_free_streams+0x98/0xc0
usb_unbind_interface+0x1b8/0x2f8
device_release_driver_internal+0x1d4/0x2cc
device_release_driver+0x18/0x28
bus_remove_device+0x160/0x1a4
device_del+0x1ec/0x350
usb_disable_device+0x98/0x214
usb_disconnect+0xf0/0x35c
hub_event+0xab4/0x19ec
process_one_work+0x278/0x63c
Fix this by saving the stream_info pointers and clearing the
ep references under the lock, then calling xhci_free_stream_info()
outside the lock where sleeping is allowed.
Fixes: 8df75f42f8e6 ("USB: xhci: Add memory allocation for USB3 bulk streams.")
Cc: stable <stable@kernel.org>
Signed-off-by: Lianqin Hu <hulianqin@vivo.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20260703144033.483286-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3636,6 +3636,7 @@ static int xhci_free_streams(struct usb_
struct xhci_virt_device *vdev;
struct xhci_command *command;
struct xhci_input_control_ctx *ctrl_ctx;
+ struct xhci_stream_info *stream_info[EP_CTX_PER_DEV];
unsigned int ep_index;
unsigned long flags;
u32 changed_ep_bitmask;
@@ -3696,10 +3697,15 @@ static int xhci_free_streams(struct usb_
if (ret < 0)
return ret;
+ /*
+ * dma_free_coherent() called by xhci_free_stream_info() may sleep,
+ * so save stream_info pointers and clear references under lock,
+ * then free the memory outside lock.
+ */
spin_lock_irqsave(&xhci->lock, flags);
for (i = 0; i < num_eps; i++) {
ep_index = xhci_get_endpoint_index(&eps[i]->desc);
- xhci_free_stream_info(xhci, vdev->eps[ep_index].stream_info);
+ stream_info[i] = vdev->eps[ep_index].stream_info;
vdev->eps[ep_index].stream_info = NULL;
/* FIXME Unset maxPstreams in endpoint context and
* update deq ptr to point to normal string ring.
@@ -3709,6 +3715,9 @@ static int xhci_free_streams(struct usb_
}
spin_unlock_irqrestore(&xhci->lock, flags);
+ for (i = 0; i < num_eps; i++)
+ xhci_free_stream_info(xhci, stream_info[i]);
+
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 063/699] PCI: altera: Do not dispose parent IRQ mapping
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 062/699] usb: xhci: Fix sleep in atomic context in xhci_free_streams() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 064/699] PCI: host-common: Request bus reassignment when not probe-only Greg Kroah-Hartman
` (639 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahesh Vaidya, Manivannan Sadhasivam,
Subhransu S. Prusty
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Vaidya <mahesh.vaidya@altera.com>
commit 5ef4bac02189bee0b7c170e352d7a38e13fe9678 upstream.
altera_pcie_irq_teardown() calls irq_dispose_mapping() on pcie->irq.
However, pcie->irq is the parent IRQ returned by platform_get_irq(), not
the mapping created by Altera INTx irq_domain.
The Altera driver only sets the chained handler on the parent IRQ. It
should detach that handler during teardown, but it should not dispose the
parent IRQ mapping, which belongs to the parent interrupt controller's
irq_domain.
Drop irq_dispose_mapping(pcie->irq) from the teardown path.
Note that during irqchip remove(), the child IRQs should've disposed. But
since the chained handler itself is removed, there is no way the stale
child IRQs (if exists) could fire. So it is safe here.
Fixes: ec15c4d0d5d2 ("PCI: altera: Allow building as module")
Signed-off-by: Mahesh Vaidya <mahesh.vaidya@altera.com>
[mani: added a note about IRQ disposal]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Subhransu S. Prusty <subhransu.sekhar.prusty@altera.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260430204330.3121003-2-mahesh.vaidya@altera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pcie-altera.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/pci/controller/pcie-altera.c
+++ b/drivers/pci/controller/pcie-altera.c
@@ -689,7 +689,6 @@ static void altera_pcie_irq_teardown(str
{
irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
irq_domain_remove(pcie->irq_domain);
- irq_dispose_mapping(pcie->irq);
}
static int altera_pcie_parse_dt(struct altera_pcie *pcie)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 064/699] PCI: host-common: Request bus reassignment when not probe-only
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 063/699] PCI: altera: Do not dispose parent IRQ mapping Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 065/699] netfilter: ipset: fix race between dump and ip_set_list resize Greg Kroah-Hartman
` (638 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ratheesh Kannoth,
Manivannan Sadhasivam, Bjorn Helgaas, Vidya Sagar
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <rkannoth@marvell.com>
commit fda8749ba73638f5bbca3ffb39bc6861eb3b23fa upstream.
pci_host_common_init() is used by several generic ECAM host drivers.
After PCI core changes around pci_flags and preserve_config, these hosts
no longer opted into full bus number reassignment the way they did
before, which broke enumeration of devices on a Marvell CN106XX board.
When PCI_PROBE_ONLY is not set, add PCI_REASSIGN_ALL_BUS so
pci_scan_bridge_extend() takes the reassignment path: bus numbers can be
assigned from firmware EA data (e.g. pci_ea_fixed_busnrs()). Skip the
flag in probe-only mode so existing assignments are not overridden.
Fixes: 7246a4520b4b ("PCI: Use preserve_config in place of pci_flags")
Closes: https://lore.kernel.org/all/abkqm_LCd9zAM8cW@rkannoth-OptiPlex-7090/
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
[mani: added stable tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: add problem report link]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Cc: Vidya Sagar <vidyas@nvidia.com>
Link: https://patch.msgid.link/20260414081730.3864372-1-rkannoth@marvell.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pci-host-common.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/pci/controller/pci-host-common.c
+++ b/drivers/pci/controller/pci-host-common.c
@@ -75,6 +75,10 @@ int pci_host_common_probe(struct platfor
if (!pci_has_flag(PCI_PROBE_ONLY))
pci_add_flags(PCI_REASSIGN_ALL_BUS);
+ /* Do not reassign bus numbers if probe only */
+ if (!pci_has_flag(PCI_PROBE_ONLY))
+ pci_add_flags(PCI_REASSIGN_ALL_BUS);
+
bridge->sysdata = cfg;
bridge->ops = (struct pci_ops *)&ops->pci_ops;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 065/699] netfilter: ipset: fix race between dump and ip_set_list resize
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 064/699] PCI: host-common: Request bus reassignment when not probe-only Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 066/699] virtio-mmio: fix device release warning on module unload Greg Kroah-Hartman
` (637 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jozsef Kadlecsik, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 7cd9103283b26b917360ec99d7d2f2d761bcf1ab upstream.
The release path of ip_set_dump_do() and ip_set_dump_done() read
inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_dereference_raw()
of the array pointer. These run from netlink_recvmsg() without the nfnl
mutex and without an RCU read-side critical section.
A concurrent ip_set_create() can grow the array: it publishes the new
array, calls synchronize_net() and then kvfree()s the old one. Since the
dump paths read the array outside any RCU reader, synchronize_net() does
not wait for them and the old array can be freed while they still index
into it, causing a use-after-free.
The dumped set itself stays pinned via set->ref_netlink, so only the
array load needs protecting. Take rcu_read_lock() around it, matching
ip_set_get_byname() and __ip_set_put_byindex().
BUG: KASAN: slab-use-after-free in ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
Read of size 8 at addr ffff88800b5c4018 by task exploit/150
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1697)
netlink_dump (net/netlink/af_netlink.c:2325)
netlink_recvmsg (net/netlink/af_netlink.c:1976)
sock_recvmsg (net/socket.c:1159)
__sys_recvfrom (net/socket.c:2315)
...
Oops: general protection fault, probably for non-canonical address ... KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x02d6...d0-0x02d6...d7]
RIP: 0010:ip_set_dump_do (net/netfilter/ipset/ip_set_core.c:1698)
Kernel panic - not syncing: Fatal exception
Fixes: 8a02bdd50b2e ("netfilter: ipset: Fix calling ip_set() macro at dumping")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipset/ip_set_core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1490,7 +1490,11 @@ ip_set_dump_done(struct netlink_callback
struct ip_set_net *inst =
(struct ip_set_net *)cb->args[IPSET_CB_NET];
ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX];
- struct ip_set *set = ip_set_ref_netlink(inst, index);
+ struct ip_set *set;
+
+ rcu_read_lock();
+ set = ip_set_ref_netlink(inst, index);
+ rcu_read_unlock();
if (set->variant->uref)
set->variant->uref(set, cb, false);
@@ -1695,7 +1699,9 @@ next_set:
release_refcount:
/* If there was an error or set is done, release set */
if (ret || !cb->args[IPSET_CB_ARG0]) {
+ rcu_read_lock();
set = ip_set_ref_netlink(inst, index);
+ rcu_read_unlock();
if (set->variant->uref)
set->variant->uref(set, cb, false);
pr_debug("release set %s\n", set->name);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 066/699] virtio-mmio: fix device release warning on module unload
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 065/699] netfilter: ipset: fix race between dump and ip_set_list resize Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 067/699] hwrng: virtio: clamp device-reported used.len at copy_data() Greg Kroah-Hartman
` (636 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pawel Moll, Johan Hovold,
Michael S. Tsirkin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c687bc35694698ec4c7f92bf929c3d659f0cecb8 upstream.
Driver core expects devices to be allocated dynamically and complains
loudly when a device that lacks a release function is freed.
Use __root_device_register() to allocate and register the root device
instead of open coding using a static device.
Note that root_device_register(), which also creates a link to the
module, cannot be used as the device is registered when parsing the
module parameters which happens before the module kobject has been set
up.
Fixes: 81a054ce0b46 ("virtio-mmio: Devices parameter parsing")
Cc: stable@vger.kernel.org # 3.5
Cc: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260427143710.14702-1-johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_mmio.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
--- a/drivers/virtio/virtio_mmio.c
+++ b/drivers/virtio/virtio_mmio.c
@@ -675,9 +675,7 @@ static int virtio_mmio_remove(struct pla
#if defined(CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES)
-static struct device vm_cmdline_parent = {
- .init_name = "virtio-mmio-cmdline",
-};
+static struct device *vm_cmdline_parent;
static int vm_cmdline_parent_registered;
static int vm_cmdline_id;
@@ -685,7 +683,6 @@ static int vm_cmdline_id;
static int vm_cmdline_set(const char *device,
const struct kernel_param *kp)
{
- int err;
struct resource resources[2] = {};
char *str;
long long int base, size;
@@ -717,11 +714,10 @@ static int vm_cmdline_set(const char *de
resources[1].start = resources[1].end = irq;
if (!vm_cmdline_parent_registered) {
- err = device_register(&vm_cmdline_parent);
- if (err) {
- put_device(&vm_cmdline_parent);
+ vm_cmdline_parent = __root_device_register("virtio-mmio-cmdline", NULL);
+ if (IS_ERR(vm_cmdline_parent)) {
pr_err("Failed to register parent device!\n");
- return err;
+ return PTR_ERR(vm_cmdline_parent);
}
vm_cmdline_parent_registered = 1;
}
@@ -732,7 +728,7 @@ static int vm_cmdline_set(const char *de
(unsigned long long)resources[0].end,
(int)resources[1].start);
- pdev = platform_device_register_resndata(&vm_cmdline_parent,
+ pdev = platform_device_register_resndata(vm_cmdline_parent,
"virtio-mmio", vm_cmdline_id++,
resources, ARRAY_SIZE(resources), NULL, 0);
@@ -756,8 +752,12 @@ static int vm_cmdline_get_device(struct
static int vm_cmdline_get(char *buffer, const struct kernel_param *kp)
{
buffer[0] = '\0';
- device_for_each_child(&vm_cmdline_parent, buffer,
- vm_cmdline_get_device);
+
+ if (vm_cmdline_parent_registered) {
+ device_for_each_child(vm_cmdline_parent, buffer,
+ vm_cmdline_get_device);
+ }
+
return strlen(buffer) + 1;
}
@@ -779,9 +779,9 @@ static int vm_unregister_cmdline_device(
static void vm_unregister_cmdline_devices(void)
{
if (vm_cmdline_parent_registered) {
- device_for_each_child(&vm_cmdline_parent, NULL,
+ device_for_each_child(vm_cmdline_parent, NULL,
vm_unregister_cmdline_device);
- device_unregister(&vm_cmdline_parent);
+ root_device_unregister(vm_cmdline_parent);
vm_cmdline_parent_registered = 0;
}
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 067/699] hwrng: virtio: clamp device-reported used.len at copy_data()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 066/699] virtio-mmio: fix device release warning on module unload Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 068/699] USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Greg Kroah-Hartman
` (635 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael S. Tsirkin,
Michael Bommarito
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit e3046eeada299f917a8ad883af4434bfb86556b1 upstream.
random_recv_done() stores the device-reported used.len directly into
vi->data_avail. copy_data() then indexes vi->data[] using
vi->data_idx (advanced by previous copy_data() calls) and issues a
memcpy() without re-validating either value against the posted
buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32
or 64).
A malicious or buggy virtio-rng backend can set used.len beyond
sizeof(vi->data), steering the memcpy() past the end of the inline
array into adjacent kmalloc-1k slab bytes. hwrng_fillfn() mixes
those bytes into the guest RNG, and guest root can also observe
them directly via /dev/hwrng.
Concrete impact is inside the guest:
- Memory-safety / hardening: any virtio-rng backend that
over-reports used.len causes the driver to read past vi->data
into unrelated slab contents. hwrng_fillfn() is a kernel thread
that runs as soon as the device is probed; no guest userspace
interaction is required to first-trigger the OOB.
- Cross-boundary leak (confidential-compute threat model): a
malicious hypervisor cooperating with a malicious or compromised
guest root userspace can use /dev/hwrng as a leak channel for
guest-kernel heap data. The host sets a large used.len, guest
root reads /dev/hwrng, and the returned bytes contain guest
kernel slab contents that were adjacent to vi->data. In
practice, confidential-compute guests (SEV-SNP, TDX) usually
disable virtio-rng entirely, so this path is narrow, but the
fix is still worth carrying because the underlying
memory-safety bug contaminates the guest RNG on any host.
KASAN confirms the OOB on a 7.1-rc4 guest whose virtio-rng backend
has been patched to report used.len = 0x10000:
BUG: KASAN: slab-out-of-bounds in virtio_read+0x394/0x5d0
Read of size 64 at addr ffff88800ae0ba20 by task hwrng/52
Call Trace:
__asan_memcpy+0x23/0x60
virtio_read+0x394/0x5d0
hwrng_fillfn+0xb2/0x470
kthread+0x2cc/0x3a0
Allocated by task 1:
probe_common+0xa5/0x660
virtio_dev_probe+0x549/0xbc0
The buggy address belongs to the object at ffff88800ae0b800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 0 bytes to the right of
allocated 544-byte region [ffff88800ae0b800, ffff88800ae0ba20)
Same class of bug as commit c04db81cd028 ("net/9p: Fix buffer
overflow in USB transport layer"), which hardened
usb9pfs_rx_complete() against unchecked device-reported length in
the USB 9p transport.
With the clamp at point of use and array_index_nospec() in place,
the same harness boots cleanly: copy_data() returns zero for the
bogus report, the device-supplied bytes after data_idx are
discarded, and the driver issues a fresh request.
Fixes: f7f510ec1957 ("virtio: An entropy device, as suggested by hpa.")
Cc: stable@vger.kernel.org
Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260531142251.2792061-1-michael.bommarito@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/hw_random/virtio-rng.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -7,6 +7,7 @@
#include <asm/barrier.h>
#include <linux/err.h>
#include <linux/hw_random.h>
+#include <linux/nospec.h>
#include <linux/scatterlist.h>
#include <linux/spinlock.h>
#include <linux/virtio.h>
@@ -66,8 +67,26 @@ static void request_entropy(struct virtr
static unsigned int copy_data(struct virtrng_info *vi, void *buf,
unsigned int size)
{
- size = min_t(unsigned int, size, vi->data_avail);
- memcpy(buf, vi->data + vi->data_idx, size);
+ unsigned int idx, avail;
+
+ /*
+ * vi->data_avail was set from the device-reported used.len and
+ * vi->data_idx was advanced by previous copy_data() calls. A
+ * malicious or buggy virtio-rng backend can drive either past
+ * sizeof(vi->data). Clamp at point of use and harden the index
+ * with array_index_nospec() so the memcpy() below cannot be
+ * steered into adjacent slab memory, including under
+ * speculation.
+ */
+ avail = min_t(unsigned int, vi->data_avail, sizeof(vi->data));
+ if (vi->data_idx >= avail) {
+ vi->data_avail = 0;
+ request_entropy(vi);
+ return 0;
+ }
+ size = min_t(unsigned int, size, avail - vi->data_idx);
+ idx = array_index_nospec(vi->data_idx, sizeof(vi->data));
+ memcpy(buf, vi->data + idx, size);
vi->data_idx += size;
vi->data_avail -= size;
if (vi->data_avail == 0)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 068/699] USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 067/699] hwrng: virtio: clamp device-reported used.len at copy_data() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 069/699] 6lowpan: fix NHC entry use-after-free on error path Greg Kroah-Hartman
` (634 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Alan Stern, stable,
Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit abf76d3239dee97b66e7241ad04811f1ce562e28 upstream.
The chaoskey driver has a use-after-free bug in its release routine.
If the user closes the device file after the USB device has been
unplugged, a debugging log statement will try to access the
usb_interface structure after it has been deallocated:
BUG: KASAN: slab-use-after-free in dev_driver_string (drivers/base/core.c:2406)
Read of size 8 at addr ffff888168e8a0b8 by task chaoskey_raw_re/10106
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
dev_driver_string (drivers/base/core.c:2406)
__dynamic_dev_dbg (lib/dynamic_debug.c:906)
chaoskey_release (drivers/usb/misc/chaoskey.c:323)
__fput (fs/file_table.c:510)
fput_close_sync (fs/file_table.c:615)
__x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The driver's last reference to the interface structure is dropped in
the chaoskey_free() routine, so the code must not use the interface --
even in a debugging statement -- after that routine returns.
(Exception: If we know that another reference is held by someone else,
such as the device core while the disconnect routine runs, there's no
problem. Thanks to Johan Hovold for pointing this out.)
Since the bad access is part of an unimportant debugging statement,
we can fix the problem simply by removing the whole statement.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/linux-usb/20EC9664-054E-438B-B411-2145D347F97B@gmail.com/
Tested-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 66e3e591891d ("usb: Add driver for Altus Metrum ChaosKey device (v2)")
Cc: stable <stable@kernel.org>
Reviewed-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/bb5b1dc6-eb59-43e1-8d26-51e658e88bbe@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/chaoskey.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/usb/misc/chaoskey.c
+++ b/drivers/usb/misc/chaoskey.c
@@ -321,7 +321,6 @@ bail:
mutex_unlock(&dev->lock);
destruction:
mutex_unlock(&chaoskey_list_lock);
- usb_dbg(interface, "release success");
return rv;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 069/699] 6lowpan: fix NHC entry use-after-free on error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 068/699] USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 070/699] tipc: fix out-of-bounds read in broadcast Gap ACK blocks Greg Kroah-Hartman
` (633 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Alexander Aring, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
commit 1720db928e5a58ca7d75ac1d514c3b73fd7061a7 upstream.
lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding
lowpan_nhc_lock. If the descriptor has no uncompress callback, the error
path drops the lock before printing nhc->name.
lowpan_nhc_del() removes descriptors under the same lock and then relies
on synchronize_net() before the owning module can be unloaded. That only
waits for net RX RCU readers. lowpan_header_decompress() is also exported
and can be reached from callers that are not necessarily covered by the net
core RX critical section, for example the Bluetooth 6LoWPAN L2CAP receive
path.
This leaves a race where one task drops lowpan_nhc_lock in the error path,
another task unregisters and frees the matching descriptor after
synchronize_net() returns, and the first task then dereferences nhc->name
for the warning.
With the post-unlock window widened, KASAN reports:
BUG: KASAN: slab-use-after-free in lowpan_nhc_do_uncompression+0x1f4/0x220
Read of size 8
lowpan_nhc_do_uncompression
lowpan_header_decompress
Fix this by printing the warning before dropping lowpan_nhc_lock, so the
descriptor name is read while unregister is still excluded. The malformed
packet is still rejected with -ENOTSUPP.
Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Alexander Aring <aahringo@redhat.com>
Link: https://patch.msgid.link/20260609080054.4541-1-zhaoyz24@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/6lowpan/nhc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/6lowpan/nhc.c
+++ b/net/6lowpan/nhc.c
@@ -168,9 +168,9 @@ int lowpan_nhc_do_uncompression(struct s
return ret;
}
} else {
- spin_unlock_bh(&lowpan_nhc_lock);
netdev_warn(dev, "received nhc id for %s which is not implemented.\n",
nhc->name);
+ spin_unlock_bh(&lowpan_nhc_lock);
return -ENOTSUPP;
}
} else {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 070/699] tipc: fix out-of-bounds read in broadcast Gap ACK blocks
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 069/699] 6lowpan: fix NHC entry use-after-free on error path Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 071/699] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Greg Kroah-Hartman
` (632 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Page, Tung Nguyen,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <sam@bynar.io>
commit 2b66974a1b6134a4bbc3bfed181f7418f688eb54 upstream.
A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its
data area. tipc_get_gap_ack_blks() only verifies that the record's len
field is self-consistent with its ugack_cnt/bgack_cnt counts
(sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check
that the record actually fits in the message data area, msg_data_sz().
The unicast caller tipc_link_proto_rcv() bounds it ("if (glen > dlen)
break;"), but the broadcast caller tipc_bcast_sync_rcv() discards the
returned size, so tipc_link_advance_transmq() copies the record off the
receive skb with an attacker-controlled count:
this_ga = kmemdup(ga, struct_size(ga, gacks, ga->bgack_cnt),
GFP_ATOMIC);
A TIPC neighbour that negotiated TIPC_GAP_ACK_BLOCK triggers it with one
ordinary broadcast STATE_MSG (msg_bc_ack_invalid() clear), sized so its
data area is short, carrying a Gap ACK record with len = 0x400,
bgack_cnt = 0xff and ugack_cnt = 0. len then equals
struct_size(p, gacks, 255), so the consistency check passes and ga is
non-NULL; kmemdup() reads struct_size(ga, gacks, 255) = 1024 bytes out
of the much smaller skb:
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x48/0x60
Read of size 1024 at addr ffff0000c7030d38 by task poc864/69
Call trace:
kmemdup_noprof+0x48/0x60
tipc_link_advance_transmq+0x86c/0xb80
tipc_link_bc_ack_rcv+0x19c/0x1e0
tipc_bcast_sync_rcv+0x1c4/0x2c4
tipc_rcv+0x85c/0x1340
tipc_l2_rcv_msg+0xac/0x104
The buggy address belongs to the object at ffff0000c7030d00
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 56 bytes inside of
allocated 704-byte region [ffff0000c7030d00, ffff0000c7030fc0)
The copied-out bytes are subsequently consumed as gap/ack values, but
the read is already out of bounds at the kmemdup() regardless of how
they are used.
The unicast STATE path drops such a message: "if (glen > dlen) break;"
skips the rest of STATE_MSG handling and the skb is freed. Make the
broadcast path drop it too. tipc_bcast_sync_rcv() now bounds the record
against msg_data_sz() and, when it does not fit, reports it back through
tipc_node_bc_sync_rcv() to tipc_rcv() so the skb is discarded rather than
processed. ga is not cleared on this path: ga == NULL already means
"legacy peer without Selective ACK", a distinct legitimate state.
Fixes: d7626b5acff9 ("tipc: introduce Gap ACK blocks for broadcast link")
Cc: stable@vger.kernel.org
Signed-off-by: Samuel Page <sam@bynar.io>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260625143815.1525412-1-sam@bynar.io
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/bcast.c | 22 ++++++++++++++--------
net/tipc/bcast.h | 2 +-
net/tipc/node.c | 15 ++++++++++++---
3 files changed, 27 insertions(+), 12 deletions(-)
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -497,12 +497,13 @@ void tipc_bcast_ack_rcv(struct net *net,
*/
int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l,
struct tipc_msg *hdr,
- struct sk_buff_head *retrq)
+ struct sk_buff_head *retrq, bool *valid)
{
struct sk_buff_head *inputq = &tipc_bc_base(net)->inputq;
struct tipc_gap_ack_blks *ga;
struct sk_buff_head xmitq;
int rc = 0;
+ u16 glen;
__skb_queue_head_init(&xmitq);
@@ -510,13 +511,18 @@ int tipc_bcast_sync_rcv(struct net *net,
if (msg_type(hdr) != STATE_MSG) {
tipc_link_bc_init_rcv(l, hdr);
} else if (!msg_bc_ack_invalid(hdr)) {
- tipc_get_gap_ack_blks(&ga, l, hdr, false);
- if (!sysctl_tipc_bc_retruni)
- retrq = &xmitq;
- rc = tipc_link_bc_ack_rcv(l, msg_bcast_ack(hdr),
- msg_bc_gap(hdr), ga, &xmitq,
- retrq);
- rc |= tipc_link_bc_sync_rcv(l, hdr, &xmitq);
+ glen = tipc_get_gap_ack_blks(&ga, l, hdr, false);
+ if (glen > msg_data_sz(hdr)) {
+ /* Malformed Gap ACK blocks; caller drops the msg */
+ *valid = false;
+ } else {
+ if (!sysctl_tipc_bc_retruni)
+ retrq = &xmitq;
+ rc = tipc_link_bc_ack_rcv(l, msg_bcast_ack(hdr),
+ msg_bc_gap(hdr), ga, &xmitq,
+ retrq);
+ rc |= tipc_link_bc_sync_rcv(l, hdr, &xmitq);
+ }
}
tipc_bcast_unlock(net);
--- a/net/tipc/bcast.h
+++ b/net/tipc/bcast.h
@@ -97,7 +97,7 @@ void tipc_bcast_ack_rcv(struct net *net,
struct tipc_msg *hdr);
int tipc_bcast_sync_rcv(struct net *net, struct tipc_link *l,
struct tipc_msg *hdr,
- struct sk_buff_head *retrq);
+ struct sk_buff_head *retrq, bool *valid);
int tipc_nl_add_bc_link(struct net *net, struct tipc_nl_msg *msg,
struct tipc_link *bcl);
int tipc_nl_bc_link_set(struct net *net, struct nlattr *attrs[]);
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1804,12 +1804,15 @@ static void tipc_node_mcast_rcv(struct t
}
static void tipc_node_bc_sync_rcv(struct tipc_node *n, struct tipc_msg *hdr,
- int bearer_id, struct sk_buff_head *xmitq)
+ int bearer_id, struct sk_buff_head *xmitq,
+ bool *valid)
{
struct tipc_link *ucl;
int rc;
- rc = tipc_bcast_sync_rcv(n->net, n->bc_entry.link, hdr, xmitq);
+ rc = tipc_bcast_sync_rcv(n->net, n->bc_entry.link, hdr, xmitq, valid);
+ if (!*valid)
+ return;
if (rc & TIPC_LINK_DOWN_EVT) {
tipc_node_reset_links(n);
@@ -2111,12 +2114,18 @@ rcv:
/* Ensure broadcast reception is in synch with peer's send state */
if (unlikely(usr == LINK_PROTOCOL)) {
+ bool valid = true;
+
if (unlikely(skb_linearize(skb))) {
tipc_node_put(n);
goto discard;
}
hdr = buf_msg(skb);
- tipc_node_bc_sync_rcv(n, hdr, bearer_id, &xmitq);
+ tipc_node_bc_sync_rcv(n, hdr, bearer_id, &xmitq, &valid);
+ if (!valid) {
+ tipc_node_put(n);
+ goto discard;
+ }
} else if (unlikely(tipc_link_acked(n->bc_entry.link) != bc_ack)) {
tipc_bcast_ack_rcv(net, n->bc_entry.link, hdr);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 071/699] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 070/699] tipc: fix out-of-bounds read in broadcast Gap ACK blocks Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 072/699] crypto: amlogic - avoid double cleanup in meson_crypto_probe() Greg Kroah-Hartman
` (631 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Hans Verkuil
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit c32fe4c4918c9aa49f61359e3b42619c4d8686de upstream.
If the driver's stripe information is invalid it can result in an integer
underflow. Add a range check to avoid this kind of error.
This patch fixes the following smatch error:
drivers/staging/media/ipu3/ipu3-css-params.c:1792 imgu_css_cfg_acc_stripe() warn: 'acc->stripe.bds_out_stripes[0]->width - 2 * f' 4294967168 can't fit into 65535 'acc->stripe.bds_out_stripes[1]->offset'
Cc: stable@vger.kernel.org
Fixes: e11110a5b744 ("media: staging/intel-ipu3: css: Compute and program ccs")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/ipu3/ipu3-css-params.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/staging/media/ipu3/ipu3-css-params.c
+++ b/drivers/staging/media/ipu3/ipu3-css-params.c
@@ -1773,6 +1773,8 @@ static int imgu_css_cfg_acc_stripe(struc
acc->stripe.bds_out_stripes[0].width =
ALIGN(css_pipe->rect[IPU3_CSS_RECT_BDS].width, f);
} else {
+ u32 offset;
+
/* Image processing is divided into two stripes */
acc->stripe.bds_out_stripes[0].width =
acc->stripe.bds_out_stripes[1].width =
@@ -1791,8 +1793,10 @@ static int imgu_css_cfg_acc_stripe(struc
acc->stripe.bds_out_stripes[1].width += f;
}
/* Overlap between stripes is IPU3_UAPI_ISP_VEC_ELEMS * 4 */
- acc->stripe.bds_out_stripes[1].offset =
- acc->stripe.bds_out_stripes[0].width - 2 * f;
+ offset = acc->stripe.bds_out_stripes[0].width - 2 * f;
+ if (offset > 65535)
+ return -EINVAL;
+ acc->stripe.bds_out_stripes[1].offset = offset;
}
acc->stripe.effective_stripes[0].height =
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 072/699] crypto: amlogic - avoid double cleanup in meson_crypto_probe()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 071/699] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 073/699] net: af_key: initialize alg_key_len for IPComp states Greg Kroah-Hartman
` (630 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zilin Guan, Dawei Feng, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit 6d827ade51a24e18d81afb9f32756d339520a14c upstream.
When meson_allocate_chanlist() fails after a partial allocation, it already
unwinds the allocated chanlist state through its local error path.
meson_crypto_probe() then jump to error_flow and calls
meson_free_chanlist() again, causing the same per-flow resources to be torn
down twice. In the reproduced failure path, the second teardown
re-entered crypto_engine_exit() on an already destroyed worker and KASAN
reported a slab-use-after-free in kthread_destroy_worker().
Prevent double-free by handling partial allocation failures locally within
meson_allocate_chanlist() and skipping the outer cleanup path.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available.
The bug was reproduced in a QEMU x86_64 guest booted with KASAN on v7.1,
using the reproducer under tools/testing/meson_crypto_probe. The reproducer
forces the second dma_alloc_attrs() call in the gxl-crypto probe path to
return NULL, making meson_allocate_chanlist() fail after partial
initialization. On the unpatched kernel this reliably triggered a
slab-use-after-free. With this fix applied, the same reproducer no longer
emits any KASAN report and the probe fails cleanly with -ENOMEM.
==================================================================
BUG: KASAN: slab-use-after-free in kthread_destroy_worker+0xb2/0xd0
Read of size 8 at addr ff1100010c057a68 by task insmod/265
CPU: 1 UID: 0 PID: 265 Comm: insmod Tainted: G O 7.1.0-rc2-00376-g810af9adc907-dirty #10 PREEMPT(lazy)
Tainted: [O]=OOT_MODULE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x68/0xa0
print_report+0xcb/0x5e0
? __virt_addr_valid+0x21d/0x3f0
? kthread_destroy_worker+0xb2/0xd0
? kthread_destroy_worker+0xb2/0xd0
kasan_report+0xca/0x100
? kthread_destroy_worker+0xb2/0xd0
kthread_destroy_worker+0xb2/0xd0
meson_crypto_probe+0x4d0/0xc10 [amlogic_gxl_crypto]
platform_probe+0x99/0x140
really_probe+0x1c6/0x6a0
? __pfx___device_attach_driver+0x10/0x10
__driver_probe_device+0x248/0x310
? acpi_driver_match_device+0xb0/0x100
driver_probe_device+0x48/0x210
? __pfx___device_attach_driver+0x10/0x10
__device_attach_driver+0x160/0x320
bus_for_each_drv+0x104/0x190
? __pfx_bus_for_each_drv+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
__device_attach+0x19d/0x3b0
? __pfx___device_attach+0x10/0x10
? do_raw_spin_unlock+0x53/0x220
device_initial_probe+0x78/0xa0
bus_probe_device+0x5b/0x130
device_add+0xcfd/0x1430
? __pfx_device_add+0x10/0x10
? insert_resource+0x34/0x50
? lock_release+0xc9/0x290
platform_device_add+0x24e/0x590
? __pfx_meson_crypto_probe_repro_init+0x10/0x10 [meson_crypto_probe_repro]
meson_crypto_probe_repro_init+0x330/0xff0 [meson_crypto_probe_repro]
do_one_initcall+0xc0/0x450
? __pfx_do_one_initcall+0x10/0x10
? _raw_spin_unlock_irqrestore+0x2c/0x50
? __create_object+0x59/0x80
? kasan_unpoison+0x27/0x60
do_init_module+0x27b/0x7d0
? __pfx_do_init_module+0x10/0x10
? kasan_quarantine_put+0x84/0x1d0
? kfree+0x32c/0x510
? load_module+0x561e/0x5ff0
load_module+0x54fe/0x5ff0
? __pfx_load_module+0x10/0x10
? security_file_permission+0x20/0x40
? kernel_read_file+0x23d/0x6e0
? mmap_region+0x235/0x4a0
? __pfx_kernel_read_file+0x10/0x10
? __file_has_perm+0x2c0/0x3e0
init_module_from_file+0x158/0x180
? __pfx_init_module_from_file+0x10/0x10
? __lock_acquire+0x45a/0x1ba0
? idempotent_init_module+0x315/0x610
? lock_release+0xc9/0x290
? lockdep_init_map_type+0x4b/0x220
? do_raw_spin_unlock+0x53/0x220
idempotent_init_module+0x330/0x610
? __pfx_idempotent_init_module+0x10/0x10
? __pfx_cred_has_capability.isra.0+0x10/0x10
? ksys_mmap_pgoff+0x385/0x520
__x64_sys_finit_module+0xbe/0x120
do_syscall_64+0x115/0x690
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7d6d31690d
Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f3 b4 0f 00 f7 d8 >
RSP: 002b:00007fffc027ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000055f7b81967c0 RCX: 00007f7d6d31690d
RDX: 0000000000000000 RSI: 000055f79a0d6cd2 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 000055f79a0d6cd2
R13: 000055f7b8196790 R14: 000055f79a0d5888 R15: 000055f7b81968e0
</TASK>
Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL")
Cc: stable@vger.kernel.org
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/amlogic/amlogic-gxl-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/amlogic/amlogic-gxl-core.c
+++ b/drivers/crypto/amlogic/amlogic-gxl-core.c
@@ -275,8 +275,8 @@ static int meson_crypto_probe(struct pla
return 0;
error_alg:
meson_unregister_algs(mc);
-error_flow:
meson_free_chanlist(mc, MAXFLOW - 1);
+error_flow:
clk_disable_unprepare(mc->busclk);
return err;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 073/699] net: af_key: initialize alg_key_len for IPComp states
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 072/699] crypto: amlogic - avoid double cleanup in meson_crypto_probe() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 074/699] audit: Fix data races of skb_queue_len() readers on audit_queue Greg Kroah-Hartman
` (629 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijing Yin, Sabrina Dubroca,
Steffen Klassert
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijing Yin <yzjaurora@gmail.com>
commit d129c3177d7b1138fd5066fcc63a698b3ba415b0 upstream.
pfkey_msg2xfrm_state() handles the IPComp (SADB_X_SATYPE_IPCOMP) case by
allocating x->calg and copying only the algorithm name:
x->calg = kmalloc_obj(*x->calg);
if (!x->calg) {
err = -ENOMEM;
goto out;
}
strcpy(x->calg->alg_name, a->name);
x->props.calgo = sa->sadb_sa_encrypt;
Unlike the authentication (x->aalg) and encryption (x->ealg) branches of
the same function, the compression branch never initializes
calg->alg_key_len. IPComp carries no key and the allocation only
reserves sizeof(struct xfrm_algo) (i.e. no room for a key), so the field
is left containing uninitialized slab data.
calg->alg_key_len is later used as a length by xfrm_algo_clone() when an
IPComp state is cloned during XFRM_MSG_MIGRATE:
xfrm_state_migrate()
xfrm_state_clone_and_setup()
x->calg = xfrm_algo_clone(orig->calg);
kmemdup(orig, xfrm_alg_len(orig));
where xfrm_alg_len() returns sizeof(*alg) + (alg_key_len + 7) / 8. With
a non-zero garbage alg_key_len, kmemdup() reads past the end of the
68-byte calg object. Adding an IPComp SA via PF_KEY and then migrating
it triggers (net-next, KASAN, init_on_alloc=0):
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x44/0x60
Read of size 4164 at addr ff11000025a74980 by task diag2/9287
CPU: 3 UID: 0 PID: 9287 Comm: diag2 7.1.0-rc6-g903db046d557 #1
Call Trace:
<TASK>
dump_stack_lvl+0x10e/0x1f0
print_report+0xf7/0x600
kasan_report+0xe4/0x120
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x23/0x60
kmemdup_noprof+0x44/0x60
xfrm_state_migrate+0x70a/0x1da0
xfrm_migrate+0x753/0x18a0
xfrm_do_migrate+0xb47/0xf10
xfrm_user_rcv_msg+0x411/0xb50
netlink_rcv_skb+0x158/0x420
xfrm_netlink_rcv+0x71/0x90
netlink_unicast+0x584/0x850
netlink_sendmsg+0x8b0/0xdc0
____sys_sendmsg+0x9f7/0xb90
___sys_sendmsg+0x134/0x1d0
__sys_sendmsg+0x16d/0x220
do_syscall_64+0x116/0x7d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 9287:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
pfkey_add+0x2652/0x2ea0
pfkey_process+0x6d0/0x830
pfkey_sendmsg+0x42c/0x850
__sys_sendto+0x461/0x4b0
__x64_sys_sendto+0xe0/0x1c0
do_syscall_64+0x116/0x7d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ff11000025a74980
which belongs to the cache kmalloc-96 of size 96
The buggy address is located 0 bytes inside of
allocated 68-byte region [ff11000025a74980, ff11000025a749c4)
Depending on the uninitialized value the same field can instead request
an oversized kmemdup() allocation and make the migration clone fail.
The XFRM netlink path is not affected: verify_one_alg() rejects an
XFRMA_ALG_COMP attribute shorter than xfrm_alg_len(), so a calg added via
XFRM_MSG_NEWSA is always self-consistent.
Initialize calg->alg_key_len to 0, matching the aalg/ealg branches.
Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Cc: stable@vger.kernel.org
Signed-off-by: Zijing Yin <yzjaurora@gmail.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/key/af_key.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1206,6 +1206,7 @@ static struct xfrm_state * pfkey_msg2xfr
goto out;
}
strcpy(x->calg->alg_name, a->name);
+ x->calg->alg_key_len = 0;
x->props.calgo = sa->sadb_sa_encrypt;
} else {
int keysize = 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 074/699] audit: Fix data races of skb_queue_len() readers on audit_queue
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 073/699] net: af_key: initialize alg_key_len for IPComp states Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 075/699] debugobjects: Plug race against a concurrent OOM disable Greg Kroah-Hartman
` (628 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Wang, Ricardo Robaina,
Paul Moore
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Wang <wangchi@kylinos.cn>
commit c9a71daaecb2fb1d8c704545cc0b1c920b9bf5d7 upstream.
Multiple readers access audit_queue.qlen via skb_queue_len() without
holding the queue lock or using READ_ONCE(), while kauditd writes to
this field via the skb_dequeue() → __skb_unlink() path with WRITE_ONCE()
protected by a spinlock. This constitutes data races.
All affected skb_queue_len(&audit_queue) call sites:
- kauditd_thread() wait_event_freezable() condition
- audit_receive_msg() AUDIT_GET handler (s.backlog assignment)
- audit_receive() backlog check
- audit_log_start() backlog check and pr_warn()
KCSAN reports the following conflicting access pattern (one example):
==================================================================
BUG: KCSAN: data-race in audit_log_start / skb_dequeue
write (marked) to 0xffffffff8512ee20 of 4 bytes by task 661 on cpu 57:
skb_dequeue+0x70/0xf0
kauditd_send_queue+0x71/0x220
kauditd_thread+0x1cb/0x430
kthread+0x1c2/0x210
ret_from_fork+0x162/0x1a0
ret_from_fork_asm+0x1a/0x30
read to 0xffffffff8512ee20 of 4 bytes by task 36586 on cpu 1:
audit_log_start+0x2a0/0x6b0
audit_core_dumps+0x64/0xa0
do_coredump+0x14b/0x1260
get_signal+0xeb2/0xf70
arch_do_signal_or_restart+0x41/0x170
exit_to_user_mode_loop+0xa2/0x1c0
do_syscall_64+0x1a3/0x1c0
entry_SYSCALL_64_after_hwframe+0x76/0xe0
value changed: 0x00000001 -> 0x00000000
==================================================================
Resolve the race by switching to lockless helper skb_queue_len_lockless(),
which internally uses READ_ONCE() and properly pairs with the WRITE_ONCE()
write accesses already present on the writer side.
Cc: stable@vger.kernel.org
Fixes: 3197542482df ("audit: rework audit_log_start()")
Signed-off-by: Chi Wang <wangchi@kylinos.cn>
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
[PM: line length tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/audit.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -912,7 +912,7 @@ main_queue:
* do the multicast send and rotate records from the
* main queue to the retry/hold queues */
wait_event_freezable(kauditd_wait,
- (skb_queue_len(&audit_queue) ? 1 : 0));
+ (skb_queue_len_lockless(&audit_queue) ? 1 : 0));
}
return 0;
@@ -1247,7 +1247,7 @@ static int audit_receive_msg(struct sk_b
s.rate_limit = audit_rate_limit;
s.backlog_limit = audit_backlog_limit;
s.lost = atomic_read(&audit_lost);
- s.backlog = skb_queue_len(&audit_queue);
+ s.backlog = skb_queue_len_lockless(&audit_queue);
s.feature_bitmap = AUDIT_FEATURE_BITMAP_ALL;
s.backlog_wait_time = audit_backlog_wait_time;
s.backlog_wait_time_actual = atomic_read(&audit_backlog_wait_time_actual);
@@ -1588,7 +1588,7 @@ static void audit_receive(struct sk_buff
/* can't block with the ctrl lock, so penalize the sender now */
if (audit_backlog_limit &&
- (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+ (skb_queue_len_lockless(&audit_queue) > audit_backlog_limit)) {
DECLARE_WAITQUEUE(wait, current);
/* wake kauditd to try and flush the queue */
@@ -1890,7 +1890,7 @@ struct audit_buffer *audit_log_start(str
long stime = audit_backlog_wait_time;
while (audit_backlog_limit &&
- (skb_queue_len(&audit_queue) > audit_backlog_limit)) {
+ (skb_queue_len_lockless(&audit_queue) > audit_backlog_limit)) {
/* wake kauditd to try and flush the queue */
wake_up_interruptible(&kauditd_wait);
@@ -1910,7 +1910,7 @@ struct audit_buffer *audit_log_start(str
} else {
if (audit_rate_check() && printk_ratelimit())
pr_warn("audit_backlog=%d > audit_backlog_limit=%d\n",
- skb_queue_len(&audit_queue),
+ skb_queue_len_lockless(&audit_queue),
audit_backlog_limit);
audit_log_lost("backlog limit exceeded");
return NULL;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 075/699] debugobjects: Plug race against a concurrent OOM disable
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 074/699] audit: Fix data races of skb_queue_len() readers on audit_queue Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 076/699] gpio: eic-sprd: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
` (627 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5e8dda76ca21dae314b6,
Thomas Gleixner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@kernel.org>
commit b81dde13cc163450dcb402dcc915ef13ba241e01 upstream.
syzbot reported a puzzling splat:
WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20
stub_timer() is installed as timer callback function in
hrtimer_fixup_assert_init(), which is invoked when
debug_object_assert_init() can't find a shadow object. In that case debug
objects emits a warning about it before invoking the fixup.
Though the provided console log lacks this warning and instead has the
following a few seconds before the splat:
ODEBUG: Out of memory. ODEBUG disabled
So the object was looked up in debug_object_assert_init() and the lookup
failed due a concurrent out of memory situation which disabled debug
objects and freed the shadow objects:
debug_object_assert_init()
if (!debug_objects_enabled)
return; obj = alloc();
if (!obj) {
// Out of memory
debug_objects_enabled = false;
free_objects();
obj = lookup_or_alloc();
// The lookup failed because the other side
// removed the objects, so this returns
// an error code as the object in question
// is not statically initialized
if (!IS_ERR_OR_NULL(obj))
return;
if (!obj) {
debug_oom();
return;
}
print(...)
if (!debug_objects_enabled)
return;
fixup(...)
The debug object splat is skipped because debug_objects_enabled is false,
but the fixup callback is invoked unconditionally, which makes the timer
disfunctional.
This is only a problem in debug_object_assert_init() and
debug_object_activate() as both have to handle statically initialized
objects and therefore must handle the error pointer return case
gracefully. All other places only handle the found/not found case and the
NULL pointer return is a signal for OOM. Otherwise they get a valid shadow
object.
Plug the hole by checking whether debug objects are still enabled before
invoking the print and fixup function in those two places.
Fixes: b84d435cc228 ("debugobjects: Extend to assert that an object is initialized")
Reported-by: syzbot+5e8dda76ca21dae314b6@syzkaller.appspotmail.com
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/874iiwlzlb.ffs@fw13
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/debugobjects.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -722,6 +722,14 @@ int debug_object_activate(void *addr, co
}
raw_spin_unlock_irqrestore(&db->lock, flags);
+
+ /*
+ * lookup_object_or_alloc() might have raced with a concurrent
+ * allocation failure which disabled debug objects.
+ */
+ if (!debug_objects_enabled)
+ return 0;
+
debug_print_object(&o, "activate");
switch (o.state) {
@@ -899,6 +907,15 @@ void debug_object_assert_init(void *addr
return;
}
+ /*
+ * lookup_object_or_alloc() might have raced with a concurrent
+ * allocation failure which disabled debug objects. Don't run the fixup
+ * as it might turn a valid object useless. See for example
+ * hrtimer_fixup_assert_init().
+ */
+ if (!debug_objects_enabled)
+ return;
+
/* Object is neither tracked nor static. It's not initialized. */
debug_print_object(&o, "assert_init");
debug_object_fixup(descr->fixup_assert_init, addr, ODEBUG_STATE_NOTAVAILABLE);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 076/699] gpio: eic-sprd: use raw_spinlock_t in the irq startup path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 075/699] debugobjects: Plug race against a concurrent OOM disable Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 077/699] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Greg Kroah-Hartman
` (626 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao,
Sebastian Andrzej Siewior, Bartosz Golaszewski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 90f0109019e6817eb40a486671b7722d1544ae29 upstream.
sprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller
state through sprd_eic_update(), which takes sprd_eic->lock with
spin_lock_irqsave(). The callback can be reached from irq_startup()
while setting up a requested IRQ. That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sprd_eic_irq_unmask() -> sprd_eic_update() carrier and
used the original spin_lock_irqsave(&sprd_eic->lock) edge. Lockdep
reported:
BUG: sleeping function called from invalid context
hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
sprd_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
sprd_eic_update.constprop.0+0x48/0x90 [vuln_msv]
sprd_eic_irq_unmask.constprop.0+0x35/0x50 [vuln_msv]
__setup_irq.constprop.0+0xd/0x30 [vuln_msv]
Convert the Spreadtrum EIC controller lock to raw_spinlock_t. The
locked section only serializes MMIO register updates and does not contain
sleepable operations, so keeping it non-sleeping is appropriate for the
irqchip callbacks.
Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260617154035.1199948-3-runyu.xiao@seu.edu.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-eic-sprd.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpio/gpio-eic-sprd.c
+++ b/drivers/gpio/gpio-eic-sprd.c
@@ -94,7 +94,7 @@ struct sprd_eic {
struct irq_chip intc;
void __iomem *base[SPRD_EIC_MAX_BANK];
enum sprd_eic_type type;
- spinlock_t lock;
+ raw_spinlock_t lock;
int irq;
};
@@ -146,7 +146,7 @@ static void sprd_eic_update(struct gpio_
unsigned long flags;
u32 tmp;
- spin_lock_irqsave(&sprd_eic->lock, flags);
+ raw_spin_lock_irqsave(&sprd_eic->lock, flags);
tmp = readl_relaxed(base + reg);
if (val)
@@ -155,7 +155,7 @@ static void sprd_eic_update(struct gpio_
tmp &= ~BIT(SPRD_EIC_BIT(offset));
writel_relaxed(tmp, base + reg);
- spin_unlock_irqrestore(&sprd_eic->lock, flags);
+ raw_spin_unlock_irqrestore(&sprd_eic->lock, flags);
}
static int sprd_eic_read(struct gpio_chip *chip, unsigned int offset, u16 reg)
@@ -606,7 +606,7 @@ static int sprd_eic_probe(struct platfor
if (!sprd_eic)
return -ENOMEM;
- spin_lock_init(&sprd_eic->lock);
+ raw_spin_lock_init(&sprd_eic->lock);
sprd_eic->type = pdata->type;
sprd_eic->irq = platform_get_irq(pdev, 0);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 077/699] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 076/699] gpio: eic-sprd: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 078/699] ipv4: igmp: remove multicast group from hash table on device destruction Greg Kroah-Hartman
` (625 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 29bef9934b2521f787bb15dd1985d4c0d12ae02a upstream.
commit 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work
run loop") fixed the obvious case where io_worker_handle_work() took one
exit-bit snapshot before draining pending work, but the fix stops one
level too early.
io_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work
run loop, yet it still snapshots that bit once before processing a whole
dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT
after the first linked item has started, the remaining linked items can
still reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue
running after exit has begun.
Move the check further inside, so it covers linked items too. Note: this
is a syzbot special as it loves setting up tons of slow linked work on
weird devices like msr that take forever to read, and immediately close
the ring. Exit then takes a long time.
Fixes: 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260527172203.2043962-1-runyu.xiao@seu.edu.cn
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io-wq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -556,7 +556,6 @@ static void io_worker_handle_work(struct
struct io_wq *wq = wqe->wq;
do {
- bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
struct io_wq_work *work;
get_next:
/*
@@ -578,6 +577,7 @@ get_next:
/* handle a whole dependent link */
do {
+ bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
struct io_wq_work *next_hashed, *linked;
unsigned int hash = io_get_work_hash(work);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 078/699] ipv4: igmp: remove multicast group from hash table on device destruction
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 077/699] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 079/699] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Greg Kroah-Hartman
` (624 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuyang Huang, Kuniyuki Iwashima,
Ido Schimmel, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuyang Huang <yuyanghuang@google.com>
commit 7993211bde166471dffac074dc965489f86531f8 upstream.
When a device is destroyed under RTNL, ip_mc_destroy_dev() iterates through
the multicast list and calls ip_ma_put() on each membership, scheduling
them for RCU reclamation. However, they are not unlinked from the device's
multicast hash table (mc_hash).
Since the device remains published in dev->ip_ptr until after
ip_mc_destroy_dev() completes, concurrent RCU readers traversing mc_hash
can still locate and access the multicast group after its refcount is
decremented. If the RCU callback runs and frees the group while a reader is
accessing it, a use-after-free occurs.
Fix this by unlinking the multicast group from mc_hash using
ip_mc_hash_remove() before scheduling it for reclamation.
BUG: KASAN: slab-use-after-free in ip_check_mc_rcu+0x149/0x3f0
Read of size 4 at addr ffff888009bf1408 by task mausezahn/2276
Call Trace:
<IRQ>
dump_stack_lvl+0x67/0x90
print_report+0x175/0x7c0
kasan_report+0x147/0x180
ip_check_mc_rcu+0x149/0x3f0
udp_v4_early_demux+0x36d/0x12d0
ip_rcv_finish_core+0xb8b/0x1390
ip_rcv_finish+0x54/0x120
NF_HOOK+0x213/0x2b0
__netif_receive_skb+0x126/0x340
process_backlog+0x4f2/0xf00
__napi_poll+0x92/0x2c0
net_rx_action+0x583/0xc60
handle_softirqs+0x236/0x7f0
do_softirq+0x57/0x80
</IRQ>
Allocated by task 2239:
kasan_save_track+0x3e/0x80
__kasan_kmalloc+0x72/0x90
____ip_mc_inc_group+0x31a/0xa40
__ip_mc_join_group+0x334/0x3f0
do_ip_setsockopt+0x16fa/0x2010
ip_setsockopt+0x3f/0x90
do_sock_setsockopt+0x1ad/0x300
Freed by task 0:
kasan_save_track+0x3e/0x80
kasan_save_free_info+0x40/0x50
__kasan_slab_free+0x3a/0x60
__rcu_free_sheaf_prepare+0xd4/0x220
rcu_free_sheaf+0x36/0x190
rcu_core+0x8d9/0x12f0
handle_softirqs+0x236/0x7f0
Fixes: e9897071350b ("igmp: hash a hash table to speedup ip_check_mc_rcu()")
Cc: stable@vger.kernel.org
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260701235014.73505-1-yuyanghuang@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/igmp.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1816,6 +1816,7 @@ void ip_mc_destroy_dev(struct in_device
#endif
while ((i = rtnl_dereference(in_dev->mc_list)) != NULL) {
+ ip_mc_hash_remove(in_dev, i);
in_dev->mc_list = i->next_rcu;
in_dev->mc_count--;
ip_mc_clear_src(i);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 079/699] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 078/699] ipv4: igmp: remove multicast group from hash table on device destruction Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 080/699] mfd: cros_ec: Delay dev_set_drvdata() until probe success Greg Kroah-Hartman
` (623 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Zhengchuan Liang, Xin Liu,
Eric Dumazet, Wyatt Feng, Ren Wei, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
commit efb8763d7bbb40cff4cc55a6b62c3095a038149c upstream.
Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP
socket state. The sysctl is stored as an `int` but copied into the
`u32` `tp->reordering` field for new sockets, so negative writes wrap
to large values.
With `tcp_mtu_probing=2`, the wrapped value can overflow the
`tcp_mtu_probe()` size calculation and drive the MTU probing path into
an out-of-bounds read. Route `tcp_reordering` writes through
`proc_dointvec_minmax()` and require it to be at least 1. Also require
`tcp_max_reordering` to be at least 1 so the configured maximum cannot
become negative either.
When registering the table for a non-init network namespace, relocate
`extra2` pointers that refer into `init_net.ipv4` so the
`tcp_reordering` upper bound follows that namespace's
`tcp_max_reordering`.
Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`.
This keeps the send queue and window checks from being bypassed through
signed integer overflow.
Fixes: 91cc17c0e5e5 ("[TCP]: MTUprobe: receiver window & data available checks fixed")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/1a5b7e1ef4d70fbad8c8ee0b82d8405f3c964a3d.1781395200.git.bronzed_45_vested@icloud.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/sysctl_net_ipv4.c | 10 ++++++++--
net/ipv4/tcp_output.c | 4 ++--
2 files changed, 10 insertions(+), 4 deletions(-)
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -892,7 +892,9 @@ static struct ctl_table ipv4_net_table[]
.data = &init_net.ipv4.sysctl_tcp_reordering,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ONE,
+ .extra2 = &init_net.ipv4.sysctl_tcp_max_reordering,
},
{
.procname = "tcp_retries1",
@@ -1109,7 +1111,8 @@ static struct ctl_table ipv4_net_table[]
.data = &init_net.ipv4.sysctl_tcp_max_reordering,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ONE,
},
{
.procname = "tcp_dsack",
@@ -1336,6 +1339,9 @@ static __net_init int ipv4_sysctl_init_n
*/
table[i].mode &= ~0222;
}
+ if (table[i].extra2 >= (void *)&init_net.ipv4 &&
+ table[i].extra2 < (void *)(&init_net.ipv4 + 1))
+ table[i].extra2 += (void *)net - (void *)&init_net;
}
}
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2343,7 +2343,7 @@ static int tcp_mtu_probe(struct sock *sk
struct sk_buff *skb, *nskb, *next;
struct net *net = sock_net(sk);
int probe_size;
- int size_needed;
+ u64 size_needed;
int copy, len;
int mss_now;
int interval;
@@ -2367,7 +2367,7 @@ static int tcp_mtu_probe(struct sock *sk
mss_now = tcp_current_mss(sk);
probe_size = tcp_mtu_to_mss(sk, (icsk->icsk_mtup.search_high +
icsk->icsk_mtup.search_low) >> 1);
- size_needed = probe_size + (tp->reordering + 1) * tp->mss_cache;
+ size_needed = probe_size + (tp->reordering + 1) * (u64)tp->mss_cache;
interval = icsk->icsk_mtup.search_high - icsk->icsk_mtup.search_low;
/* When misfortune happens, we are reprobing actively,
* and then reprobe timer has expired. We stick with current
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 080/699] mfd: cros_ec: Delay dev_set_drvdata() until probe success
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 079/699] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 081/699] netfilter: ebtables: module names must be null-terminated Greg Kroah-Hartman
` (622 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Andrei Kuchynski,
Benson Leung, Lee Jones
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <akuchynski@chromium.org>
commit 8b2c1d41bc36c100b38ce5ee6def246c527eaf8a upstream.
If ec_device_probe() fails, cros_ec_class_release releases memory for the
cros_ec_dev structure. However, because the drvdata was already set,
sub-drivers like cros_ec_typec can still retrieve the stale pointer via the
platform device. This leads to a use-after-free when cros_ec_typec attempts
to access &typec->ec->ec->dev on a device that has already been released.
Move dev_set_drvdata() to ensure that the pointer is only made available
once all initialization steps have succeeded.
sysfs: cannot create duplicate filename '/class/chromeos/cros_ec'
Call trace:
sysfs_do_create_link_sd+0x94/0xdc
sysfs_create_link+0x30/0x44
device_add_class_symlinks+0x90/0x13c
device_add+0xf0/0x50c
ec_device_probe+0x150/0x4f0
platform_probe+0xa0/0xe0
...
BUG: KASAN: invalid-access in __memcpy+0x44/0x230
Write at addr f5ffff809e2d33ac by task kworker/u32:5/125
Pointer tag: [f5], memory tag: [fe]
Tainted : [W]=WARN, [O]=OOT_MODULE
Hardware name: Google Navi unprovisioned 0x7FFFFFFF/sku0 board/sku3
Workqueue: events_unbound deferred_probe_work_func
Call trace:
__memcpy+0x44/0x230
cros_ec_check_features+0x60/0xcc [cros_ec_proto]
cros_typec_probe+0xe8/0x6e0 [cros_ec_typec]
platform_probe+0xa0/0xe0
Cc: stable@vger.kernel.org
Fixes: 1c1d152cc5ac ("platform/chrome: cros_ec_dev - utilize new cdev_device_add helper function")
Co-developed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Link: https://patch.msgid.link/20260427131721.1165078-1-akuchynski@chromium.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/cros_ec_dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/mfd/cros_ec_dev.c
+++ b/drivers/mfd/cros_ec_dev.c
@@ -137,7 +137,6 @@ static int ec_device_probe(struct platfo
if (!ec)
return retval;
- dev_set_drvdata(dev, ec);
ec->ec_dev = dev_get_drvdata(dev->parent);
ec->dev = dev;
ec->cmd_offset = ec_platform->cmd_offset;
@@ -179,6 +178,8 @@ static int ec_device_probe(struct platfo
if (retval)
goto failed;
+ dev_set_drvdata(dev, ec);
+
/* check whether this EC is a sensor hub. */
if (cros_ec_get_sensor_count(ec) > 0) {
retval = mfd_add_hotplug_devices(ec->dev,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 081/699] netfilter: ebtables: module names must be null-terminated
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 080/699] mfd: cros_ec: Delay dev_set_drvdata() until probe success Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 082/699] netfilter: ebtables: terminate table name before find_table_lock() Greg Kroah-Hartman
` (621 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 084d23f818321390509e9738a0b08bbf46df6425 upstream.
We need to explicitly check the length, else we may pass non-null
terminated string to request_module().
Cc: stable@vger.kernel.org
Fixes: bcf493428840 ("netfilter: ebtables: Fix extension lookup with identical name")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -363,6 +363,9 @@ ebt_check_match(struct ebt_entry_match *
left - sizeof(struct ebt_entry_match) < m->match_size)
return -EINVAL;
+ if (strnlen(m->u.name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
+ return -EINVAL;
+
match = xt_find_match(NFPROTO_BRIDGE, m->u.name, m->u.revision);
if (IS_ERR(match) || match->family != NFPROTO_BRIDGE) {
if (!IS_ERR(match))
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 082/699] netfilter: ebtables: terminate table name before find_table_lock()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 081/699] netfilter: ebtables: module names must be null-terminated Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 083/699] Bluetooth: bnep: pin L2CAP connection during netdev registration Greg Kroah-Hartman
` (620 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit a622d2e9608c9dff47fc2e5759ac7aa3a836b45d upstream.
update_counters() and compat_update_counters() forward a user-supplied
32-byte table name to find_table_lock() without NUL-terminating it. On a
lookup miss, find_inlist_lock() calls try_then_request_module(..., "%s%s",
"ebtable_", name), and vsnprintf() reads past the name field and the
stack object until it hits a zero byte.
BUG: KASAN: stack-out-of-bounds in string (lib/vsprintf.c:648 lib/vsprintf.c:730)
Read of size 1 at addr ffff8880119dfb20 by task exploit/147
Call Trace:
...
string (lib/vsprintf.c:648 lib/vsprintf.c:730)
vsnprintf (lib/vsprintf.c:2945)
__request_module (kernel/module/kmod.c:150)
do_update_counters.isra.0 (net/bridge/netfilter/ebtables.c:371 net/bridge/netfilter/ebtables.c:380)
update_counters (net/bridge/netfilter/ebtables.c:1440)
do_ebt_set_ctl (net/bridge/netfilter/ebtables.c:2573)
nf_setsockopt (net/netfilter/nf_sockopt.c:101)
ip_setsockopt (net/ipv4/ip_sockglue.c:1424)
raw_setsockopt (net/ipv4/raw.c:847)
__sys_setsockopt (net/socket.c:2393)
...
compat_do_replace() shares the same unterminated name via
compat_copy_ebt_replace_from_user(); terminate it there too so all
find_table_lock() callers behave alike. The other callers already
terminate the name after the copy.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1319,6 +1319,8 @@ static int update_counters(struct net *n
if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
return -EFAULT;
+ hlp.name[sizeof(hlp.name) - 1] = '\0';
+
if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
return -EINVAL;
@@ -2158,6 +2160,8 @@ static int compat_copy_ebt_replace_from_
memcpy(repl, &tmp, offsetof(struct ebt_replace, hook_entry));
+ repl->name[sizeof(repl->name) - 1] = '\0';
+
/* starting with hook_entry, 32 vs. 64 bit structures are different */
for (i = 0; i < NF_BR_NUMHOOKS; i++)
repl->hook_entry[i] = compat_ptr(tmp.hook_entry[i]);
@@ -2280,6 +2284,8 @@ static int compat_update_counters(struct
if (copy_from_sockptr(&hlp, arg, sizeof(hlp)))
return -EFAULT;
+ hlp.name[sizeof(hlp.name) - 1] = '\0';
+
/* try real handler in case userland supplied needed padding */
if (len != sizeof(hlp) + hlp.num_counters * sizeof(struct ebt_counter))
return update_counters(net, arg, len);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 083/699] Bluetooth: bnep: pin L2CAP connection during netdev registration
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 082/699] netfilter: ebtables: terminate table name before find_table_lock() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 084/699] Bluetooth: fix UAF in bt_accept_dequeue() Greg Kroah-Hartman
` (619 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+fed5dce4553262f3b35c,
Yousef Alhouseen, Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit bb067a99a0356196c0b89a95721985485ebce5a5 upstream.
bnep_add_connection() reads the L2CAP connection without holding the
channel lock, then passes its HCI device to register_netdev(). Controller
teardown can clear and release that connection concurrently, leaving the
network device registration path to dereference a freed parent device.
Take a reference to the L2CAP connection while holding the channel lock.
Retain it until register_netdev() has taken the parent device reference.
Fixes: 65f53e9802db ("Bluetooth: Access BNEP session addresses through L2CAP channel")
Reported-by: syzbot+fed5dce4553262f3b35c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fed5dce4553262f3b35c
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/bnep/core.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -540,14 +540,18 @@ static int bnep_session(void *arg)
return 0;
}
-static struct device *bnep_get_device(struct bnep_session *session)
+static struct l2cap_conn *bnep_get_conn(struct bnep_session *session)
{
- struct l2cap_conn *conn = l2cap_pi(session->sock->sk)->chan->conn;
+ struct l2cap_chan *chan = l2cap_pi(session->sock->sk)->chan;
+ struct l2cap_conn *conn;
- if (!conn || !conn->hcon)
- return NULL;
+ l2cap_chan_lock(chan);
+ conn = chan->conn;
+ if (conn)
+ l2cap_conn_get(conn);
+ l2cap_chan_unlock(chan);
- return &conn->hcon->dev;
+ return conn;
}
static struct device_type bnep_type = {
@@ -559,6 +563,7 @@ int bnep_add_connection(struct bnep_conn
u32 valid_flags = BIT(BNEP_SETUP_RESPONSE);
struct net_device *dev;
struct bnep_session *s, *ss;
+ struct l2cap_conn *conn = NULL;
u8 dst[ETH_ALEN], src[ETH_ALEN];
int err;
@@ -618,10 +623,18 @@ int bnep_add_connection(struct bnep_conn
bnep_set_default_proto_filter(s);
#endif
- SET_NETDEV_DEV(dev, bnep_get_device(s));
+ conn = bnep_get_conn(s);
+ if (!conn) {
+ err = -ENOTCONN;
+ goto failed;
+ }
+
+ SET_NETDEV_DEV(dev, &conn->hcon->dev);
SET_NETDEV_DEVTYPE(dev, &bnep_type);
err = register_netdev(dev);
+ l2cap_conn_put(conn);
+ conn = NULL;
if (err)
goto failed;
@@ -643,6 +656,8 @@ int bnep_add_connection(struct bnep_conn
return 0;
failed:
+ if (conn)
+ l2cap_conn_put(conn);
up_write(&bnep_session_sem);
free_netdev(dev);
return err;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 084/699] Bluetooth: fix UAF in bt_accept_dequeue()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 083/699] Bluetooth: bnep: pin L2CAP connection during netdev registration Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 085/699] Bluetooth: L2CAP: validate option length before reading conf opt value Greg Kroah-Hartman
` (618 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+674ff7e4d7fdfd572afc,
Yousef Alhouseen, Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit 4bd0b274054f2679f28b70222b607bb0afc3ab9a upstream.
bt_accept_get() takes a temporary reference before dropping the accept
queue lock. bt_accept_dequeue() currently drops that reference before
bt_accept_unlink(), leaving only the queue reference.
bt_accept_unlink() drops the queue reference. The subsequent
sock_hold() therefore accesses freed memory if it was the final
reference, as observed by KASAN during listening L2CAP socket cleanup.
Retain the temporary queue-walk reference through unlink and hand it to
the caller on success. Drop it explicitly on the closed and
not-yet-connected paths.
Fixes: ab1513597c6c ("Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()")
Reported-by: syzbot+674ff7e4d7fdfd572afc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=674ff7e4d7fdfd572afc
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/af_bluetooth.c | 17 +++--------------
net/bluetooth/l2cap_sock.c | 4 ++--
2 files changed, 5 insertions(+), 16 deletions(-)
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -281,7 +281,7 @@ struct sock *bt_accept_dequeue(struct so
restart:
for (sk = bt_accept_get(parent, NULL); sk; sk = next) {
- /* Prevent early freeing of sk due to unlink and sock_kill */
+ /* The reference from bt_accept_get() keeps sk alive. */
lock_sock(sk);
/* Check sk has not already been unlinked via
@@ -297,13 +297,11 @@ restart:
next = bt_accept_get(parent, sk);
- /* sk is safely in the parent list so reduce reference count */
- sock_put(sk);
-
/* FIXME: Is this check still needed */
if (sk->sk_state == BT_CLOSED) {
bt_accept_unlink(sk);
release_sock(sk);
+ sock_put(sk);
continue;
}
@@ -313,16 +311,6 @@ restart:
if (newsock)
sock_graft(sk, newsock);
- /* Hand the caller a reference taken while sk is
- * still locked. bt_accept_unlink() just dropped
- * the accept-queue reference; without this hold a
- * concurrent teardown (e.g. l2cap_conn_del() ->
- * l2cap_sock_kill()) could free sk between
- * release_sock() and the caller using it. Every
- * caller drops this with sock_put() when done.
- */
- sock_hold(sk);
-
release_sock(sk);
if (next)
sock_put(next);
@@ -330,6 +318,7 @@ restart:
}
release_sock(sk);
+ sock_put(sk);
}
return NULL;
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1420,8 +1420,8 @@ static void l2cap_sock_cleanup_listen(st
/* Close not yet accepted channels.
*
- * bt_accept_dequeue() now returns sk with an extra reference held
- * (taken while sk was still locked) so a concurrent l2cap_conn_del()
+ * bt_accept_dequeue() returns sk with its temporary queue-walk
+ * reference held, so a concurrent l2cap_conn_del()
* -> l2cap_sock_kill() cannot free sk under us.
*
* cleanup_listen() runs under the parent sk lock, so unlike
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 085/699] Bluetooth: L2CAP: validate option length before reading conf opt value
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 084/699] Bluetooth: fix UAF in bt_accept_dequeue() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 086/699] net: Drop the lock in skb_may_tx_timestamp() Greg Kroah-Hartman
` (617 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal,
Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit 687617555cedfb74c9e3cb85d759b908dcb17856 upstream.
l2cap_get_conf_opt() derives the option length from the
attacker-controlled opt->len field and immediately dereferences
opt->val (as u8, get_unaligned_le16() or get_unaligned_le32(), or a
raw pointer for the default case) before any caller has confirmed
that opt->len bytes are present in the buffer. The callers
(l2cap_parse_conf_req(), l2cap_parse_conf_rsp() and
l2cap_conf_rfc_get()) only detect a malformed option afterwards, once
the running length has gone negative, by which point the
out-of-bounds read has already executed.
An existing post-hoc length check keeps the garbage value from being
consumed, so this is not a data leak in the current control flow. It
is still a validate-after-use ordering bug: up to 4 bytes are read
past the end of the buffer before it is known to contain them, and it
is fragile to future changes in the callers.
Fix it at the source. Pass the end of the buffer into
l2cap_get_conf_opt() and refuse to touch opt->val unless the full
option (header + value) fits. Each caller computes an end pointer
once before the loop and checks the return value directly instead of
inferring the error from a negative length.
Fixes: 7c9cbd0b5e38 ("Bluetooth: Verify that l2cap_get_conf_opt provides large enough buffer")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 36 ++++++++++++++++++++++++++++--------
1 file changed, 28 insertions(+), 8 deletions(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3166,13 +3166,24 @@ fail:
return NULL;
}
-static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
- unsigned long *val)
+static inline int l2cap_get_conf_opt(void **ptr, void *end, int *type,
+ int *olen, unsigned long *val)
{
struct l2cap_conf_opt *opt = *ptr;
int len;
+ /* opt->len is attacker-controlled. Validate that the full option
+ * (header + value) actually fits in the buffer before touching
+ * opt->val, otherwise the switch below reads past the end of the
+ * caller's buffer.
+ */
+ if (end - *ptr < L2CAP_CONF_OPT_SIZE)
+ return -EINVAL;
+
len = L2CAP_CONF_OPT_SIZE + opt->len;
+ if (end - *ptr < len)
+ return -EINVAL;
+
*ptr += len;
*type = opt->type;
@@ -3578,6 +3589,7 @@ static int l2cap_parse_conf_req(struct l
void *ptr = rsp->data;
void *endptr = data + data_size;
void *req = chan->conf_req;
+ void *req_end = req + chan->conf_len;
int len = chan->conf_len;
int type, hint, olen;
unsigned long val;
@@ -3591,9 +3603,11 @@ static int l2cap_parse_conf_req(struct l
BT_DBG("chan %p", chan);
while (len >= L2CAP_CONF_OPT_SIZE) {
- len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
- if (len < 0)
+ int ret = l2cap_get_conf_opt(&req, req_end, &type, &olen, &val);
+
+ if (ret < 0)
break;
+ len -= ret;
hint = type & L2CAP_CONF_HINT;
type &= L2CAP_CONF_MASK;
@@ -3827,6 +3841,7 @@ static int l2cap_parse_conf_rsp(struct l
struct l2cap_conf_req *req = data;
void *ptr = req->data;
void *endptr = data + size;
+ void *rsp_end = rsp + len;
int type, olen;
unsigned long val;
struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
@@ -3835,9 +3850,11 @@ static int l2cap_parse_conf_rsp(struct l
BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
while (len >= L2CAP_CONF_OPT_SIZE) {
- len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
- if (len < 0)
+ int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val);
+
+ if (ret < 0)
break;
+ len -= ret;
switch (type) {
case L2CAP_CONF_MTU:
@@ -4090,6 +4107,7 @@ static void l2cap_conf_rfc_get(struct l2
{
int type, olen;
unsigned long val;
+ void *rsp_end = rsp + len;
/* Use sane default values in case a misbehaving remote device
* did not send an RFC or extended window size option.
*/
@@ -4108,9 +4126,11 @@ static void l2cap_conf_rfc_get(struct l2
return;
while (len >= L2CAP_CONF_OPT_SIZE) {
- len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
- if (len < 0)
+ int ret = l2cap_get_conf_opt(&rsp, rsp_end, &type, &olen, &val);
+
+ if (ret < 0)
break;
+ len -= ret;
switch (type) {
case L2CAP_CONF_RFC:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 086/699] net: Drop the lock in skb_may_tx_timestamp()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 085/699] Bluetooth: L2CAP: validate option length before reading conf opt value Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 087/699] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Greg Kroah-Hartman
` (616 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Andrzej Siewior,
Willem de Bruijn, Jason Xing, Eric Dumazet, Paolo Abeni, Philo Lu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 983512f3a87fd8dc4c94dfa6b596b6e57df5aad7 upstream.
skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must
not be taken in IRQ context, only softirq is okay. A few drivers receive
the timestamp via a dedicated interrupt and complete the TX timestamp
from that handler. This will lead to a deadlock if the lock is already
write-locked on the same CPU.
Taking the lock can be avoided. The socket (pointed by the skb) will
remain valid until the skb is released. The ->sk_socket and ->file
member will be set to NULL once the user closes the socket which may
happen before the timestamp arrives.
If we happen to observe the pointer while the socket is closing but
before the pointer is set to NULL then we may use it because both
pointer (and the file's cred member) are RCU freed.
Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a
matching WRITE_ONCE() where the pointer are cleared.
Link: https://lore.kernel.org/all/20260205145104.iWinkXHv@linutronix.de
Fixes: b245be1f4db1a ("net-timestamp: no-payload only sysctl")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260220183858.N4ERjFW6@linutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ adapted sk_set_socket() in include/net/sock.h to fix the conflict from
not having commit 5d6b58c932ec ("net: lockless sock_i_ino()") and the
additional previous changes required by it.
It comes down to just now having the lines of
if (sock) {
WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
}
below the changed line. ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 2 +-
net/core/skbuff.c | 23 ++++++++++++++++++-----
net/socket.c | 2 +-
3 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index f0e391afb511d2..b9c44e47cb7a78 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1981,7 +1981,7 @@ static inline int sk_rx_queue_get(const struct sock *sk)
static inline void sk_set_socket(struct sock *sk, struct socket *sock)
{
- sk->sk_socket = sock;
+ WRITE_ONCE(sk->sk_socket, sock);
}
static inline wait_queue_head_t *sk_sleep(struct sock *sk)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e4a39e0f55f242..90a63c356affb2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4772,15 +4772,28 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
static bool skb_may_tx_timestamp(struct sock *sk, bool tsonly)
{
- bool ret;
+ struct socket *sock;
+ struct file *file;
+ bool ret = false;
if (likely(READ_ONCE(sysctl_tstamp_allow_data) || tsonly))
return true;
- read_lock_bh(&sk->sk_callback_lock);
- ret = sk->sk_socket && sk->sk_socket->file &&
- file_ns_capable(sk->sk_socket->file, &init_user_ns, CAP_NET_RAW);
- read_unlock_bh(&sk->sk_callback_lock);
+ /* The sk pointer remains valid as long as the skb is. The sk_socket and
+ * file pointer may become NULL if the socket is closed. Both structures
+ * (including file->cred) are RCU freed which means they can be accessed
+ * within a RCU read section.
+ */
+ rcu_read_lock();
+ sock = READ_ONCE(sk->sk_socket);
+ if (!sock)
+ goto out;
+ file = READ_ONCE(sock->file);
+ if (!file)
+ goto out;
+ ret = file_ns_capable(file, &init_user_ns, CAP_NET_RAW);
+out:
+ rcu_read_unlock();
return ret;
}
diff --git a/net/socket.c b/net/socket.c
index de838c3b004861..eb157ea2a3efbb 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -608,7 +608,7 @@ static void __sock_release(struct socket *sock, struct inode *inode)
iput(SOCK_INODE(sock));
return;
}
- sock->file = NULL;
+ WRITE_ONCE(sock->file, NULL);
}
/**
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 087/699] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 086/699] net: Drop the lock in skb_may_tx_timestamp() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 088/699] cpufreq: Fix hotplug-suspend race during reboot Greg Kroah-Hartman
` (615 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tejun Heo, Steven Rostedt,
Peter Zijlstra (Intel)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt <rostedt@goodmis.org>
commit dd29c017aed628076e915fe4cdfb5392fd4c5cab upstream.
RT migration is done aggressively. When a CPU schedules out a high
priority RT task for a lower priority task, it will look to see if there's
any RT tasks that are waiting to run on another CPU that is of higher
priority than the task this CPU is about to run. If it finds one, it will
pull that task over to the CPU and allow it to run there instead.
Normally, this pulling is done by looking at the RT overloaded mask (rto)
which contains all the CPUs in the scheduler domain with RT tasks that are
waiting to run due to a higher priority RT task currently running on their
CPU. The CPU that is about to schedule a lower priority task will grab the
rq lock of the overloaded CPU and move the RT task from that CPU's runqueue
to the local one and schedule the higher priority RT task.
This caused issues when a lot of CPUs would schedule a lower priority task
at the same time. They would all try to grab the same runqueue lock of
the CPU with the overloaded RT tasks. Only the first CPU that got in will
get that task. All the others would wait until they got the runqueue lock
and see there's nothing to pull and do nothing. On systems with lots of
CPUs, this caused a large latency (up to 500us) which is beyond what
PREEMPT_RT is to allow.
The solution to that was to create an RT_PUSH_IPI logic. When any CPU
wanted to pull a task, instead of grabbing the runqueue lock of the
overloaded CPU, it would start by sending an IPI to the overloaded CPU,
and that IPI handler would have the CPU with the waiting RT task do a push
instead. Then that handler would send an IPI to the next CPU with
overloaded RT tasks, and so on. Note, after the first CPU starts this
process, if another CPU wanted to do a pull, it would see that the process
has already begun and would only increment a counter to have the IPIs
continue again.
The RT_PUSH_IPI solved the latency problem with PREEMPT_RT but could cause
a new issue with non PREEMPT_RT. Namely, softirqs run in a threaded
context on PREEMPT_RT but they can run in an interrupt context in non-RT.
If an IPI lands on a CPU that has just woken up multiple RT tasks and the
current CPU is running a non RT or a low priority RT task, instead of
doing a push, it would simply do a schedule on that CPU. But if a softirq
was also executing on this CPU, the schedule would need to wait until the
softirq finished. Until then, the CPU would still be considered overloaded
as there are RT tasks still waiting to run on it.
A live lock occurred on a workload that was doing heavy networking traffic
on a large machine where the softirqs would run 500us out of 750us. And it
would also be waking up RT tasks, causing the RT pull logic to be
constantly executed.
When a softirq triggered on a CPU with RT tasks queued but not running
yet, and the other CPUs would see this CPU as being overloaded, they would
send an IPI over to it. The CPU would notice that the waiting RT tasks are
of higher priority than the currently running task and simply schedule
that CPU instead. But because the softirq was executing, before it could
schedule, it would receive another IPI to do the same. The amount of IPIs
would slow down the currently running softirq so much that before it could
return back to task context, it would execute another softirq never
allowing the CPU to schedule. This live locked that CPU.
As RT_PUSH_IPI was created to help PREEMPT_RT, make it default off if
PREEMPT_RT is not enabled.
Fixes: b6366f048e0c ("sched/rt: Use IPI to trigger RT task push migration instead of pulling")
Closes: https://lore.kernel.org/all/20260506235716.2530720-1-tj@kernel.org/
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260515103740.25ccbed8@gandalf.local.home
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/features.h | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/kernel/sched/features.h
+++ b/kernel/sched/features.h
@@ -73,8 +73,16 @@ SCHED_FEAT(WARN_DOUBLE_CLOCK, false)
* rq lock and possibly create a large contention, sending an
* IPI to that CPU and let that CPU push the RT task to where
* it should go may be a better scenario.
+ *
+ * This is best for PREEMPT_RT, but for non-RT it can cause issues
+ * when preemption is disabled for long periods of time. Have
+ * it only default enabled for PREEMPT_RT.
*/
+# ifdef CONFIG_PREEMPT_RT
SCHED_FEAT(RT_PUSH_IPI, true)
+# else
+SCHED_FEAT(RT_PUSH_IPI, false)
+# endif
#endif
SCHED_FEAT(RT_RUNTIME_SHARE, false)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 088/699] cpufreq: Fix hotplug-suspend race during reboot
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 087/699] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 089/699] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Greg Kroah-Hartman
` (614 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tianxiang Chen, Zhongqiu Han,
Rafael J. Wysocki
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianxiang Chen <nanmu@xiaomi.com>
commit a9029dd55696c651ee46912afa2a166fa456bb3e upstream.
During system reboot, cpufreq_suspend() is called via the
kernel_restart() -> device_shutdown() path. Unlike the normal system
suspend path, the reboot path does not call freeze_processes(), so
userspace processes and kernel threads remain active.
This allows CPU hotplug operations to run concurrently with
cpufreq_suspend(). The original code has no synchronization with CPU
hotplug, leading to a race condition where governor_data can be freed
by the hotplug path while cpufreq_suspend() is still accessing it,
resulting in a null pointer dereference:
Unable to handle kernel NULL pointer dereference
Call Trace:
do_kernel_fault+0x28/0x3c
cpufreq_suspend+0xdc/0x160
device_shutdown+0x18/0x200
kernel_restart+0x40/0x80
arm64_sys_reboot+0x1b0/0x200
Fix this by adding cpus_read_lock()/cpus_read_unlock() to
cpufreq_suspend() to block CPU hotplug operations while suspend is in
progress.
Fixes: 65650b35133f ("cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown")
Signed-off-by: Tianxiang Chen <nanmu@xiaomi.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260408141914.35281-1-nanmu@xiaomi.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/cpufreq.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1872,6 +1872,7 @@ void cpufreq_suspend(void)
if (!cpufreq_driver)
return;
+ cpus_read_lock();
if (!has_target() && !cpufreq_driver->suspend)
goto suspend;
@@ -1891,6 +1892,7 @@ void cpufreq_suspend(void)
suspend:
cpufreq_suspended = true;
+ cpus_read_unlock();
}
/**
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 089/699] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 088/699] cpufreq: Fix hotplug-suspend race during reboot Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 090/699] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Greg Kroah-Hartman
` (613 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Zhongqiu Han,
Rafael J. Wysocki
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
commit 266d3dd8b757b48a576e90f018b51f7b7563cc32 upstream.
pcc_cpufreq_do_osc() calls acpi_evaluate_object() twice for the
two-phase _OSC negotiation. Between the two calls it freed
output.pointer but left output.length unchanged. Since
acpi_evaluate_object() treats a non-zero length with a non-NULL
pointer as an existing buffer to write into, the second call wrote
into freed memory (use-after-free). The subsequent kfree(output.pointer)
at out_free then freed the same pointer a second time (double free).
Reset output.pointer to NULL and output.length to ACPI_ALLOCATE_BUFFER
after freeing the first result, so ACPICA allocates a fresh buffer for
each phase independently.
Fixes: 0f1d683fb35d ("[CPUFREQ] Processor Clocking Control interface driver")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260416144621.93964-1-dbgh9129@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/pcc-cpufreq.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/cpufreq/pcc-cpufreq.c
+++ b/drivers/cpufreq/pcc-cpufreq.c
@@ -351,6 +351,8 @@ static int __init pcc_cpufreq_do_osc(acp
}
kfree(output.pointer);
+ output.pointer = NULL;
+ output.length = ACPI_ALLOCATE_BUFFER;
capabilities[0] = 0x0;
capabilities[1] = 0x1;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 090/699] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 089/699] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 091/699] HID: wacom: stop hardware after post-start probe failures Greg Kroah-Hartman
` (612 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, WenTao Liang, Thomas Gleixner,
Frederic Weisbecker
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit 87bd2ad568e15b90d5f7d4bcd70342d05dad649c upstream.
In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
posix_cpu_timer_set() call fails, the function returns immediately
without calling posix_cpu_timer_del() to release the pid reference,
causing a leak.
Fix it by calling posix_cpu_timer_del() before the unlock-and-return
on the error path, consistent with the other exit paths in the same
function.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260611161738.97043-1-vulab@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/posix-cpu-timers.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1472,6 +1472,7 @@ static int do_cpu_nanosleep(const clocki
spin_lock_irq(&timer.it_lock);
error = posix_cpu_timer_set(&timer, flags, &it, NULL);
if (error) {
+ posix_cpu_timer_del(&timer);
spin_unlock_irq(&timer.it_lock);
return error;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 091/699] HID: wacom: stop hardware after post-start probe failures
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 090/699] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 092/699] HID: lg-g15: cancel pending work on remove to fix a use-after-free Greg Kroah-Hartman
` (611 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Dmitry Torokhov, Jiri Kosina
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit ec2612b8ad9e642596db011dd8b6568ef1edeaa1 upstream.
wacom_parse_and_register() starts HID hardware before registering inputs
and initializing pad LEDs/remotes. Those later steps can fail, but their
error paths currently release Wacom resources without stopping the HID
hardware.
Route post-hid_hw_start() failures through hid_hw_stop() before
releasing driver resources.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: c1d6708bf0d3 ("HID: wacom: Do not register input devices until after hid_hw_start")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_sys.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2427,16 +2427,16 @@ static int wacom_parse_and_register(stru
error = wacom_register_inputs(wacom);
if (error)
- goto fail;
+ goto fail_hw_stop;
if (wacom->wacom_wac.features.device_type & WACOM_DEVICETYPE_PAD) {
error = wacom_initialize_leds(wacom);
if (error)
- goto fail;
+ goto fail_hw_stop;
error = wacom_initialize_remotes(wacom);
if (error)
- goto fail;
+ goto fail_hw_stop;
}
if (!wireless) {
@@ -2450,14 +2450,14 @@ static int wacom_parse_and_register(stru
cancel_delayed_work_sync(&wacom->init_work);
_wacom_query_tablet_data(wacom);
error = -ENODEV;
- goto fail_quirks;
+ goto fail_hw_stop;
}
if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR) {
error = hid_hw_open(hdev);
if (error) {
hid_err(hdev, "hw open failed\n");
- goto fail_quirks;
+ goto fail_hw_stop;
}
}
@@ -2466,7 +2466,7 @@ static int wacom_parse_and_register(stru
return 0;
-fail_quirks:
+fail_hw_stop:
hid_hw_stop(hdev);
fail:
wacom_release_resources(wacom);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 092/699] HID: lg-g15: cancel pending work on remove to fix a use-after-free
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 091/699] HID: wacom: stop hardware after post-start probe failures Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 093/699] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Greg Kroah-Hartman
` (610 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Maoyi Xie,
Hans de Goede, Jiri Kosina
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 7705b4140d188ce22656f6e541ae7ef834c7e11a upstream.
lg_g15_data is allocated with devm and holds a work item. The report
handlers schedule that work straight from device input.
lg_g15_event() and lg_g15_v2_event() do it on the backlight cycle key,
and lg_g510_leds_event() does it too. The worker dereferences the
lg_g15_data back through container_of.
The driver had no remove callback and never cancelled the work. So if a
report scheduled the work and the keyboard was then unplugged, devres
freed lg_g15_data while the work was still pending or running, and the
worker touched freed memory. This is a use-after-free. It is reachable
as a race on device unplug.
Add a remove callback that cancels the work before devres frees the
state. g15->work is only initialized for the models that schedule it
(G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so guard the
cancel on g15->work.func to avoid cancelling a work that was never set
up. The g15 NULL test mirrors the one already in lg_g15_raw_event().
Fixes: 97b741aba918 ("HID: lg-g15: Add keyboard and LCD backlight control")
Cc: stable@vger.kernel.org
Suggested-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-lg-g15.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/hid/hid-lg-g15.c
+++ b/drivers/hid/hid-lg-g15.c
@@ -894,11 +894,27 @@ static const struct hid_device_id lg_g15
};
MODULE_DEVICE_TABLE(hid, lg_g15_devices);
+static void lg_g15_remove(struct hid_device *hdev)
+{
+ struct lg_g15_data *g15 = hid_get_drvdata(hdev);
+
+ /*
+ * g15->work is only initialized for the models that schedule it
+ * (G15, G15 v2, G510). The G13 and Z-10 leave it zeroed, so only
+ * cancel it when it was set up.
+ */
+ if (g15 && g15->work.func)
+ cancel_work_sync(&g15->work);
+
+ hid_hw_stop(hdev);
+}
+
static struct hid_driver lg_g15_driver = {
.name = "lg-g15",
.id_table = lg_g15_devices,
.raw_event = lg_g15_raw_event,
.probe = lg_g15_probe,
+ .remove = lg_g15_remove,
};
module_hid_driver(lg_g15_driver);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 093/699] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 092/699] HID: lg-g15: cancel pending work on remove to fix a use-after-free Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 094/699] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Greg Kroah-Hartman
` (609 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada, Zhang Lixu,
Jiri Kosina, Andy Shevchenko, Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit f784fcea450617055d2d12eec5b2f6e0e38bf878 upstream.
sensor_hub_input_attr_get_raw_value() is limited to returning a single
32-bit value, which is insufficient for sensors that report data larger
than 32 bits, such as a quaternion with four s16 elements.
Add sensor_hub_input_attr_read_values() that accepts a caller-provided
buffer and accumulates incoming data until the buffer is full. The two
paths are distinguished in sensor_hub_raw_event() by pending.max_raw_size
being non-zero, preserving backward compatibility.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Co-developed-by: Zhang Lixu <lixu.zhang@intel.com>
Signed-off-by: Zhang Lixu <lixu.zhang@intel.com>
Acked-by: Jiri Kosina <jkosina@suse.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-hub.c | 77 +++++++++++++++++++++++++++++++++++++----
include/linux/hid-sensor-hub.h | 25 +++++++++++++
2 files changed, 96 insertions(+), 6 deletions(-)
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -287,6 +287,54 @@ done_proc:
}
EXPORT_SYMBOL_GPL(sensor_hub_get_feature);
+int sensor_hub_input_attr_read_values(struct hid_sensor_hub_device *hsdev,
+ u32 usage_id, u32 attr_usage_id,
+ u32 report_id,
+ enum sensor_hub_read_flags flag,
+ u32 buffer_size, u8 *buffer)
+{
+ struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
+ struct hid_report *report;
+ unsigned long flags;
+ long cycles;
+ int ret;
+
+ report = sensor_hub_report(report_id, hsdev->hdev, HID_INPUT_REPORT);
+ if (!report)
+ return -EINVAL;
+
+ mutex_lock(hsdev->mutex_ptr);
+ if (flag == SENSOR_HUB_SYNC) {
+ memset(&hsdev->pending, 0, sizeof(hsdev->pending));
+ init_completion(&hsdev->pending.ready);
+ hsdev->pending.usage_id = usage_id;
+ hsdev->pending.attr_usage_id = attr_usage_id;
+ hsdev->pending.max_raw_size = buffer_size;
+ hsdev->pending.raw_data = buffer;
+
+ spin_lock_irqsave(&data->lock, flags);
+ hsdev->pending.status = true;
+ spin_unlock_irqrestore(&data->lock, flags);
+ }
+ mutex_lock(&data->mutex);
+ hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT);
+ mutex_unlock(&data->mutex);
+ ret = 0;
+ if (flag == SENSOR_HUB_SYNC) {
+ cycles = wait_for_completion_interruptible_timeout(&hsdev->pending.ready,
+ HZ * 5);
+ if (cycles == 0)
+ ret = -ETIMEDOUT;
+ else if (cycles < 0)
+ ret = cycles;
+
+ hsdev->pending.status = false;
+ }
+ mutex_unlock(hsdev->mutex_ptr);
+
+ return ret;
+}
+EXPORT_SYMBOL_GPL(sensor_hub_input_attr_read_values);
int sensor_hub_input_attr_get_raw_value(struct hid_sensor_hub_device *hsdev,
u32 usage_id,
@@ -480,6 +528,8 @@ static int sensor_hub_raw_event(struct h
struct hid_collection *collection = NULL;
void *priv = NULL;
struct hid_sensor_hub_device *hsdev = NULL;
+ u32 copy_size;
+ u32 avail;
hid_dbg(hdev, "sensor_hub_raw_event report id:0x%x size:%d type:%d\n",
report->id, size, report->type);
@@ -519,12 +569,27 @@ static int sensor_hub_raw_event(struct h
hsdev->pending.attr_usage_id ==
report->field[i]->logical)) {
hid_dbg(hdev, "data was pending ...\n");
- hsdev->pending.raw_data = kmemdup(ptr, sz, GFP_ATOMIC);
- if (hsdev->pending.raw_data)
- hsdev->pending.raw_size = sz;
- else
- hsdev->pending.raw_size = 0;
- complete(&hsdev->pending.ready);
+ if (hsdev->pending.max_raw_size) {
+ if (hsdev->pending.index < hsdev->pending.max_raw_size) {
+ avail = hsdev->pending.max_raw_size - hsdev->pending.index;
+ copy_size = clamp(sz, 0U, avail);
+
+ memcpy(hsdev->pending.raw_data + hsdev->pending.index,
+ ptr, copy_size);
+ hsdev->pending.index += copy_size;
+ if (hsdev->pending.index >= hsdev->pending.max_raw_size) {
+ hsdev->pending.raw_size = hsdev->pending.index;
+ complete(&hsdev->pending.ready);
+ }
+ }
+ } else {
+ hsdev->pending.raw_data = kmemdup(ptr, sz, GFP_ATOMIC);
+ if (hsdev->pending.raw_data)
+ hsdev->pending.raw_size = sz;
+ else
+ hsdev->pending.raw_size = 0;
+ complete(&hsdev->pending.ready);
+ }
}
if (callback->capture_sample) {
if (report->field[i]->logical)
--- a/include/linux/hid-sensor-hub.h
+++ b/include/linux/hid-sensor-hub.h
@@ -43,6 +43,8 @@ struct hid_sensor_hub_attribute_info {
* @attr_usage_id: Usage Id of a field, E.g. X-AXIS for a gyro.
* @raw_size: Response size for a read request.
* @raw_data: Place holder for received response.
+ * @index: Current write index into raw_data for multi-byte reads.
+ * @max_raw_size: Total buffer size for multi-byte reads; 0 for single-value reads.
*/
struct sensor_hub_pending {
bool status;
@@ -51,6 +53,8 @@ struct sensor_hub_pending {
u32 attr_usage_id;
int raw_size;
u8 *raw_data;
+ u32 index;
+ u32 max_raw_size;
};
/**
@@ -183,6 +187,27 @@ int sensor_hub_input_attr_get_raw_value(
);
/**
+ * sensor_hub_input_attr_read_values() - Synchronous multi-byte read request
+ * @hsdev: Hub device instance.
+ * @usage_id: Attribute usage id of parent physical device as per spec
+ * @attr_usage_id: Attribute usage id as per spec
+ * @report_id: Report id to look for
+ * @flag: Synchronous or asynchronous read
+ * @buffer_size: Size of the buffer in bytes
+ * @buffer: Buffer to store the read data
+ *
+ * Issues a synchronous or asynchronous read request for an input attribute,
+ * accumulating data into the provided buffer until it is full.
+ * Return: 0 on success, -ETIMEDOUT if the device did not respond, or a
+ * negative error code.
+ */
+int sensor_hub_input_attr_read_values(struct hid_sensor_hub_device *hsdev,
+ u32 usage_id, u32 attr_usage_id,
+ u32 report_id,
+ enum sensor_hub_read_flags flag,
+ u32 buffer_size, u8 *buffer);
+
+/**
* sensor_hub_set_feature() - Feature set request
* @hsdev: Hub device instance.
* @report_id: Report id to look for
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 094/699] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 093/699] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 095/699] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Greg Kroah-Hartman
` (608 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+217eb327242d08197efb,
Tristan Madani, Viacheslav Dubeyko
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
commit d67aadee19ffdf3cc8520c5a4f4d5b2916d30baf upstream.
hfs_bnode_read() can return early without writing to the output buffer
when is_bnode_offset_valid() fails or when check_and_correct_requested_
length() corrects the length to zero. Callers such as hfs_bnode_read_
u16() and hfs_bnode_read_u8() pass stack-allocated buffers and use the
result unconditionally, leading to KMSAN uninit-value reports.
Rather than initializing at each individual call site, zero the buffer
at the start of hfs_bnode_read() before any validation checks. This
ensures all callers in both hfs and hfsplus get a deterministic zero
value regardless of which early-return path is taken.
Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Tested-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Fixes: a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260505111300.3592757-3-tristmd@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/hfs/bnode.c | 2 ++
fs/hfsplus/bnode.c | 2 ++
2 files changed, 4 insertions(+)
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -65,6 +65,8 @@ void hfs_bnode_read(struct hfs_bnode *no
int bytes_to_read;
void *vaddr;
+ memset(buf, 0, len);
+
if (!is_bnode_offset_valid(node, off))
return;
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -25,6 +25,8 @@ void hfs_bnode_read(struct hfs_bnode *no
struct page **pagep;
int l;
+ memset(buf, 0, len);
+
if (!is_bnode_offset_valid(node, off))
return;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 095/699] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 094/699] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 096/699] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Greg Kroah-Hartman
` (607 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+62f0f99d2f2bb8e3bbd7,
Deepanshu Kartikey, Ryusuke Konishi, Viacheslav Dubeyko
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Deepanshu Kartikey <kartikey406@gmail.com>
commit 0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9 upstream.
Syzbot reported a hung task in nilfs_transaction_begin() where multiple
tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds
waiting to acquire ns_segctor_sem for read:
INFO: task syz.0.17:5918 blocked for more than 143 seconds.
Call Trace:
schedule+0x164/0x360
rwsem_down_read_slowpath+0x6d9/0x940
down_read+0x99/0x2e0
nilfs_transaction_begin+0x364/0x710 fs/nilfs2/segment.c:221
nilfs_setattr+0x124/0x2c0 fs/nilfs2/inode.c:921
notify_change+0xc1a/0xf40
chmod_common+0x273/0x4a0
do_fchmodat+0x12d/0x230
The writer holding ns_segctor_sem was a concurrent
NILFS_IOCTL_CLEAN_SEGMENTS caller, stuck inside printk while emitting
per-element warnings from nilfs_sufile_updatev():
__nilfs_msg+0x373/0x450 fs/nilfs2/super.c:78
nilfs_sufile_updatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186
nilfs_sufile_freev fs/nilfs2/sufile.h:93 [inline]
nilfs_free_segments fs/nilfs2/segment.c:1140 [inline]
nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1261 [inline]
nilfs_segctor_do_construct+0x1f55/0x76c0
nilfs_clean_segments+0x3bd/0xa50
nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline]
nilfs_ioctl+0x261f/0x2780
The root cause is that user-supplied segment numbers are not validated
before nilfs_clean_segments() begins doing work; the range check on
each segnum is performed deep inside the call chain by
nilfs_sufile_updatev(), which emits a nilfs_warn() per invalid entry
while still holding the segctor lock and the sufile mi_sem. Under load
(repeated invocations across multiple mounts saturating the global
printk path), the cumulative printk latency keeps ns_segctor_sem held
long enough to trip the hung_task watchdog, blocking concurrent
operations such as chmod() that need ns_segctor_sem for read.
Fix by validating the contents of kbufs[4] in nilfs_clean_segments()
immediately after acquiring ns_segctor_sem via nilfs_transaction_lock().
Holding ns_segctor_sem serializes the check against
nilfs_ioctl_resize(), which can modify ns_nsegments, so the validation
uses a consistent value. Out-of-range segment numbers are rejected
with -EINVAL before any segment-cleaning work begins, so the bad
entries never reach the per-element diagnostic path inside
nilfs_sufile_updatev().
Reported-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=62f0f99d2f2bb8e3bbd7
Tested-by: syzbot+62f0f99d2f2bb8e3bbd7@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Fixes: 071cb4b81987 ("nilfs2: eliminate removal list of segments")
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/segment.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2505,12 +2505,33 @@ int nilfs_clean_segments(struct super_bl
struct nilfs_sc_info *sci = nilfs->ns_writer;
struct nilfs_transaction_info ti;
int err;
+ size_t i, nfreesegs = argv[4].v_nmembs;
+ __u64 *segnumv = kbufs[4];
if (unlikely(!sci))
return -EROFS;
nilfs_transaction_lock(sb, &ti, 1);
+ /*
+ * Validate segment numbers under ns_segctor_sem (held for write
+ * by nilfs_transaction_lock above) so the check is serialized
+ * against nilfs_ioctl_resize(), which can modify ns_nsegments.
+ * Rejecting bad input here, before any segment-cleaning work
+ * begins, avoids the per-element diagnostic path inside
+ * nilfs_sufile_updatev() that would otherwise run under this
+ * same lock and stall concurrent readers.
+ */
+ for (i = 0; i < nfreesegs; i++) {
+ if (segnumv[i] >= nilfs->ns_nsegments) {
+ nilfs_err(sb,
+ "Segment number %llu to be freed is out of range",
+ (unsigned long long)segnumv[i]);
+ err = -EINVAL;
+ goto bail_unlock;
+ }
+ }
+
err = nilfs_mdt_save_to_shadow_map(nilfs->ns_dat);
if (unlikely(err))
goto out_unlock;
@@ -2551,6 +2572,7 @@ int nilfs_clean_segments(struct super_bl
sci->sc_freesegs = NULL;
sci->sc_nfreesegs = 0;
nilfs_mdt_clear_shadow_map(nilfs->ns_dat);
+ bail_unlock:
nilfs_transaction_unlock(sb);
return err;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 096/699] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 095/699] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 097/699] usb: cdc_acm: Add quirk for Uniden BC125AT scanner Greg Kroah-Hartman
` (606 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Andrew Lunn,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 47b6bcef6e679593d2e86e04ee72c46a4e2f7139 upstream.
kalmia_rx_fixup() computes usb_packet_length = skb->len - (2 *
KALMIA_HEADER_LENGTH) as a u16, guarded only by a pre-loop check that
skb->len is at least KALMIA_HEADER_LENGTH, which is 6. A device can
deliver a short bulk-IN frame with skb->len in the 6 to 11 range, or
leave a short trailing remainder on a later loop iteration. Either case
underflows usb_packet_length to about 65530.
That bypasses the usb_packet_length < ether_packet_length truncation path.
The device-supplied ether_packet_length, a le16 up to 65535 read from
header_start[2], then drives a memcmp() and the following skb_trim() and
skb_pull() past the end of the rx buffer. The rx buffer is hard_mtu * 10,
which is 14000 bytes. That is an out of bounds read.
Require both the start and end framing headers to be present before
subtracting them, on every loop iteration.
Fixes: d40261236e8e ("net/usb: Add Samsung Kalmia driver for Samsung GT-B3730")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/178211531778.2216480.12637613349790980750@maoyixie.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/kalmia.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/net/usb/kalmia.c
+++ b/drivers/net/usb/kalmia.c
@@ -276,6 +276,14 @@ kalmia_rx_fixup(struct usbnet *dev, stru
"Received header: %6phC. Package length: %i\n",
header_start, skb->len - KALMIA_HEADER_LENGTH);
+ /* both framing headers must be present before we subtract
+ * them, otherwise usb_packet_length underflows and the
+ * device-supplied ether_packet_length drives an out of bounds
+ * access below
+ */
+ if (skb->len < 2 * KALMIA_HEADER_LENGTH)
+ return 0;
+
/* subtract start header and end header */
usb_packet_length = skb->len - (2 * KALMIA_HEADER_LENGTH);
ether_packet_length = get_unaligned_le16(&header_start[2]);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 097/699] usb: cdc_acm: Add quirk for Uniden BC125AT scanner
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 096/699] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 098/699] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Greg Kroah-Hartman
` (605 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jared Baldridge, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jared Baldridge <jrb@expunge.us>
commit 6eba58568f6cc3ff8515a00b05e258d8cfb72b72 upstream.
Uniden BC125AT radio scanner has a USB interface which fails to work
with the cdc_acm driver:
usb 1-1: new full-speed USB device number 2 using uhci_hcd
cdc_acm 1-1:1.0: Zero length descriptor references
cdc_acm 1-1:1.0: probe with driver cdc_acm failed with error -22
usbcore: registered new interface driver cdc_acm
Adding the NO_UNION_NORMAL quirk for the device fixes the issue:
usb 1-1: new full-speed USB device number 2 using uhci_hcd
cdc_acm 1-1:1.0: ttyACM0: USB ACM device
usbcore: registered new interface driver cdc_acm
`lsusb -v` of the device:
Bus 001 Device 002: ID 1965:0017 Uniden Corporation BC125AT
Negotiated speed: Full Speed (12Mbps)
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 2 Communications
bDeviceSubClass 0 [unknown]
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x1965 Uniden Corporation
idProduct 0x0017 BC125AT
bcdDevice 0.01
iManufacturer 1 Uniden America Corp.
iProduct 2 BC125AT
iSerial 3 0001
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0030
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 2 Communications
bInterfaceSubClass 2 Abstract (modem)
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0008 1x 8 bytes
bInterval 10
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 10 CDC Data
bInterfaceSubClass 0 [unknown]
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 0
Device Status: 0x0000
(Bus Powered)
Signed-off-by: Jared Baldridge <jrb@expunge.us>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260530221959.612526-1-jrb@expunge.us
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1788,6 +1788,9 @@ static const struct usb_device_id acm_id
{ USB_DEVICE(0x1901, 0x0006), /* GE Healthcare Patient Monitor UI Controller */
.driver_info = DISABLE_ECHO, /* DISABLE ECHO in termios flag */
},
+ { USB_DEVICE(0x1965, 0x0017), /* Uniden BC125AT */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
{ USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */
.driver_info = NO_UNION_NORMAL, /* has no union descriptor */
},
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 098/699] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 097/699] usb: cdc_acm: Add quirk for Uniden BC125AT scanner Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 099/699] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Greg Kroah-Hartman
` (604 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
Rodrigo Lugathe da Conceição Alves, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Lugathe da Conceição Alves <lugathe2@gmail.com>
commit bd728c3d9b1cc0bb0fda6a7055c5c8b55d7477b2 upstream.
The VIA Labs, Inc. USB 2.0 hub controller (2109:2817),
found in a KVM switch, fails to enumerate high-power devices during
cold boot and system restart.
Applying the kernel parameter
usbcore.quirks=2109:2817:k
resolves the issue.
Enumeration failure log:
usb 1-1.2.3: device descriptor read/64, error -32
usb 1-1.2.3: Device not responding to setup address.
usb 1-1.2.3: device not accepting address 11, error -71
usb 1-1.2-port3: unable to enumerate USB device
Add USB_QUIRK_NO_LPM for this device.
Signed-off-by: Rodrigo Lugathe da Conceição Alves <lugathe2@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260603113626.395612-1-lugathe2@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -561,6 +561,9 @@ static const struct usb_device_id usb_qu
/* VLI disk */
{ USB_DEVICE(0x2109, 0x0711), .driver_info = USB_QUIRK_NO_LPM },
+ /* VIA Labs, Inc. USB2.0 Hub */
+ { USB_DEVICE(0x2109, 0x2817), .driver_info = USB_QUIRK_NO_LPM },
+
/* Raydium Touchscreen */
{ USB_DEVICE(0x2386, 0x3114), .driver_info = USB_QUIRK_NO_LPM },
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 099/699] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 098/699] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 100/699] USB: idmouse: fix use-after-free on disconnect race Greg Kroah-Hartman
` (603 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Maoyi Xie
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit f8f680609c2b3ab795ffcd6f21585b6dfc46d395 upstream.
The OTG branch of composite_setup() falls back to the first
configuration when none is selected:
if (cdev->config)
config = cdev->config;
else
config = list_first_entry(&cdev->configs,
struct usb_configuration, list);
if (!config)
goto done;
...
memcpy(req->buf, config->descriptors[0], value);
list_first_entry() never returns NULL. On an empty list it returns
container_of() of the list head. So the "if (!config)" check is dead.
When cdev->configs is empty, config points at the head inside struct
usb_composite_dev. config->descriptors[0] reads whatever sits at that
offset. The memcpy copies up to w_length bytes of it into the response
buffer.
cdev->configs can be empty in two cases. One is a teardown race on
gadget unbind with a control transfer in flight. The other is a driver
that sets is_otg before it adds a config. A reproducer that holds
cdev->configs empty triggers a KASAN fault in this branch.
Use list_first_entry_or_null() so the existing check does its job.
Fixes: 53e6242db8d6 ("usb: gadget: composite: add USB_DT_OTG request handling")
Cc: stable <stable@kernel.org>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/20260527150832.2943293-1-maoyixie.tju@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/composite.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1747,9 +1747,10 @@ composite_setup(struct usb_gadget *gadge
if (cdev->config)
config = cdev->config;
else
- config = list_first_entry(
+ config = list_first_entry_or_null(
&cdev->configs,
- struct usb_configuration, list);
+ struct usb_configuration,
+ list);
if (!config)
goto done;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 100/699] USB: idmouse: fix use-after-free on disconnect race
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 099/699] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 101/699] USB: ldusb: " Greg Kroah-Hartman
` (602 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ff002c153f9722caece3983cc23dc4d9d4652cb4 upstream.
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: 54d2bc068fd2 ("USB: fix locking in idmouse")
Cc: stable@vger.kernel.org # 2.6.24
Cc: Oliver Neukum <oliver@neukum.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260622152612.116422-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/idmouse.c | 45 ++++++++++++++++++++++-----------------------
1 file changed, 22 insertions(+), 23 deletions(-)
--- a/drivers/usb/misc/idmouse.c
+++ b/drivers/usb/misc/idmouse.c
@@ -63,6 +63,7 @@ MODULE_DEVICE_TABLE(usb, idmouse_table);
/* structure to hold all of our device specific stuff */
struct usb_idmouse {
+ struct kref kref;
struct usb_device *udev; /* save off the usb device pointer */
struct usb_interface *interface; /* the interface for this device */
@@ -209,8 +210,10 @@ static int idmouse_resume(struct usb_int
return 0;
}
-static inline void idmouse_delete(struct usb_idmouse *dev)
+static inline void idmouse_delete(struct kref *kref)
{
+ struct usb_idmouse *dev = container_of(kref, struct usb_idmouse, kref);
+
kfree(dev->bulk_in_buffer);
kfree(dev);
}
@@ -254,6 +257,8 @@ static int idmouse_open(struct inode *in
/* increment our usage count for the driver */
++dev->open;
+ kref_get(&dev->kref);
+
/* save our object in the file's private structure */
file->private_data = dev;
@@ -277,16 +282,11 @@ static int idmouse_release(struct inode
/* lock our device */
mutex_lock(&dev->lock);
-
--dev->open;
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, idmouse_delete);
- if (!dev->present) {
- /* the device was unplugged before the file was released */
- mutex_unlock(&dev->lock);
- idmouse_delete(dev);
- } else {
- mutex_unlock(&dev->lock);
- }
return 0;
}
@@ -334,6 +334,7 @@ static int idmouse_probe(struct usb_inte
if (dev == NULL)
return -ENOMEM;
+ kref_init(&dev->kref);
mutex_init(&dev->lock);
dev->udev = udev;
dev->interface = interface;
@@ -342,8 +343,7 @@ static int idmouse_probe(struct usb_inte
result = usb_find_bulk_in_endpoint(iface_desc, &endpoint);
if (result) {
dev_err(&interface->dev, "Unable to find bulk-in endpoint.\n");
- idmouse_delete(dev);
- return result;
+ goto err_put_kref;
}
dev->orig_bi_size = usb_endpoint_maxp(endpoint);
@@ -351,8 +351,8 @@ static int idmouse_probe(struct usb_inte
dev->bulk_in_endpointAddr = endpoint->bEndpointAddress;
dev->bulk_in_buffer = kmalloc(IMGSIZE + dev->bulk_in_size, GFP_KERNEL);
if (!dev->bulk_in_buffer) {
- idmouse_delete(dev);
- return -ENOMEM;
+ result = -ENOMEM;
+ goto err_put_kref;
}
/* allow device read, write and ioctl */
@@ -364,14 +364,18 @@ static int idmouse_probe(struct usb_inte
if (result) {
/* something prevented us from registering this device */
dev_err(&interface->dev, "Unable to allocate minor number.\n");
- idmouse_delete(dev);
- return result;
+ goto err_put_kref;
}
/* be noisy */
dev_info(&interface->dev,"%s now attached\n",DRIVER_DESC);
return 0;
+
+err_put_kref:
+ kref_put(&dev->kref, idmouse_delete);
+
+ return result;
}
static void idmouse_disconnect(struct usb_interface *interface)
@@ -387,14 +391,9 @@ static void idmouse_disconnect(struct us
/* prevent device read, write and ioctl */
dev->present = 0;
- /* if the device is opened, idmouse_release will clean this up */
- if (!dev->open) {
- mutex_unlock(&dev->lock);
- idmouse_delete(dev);
- } else {
- /* unlock */
- mutex_unlock(&dev->lock);
- }
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, idmouse_delete);
dev_info(&interface->dev, "disconnected\n");
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 101/699] USB: ldusb: fix use-after-free on disconnect race
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 100/699] USB: idmouse: fix use-after-free on disconnect race Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 102/699] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
` (601 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Daniel Walker, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 19bdfc7b3c179331eafa423d87e1336f43bbfeb8 upstream.
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: ce0d7d3f575f ("usb: ldusb: ld_usb semaphore to mutex")
Cc: stable <stable@kernel.org>
Cc: Daniel Walker <dwalker@mvista.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260622152612.116422-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/ldusb.c | 38 ++++++++++++++++++--------------------
1 file changed, 18 insertions(+), 20 deletions(-)
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -151,6 +151,7 @@ MODULE_PARM_DESC(min_interrupt_out_inter
/* Structure to hold all of our device specific stuff */
struct ld_usb {
+ struct kref kref;
struct mutex mutex; /* locks this structure */
struct usb_interface *intf; /* save off the usb interface pointer */
unsigned long disconnected:1;
@@ -202,8 +203,10 @@ static void ld_usb_abort_transfers(struc
/*
* ld_usb_delete
*/
-static void ld_usb_delete(struct ld_usb *dev)
+static void ld_usb_delete(struct kref *kref)
{
+ struct ld_usb *dev = container_of(kref, struct ld_usb, kref);
+
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -356,6 +359,8 @@ static int ld_usb_open(struct inode *ino
goto unlock_exit;
}
+ kref_get(&dev->kref);
+
/* save device in the file's private structure */
file->private_data = dev;
@@ -382,17 +387,8 @@ static int ld_usb_release(struct inode *
mutex_lock(&dev->mutex);
- if (dev->open_count != 1) {
- retval = -ENODEV;
+ if (dev->disconnected)
goto unlock_exit;
- }
- if (dev->disconnected) {
- /* the device was unplugged before the file was released */
- mutex_unlock(&dev->mutex);
- /* unlock here as ld_usb_delete frees dev */
- ld_usb_delete(dev);
- goto exit;
- }
/* wait until write transfer is finished */
if (dev->interrupt_out_busy)
@@ -402,7 +398,7 @@ static int ld_usb_release(struct inode *
unlock_exit:
mutex_unlock(&dev->mutex);
-
+ kref_put(&dev->kref, ld_usb_delete);
exit:
return retval;
}
@@ -661,6 +657,8 @@ static int ld_usb_probe(struct usb_inter
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
if (!dev)
goto exit;
+
+ kref_init(&dev->kref);
mutex_init(&dev->mutex);
spin_lock_init(&dev->rbsl);
dev->intf = intf;
@@ -740,7 +738,7 @@ exit:
return retval;
error:
- ld_usb_delete(dev);
+ kref_put(&dev->kref, ld_usb_delete);
return retval;
}
@@ -768,18 +766,18 @@ static void ld_usb_disconnect(struct usb
mutex_lock(&dev->mutex);
- /* if the device is not opened, then we clean up right now */
- if (!dev->open_count) {
- mutex_unlock(&dev->mutex);
- ld_usb_delete(dev);
- } else {
- dev->disconnected = 1;
+ dev->disconnected = 1;
+
+ if (dev->open_count) {
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
- mutex_unlock(&dev->mutex);
}
+ mutex_unlock(&dev->mutex);
+
+ kref_put(&dev->kref, ld_usb_delete);
+
dev_info(&intf->dev, "LD USB Device #%d now disconnected\n",
(minor - USB_LD_MINOR_BASE));
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 102/699] USB: iowarrior: fix use-after-free on disconnect
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 101/699] USB: ldusb: " Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 103/699] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Greg Kroah-Hartman
` (600 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+ad2aac2febc3bedf0962, stable,
Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit bc0e4f16c44e50daa0b1ea729934baa3b4815dee upstream.
Submitted write URBs are not stopped on close() and therefore need to be
stopped unconditionally on disconnect() to avoid use-after-free in the
completion handler.
Fixes: b5f8d46867ca ("USB: iowarrior: fix use-after-free after driver unbind")
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Reported-by: syzbot+ad2aac2febc3bedf0962@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/6a0ce39b.170a0220.39a13.0007.GAE@google.com/
Cc: stable <stable@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260523170523.1074563-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/iowarrior.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -923,13 +923,15 @@ static void iowarrior_disconnect(struct
/* prevent device read, write and ioctl */
dev->present = 0;
+ /* write urbs are not stopped on close() so kill unconditionally */
+ usb_kill_anchored_urbs(&dev->submitted);
+
if (dev->opened) {
/* There is a process that holds a filedescriptor to the device ,
so we only shutdown read-/write-ops going on.
Deleting the device is postponed until close() was called.
*/
usb_kill_urb(dev->int_in_urb);
- usb_kill_anchored_urbs(&dev->submitted);
wake_up_interruptible(&dev->read_wait);
wake_up_interruptible(&dev->write_wait);
mutex_unlock(&dev->mutex);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 103/699] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 102/699] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 104/699] USB: legousbtower: fix use-after-free on disconnect race Greg Kroah-Hartman
` (599 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Erich E. Hoover, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erich E. Hoover <erich.e.hoover@gmail.com>
commit fc591787785b9709a0bb65a7df3ba2537d611c47 upstream.
The Samsung T5 EVO Portable SSD (04e8:6200) exhibit two forms of
link instability when USB Link Power Management is enabled:
1. The units fail to initialize properly on first detection,
resulting in a lockup in the drive where it must be power cycled
or the kernel will not recognize the presence of the device.
2. If used for sustained operations (small amounts of continuous
data are transferred to the unit) then the unit will "hiccup"
after roughly 8 hours of use and will disconnect and reconnect.
This has a certain probability of triggering the first issue,
but also causes mount points to become invalid since the device
gets issued a new letter.
Signed-off-by: Erich E. Hoover <erich.e.hoover@gmail.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/20260602204508.48856-1-erich.e.hoover@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -292,6 +292,9 @@ static const struct usb_device_id usb_qu
/* CarrolTouch 4500U */
{ USB_DEVICE(0x04e7, 0x0030), .driver_info = USB_QUIRK_RESET_RESUME },
+ /* Samsung T5 EVO Portable SSD */
+ { USB_DEVICE(0x04e8, 0x6200), .driver_info = USB_QUIRK_NO_LPM },
+
/* Samsung Android phone modem - ID conflict with SPH-I500 */
{ USB_DEVICE(0x04e8, 0x6601), .driver_info =
USB_QUIRK_CONFIG_INTF_STRINGS },
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 104/699] USB: legousbtower: fix use-after-free on disconnect race
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 103/699] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 105/699] usb: sl811-hcd: disable controller wakeup on remove Greg Kroah-Hartman
` (598 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Daniel Walker, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 62fc8eb1b1481051f7bab4aa93d79809053dd09f upstream.
mutex_unlock() may access the mutex structure after releasing the lock
and therefore cannot be used to manage lifetime of objects directly
(unlike spinlocks and refcounts). [1][2]
Use a kref to release the driver data to avoid use-after-free in
mutex_unlock() when release() races with disconnect().
[1] a51749ab34d9 ("locking/mutex: Document that mutex_unlock() is
non-atomic")
[2] 2b9d9e0a9ba0 ("locking/mutex: Clarify that mutex_unlock(), and most
other sleeping locks, can still use the lock object
after it's unlocked")
Fixes: 18bcbcfe9ca2 ("USB: misc: legousbtower: semaphore to mutex")
Cc: stable <stable@kernel.org>
Cc: Daniel Walker <dwalker@mvista.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260622152612.116422-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/legousbtower.c | 37 +++++++++++++++++++------------------
1 file changed, 19 insertions(+), 18 deletions(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -185,6 +185,7 @@ MODULE_DEVICE_TABLE(usb, tower_table);
/* Structure to hold all of our device specific stuff */
struct lego_usb_tower {
+ struct kref kref;
struct mutex lock; /* locks this structure */
struct usb_device *udev; /* save off the usb device pointer */
unsigned char minor; /* the starting minor number for this device */
@@ -220,7 +221,6 @@ struct lego_usb_tower {
/* local function prototypes */
static ssize_t tower_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos);
static ssize_t tower_write(struct file *file, const char __user *buffer, size_t count, loff_t *ppos);
-static inline void tower_delete(struct lego_usb_tower *dev);
static int tower_open(struct inode *inode, struct file *file);
static int tower_release(struct inode *inode, struct file *file);
static __poll_t tower_poll(struct file *file, poll_table *wait);
@@ -286,8 +286,10 @@ static inline void lego_usb_tower_debug_
/*
* tower_delete
*/
-static inline void tower_delete(struct lego_usb_tower *dev)
+static inline void tower_delete(struct kref *kref)
{
+ struct lego_usb_tower *dev = container_of(kref, struct lego_usb_tower, kref);
+
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -381,6 +383,8 @@ static int tower_open(struct inode *inod
dev->open_count = 1;
+ kref_get(&dev->kref);
+
unlock_exit:
mutex_unlock(&dev->lock);
@@ -404,14 +408,8 @@ static int tower_release(struct inode *i
mutex_lock(&dev->lock);
- if (dev->disconnected) {
- /* the device was unplugged before the file was released */
-
- /* unlock here as tower_delete frees dev */
- mutex_unlock(&dev->lock);
- tower_delete(dev);
- goto exit;
- }
+ if (dev->disconnected)
+ goto out_unlock;
/* wait until write transfer is finished */
if (dev->interrupt_out_busy) {
@@ -425,7 +423,9 @@ static int tower_release(struct inode *i
dev->open_count = 0;
+out_unlock:
mutex_unlock(&dev->lock);
+ kref_put(&dev->kref, tower_delete);
exit:
return retval;
}
@@ -752,6 +752,7 @@ static int tower_probe(struct usb_interf
if (!dev)
goto exit;
+ kref_init(&dev->kref);
mutex_init(&dev->lock);
dev->udev = usb_get_dev(udev);
spin_lock_init(&dev->read_buffer_lock);
@@ -828,7 +829,7 @@ exit:
return retval;
error:
- tower_delete(dev);
+ kref_put(&dev->kref, tower_delete);
return retval;
}
@@ -856,18 +857,18 @@ static void tower_disconnect(struct usb_
mutex_lock(&dev->lock);
- /* if the device is not opened, then we clean up right now */
- if (!dev->open_count) {
- mutex_unlock(&dev->lock);
- tower_delete(dev);
- } else {
- dev->disconnected = 1;
+ dev->disconnected = 1;
+
+ if (dev->open_count) {
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
- mutex_unlock(&dev->lock);
}
+ mutex_unlock(&dev->lock);
+
+ kref_put(&dev->kref, tower_delete);
+
dev_info(&interface->dev, "LEGO USB Tower #%d now disconnected\n",
(minor - LEGO_USB_TOWER_MINOR_BASE));
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 105/699] usb: sl811-hcd: disable controller wakeup on remove
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 104/699] USB: legousbtower: fix use-after-free on disconnect race Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 106/699] USB: storage: include US_FL_NO_SAME in quirks mask Greg Kroah-Hartman
` (597 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Ijae Kim, Myeonghun Pak
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 4e8ba83ac4d311992e6a4c21de5dd705010df06e upstream.
sl811h_probe() enables the HCD controller device as a wakeup source after
usb_add_hcd() succeeds, but sl811h_remove() removes the HCD and releases
the driver resources without disabling that wakeup source.
Disable controller wakeup after usb_remove_hcd() and before usb_put_hcd()
so the wakeup source object is detached while the controller device pointer
is still available.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 3c9740a117d4 ("usb: hcd: move controller wakeup setting initialization to individual driver")
Cc: stable <stable@kernel.org>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260701121625.96815-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/sl811-hcd.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -1591,6 +1591,7 @@ sl811h_remove(struct platform_device *de
remove_debug_file(sl811);
usb_remove_hcd(hcd);
+ device_wakeup_disable(hcd->self.controller);
/* some platforms may use IORESOURCE_IO */
res = platform_get_resource(dev, IORESOURCE_MEM, 1);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 106/699] USB: storage: include US_FL_NO_SAME in quirks mask
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 105/699] usb: sl811-hcd: disable controller wakeup on remove Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 107/699] USB: misc: uss720: unregister parport on probe failure Greg Kroah-Hartman
` (596 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Xu Rao, Alan Stern
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 2c00e09e3f9f06f8434f5ea2ee6179ce46692ee6 upstream.
usb_stor_adjust_quirks() parses the usb-storage.quirks module
parameter into a new flag set and then applies it with the quirk
mask to override built-in flags.
The mask is meant to cover the flags that can be overridden by
the module parameter. The 'k' quirk character sets US_FL_NO_SAME,
but US_FL_NO_SAME is not included in the mask.
As a result, the module parameter can set US_FL_NO_SAME, but it
cannot clear a built-in US_FL_NO_SAME flag by providing an override
entry that omits 'k'.
Add US_FL_NO_SAME to the mask so that the module parameter can
override it in the same way as the other supported flags.
Fixes: 8010622c86ca ("USB: UAS: introduce a quirk to set no_write_same")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/3BCE5880F9A45C2E+20260602053842.2920137-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -488,7 +488,7 @@ void usb_stor_adjust_quirks(struct usb_d
US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE |
US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES |
US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS |
- US_FL_ALWAYS_SYNC);
+ US_FL_ALWAYS_SYNC | US_FL_NO_SAME);
p = quirks;
while (*p) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 107/699] USB: misc: uss720: unregister parport on probe failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 106/699] USB: storage: include US_FL_NO_SAME in quirks mask Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 108/699] usb: mtu3: unmap request DMA on queue failure Greg Kroah-Hartman
` (595 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ijae Kim, Myeonghun Pak,
Alex Henrie
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit b4ecbdc4f8830f5586c4a5cfc384c00f20f8f8b3 upstream.
uss720_probe() registers a parport before reading the 1284 register used
to detect unsupported Belkin F5U002 adapters. If get_1284_register()
fails, the error path drops the driver private data and the USB device
reference, but leaves the parport device registered.
Leaving the port registered is more than a private allocation leak:
parport_register_port() has already reserved a parport number and
registered the parport bus device, while pp->private_data still points at
the private data that the common error path is about to release.
Undo the pre-announce registration in the get_1284_register() failure
branch before jumping to the common private-data cleanup path. Clear
priv->pp first, matching the disconnect path and avoiding a stale pointer
in the private data.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 3295f1b866bf ("usb: misc: uss720: check for incompatible versions of the Belkin F5U002")
Cc: stable <stable@kernel.org>
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Alex Henrie <alexhenrie24@gmail.com>
Link: https://patch.msgid.link/20260706151049.63470-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/uss720.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/uss720.c
+++ b/drivers/usb/misc/uss720.c
@@ -732,8 +732,11 @@ static int uss720_probe(struct usb_inter
* here. */
ret = get_1284_register(pp, 0, ®, GFP_KERNEL);
dev_dbg(&intf->dev, "reg: %7ph\n", priv->reg);
- if (ret < 0)
+ if (ret < 0) {
+ priv->pp = NULL;
+ parport_del_port(pp);
goto probe_abort;
+ }
ret = usb_find_last_int_in_endpoint(interface, &epd);
if (!ret) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 108/699] usb: mtu3: unmap request DMA on queue failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 107/699] USB: misc: uss720: unregister parport on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 109/699] USB: serial: option: add Telit Cinterion FE990D50 compositions Greg Kroah-Hartman
` (594 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Haoxiang Li
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 0bddda5a11665c210339de76d27ebbd1a2e0b43c upstream.
mtu3_gadget_queue() maps the request before checking whether
the QMU GPD ring can accept another transfer. the request is
returned with -EAGAIN before it is linked on the endpoint
request list if mtu3_prepare_transfer() fails.
Normal completion and dequeue paths unmap requests from
mtu3_req_complete(), but this error path never reaches that
helper, so the DMA mapping is left active. Unmap the request
before returning from the failed queue path.
Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260623093325.2105323-1-haoxiang_li2024@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/mtu3/mtu3_gadget.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -305,6 +305,7 @@ static int mtu3_gadget_queue(struct usb_
if (mtu3_prepare_transfer(mep)) {
ret = -EAGAIN;
+ usb_gadget_unmap_request(&mtu->g, req, mep->is_in);
goto error;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 109/699] USB: serial: option: add Telit Cinterion FE990D50 compositions
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 108/699] usb: mtu3: unmap request DMA on queue failure Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 110/699] USB: serial: digi_acceleport: fix broken rx after throttle Greg Kroah-Hartman
` (593 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Porcedda, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <fabio.porcedda@gmail.com>
commit b33ab1dd80f5c1742f49eb6ec7b337c5ffcf3d32 upstream.
Add support for Telit Cinterion FE990D50 compositions:
0x990: RNDIS + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0990 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x991: rmnet + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 9 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0991 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=(none)
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x992: MBIM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 12 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0992 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x993: ECM + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) +
tty (diag) + ADPL + adb
T: Bus=01 Lev=01 Prnt=01 Port=06 Cnt=03 Dev#= 15 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=0993 Rev=06.06
S: Manufacturer=Telit Cinterion
S: Product=FE990
S: SerialNumber=90b6a3ed
C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
E: Ad=82(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8c(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 8 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=8d(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Cc: stable@vger.kernel.org
Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1326,6 +1326,22 @@ static const struct usb_device_id option
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0990, 0xff, 0xff, 0x30), /* Telit FE990D50 (RNDIS) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0990, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0990, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0991, 0xff, 0xff, 0x30), /* Telit FE990D50 (rmnet) */
+ .driver_info = NCTRL(5) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0991, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0991, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0992, 0xff, 0xff, 0x30), /* Telit FE990D50 (MBIM) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0992, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0992, 0xff, 0xff, 0x60) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0993, 0xff, 0xff, 0x30), /* Telit FE990D50 (ECM) */
+ .driver_info = NCTRL(6) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0993, 0xff, 0xff, 0x40) },
+ { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x0993, 0xff, 0xff, 0x60) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1031, 0xff), /* Telit LE910C1-EUX */
.driver_info = NCTRL(0) | RSVD(3) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 110/699] USB: serial: digi_acceleport: fix broken rx after throttle
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 109/699] USB: serial: option: add Telit Cinterion FE990D50 compositions Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 111/699] USB: serial: digi_acceleport: fix hard lockup on disconnect Greg Kroah-Hartman
` (592 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 83a3dfc018943b05b6daf3a6f891833e1aabfa1f upstream.
If the port is closed while throttled, the read urb is never resubmitted
and the port will not receive any further data until the device is
reconnected (or the driver is rebound).
Clear the throttle flags and submit the urb if needed when opening the
port.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/digi_acceleport.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1070,6 +1070,7 @@ static int digi_open(struct tty_struct *
unsigned char buf[32];
struct digi_port *priv = usb_get_serial_port_data(port);
struct ktermios not_termios;
+ int throttled;
/* be sure the device is started up */
if (digi_startup_device(port->serial) != 0)
@@ -1097,6 +1098,21 @@ static int digi_open(struct tty_struct *
not_termios.c_iflag = ~tty->termios.c_iflag;
digi_set_termios(tty, port, ¬_termios);
}
+
+ spin_lock_irq(&priv->dp_port_lock);
+ throttled = priv->dp_throttle_restart;
+ priv->dp_throttled = 0;
+ priv->dp_throttle_restart = 0;
+ spin_unlock_irq(&priv->dp_port_lock);
+
+ if (throttled) {
+ ret = usb_submit_urb(port->read_urb, GFP_KERNEL);
+ if (ret) {
+ dev_err(&port->dev, "failed to submit read urb: %d\n", ret);
+ return ret;
+ }
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 111/699] USB: serial: digi_acceleport: fix hard lockup on disconnect
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 110/699] USB: serial: digi_acceleport: fix broken rx after throttle Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 112/699] USB: ulpi: fix memory leak on registration failure Greg Kroah-Hartman
` (591 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 5c1ea24b53bf3bfb859f0a05573997487975da23 upstream.
If submitting the OOB write urb fails persistently (e.g if the device is
being disconnected) the driver would loop indefinitely with interrupts
disabled.
Check for urb submission errors when sending OOB commands to avoid
hanging if, for example, open(), set_termios() or close() races with a
physical disconnect.
This is issue was flagged by Sashiko when reviewing an unrelated change
to the driver.
Link: https://sashiko.dev/#/patchset/20260610132232.356139-1-johan%40kernel.org?part=1
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/digi_acceleport.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -394,12 +394,14 @@ static int digi_write_oob_command(struct
len &= ~3;
memcpy(oob_port->write_urb->transfer_buffer, buf, len);
oob_port->write_urb->transfer_buffer_length = len;
+
ret = usb_submit_urb(oob_port->write_urb, GFP_ATOMIC);
- if (ret == 0) {
- oob_priv->dp_write_urb_in_use = 1;
- count -= len;
- buf += len;
- }
+ if (ret)
+ break;
+
+ oob_priv->dp_write_urb_in_use = 1;
+ count -= len;
+ buf += len;
}
spin_unlock_irqrestore(&oob_priv->dp_port_lock, flags);
if (ret)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 112/699] USB: ulpi: fix memory leak on registration failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 111/699] USB: serial: digi_acceleport: fix hard lockup on disconnect Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 113/699] USB: usb-storage: ene_ub6250: restore media-ready check Greg Kroah-Hartman
` (590 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Heikki Krogerus,
Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 8af6812795869a66e9b26044f455b13deecdb69c upstream.
The allocated device name is never freed on early ULPI device
registration failures.
Fix this by initialising the device structure earlier and releasing the
initial reference whenever registration fails.
Fixes: 289fcff4bcdb ("usb: add bus type for USB ULPI")
Cc: stable <stable@kernel.org>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260608145803.69360-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/common/ulpi.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
--- a/drivers/usb/common/ulpi.c
+++ b/drivers/usb/common/ulpi.c
@@ -241,28 +241,24 @@ static int ulpi_register(struct device *
ulpi->dev.parent = dev; /* needed early for ops */
ulpi->dev.bus = &ulpi_bus;
ulpi->dev.type = &ulpi_dev_type;
+
+ device_initialize(&ulpi->dev);
+
dev_set_name(&ulpi->dev, "%s.ulpi", dev_name(dev));
ACPI_COMPANION_SET(&ulpi->dev, ACPI_COMPANION(dev));
ret = ulpi_of_register(ulpi);
- if (ret) {
- kfree(ulpi);
+ if (ret)
return ret;
- }
ret = ulpi_read_id(ulpi);
- if (ret) {
- of_node_put(ulpi->dev.of_node);
- kfree(ulpi);
+ if (ret)
return ret;
- }
- ret = device_register(&ulpi->dev);
- if (ret) {
- put_device(&ulpi->dev);
+ ret = device_add(&ulpi->dev);
+ if (ret)
return ret;
- }
dev_dbg(&ulpi->dev, "registered ULPI PHY: vendor %04x, product %04x\n",
ulpi->id.vendor, ulpi->id.product);
@@ -291,9 +287,10 @@ struct ulpi *ulpi_register_interface(str
ulpi->ops = ops;
ret = ulpi_register(dev, ulpi);
- if (ret)
+ if (ret) {
+ put_device(&ulpi->dev);
return ERR_PTR(ret);
-
+ }
return ulpi;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 113/699] USB: usb-storage: ene_ub6250: restore media-ready check
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 112/699] USB: ulpi: fix memory leak on registration failure Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 114/699] usbip: tools: support SuperSpeedPlus devices Greg Kroah-Hartman
` (589 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Xu Rao, Alan Stern
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 5fc3f333c001f1e308bbcdeecdec0d054d24338b upstream.
Commit 1892bf90677a ("USB: usb-storage: Fix use of bitfields for
hardware data in ene_ub6250.c") converted the media status fields from
bitfields to bit masks.
The original ene_transport() test called ene_init() only when neither
media type was ready:
!(sd_ready || ms_ready)
The converted test became:
!sd_ready || ms_ready
This is not equivalent. Restore the original semantics by testing that
both ready bits are clear before calling ene_init().
Fixes: 1892bf90677a ("USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/F42641386E32404F+20260626070607.4119527-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/ene_ub6250.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -2305,7 +2305,8 @@ static int ene_transport(struct scsi_cmn
/*US_DEBUG(usb_stor_show_command(us, srb)); */
scsi_set_resid(srb, 0);
- if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready)))
+ if (unlikely(!(info->SD_Status & SD_Ready) &&
+ !(info->MS_Status & MS_Ready)))
result = ene_init(us);
if (result == USB_STOR_XFER_GOOD) {
result = USB_STOR_TRANSPORT_ERROR;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 114/699] usbip: tools: support SuperSpeedPlus devices
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 113/699] USB: usb-storage: ene_ub6250: restore media-ready check Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 115/699] usbip: vudc: fix NULL deref in vep_dequeue() Greg Kroah-Hartman
` (588 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Yichong Chen, Shuah Khan
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 195e667c8719480c320cd48ac0fbf1cb81d6ffe0 upstream.
USB devices running at SuperSpeedPlus report "10000" or "20000" in
their sysfs speed attribute. usbip currently maps only "5000" to
USB_SPEED_SUPER, so a SuperSpeedPlus device is imported as
USB_SPEED_UNKNOWN.
The attach request is then rejected by vhci_hcd:
vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN
Map the SuperSpeedPlus sysfs speed values to USB_SPEED_SUPER_PLUS, use
the SuperSpeed VHCI hub for SuperSpeedPlus devices, and recognize the
gadget current_speed string used by the kernel.
Fixes: b2316645ca5e ("usb: show speed "10000" in sysfs for USB 3.1 SuperSpeedPlus devices")
Cc: stable <stable@kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://patch.msgid.link/00C828F338E43447+20260617020613.199086-1-chenyichong@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/usb/usbip/libsrc/usbip_common.c | 2 ++
tools/usb/usbip/libsrc/usbip_device_driver.c | 4 ++++
tools/usb/usbip/libsrc/vhci_driver.c | 1 +
3 files changed, 7 insertions(+)
--- a/tools/usb/usbip/libsrc/usbip_common.c
+++ b/tools/usb/usbip/libsrc/usbip_common.c
@@ -29,6 +29,8 @@ static const struct speed_string speed_s
{ USB_SPEED_HIGH, "480", "High Speed(480Mbps)" },
{ USB_SPEED_WIRELESS, "53.3-480", "Wireless"},
{ USB_SPEED_SUPER, "5000", "Super Speed(5000Mbps)" },
+ { USB_SPEED_SUPER_PLUS, "10000", "Super Speed Plus(10000Mbps)" },
+ { USB_SPEED_SUPER_PLUS, "20000", "Super Speed Plus(20000Mbps)" },
{ 0, NULL, NULL }
};
--- a/tools/usb/usbip/libsrc/usbip_device_driver.c
+++ b/tools/usb/usbip/libsrc/usbip_device_driver.c
@@ -57,6 +57,10 @@ static struct {
.speed = USB_SPEED_SUPER,
.name = "super-speed",
},
+ {
+ .speed = USB_SPEED_SUPER_PLUS,
+ .name = "super-speed-plus",
+ },
};
static
--- a/tools/usb/usbip/libsrc/vhci_driver.c
+++ b/tools/usb/usbip/libsrc/vhci_driver.c
@@ -338,6 +338,7 @@ int usbip_vhci_get_free_port(uint32_t sp
switch (speed) {
case USB_SPEED_SUPER:
+ case USB_SPEED_SUPER_PLUS:
if (vhci_driver->idev[i].hub != HUB_SPEED_SUPER)
continue;
break;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 115/699] usbip: vudc: fix NULL deref in vep_dequeue()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 114/699] usbip: tools: support SuperSpeedPlus devices Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 116/699] usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Greg Kroah-Hartman
` (587 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Igor Kotrasinski, Sam Day
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sam Day <me@samcday.com>
commit c5371e0b91b24159a3ebaa61e70b0980bcf03c0a upstream.
vep_alloc_request() wasn't initializing vrequest->udc, so cancellations
on the FunctionFS AIO path were arriving in vep_dequeue without a valid
UDC reference.
Since vrequest->udc is never actually properly used anywhere, we opt to
remove it, and update vep_dequeue to obtain a reference to the udc with
ep_to_vudc(), consistent with the other vep_ ops.
AFAICT this bug has existed for ~10 years. Seems that nobody has really
stressed the FunctionFS AIO path on usbip's vudc.
I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints
via AIO. Before the fix, running `usbip attach` from the host would
cause the guest to oops with the following backtrace:
Call trace:
vep_dequeue+0x1c/0xe4 (P)
usb_ep_dequeue+0x14/0x20
ffs_aio_cancel+0x24/0x34
__arm64_sys_io_cancel+0xb0/0x124
do_el0_svc+0x68/0x100
el0_svc+0x18/0x5c
el0t_64_sync_handler+0x98/0xdc
el0t_64_sync+0x154/0x158
Assisted-by: opencode:openai/gpt-5.5
Cc: stable <stable@kernel.org>
Fixes: b6a0ca111867 ("usbip: vudc: Add UDC specific ops")
Reviewed-by: Igor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: Sam Day <me@samcday.com>
Link: https://patch.msgid.link/20260626-usbip-vudc-deque-fix-v3-1-98c2dc4d6a48@samcday.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/usbip/vudc.h | 1 -
drivers/usb/usbip/vudc_dev.c | 4 +---
2 files changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/usbip/vudc.h
+++ b/drivers/usb/usbip/vudc.h
@@ -38,7 +38,6 @@ struct vep {
struct vrequest {
struct usb_request req;
- struct vudc *udc;
struct list_head req_entry; /* Request queue */
};
--- a/drivers/usb/usbip/vudc_dev.c
+++ b/drivers/usb/usbip/vudc_dev.c
@@ -333,7 +333,6 @@ static int vep_queue(struct usb_ep *_ep,
static int vep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
{
struct vep *ep;
- struct vrequest *req;
struct vudc *udc;
struct vrequest *lst;
unsigned long flags;
@@ -343,8 +342,7 @@ static int vep_dequeue(struct usb_ep *_e
return ret;
ep = to_vep(_ep);
- req = to_vrequest(_req);
- udc = req->udc;
+ udc = ep_to_vudc(ep);
if (!udc->driver)
return -ESHUTDOWN;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 116/699] usb: typec: tcpm: Validate SVID index in svdm_consume_modes()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 115/699] usbip: vudc: fix NULL deref in vep_dequeue() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 117/699] usb: typec: ucsi: Invert DisplayPort role assignment Greg Kroah-Hartman
` (586 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Badhri Jagan Sridharan,
RD Babiera, Heikki Krogerus
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Badhri Jagan Sridharan <badhri@google.com>
commit 7b681dd5fbf60b24a13c14661e5b7735759fb491 upstream.
In svdm_consume_modes(), the SVID value is read from pmdata->svids using
pmdata->svid_index as an array index without bounds validation:
paltmode->svid = pmdata->svids[pmdata->svid_index];
If pmdata->svid_index is driven beyond SVID_DISCOVERY_MAX (16), it results
in an out-of-bounds read of the pmdata->svids array. Because pd_mode_data
is embedded inside struct tcpm_port, indexing past svids reads into
adjacent fields. In particular:
- At index 16, it reads the altmodes count.
- At index 18 and beyond, it reads into altmode_desc[], which contains
partner-supplied SVDM Discovery Modes VDOs.
By injecting a chosen SVID into altmode_desc[0].vdo and driving svid_index
to 20, the partner can force paltmode->svid to be loaded with an arbitrary,
partner- chosen SVID, which is then registered via
typec_partner_register_altmode().
Fix this by validating that pmdata->svid_index is non-negative and strictly
less than pmdata->nsvids before accessing the pmdata->svids array inside
svdm_consume_modes().
Assisted-by: Antigravity:gemini-3.5-flash
Fixes: 4ab8c18d4d67 ("usb: typec: Register a device for every mode")
Cc: stable <stable@kernel.org>
Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Reviewed-by: RD Babiera <rdbabiera@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260622220803.305750-1-badhri@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpm.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -1157,6 +1157,11 @@ static void svdm_consume_modes(struct tc
return;
}
+ if (pmdata->svid_index < 0 || pmdata->svid_index >= pmdata->nsvids) {
+ tcpm_log(port, "Invalid SVID index %d", pmdata->svid_index);
+ return;
+ }
+
for (i = 1; i < cnt; i++) {
paltmode = &pmdata->altmode_desc[pmdata->altmodes];
memset(paltmode, 0, sizeof(*paltmode));
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 117/699] usb: typec: ucsi: Invert DisplayPort role assignment
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 116/699] usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 118/699] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Greg Kroah-Hartman
` (585 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Andrei Kuchynski,
Heikki Krogerus
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Kuchynski <akuchynski@chromium.org>
commit d092d7edf8faefa3e27b9fc7f0e7904b06c833a2 upstream.
The existing implementation assigned these flags backwards, configuring
the partner's DisplayPort role to match the port's role instead of
complementing it.
This prevents proper configuration during DP altmode activation, often
causing `pin_assignment` to remain 0 in `dp_altmode_configure()` and
resulting in VDM negotiation failures:
[ 583.328246] typec port1.1: VDM 0xff01a150 failed
Additionally, the fix ensures that the `pin_assignment` sysfs attribute
displays the correct values.
Cc: stable <stable@kernel.org>
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260601142837.3240207-1-akuchynski@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/displayport.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -150,12 +150,12 @@ static int ucsi_displayport_status_updat
* that Multi-function is preferred.
*/
if (DP_CAP_CAPABILITY(cap) & DP_CAP_UFP_D) {
- dp->data.status |= DP_STATUS_CON_UFP_D;
+ dp->data.status |= DP_STATUS_CON_DFP_D;
if (DP_CAP_UFP_D_PIN_ASSIGN(cap) & BIT(DP_PIN_ASSIGN_D))
dp->data.status |= DP_STATUS_PREFER_MULTI_FUNC;
} else {
- dp->data.status |= DP_STATUS_CON_DFP_D;
+ dp->data.status |= DP_STATUS_CON_UFP_D;
if (DP_CAP_DFP_D_PIN_ASSIGN(cap) & BIT(DP_PIN_ASSIGN_D))
dp->data.status |= DP_STATUS_PREFER_MULTI_FUNC;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 118/699] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 117/699] usb: typec: ucsi: Invert DisplayPort role assignment Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 119/699] iio: adc: spear: Initialize completion before requesting IRQ Greg Kroah-Hartman
` (584 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Madhu M, Jameson Thies,
Andrei Kuchynski, Heikki Krogerus
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhu M <madhu.m@intel.com>
commit 735a461d060d4eeb2f9732aba1295bc32a3982e2 upstream.
In the UCSI Specification Revision 3.1 RC1, bits 32-63 of the SET_NEW_CAM
command hold the 32-bit Alternate Mode Specific (AMSpecific) field.
For DisplayPort Alternate Mode, this field must contain the full
32-bit DisplayPort configuration VDO payload that the OPM wants the
connector to operate in, rather than just the pin assignment value.
This AMSpecific value follows the DisplayPort Configurations defined
in the DisplayPort Alt Mode on USB Type-C Specification v2.1a,
Table 5-13: SOP DisplayPort Configurations.
Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc: stable <stable@kernel.org>
Signed-off-by: Madhu M <madhu.m@intel.com>
Reviewed-by: Jameson Thies <jthies@google.com>
Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260619153311.3526083-1-madhu.m@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/displayport.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -169,13 +169,12 @@ static int ucsi_displayport_status_updat
static int ucsi_displayport_configure(struct ucsi_dp *dp)
{
- u32 pins = DP_CONF_GET_PIN_ASSIGN(dp->data.conf);
u64 command;
if (!dp->override)
return 0;
- command = UCSI_CMD_SET_NEW_CAM(dp->con->num, 1, dp->offset, pins);
+ command = UCSI_CMD_SET_NEW_CAM(dp->con->num, 1, dp->offset, dp->data.conf);
return ucsi_send_command(dp->con->ucsi, command, NULL, 0);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 119/699] iio: adc: spear: Initialize completion before requesting IRQ
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 118/699] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 120/699] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Greg Kroah-Hartman
` (583 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sangyun Kim, Kyungwook Boo,
Jaeyoung Chung, Maxwell Doose, Vladimir Zapolskiy, Stable,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
[ Upstream commit 3ee2128b6f0eb0be7b6cb8f6e0f1f113a65201a0 ]
In the report from Jaeyoung Chung:
"spear_adc_probe() in drivers/iio/adc/spear_adc.c registers its
interrupt handler with devm_request_irq() before it initializes
st->completion with init_completion(). If an interrupt arrives after
devm_request_irq() and before init_completion(), the handler calls
complete() on an uninitialized completion, causing a kernel panic.
The probe path, in spear_adc_probe():
iodev = devm_iio_device_alloc(&pdev->dev, sizeof(*st)); /* st kzalloc-zeroed */
...
retval = devm_request_irq(&pdev->dev, irq, spear_adc_isr, 0,
LPC32XXAD_NAME, st); /* register handler */
...
init_completion(&st->completion); /* initialize completion */
spear_adc_isr() calls complete():
complete(&st->completion);
If the device raises an interrupt before init_completion() runs,
complete() acquires the uninitialized wait.lock and walks the zeroed
task_list in swake_up_locked(). The zeroed task_list makes list_empty()
return false, so swake_up_locked() dereferences a NULL list entry,
triggering a KASAN wild-memory-access."
Fix the chance of a spurious IRQ causing an uninitialized pointer
dereference by moving init_completion() above devm_request_irq().
Fixes: b586e5d9eee0 ("staging:iio:adc:spear rename device specific state structure to _state")
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Closes: https://lore.kernel.org/linux-iio/20260610115700.774689-1-jjy600901@snu.ac.kr/
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/spear_adc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
index 4d4aff88aa6ceb..12e0811a47b71a 100644
--- a/drivers/iio/adc/spear_adc.c
+++ b/drivers/iio/adc/spear_adc.c
@@ -274,6 +274,8 @@ static int spear_adc_probe(struct platform_device *pdev)
st = iio_priv(indio_dev);
st->np = np;
+ init_completion(&st->completion);
+
/*
* SPEAr600 has a different register layout than other SPEAr SoC's
* (e.g. SPEAr3xx). Let's provide two register base addresses
@@ -334,8 +336,6 @@ static int spear_adc_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, indio_dev);
- init_completion(&st->completion);
-
indio_dev->name = SPEAR_ADC_MOD_NAME;
indio_dev->info = &spear_adc_info;
indio_dev->modes = INDIO_DIRECT_MODE;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 120/699] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 119/699] iio: adc: spear: Initialize completion before requesting IRQ Greg Kroah-Hartman
@ 2026-07-21 15:17 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 121/699] udf: validate free block extents against the partition length Greg Kroah-Hartman
` (582 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:17 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liviu Stan, Stable, Jonathan Cameron,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liviu Stan <liviu.stan@analog.com>
[ Upstream commit 434c150752675f44dc52c384a7fa22e5176bc35a ]
When adi,number-of-wires is absent, n_wires is left at 0. The binding
documents a default of 2 wires, matching the hardware default. However
the current-rotate validation checks n_wires == 2 || n_wires == 3, so
with n_wires = 0 the guard is bypassed and adi,current-rotate is accepted
for a 2-wire RTD.
Initialize n_wires = 2 to match the binding default and ensure the
rotation check fires correctly when the property is absent.
Fixes: f110f3188e56 ("iio: temperature: Add support for LTC2983")
Signed-off-by: Liviu Stan <liviu.stan@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Liviu Stan <liviu.stan@analog.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/temperature/ltc2983.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iio/temperature/ltc2983.c b/drivers/iio/temperature/ltc2983.c
index ecc8b2e129b896..c6748cfc5d5ce2 100644
--- a/drivers/iio/temperature/ltc2983.c
+++ b/drivers/iio/temperature/ltc2983.c
@@ -697,7 +697,7 @@ static struct ltc2983_sensor *ltc2983_rtd_new(const struct device_node *child,
int ret = 0;
struct device *dev = &st->spi->dev;
struct device_node *phandle;
- u32 excitation_current = 0, n_wires = 0;
+ u32 excitation_current = 0, n_wires = 2;
rtd = devm_kzalloc(dev, sizeof(*rtd), GFP_KERNEL);
if (!rtd)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 121/699] udf: validate free block extents against the partition length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-07-21 15:17 ` [PATCH 5.10 120/699] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 122/699] udf: validate VAT header length against the VAT inode size Greg Kroah-Hartman
` (581 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 5f0419457f89dce1a3f1c8e62a3adf2f39ab8168 upstream.
udf_free_blocks() checks the logical block number and count against the
partition length, but drops the extent offset from that final bound. A
crafted extent can pass the guard while logicalBlockNum + offset + count
points past the partition, which later indexes past the space bitmap
array.
A single ftruncate(2) on a file backed by such an extent reliably
panics the kernel. This is a local availability issue. On desktop
systems where UDisks/polkit allows the active user to mount removable
UDF media without CAP_SYS_ADMIN, an unprivileged local user can supply
the crafted filesystem and trigger the panic by truncating a writable
file on it. Systems that require root or CAP_SYS_ADMIN to mount the
image have a higher prerequisite.
No confidentiality or integrity impact is claimed: the reproduced
primitive is an out-of-bounds read of a bitmap pointer slot followed by
a kernel panic.
Use the already computed logicalBlockNum + offset + count value for the
partition length check. Also make load_block_bitmap() reject an
out-of-range block group before indexing s_block_bitmap[], so corrupted
callers cannot walk past the flexible array.
Fixes: 56e69e59751d ("udf: prevent integer overflow in udf_bitmap_free_blocks()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260515142327.1120767-1-michael.bommarito@gmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/balloc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -86,8 +86,9 @@ static int __load_block_bitmap(struct su
int nr_groups = bitmap->s_nr_groups;
if (block_group >= nr_groups) {
- udf_debug("block_group (%u) > nr_groups (%d)\n",
+ udf_debug("block_group (%u) >= nr_groups (%d)\n",
block_group, nr_groups);
+ return -EFSCORRUPTED;
}
if (bitmap->s_block_bitmap[block_group]) {
@@ -671,7 +672,7 @@ void udf_free_blocks(struct super_block
if (check_add_overflow(bloc->logicalBlockNum, offset, &blk) ||
check_add_overflow(blk, count, &blk) ||
- bloc->logicalBlockNum + count > map->s_partition_len) {
+ blk > map->s_partition_len) {
udf_debug("Invalid request to free blocks: (%d, %u), off %u, "
"len %u, partition len %u\n",
partition, bloc->logicalBlockNum, offset, count,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 122/699] udf: validate VAT header length against the VAT inode size
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 121/699] udf: validate free block extents against the partition length Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 123/699] udf: validate sparing table length as an entry count, not a byte count Greg Kroah-Hartman
` (580 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit d8202786b3d75125c84ebc4de6d946f92fde0ee8 upstream.
udf_load_vat() takes the virtual partition's start offset straight from
the on-disk VAT 2.0 header without checking it against the VAT inode
size:
map->s_type_specific.s_virtual.s_start_offset =
le16_to_cpu(vat20->lengthHeader);
map->s_type_specific.s_virtual.s_num_entries =
(sbi->s_vat_inode->i_size -
map->s_type_specific.s_virtual.s_start_offset) >> 2;
lengthHeader is a fully attacker-controlled 16-bit value. If it exceeds
the VAT inode size, the s_num_entries subtraction underflows to a huge
count, which defeats the "block > s_num_entries" bound in
udf_get_pblock_virt15(); and on the ICB-inline path that function reads
((__le32 *)(iinfo->i_data + s_start_offset))[block]
so a large s_start_offset indexes past the inode's in-ICB data. Mounting
a crafted UDF image with a virtual (VAT) partition then triggers an
out-of-bounds read.
Reject a VAT whose header length does not leave room for at least one
entry within the VAT inode.
Fixes: fa5e08156335 ("udf: Handle VAT packed inside inode properly")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260612-b4-disp-9a2317ee-v1-1-fefef5736154@proton.me
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/super.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1233,6 +1233,14 @@ static int udf_load_vat(struct super_blo
map->s_type_specific.s_virtual.s_start_offset =
le16_to_cpu(vat20->lengthHeader);
+ if (map->s_type_specific.s_virtual.s_start_offset
+ > sbi->s_vat_inode->i_size) {
+ udf_err(sb, "Corrupted VAT header length %u (VAT inode size %lld)\n",
+ map->s_type_specific.s_virtual.s_start_offset,
+ sbi->s_vat_inode->i_size);
+ brelse(bh);
+ return -EFSCORRUPTED;
+ }
map->s_type_specific.s_virtual.s_num_entries =
(sbi->s_vat_inode->i_size -
map->s_type_specific.s_virtual.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 123/699] udf: validate sparing table length as an entry count, not a byte count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 122/699] udf: validate VAT header length against the VAT inode size Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 124/699] dm-ioctl: report an error if a device has no table Greg Kroah-Hartman
` (579 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 3ec997bd5508e9b25210b5bbec89031629cdb093 upstream.
udf_load_sparable_map() accepts a sparing table when
sizeof(*st) + le16_to_cpu(st->reallocationTableLen) > sb->s_blocksize
is false, i.e. it treats reallocationTableLen as a number of BYTES that
must fit in the block. But the table is walked as an array of 8-byte
sparingEntry elements:
for (i = 0; i < le16_to_cpu(st->reallocationTableLen); i++) {
struct sparingEntry *entry = &st->mapEntry[i];
... entry->origLocation ...
}
in udf_get_pblock_spar15() and udf_relocate_blocks(). A
reallocationTableLen of N therefore passes the check whenever
sizeof(*st) + N <= blocksize, yet the consumers index
sizeof(*st) + N * sizeof(struct sparingEntry) bytes -- up to ~8x the
block. On a crafted UDF image this is an out-of-bounds read in
udf_get_pblock_spar15(); udf_relocate_blocks() additionally feeds the
same length to udf_update_tag(), whose crc_itu_t() reads far past the
block, and its memmove() through st->mapEntry[] is an out-of-bounds
write.
Validate reallocationTableLen as the entry count it is, with
struct_size().
Fixes: 1df2ae31c724 ("udf: Fortify loading of sparing table")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260612-b4-disp-91780c4e-v1-1-f15112ff6882@proton.me
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -1396,7 +1396,8 @@ static int udf_load_sparable_map(struct
if (ident != 0 ||
strncmp(st->sparingIdent.ident, UDF_ID_SPARING,
strlen(UDF_ID_SPARING)) ||
- sizeof(*st) + le16_to_cpu(st->reallocationTableLen) >
+ struct_size(st, mapEntry,
+ le16_to_cpu(st->reallocationTableLen)) >
sb->s_blocksize) {
brelse(bh);
continue;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 124/699] dm-ioctl: report an error if a device has no table
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 123/699] udf: validate sparing table length as an entry count, not a byte count Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 125/699] partitions: aix: bound the pp_count scan to the ppe array Greg Kroah-Hartman
` (578 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Benjamin Marzinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 457e32348d606a77f9b20e25e989734189834c07 upstream.
When we send a message to a device that has no table, the return code was
not set. The code would return "2", which is not considered a valid return value.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-ioctl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -1633,8 +1633,11 @@ static int target_message(struct file *f
goto out_argv;
table = dm_get_live_table(md, &srcu_idx);
- if (!table)
+ if (!table) {
+ DMERR("The device has no table.");
+ r = -EINVAL;
goto out_table;
+ }
if (dm_deleting_md(md)) {
r = -ENXIO;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 125/699] partitions: aix: bound the pp_count scan to the ppe array
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 124/699] dm-ioctl: report an error if a device has no table Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 126/699] isofs: bound Rock Ridge symlink components to the SL record Greg Kroah-Hartman
` (577 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Philippe De Muyter,
Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 2dc0bfd2fe355fb930de63c2f2eb8ced8570c579 upstream.
aix_partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:
int numpps = be16_to_cpu(pvd->pp_count);
...
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
...
lp_ix = be16_to_cpu(p->lp_ix);
pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp_count. pp_count is an unvalidated __be16 read straight from
the descriptor, so a crafted AIX image with pp_count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos_partition() -> aix_partition().
Clamp the scan to the number of entries the ppe[] array can hold.
Fixes: 6ceea22bbbc8 ("partitions: add aix lvm partition support files")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Acked-by: Philippe De Muyter <phdm@macqel.be>
Link: https://patch.msgid.link/20260607064137.302574-1-hexlabsecurity@proton.me
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/partitions/aix.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/block/partitions/aix.c
+++ b/block/partitions/aix.c
@@ -244,6 +244,15 @@ int aix_partition(struct parsed_partitio
int next_lp_ix = 1;
int lp_ix;
+ /*
+ * pvd was read into a fixed-size struct pvd whose ppe[] array
+ * holds ARRAY_SIZE(pvd->ppe) entries. pp_count is an
+ * unvalidated on-disk __be16, so clamp the scan to the array
+ * size to avoid walking past the allocation.
+ */
+ if (numpps > ARRAY_SIZE(pvd->ppe))
+ numpps = ARRAY_SIZE(pvd->ppe);
+
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
unsigned int lv_ix;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 126/699] isofs: bound Rock Ridge symlink components to the SL record
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 125/699] partitions: aix: bound the pp_count scan to the ppe array Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 127/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps Greg Kroah-Hartman
` (576 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Bryam Vargas,
Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 5fa1d6a5ec2356d2107dead614437c66fa7138b1 upstream.
get_symlink_chunk() and the SL handling in
parse_rock_ridge_inode_internal() walk the variable-length components of
a Rock Ridge "SL" (symbolic link) record. Each component is a two-byte
header (flags, len) followed by len bytes of text, so it occupies
slp->len + 2 bytes. Both loops read slp->len and advance to the next
component, and get_symlink_chunk() additionally does
memcpy(rpnt, slp->text, slp->len), but neither checks that the component
lies within the SL record before dereferencing it.
A crafted SL record whose component declares a len that runs past the
record (rr->len) therefore triggers an out-of-bounds read of up to 255
bytes. When the record sits at the tail of its backing buffer - for
example a small kmalloc()ed continuation block reached through a CE
record - the read crosses the allocation; get_symlink_chunk() then
copies the out-of-bounds bytes into the symlink body returned to user
space by readlink(), disclosing adjacent kernel memory.
ISO 9660 images are routinely mounted from untrusted removable media -
desktop environments auto-mount them (e.g. via udisks2) without
CAP_SYS_ADMIN - so the record contents are attacker-controlled.
Reject any component that does not fit in the remaining record bytes
before using it. In get_symlink_chunk() return NULL, like the existing
output-buffer (plimit) checks, so a malformed record makes readlink()
fail with -EIO rather than silently returning a truncated target; in
parse_rock_ridge_inode_internal() stop the inode-size walk.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Suggested-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260607011823.217748-1-hexlabsecurity@proton.me
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/isofs/rock.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/fs/isofs/rock.c
+++ b/fs/isofs/rock.c
@@ -464,6 +464,9 @@ repeat:
inode->i_size = symlink_len;
while (slen > 1) {
rootflag = 0;
+ /* keep the component within the SL record */
+ if (slp->len + 2 > slen)
+ goto eio;
switch (slp->flags & ~1) {
case 0:
inode->i_size +=
@@ -619,6 +622,14 @@ static char *get_symlink_chunk(char *rpn
slp = &rr->u.SL.link;
while (slen > 1) {
rootflag = 0;
+ /*
+ * A component is slp->len + 2 bytes (a two-byte header plus
+ * len bytes of text). If it does not fit in the bytes left in
+ * the SL record the record is malformed: fail like the plimit
+ * checks below so readlink() returns -EIO, not a truncated path.
+ */
+ if (slp->len + 2 > slen)
+ return NULL;
switch (slp->flags & ~1) {
case 0:
if (slp->len > plimit - rpnt)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 127/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 126/699] isofs: bound Rock Ridge symlink components to the SL record Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 128/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps again Greg Kroah-Hartman
` (575 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 3f57657b6ea23f933371f2c2846322f441773cee upstream.
Use print_hex_dump_devel() for dumping sensitive key material in
*_setkey() and gen_split_key() to avoid leaking secrets at runtime when
CONFIG_DYNAMIC_DEBUG is enabled.
Fixes: 6e005503199b ("crypto: caam - print debug messages at debug level")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/caam/caamalg.c | 12 ++++++------
drivers/crypto/caam/caamalg_qi.c | 12 ++++++------
drivers/crypto/caam/caamhash.c | 4 ++--
drivers/crypto/caam/key_gen.c | 4 ++--
4 files changed, 16 insertions(+), 16 deletions(-)
--- a/drivers/crypto/caam/caamalg.c
+++ b/drivers/crypto/caam/caamalg.c
@@ -588,7 +588,7 @@ static int aead_setkey(struct crypto_aea
dev_dbg(jrdev, "keylen %d enckeylen %d authkeylen %d\n",
keys.authkeylen + keys.enckeylen, keys.enckeylen,
keys.authkeylen);
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
/*
@@ -624,7 +624,7 @@ static int aead_setkey(struct crypto_aea
dma_sync_single_for_device(jrdev, ctx->key_dma, ctx->adata.keylen_pad +
keys.enckeylen, ctx->dir);
- print_hex_dump_debug("ctx.key@"__stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key,
ctx->adata.keylen_pad + keys.enckeylen, 1);
@@ -665,7 +665,7 @@ static int gcm_setkey(struct crypto_aead
if (err)
return err;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -686,7 +686,7 @@ static int rfc4106_setkey(struct crypto_
if (err)
return err;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -712,7 +712,7 @@ static int rfc4543_setkey(struct crypto_
if (err)
return err;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -739,7 +739,7 @@ static int skcipher_setkey(struct crypto
u32 *desc;
const bool is_rfc3686 = alg->caam.rfc3686;
- print_hex_dump_debug("key in @"__stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->cdata.keylen = keylen;
--- a/drivers/crypto/caam/caamalg_qi.c
+++ b/drivers/crypto/caam/caamalg_qi.c
@@ -207,7 +207,7 @@ static int aead_setkey(struct crypto_aea
dev_dbg(jrdev, "keylen %d enckeylen %d authkeylen %d\n",
keys.authkeylen + keys.enckeylen, keys.enckeylen,
keys.authkeylen);
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
/*
@@ -243,7 +243,7 @@ static int aead_setkey(struct crypto_aea
ctx->adata.keylen_pad + keys.enckeylen,
ctx->dir);
- print_hex_dump_debug("ctx.key@" __stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key,
ctx->adata.keylen_pad + keys.enckeylen, 1);
@@ -366,7 +366,7 @@ static int gcm_setkey(struct crypto_aead
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -470,7 +470,7 @@ static int rfc4106_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -576,7 +576,7 @@ static int rfc4543_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -626,7 +626,7 @@ static int skcipher_setkey(struct crypto
const bool is_rfc3686 = alg->caam.rfc3686;
int ret = 0;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->cdata.keylen = keylen;
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -495,7 +495,7 @@ static int axcbc_setkey(struct crypto_ah
DMA_TO_DEVICE);
ctx->adata.keylen = keylen;
- print_hex_dump_debug("axcbc ctx.key@" __stringify(__LINE__)" : ",
+ print_hex_dump_devel("axcbc ctx.key@" __stringify(__LINE__)" : ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key, keylen, 1);
return axcbc_set_sh_desc(ahash);
@@ -515,7 +515,7 @@ static int acmac_setkey(struct crypto_ah
ctx->adata.key_virt = key;
ctx->adata.keylen = keylen;
- print_hex_dump_debug("acmac ctx.key@" __stringify(__LINE__)" : ",
+ print_hex_dump_devel("acmac ctx.key@" __stringify(__LINE__)" : ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
return acmac_set_sh_desc(ahash);
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -58,7 +58,7 @@ int gen_split_key(struct device *jrdev,
dev_dbg(jrdev, "split keylen %d split keylen padded %d\n",
adata->keylen, adata->keylen_pad);
- print_hex_dump_debug("ctx.key@" __stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key_in, keylen, 1);
if (local_max > max_keylen)
@@ -113,7 +113,7 @@ int gen_split_key(struct device *jrdev,
wait_for_completion(&result.completion);
ret = result.err;
- print_hex_dump_debug("ctx.key@"__stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@"__stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key_out,
adata->keylen_pad, 1);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 128/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps again
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 127/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 129/699] crypto: ecc - Fix carry overflow in vli multiplication Greg Kroah-Hartman
` (574 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 8005dc808bcce7d6cc2ae015a3cde1683bee602d upstream.
Use print_hex_dump_devel() for dumping sensitive key material in
*_setkey() to avoid leaking secrets at runtime when CONFIG_DYNAMIC_DEBUG
is enabled.
Fixes: 8d818c105501 ("crypto: caam/qi2 - add DPAA2-CAAM driver")
Fixes: 226853ac3ebe ("crypto: caam/qi2 - add skcipher algorithms")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/caam/caamalg_qi2.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/crypto/caam/caamalg_qi2.c
+++ b/drivers/crypto/caam/caamalg_qi2.c
@@ -294,7 +294,7 @@ static int aead_setkey(struct crypto_aea
dev_dbg(dev, "keylen %d enckeylen %d authkeylen %d\n",
keys.authkeylen + keys.enckeylen, keys.enckeylen,
keys.authkeylen);
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->adata.keylen = keys.authkeylen;
@@ -308,7 +308,7 @@ static int aead_setkey(struct crypto_aea
memcpy(ctx->key + ctx->adata.keylen_pad, keys.enckey, keys.enckeylen);
dma_sync_single_for_device(dev, ctx->key_dma, ctx->adata.keylen_pad +
keys.enckeylen, ctx->dir);
- print_hex_dump_debug("ctx.key@" __stringify(__LINE__)": ",
+ print_hex_dump_devel("ctx.key@" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, ctx->key,
ctx->adata.keylen_pad + keys.enckeylen, 1);
@@ -725,7 +725,7 @@ static int gcm_setkey(struct crypto_aead
ret = aes_check_keylen(keylen);
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -821,7 +821,7 @@ static int rfc4106_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -920,7 +920,7 @@ static int rfc4543_setkey(struct crypto_
if (ret)
return ret;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
memcpy(ctx->key, key, keylen);
@@ -948,7 +948,7 @@ static int skcipher_setkey(struct crypto
u32 *desc;
const bool is_rfc3686 = alg->caam.rfc3686;
- print_hex_dump_debug("key in @" __stringify(__LINE__)": ",
+ print_hex_dump_devel("key in @" __stringify(__LINE__)": ",
DUMP_PREFIX_ADDRESS, 16, 4, key, keylen, 1);
ctx->cdata.keylen = keylen;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 129/699] crypto: ecc - Fix carry overflow in vli multiplication
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 128/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps again Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 130/699] crypto: pcrypt - restore callback for non-parallel fallback Greg Kroah-Hartman
` (573 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anastasia Tishchenko, Lukas Wunner,
Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anastasia Tishchenko <sv3iry@gmail.com>
commit 27b536a2ec8e2f85a0380c2d13c9ecbc7aaab406 upstream.
The carry flag calculation fails when r01.m_high is saturated
(0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows.
The condition (r01.m_high < product.m_high) doesn't handle the case
where r01.m_high == product.m_high and an additional carry exists
from lower-bit overflow.
When commit 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
introduced crypto/ecc.c, it split the muladd() function in the
micro-ecc library into separate mul_64_64() and add_128_128() helpers.
It seems the check got lost in translation.
Add proper handling for this boundary by accounting for the carry
from the lower addition.
Fixes: 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
Signed-off-by: Anastasia Tishchenko <sv3iry@gmail.com>
Cc: stable@vger.kernel.org # v4.8+
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/ecc.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
--- a/crypto/ecc.c
+++ b/crypto/ecc.c
@@ -364,14 +364,26 @@ static uint128_t mul_64_64(u64 left, u64
return result;
}
-static uint128_t add_128_128(uint128_t a, uint128_t b)
+/* Calculate addition with overflow checking. Returns true on wrap-around,
+ * false otherwise.
+ */
+static bool check_add_128_128_overflow(uint128_t *result, uint128_t a,
+ uint128_t b)
{
- uint128_t result;
+ bool carry;
- result.m_low = a.m_low + b.m_low;
- result.m_high = a.m_high + b.m_high + (result.m_low < a.m_low);
+ result->m_low = a.m_low + b.m_low;
+ carry = (result->m_low < a.m_low);
- return result;
+ result->m_high = a.m_high + b.m_high + carry;
+
+ /* Using constant-time bitwise arithmetic to prevent timing
+ * side-channels.
+ */
+ carry = (result->m_high < a.m_high) |
+ ((result->m_high == a.m_high) & carry);
+
+ return carry;
}
static void vli_mult(u64 *result, const u64 *left, const u64 *right,
@@ -396,9 +408,7 @@ static void vli_mult(u64 *result, const
uint128_t product;
product = mul_64_64(left[i], right[k - i]);
-
- r01 = add_128_128(r01, product);
- r2 += (r01.m_high < product.m_high);
+ r2 += check_add_128_128_overflow(&r01, r01, product);
}
result[k] = r01.m_low;
@@ -421,7 +431,7 @@ static void vli_umult(u64 *result, const
uint128_t product;
product = mul_64_64(left[k], right);
- r01 = add_128_128(r01, product);
+ check_add_128_128_overflow(&r01, r01, product);
/* no carry */
result[k] = r01.m_low;
r01.m_low = r01.m_high;
@@ -458,8 +468,7 @@ static void vli_square(u64 *result, cons
product.m_low <<= 1;
}
- r01 = add_128_128(r01, product);
- r2 += (r01.m_high < product.m_high);
+ r2 += check_add_128_128_overflow(&r01, r01, product);
}
result[k] = r01.m_low;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 130/699] crypto: pcrypt - restore callback for non-parallel fallback
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 129/699] crypto: ecc - Fix carry overflow in vli multiplication Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 131/699] crypto: drbg - Fix returning success on failure in CTR_DRBG Greg Kroah-Hartman
` (572 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yuan Tan, Yifan Wu,
Juefei Pu, Zhengchuan Liang, Xin Liu, Ruijie Li, Ren Wei,
Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruijie Li <ruijieli51@gmail.com>
commit ed459fe319376e876de433d12b6c6772e612ca36 upstream.
pcrypt installs pcrypt_aead_done() on the child AEAD request before
trying to submit it through padata. If padata_do_parallel() returns
-EBUSY, pcrypt falls back to calling the child AEAD directly.
That fallback must not keep the padata completion callback. Otherwise
an asynchronous completion runs pcrypt_aead_done() even though the
request was never enrolled in padata.
Restore the original request callback and callback data before calling
the child AEAD directly. This keeps the fallback path aligned with a
direct AEAD request while leaving the parallel path unchanged.
Fixes: 662f2f13e66d ("crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Ruijie Li <ruijieli51@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/pcrypt.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/crypto/pcrypt.c
+++ b/crypto/pcrypt.c
@@ -122,6 +122,8 @@ static int pcrypt_aead_encrypt(struct ae
return -EINPROGRESS;
if (err == -EBUSY) {
/* try non-parallel mode */
+ aead_request_set_callback(creq, flags, req->base.complete,
+ req->base.data);
return crypto_aead_encrypt(creq);
}
@@ -173,6 +175,8 @@ static int pcrypt_aead_decrypt(struct ae
return -EINPROGRESS;
if (err == -EBUSY) {
/* try non-parallel mode */
+ aead_request_set_callback(creq, flags, req->base.complete,
+ req->base.data);
return crypto_aead_decrypt(creq);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 131/699] crypto: drbg - Fix returning success on failure in CTR_DRBG
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 130/699] crypto: pcrypt - restore callback for non-parallel fallback Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 132/699] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Greg Kroah-Hartman
` (571 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b upstream.
drbg_ctr_generate() sometimes returns success when it fails, leaving the
output buffer uninitialized. Fix it.
Fixes: cde001e4c3c3 ("crypto: rng - RNGs must return 0 in success case")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/drbg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -601,7 +601,7 @@ static int drbg_ctr_generate(struct drbg
if (addtl && !list_empty(addtl)) {
ret = drbg_ctr_update(drbg, addtl, 2);
if (ret)
- return 0;
+ return ret;
}
/* 10.2.1.5.2 step 4.1 */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 132/699] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 131/699] crypto: drbg - Fix returning success on failure in CTR_DRBG Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 133/699] crypto: drbg - Fix the fips_enabled priority boost Greg Kroah-Hartman
` (570 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 6f49f00c981bbb9ef602966f19bfdbef46b681d2 upstream.
On 64-bit kernels, drbg_max_addtl() returns 2**35 bytes. That's too
large, for two reasons:
1. SP800-90A says the maximum limit is 2**35 *bits*, not 2**35 bytes.
So the implemented limit has confused bits and bytes.
2. When drbg_kcapi_hash() calls crypto_shash_update() on the additional
information string, the length is implicitly cast to 'unsigned int'.
That truncates the additional information string to U32_MAX bytes.
Fix the maximum additional information string length to always be
U32_MAX - 1, causing an error to be returned for any longer lengths.
Fixes: 541af946fe13 ("crypto: drbg - SP800-90A Deterministic Random Bit Generator")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/crypto/drbg.h | 18 +++++++-----------
1 file changed, 7 insertions(+), 11 deletions(-)
--- a/include/crypto/drbg.h
+++ b/include/crypto/drbg.h
@@ -170,19 +170,15 @@ static inline size_t drbg_max_request_by
return (1 << 16);
}
+/*
+ * SP800-90A allows implementations to support additional info / personalization
+ * strings of up to 2**35 bits. Implementations can have a smaller maximum. We
+ * use 2**35 - 16 bits == U32_MAX - 1 bytes so that the max + 1 always fits in a
+ * size_t, allowing drbg_healthcheck_sanity() to verify its enforcement.
+ */
static inline size_t drbg_max_addtl(struct drbg_state *drbg)
{
- /* SP800-90A requires 2**35 bytes additional info str / pers str */
-#if (__BITS_PER_LONG == 32)
- /*
- * SP800-90A allows smaller maximum numbers to be returned -- we
- * return SIZE_MAX - 1 to allow the verification of the enforcement
- * of this value in drbg_healthcheck_sanity.
- */
- return (SIZE_MAX - 1);
-#else
- return (1UL<<35);
-#endif
+ return U32_MAX - 1;
}
static inline size_t drbg_max_requests(struct drbg_state *drbg)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 133/699] crypto: drbg - Fix the fips_enabled priority boost
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 132/699] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 134/699] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Greg Kroah-Hartman
` (569 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit a8a1f93080efc83a9ff8452954429ae379e9e614 upstream.
When fips_enabled=1, it seems to have been intended for one of the
algorithms defined in crypto/drbg.c to be the highest priority "stdrng"
algorithm, so that it is what is used by "stdrng" users.
However, the code only boosts the priority to 400, which is less than
the priority 500 used in drivers/crypto/caam/caamprng.c. Thus, the CAAM
RNG could be used instead.
Fix this by boosting the priority by 2000 instead of 200.
Fixes: 541af946fe13 ("crypto: drbg - SP800-90A Deterministic Random Bit Generator")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/drbg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -2069,7 +2069,7 @@ static inline void __init drbg_fill_arra
* it is selected.
*/
if (fips_enabled)
- alg->base.cra_priority += 200;
+ alg->base.cra_priority += 2000;
alg->base.cra_ctxsize = sizeof(struct drbg_state);
alg->base.cra_module = THIS_MODULE;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 134/699] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 133/699] crypto: drbg - Fix the fips_enabled priority boost Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 135/699] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Greg Kroah-Hartman
` (568 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paul Louvel, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Louvel <paul.louvel@bootlin.com>
commit e17ff3d6ff907dc8406261e8fd3e1fc8a908f0f6 upstream.
In order to know if a descriptor has been processed by the device,
the driver polls the FIFO to see if DESC_HDR_DONE is set on a descriptor
header to confirm completion.
The current code does not make sure that the CPU gets up to date data
before reading the descriptor.
Fix this by calling dma_sync_single_for_cpu() before reading memory
written by the device.
Cc: stable@vger.kernel.org
Fixes: 58cdbc6d2263 ("crypto: talitos - fix hash on SEC1.")
Signed-off-by: Paul Louvel <paul.louvel@bootlin.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/talitos.c | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -320,19 +320,31 @@ static int talitos_submit(struct device
return -EINPROGRESS;
}
-static __be32 get_request_hdr(struct talitos_request *request, bool is_sec1)
+static __be32 get_request_hdr(struct device *dev,
+ struct talitos_request *request, bool is_sec1)
{
struct talitos_edesc *edesc;
- if (!is_sec1)
+ if (!is_sec1) {
+ dma_sync_single_for_cpu(dev, request->dma_desc,
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+
return request->desc->hdr;
+ }
- if (!request->desc->next_desc)
+ if (!request->desc->next_desc) {
+ dma_sync_single_for_cpu(dev, request->dma_desc,
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
return request->desc->hdr1;
-
- edesc = container_of(request->desc, struct talitos_edesc, desc);
-
- return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))->hdr1;
+ } else {
+ dma_sync_single_for_cpu(dev,
+ be32_to_cpu(request->desc->next_desc),
+ TALITOS_DESC_SIZE, DMA_BIDIRECTIONAL);
+ edesc = container_of(request->desc, struct talitos_edesc, desc);
+
+ return ((struct talitos_desc *)(edesc->buf + edesc->dma_len))
+ ->hdr1;
+ }
}
/*
@@ -356,7 +368,7 @@ static void flush_channel(struct device
/* descriptors with their done bits set don't get the error */
rmb();
- hdr = get_request_hdr(request, is_sec1);
+ hdr = get_request_hdr(dev, request, is_sec1);
if ((hdr & DESC_HDR_DONE) == DESC_HDR_DONE)
status = 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 135/699] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 134/699] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 136/699] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Greg Kroah-Hartman
` (567 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Carlos Song, Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Song <carlos.song@nxp.com>
commit e703ce47691b967fe9b4057fb1d062273211afa9 upstream.
dmaengine_terminate_all() has been deprecated, so replace it with
dmaengine_terminate_sync().
Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Link: https://patch.msgid.link/20260525062357.3191349-2-carlos.song@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-fsl-lpspi.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct
tx->sgl, tx->nents, DMA_MEM_TO_DEV,
DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
if (!desc_tx) {
- dmaengine_terminate_all(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_tx);
return -EINVAL;
}
@@ -598,8 +598,8 @@ static int fsl_lpspi_dma_transfer(struct
transfer_timeout);
if (!timeout) {
dev_err(fsl_lpspi->dev, "I/O Error in DMA TX\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -ETIMEDOUT;
}
@@ -608,8 +608,8 @@ static int fsl_lpspi_dma_transfer(struct
transfer_timeout);
if (!timeout) {
dev_err(fsl_lpspi->dev, "I/O Error in DMA RX\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -ETIMEDOUT;
}
@@ -618,8 +618,8 @@ static int fsl_lpspi_dma_transfer(struct
fsl_lpspi->slave_aborted) {
dev_dbg(fsl_lpspi->dev,
"I/O Error in DMA TX interrupted\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -EINTR;
}
@@ -628,8 +628,8 @@ static int fsl_lpspi_dma_transfer(struct
fsl_lpspi->slave_aborted) {
dev_dbg(fsl_lpspi->dev,
"I/O Error in DMA RX interrupted\n");
- dmaengine_terminate_all(controller->dma_tx);
- dmaengine_terminate_all(controller->dma_rx);
+ dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
fsl_lpspi_reset(fsl_lpspi);
return -EINTR;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 136/699] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 135/699] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 137/699] tracing: Prevent out-of-bounds read in glob matching Greg Kroah-Hartman
` (566 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Carlos Song, Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Song <carlos.song@nxp.com>
commit 01980b5da56e573d62798d0ff6c86bcaa2b22cbe upstream.
When dmaengine_prep_slave_sg() fails for the TX channel, the error path
terminates the TX DMA channel but leaves the RX channel running. Since
the RX channel was already submitted and issued prior to preparing
the TX descriptor, returning -EINVAL causes the SPI core to unmap the
DMA buffers while the RX DMA engine continues writing to them, leading
to potential memory corruption or use-after-free.
Terminate the RX channel before returning on the TX prepare failure path.
Fixes: 09c04466ce7e ("spi: lpspi: add dma mode support")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Link: https://patch.msgid.link/20260525062357.3191349-3-carlos.song@oss.nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-fsl-lpspi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -577,7 +577,7 @@ static int fsl_lpspi_dma_transfer(struct
tx->sgl, tx->nents, DMA_MEM_TO_DEV,
DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
if (!desc_tx) {
- dmaengine_terminate_sync(controller->dma_tx);
+ dmaengine_terminate_sync(controller->dma_rx);
return -EINVAL;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 137/699] tracing: Prevent out-of-bounds read in glob matching
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 136/699] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 138/699] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Greg Kroah-Hartman
` (565 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Huihui Huang, Ren Wei,
Masami Hiramatsu (Google), Steven Rostedt
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huihui Huang <hhhuang@smu.edu.sg>
commit 0a6070839b1ef276d5b05bedfb787743e140fb17 upstream.
String event fields are not necessarily NUL-terminated, so the filter
predicate functions (filter_pred_string(), filter_pred_strloc() and
filter_pred_strrelloc()) pass the field length to the regex match
callbacks, and the length-aware matchers honour it.
regex_match_glob() was the exception: it ignored the length and called
glob_match(), which scans the string until it hits a NUL byte. Some
string fields are not NUL-terminated. One example is the dynamic char
array of the xfs_* namespace tracepoints, which is copied without a
trailing NUL. For such a field, glob matching reads past the end of
the event field, causing a KASAN slab-out-of-bounds read in
glob_match(), reached via regex_match_glob() and filter_match_preds()
from the xfs_lookup tracepoint.
Add a length-bounded glob_match_len() and use it from regex_match_glob()
so glob matching always stops at the field boundary. The matching loop
is factored into a shared helper so glob_match() keeps its behaviour.
Fixes: 60f1d5e3bac4 ("ftrace: Support full glob matching")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/da1aaf125fc3b63320b0c540fd6afa7c3d5b4f1a.1782836943.git.hhhuang@smu.edu.sg
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Huihui Huang <hhhuang@smu.edu.sg>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/glob.h | 1 +
kernel/trace/trace_events_filter.c | 6 ++----
lib/glob.c | 31 +++++++++++++++++++++++++++++--
3 files changed, 32 insertions(+), 6 deletions(-)
--- a/include/linux/glob.h
+++ b/include/linux/glob.h
@@ -6,5 +6,6 @@
#include <linux/compiler.h> /* For __pure */
bool __pure glob_match(char const *pat, char const *str);
+bool __pure glob_match_len(char const *pat, char const *str, size_t len);
#endif /* _LINUX_GLOB_H */
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -865,11 +865,9 @@ static int regex_match_end(char *str, st
return 0;
}
-static int regex_match_glob(char *str, struct regex *r, int len __maybe_unused)
+static int regex_match_glob(char *str, struct regex *r, int len)
{
- if (glob_match(r->pattern, str))
- return 1;
- return 0;
+ return glob_match_len(r->pattern, str, len) ? 1 : 0;
}
/**
--- a/lib/glob.c
+++ b/lib/glob.c
@@ -9,6 +9,9 @@
MODULE_DESCRIPTION("glob(7) matching");
MODULE_LICENSE("Dual MIT/GPL");
+static bool __pure glob_match_str(char const *pat, char const *str,
+ char const *str_end);
+
/**
* glob_match - Shell-style pattern matching, like !fnmatch(pat, str, 0)
* @pat: Shell-style pattern to match, e.g. "*.[ch]".
@@ -39,6 +42,29 @@ MODULE_LICENSE("Dual MIT/GPL");
*/
bool __pure glob_match(char const *pat, char const *str)
{
+ return glob_match_str(pat, str, NULL);
+}
+EXPORT_SYMBOL(glob_match);
+
+/**
+ * glob_match_len - glob match against a length-bounded string
+ * @pat: Shell-style pattern to match.
+ * @str: String to match. Need not be NUL-terminated.
+ * @len: Number of bytes of @str that may be read.
+ *
+ * Like glob_match(), but @str is only read up to @len bytes, so it can be
+ * used on buffers that are not NUL-terminated (e.g. trace event fields).
+ * A NUL byte within @len still terminates the string.
+ */
+bool __pure glob_match_len(char const *pat, char const *str, size_t len)
+{
+ return glob_match_str(pat, str, str + len);
+}
+EXPORT_SYMBOL(glob_match_len);
+
+static bool __pure glob_match_str(char const *pat, char const *str,
+ char const *str_end)
+{
/*
* Backtrack to previous * on mismatch and retry starting one
* character later in the string. Because * matches all characters
@@ -53,9 +79,11 @@ bool __pure glob_match(char const *pat,
* on mismatch, or true after matching the trailing nul bytes.
*/
for (;;) {
- unsigned char c = *str++;
+ unsigned char c = (str_end && str >= str_end) ? '\0' : *str;
unsigned char d = *pat++;
+ str++;
+
switch (d) {
case '?': /* Wildcard: anything but nul */
if (c == '\0')
@@ -120,4 +148,3 @@ backtrack:
}
}
}
-EXPORT_SYMBOL(glob_match);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 138/699] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 137/699] tracing: Prevent out-of-bounds read in glob matching Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 139/699] exfat: bound uniname advance in exfat_find_dir_entry() Greg Kroah-Hartman
` (564 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Benjamin Coddington,
Anna Schumaker
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <ben.coddington@hammerspace.com>
commit 5140f099ecd8a2f2808b7f7b720ee1bad8468974 upstream.
POSIX requires write permission to truncate a file, so an open() that
specifies O_TRUNC must be authorized for write access regardless of the
O_ACCMODE access mode.
nfs_open_permission_mask() builds the access mask passed to
nfs_may_open(), which is the local authorization gate for OPENs the
client serves itself from a cached write delegation via the
can_open_delegated() path in nfs4_try_open_cached(). The mask is
derived from O_ACCMODE alone, so an open(O_RDONLY | O_TRUNC) against a
file the caller cannot write requests only MAY_READ and passes the
local check. The OPEN is then satisfied locally and the truncation is
issued to the server as a SETATTR(size=0) over the delegation stateid,
which the server accepts under standard write-delegation semantics.
POSIX requires that this open fail with EACCES.
Include MAY_WRITE in the mask whenever O_TRUNC is set so the local
check matches the access the server would have enforced.
Suggested-by: Trond Myklebust <trondmy@kernel.org>
Fixes: af22f94ae02a ("NFSv4: Simplify _nfs4_do_access()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/dir.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2803,6 +2803,8 @@ static int nfs_open_permission_mask(int
mask |= MAY_READ;
if ((openflags & O_ACCMODE) != O_RDONLY)
mask |= MAY_WRITE;
+ if (openflags & O_TRUNC)
+ mask |= MAY_WRITE;
}
return mask;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 139/699] exfat: bound uniname advance in exfat_find_dir_entry()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 138/699] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 140/699] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Greg Kroah-Hartman
` (563 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Bryam Vargas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 3a1230e7b043c62737b05a3e9275ca83a43ad20a upstream.
In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the
output pointer by a fixed amount while the loop guard only tracks the
accumulated name length:
if (++order == 2)
uniname = p_uniname->name;
else
uniname += EXFAT_FILE_NAME_LEN;
len = exfat_extract_uni_name(ep, entry_uniname);
name_len += len;
unichar = *(uniname+len);
*(uniname+len) = 0x0;
uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len
grows only by the actual extracted length, which is shorter when a name
fragment contains an early NUL. The only guard is
`name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short
name fragments lets uniname run far past the
p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small,
causing an out-of-bounds read and write at *(uniname+len).
The sibling extractor exfat_get_uniname_from_ext_entry() already stops
on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard
added in commit d42334578eba ("exfat: check if filename entries exceeds
max filename length")); exfat_find_dir_entry() never got the
equivalent. Track the per-entry write offset as a count and reject a
fragment once the offset, or the offset plus the extracted length, would
exceed MAX_NAME_LENGTH, before forming the output pointer.
Fixes: ca06197382bd ("exfat: add directory operations")
Cc: stable@vger.kernel.org
Suggested-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/dir.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/fs/exfat/dir.c
+++ b/fs/exfat/dir.c
@@ -1045,6 +1045,7 @@ rewind:
if (entry_type == TYPE_EXTEND) {
unsigned short entry_uniname[16], unichar;
+ unsigned int offset;
if (step != DIRENT_STEP_NAME ||
name_len >= MAX_NAME_LENGTH) {
@@ -1053,13 +1054,15 @@ rewind:
continue;
}
- if (++order == 2)
- uniname = p_uniname->name;
- else
- uniname += EXFAT_FILE_NAME_LEN;
-
+ offset = (++order - 2) * EXFAT_FILE_NAME_LEN;
len = exfat_extract_uni_name(ep, entry_uniname);
brelse(bh);
+ if (offset > MAX_NAME_LENGTH ||
+ len > MAX_NAME_LENGTH - offset) {
+ step = DIRENT_STEP_FILE;
+ continue;
+ }
+ uniname = p_uniname->name + offset;
name_len += len;
unichar = *(uniname+len);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 140/699] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 139/699] exfat: bound uniname advance in exfat_find_dir_entry() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 141/699] udmabuf: fix DMA direction mismatch in release_udmabuf() Greg Kroah-Hartman
` (562 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot ci, Sean Christopherson,
Paolo Bonzini
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
commit 7ef78d71ca713d8c00f7c34ddcf276c808143f77 upstream.
When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.
------------[ cut here ]------------
debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
Modules linked in:
CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
Call Trace:
<TASK>
apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
No functional change intended.
Reported-by: syzbot ci <syzbot+ci493c6d734b63e050@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260618174347.1981064-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/vmx/vmx.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6309,11 +6309,10 @@ static noinstr void vmx_l1d_flush(struct
static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
{
- struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
int tpr_threshold;
if (is_guest_mode(vcpu) &&
- nested_cpu_has(vmcs12, CPU_BASED_TPR_SHADOW))
+ nested_cpu_has(get_vmcs12(vcpu), CPU_BASED_TPR_SHADOW))
return;
tpr_threshold = (irr == -1 || tpr < irr) ? 0 : irr;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 141/699] udmabuf: fix DMA direction mismatch in release_udmabuf()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 140/699] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 142/699] i2c: stm32f7: truncate clock period instead of rounding it Greg Kroah-Hartman
` (561 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikhail Gavrilov, Vivek Kasireddy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
commit fb7b1a0ab25a6077d26cb3829e31743972d4f31d upstream.
begin_cpu_udmabuf() maps the sg_table with the caller-provided direction
(e.g., DMA_TO_DEVICE for a write-only sync), and caches it in ubuf->sg
for reuse. However, release_udmabuf() always unmaps this sg_table with
a hardcoded DMA_BIDIRECTIONAL, regardless of the direction that was
originally used for the mapping.
With CONFIG_DMA_API_DEBUG=y this produces:
DMA-API: misc udmabuf: device driver frees DMA memory with different
direction [device address=0x000000044a123000] [size=4096 bytes]
[mapped with DMA_TO_DEVICE] [unmapped with DMA_BIDIRECTIONAL]
The issue was found during video playback when GStreamer performed a
write-only DMA_BUF_IOCTL_SYNC on a udmabuf. It can be reproduced
with CONFIG_DMA_API_DEBUG=y by creating a udmabuf from a memfd,
performing a write-only sync (DMA_BUF_SYNC_WRITE without
DMA_BUF_SYNC_READ), and closing the file descriptor.
Fix this by storing the DMA direction used when the sg_table is first
created in begin_cpu_udmabuf(), and passing that same direction to
put_sg_table() in release_udmabuf().
Fixes: 284562e1f348 ("udmabuf: implement begin_cpu_access/end_cpu_access hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Reviewed-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Link: https://patch.msgid.link/20260314232722.15555-1-mikhail.v.gavrilov@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma-buf/udmabuf.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/dma-buf/udmabuf.c
+++ b/drivers/dma-buf/udmabuf.c
@@ -19,6 +19,7 @@ struct udmabuf {
pgoff_t pagecount;
struct page **pages;
struct sg_table *sg;
+ enum dma_data_direction sg_dir;
struct miscdevice *device;
};
@@ -105,7 +106,7 @@ static void release_udmabuf(struct dma_b
pgoff_t pg;
if (ubuf->sg)
- put_sg_table(dev, ubuf->sg, DMA_BIDIRECTIONAL);
+ put_sg_table(dev, ubuf->sg, ubuf->sg_dir);
for (pg = 0; pg < ubuf->pagecount; pg++)
put_page(ubuf->pages[pg]);
@@ -125,6 +126,8 @@ static int begin_cpu_udmabuf(struct dma_
if (IS_ERR(ubuf->sg)) {
ret = PTR_ERR(ubuf->sg);
ubuf->sg = NULL;
+ } else {
+ ubuf->sg_dir = direction;
}
} else {
dma_sync_sgtable_for_cpu(dev, ubuf->sg, direction);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 142/699] i2c: stm32f7: truncate clock period instead of rounding it
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 141/699] udmabuf: fix DMA direction mismatch in release_udmabuf() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 143/699] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Greg Kroah-Hartman
` (560 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillermo Rodríguez,
Alain Volmat, Pierre-Yves MORDRET, Andi Shyti
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillermo Rodríguez <guille.rodriguez@gmail.com>
commit 111bb7f9f4a90b32e495d70a607c67b137f3074a upstream.
stm32f7_i2c_compute_timing() derives the I2C clock source period
(i2cclk) with DIV_ROUND_CLOSEST, which may round it up. When the
period is overestimated, all timings computed from it (SCLDEL,
SDADEL, SCLL, SCLH) come out shorter on the wire than calculated,
and the resulting bus rate can exceed the requested speed, violating
the I2C specification minimums for tLOW and tHIGH.
For example, with a 104.45 MHz clock source (e.g. PCLK1, the
reset-default I2C clock source on STM32MP1), i2cclk is rounded from
9.574 ns up to 10 ns. Requesting a 400 kHz fast mode bus with
72/27 ns rise/fall times and no analog/digital filters then produces
an actual bus rate of 415.6 kHz with tLOW = 1254 ns, violating both
the 400 kHz maximum rate and the 1300 ns tLOW minimum of the
specification.
Truncate the period instead, so that it can only be underestimated.
The error then falls on the safe side: the programmed timings come
out slightly longer than computed and the bus runs marginally below
the target rate (375.3 kHz in the example above) while meeting the
specification.
i2cbus is left rounded-to-closest: it is only used as the target of
the clk_error comparison and is never multiplied into the programmed
timings, so nearest rounding remains accurate there.
Fixes: aeb068c57214 ("i2c: i2c-stm32f7: add driver")
Signed-off-by: Guillermo Rodríguez <guille.rodriguez@gmail.com>
Cc: <stable@vger.kernel.org> # v4.14+
Acked-by: Alain Volmat <alain.volmat@foss.st.com>
Reviewed-by: Pierre-Yves MORDRET <pierre-yves.mordret@foss.st.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260611104857.242153-1-guille.rodriguez@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-stm32f7.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@@ -430,8 +430,13 @@ static int stm32f7_i2c_compute_timing(st
{
struct stm32f7_i2c_spec *specs;
u32 p_prev = STM32F7_PRESC_MAX;
- u32 i2cclk = DIV_ROUND_CLOSEST(NSEC_PER_SEC,
- setup->clock_src);
+ /*
+ * Truncate instead of rounding to closest: if the clock period is
+ * overestimated, the computed SCL timings will come out shorter on
+ * the wire, which can push the bus above the target rate and below
+ * the spec's tLOW/tHIGH minimums.
+ */
+ u32 i2cclk = NSEC_PER_SEC / setup->clock_src;
u32 i2cbus = DIV_ROUND_CLOSEST(NSEC_PER_SEC,
setup->speed_freq);
u32 clk_error_prev = i2cbus;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 143/699] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 142/699] i2c: stm32f7: truncate clock period instead of rounding it Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 144/699] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Greg Kroah-Hartman
` (559 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 6251f7d3472c0409e30f8d6a24f10d33d12e3f9a upstream.
If rmi_register_physical_driver() fails, the current error path
unregisters only the RMI bus. The function handlers registered
earlier remain registered with the driver core.
Add a separate error path to unregister the function handlers
before unregistering the bus in this failure case.
Fixes: 2b6a321da9a2 ("Input: synaptics-rmi4 - add support for Synaptics RMI4 devices")
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260610064633.2837084-1-haoxiang_li2024@163.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_bus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/input/rmi4/rmi_bus.c
+++ b/drivers/input/rmi4/rmi_bus.c
@@ -447,11 +447,13 @@ static int __init rmi_bus_init(void)
if (error) {
pr_err("%s: error registering the RMI physical driver: %d\n",
__func__, error);
- goto err_unregister_bus;
+ goto err_unregister_function_handlers;
}
return 0;
+err_unregister_function_handlers:
+ rmi_unregister_function_handlers();
err_unregister_bus:
bus_unregister(&rmi_bus_type);
return error;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 144/699] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 143/699] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 145/699] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Greg Kroah-Hartman
` (558 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 57c10915f2c16c90e0d46ad00876bf39ece40fc2 upstream.
rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates gpio_key_map with
min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f3a_attention() iterates the full gpio_count and dereferences
gpio_key_map[i], and input->keycodemax is set to the full gpio_count
while input->keycode points at the 6-entry allocation.
A device that reports gpio_count > 6 therefore causes an out-of-bounds
read of gpio_key_map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input_default_getkeycode() and
input_default_setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio_count. The mapping loop is unchanged:
it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)
entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)
and are skipped when reporting.
Fixes: 9e4c596bfd00 ("Input: synaptics-rmi4 - add support for F3A")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260614-b4-disp-818d6bda-v1-1-cf39a3615085@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_f3a.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/rmi4/rmi_f3a.c
+++ b/drivers/input/rmi4/rmi_f3a.c
@@ -132,7 +132,7 @@ static int rmi_f3a_map_gpios(struct rmi_
int button_count = min_t(u8, f3a->gpio_count, TRACKSTICK_RANGE_END);
f3a->gpio_key_map = devm_kcalloc(&fn->dev,
- button_count,
+ f3a->gpio_count,
sizeof(f3a->gpio_key_map[0]),
GFP_KERNEL);
if (!f3a->gpio_key_map) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 145/699] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 144/699] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 146/699] Input: elan_i2c - prevent division by zero and arithmetic underflow Greg Kroah-Hartman
` (557 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit d577e46785d45484b2ab7e7309c49b18764bf56c upstream.
rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Fixes: 3e64fcbdbd10 ("Input: synaptics-rmi4 - limit the range of what GPIOs are buttons")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260614-b4-disp-818d6bda-v1-2-cf39a3615085@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_f30.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/rmi4/rmi_f30.c
+++ b/drivers/input/rmi4/rmi_f30.c
@@ -233,7 +233,7 @@ static int rmi_f30_map_gpios(struct rmi_
int button_count = min_t(u8, f30->gpioled_count, TRACKSTICK_RANGE_END);
f30->gpioled_key_map = devm_kcalloc(&fn->dev,
- button_count,
+ f30->gpioled_count,
sizeof(f30->gpioled_key_map[0]),
GFP_KERNEL);
if (!f30->gpioled_key_map) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 146/699] Input: elan_i2c - prevent division by zero and arithmetic underflow
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 145/699] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 147/699] Input: goodix - clamp the device-reported contact count Greg Kroah-Hartman
` (556 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ranjan Kumar, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <kumarranja@chromium.org>
commit df2b818fa009c10ff6ba875a1663ff001cda9558 upstream.
The Elan I2C touchpad driver queries the device for its physical
dimensions and trace counts to calculate the device resolution and width.
However, if the device firmware or device tree provides invalid zero
values for x_traces or y_traces, it results in a fatal division-by-zero
exception leading to a kernel panic during device probe.
Add checks to ensure these parameters are non-zero before performing
the division. If invalid trace values are detected, fall back to a safe
default of 1.
Additionally, prevent an arithmetic underflow in the touch reporting
logic. Previously, if the calculated or fallback width was smaller than
ETP_FWIDTH_REDUCE (90), the subtraction would underflow, resulting in a
massive unsigned integer being reported to userspace. Clamp the adjusted
width to a minimum of 0 to safely handle small physical dimensions and
fallback scenarios.
Completing the probe with safe fallback values ensures the sysfs nodes
are created, keeping the firmware update path intact so a recovery
firmware can be flashed to the device.
Fixes: 6696777c6506 ("Input: add driver for Elan I2C/SMbus touchpad")
Fixes: e3a9a1290688 ("Input: elan_i2c - do not query the info if they are provided")
Signed-off-by: Ranjan Kumar <kumarranja@chromium.org>
Link: https://patch.msgid.link/20260612060339.3829666-1-kumarranja@chromium.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/elan_i2c_core.c | 36 ++++++++++++++++++++++++++++++------
1 file changed, 30 insertions(+), 6 deletions(-)
--- a/drivers/input/mouse/elan_i2c_core.c
+++ b/drivers/input/mouse/elan_i2c_core.c
@@ -387,8 +387,17 @@ static int elan_query_device_parameters(
if (error)
return error;
}
- data->width_x = data->max_x / x_traces;
- data->width_y = data->max_y / y_traces;
+
+ if (!x_traces || !y_traces) {
+ dev_warn(&client->dev,
+ "invalid trace numbers: x=%u, y=%u\n",
+ x_traces, y_traces);
+ data->width_x = 1;
+ data->width_y = 1;
+ } else {
+ data->width_x = data->max_x / x_traces;
+ data->width_y = data->max_y / y_traces;
+ }
if (device_property_read_u32(&client->dev,
"touchscreen-x-mm", &x_mm) ||
@@ -402,8 +411,16 @@ static int elan_query_device_parameters(
data->x_res = elan_convert_resolution(hw_x_res, data->pattern);
data->y_res = elan_convert_resolution(hw_y_res, data->pattern);
} else {
- data->x_res = (data->max_x + 1) / x_mm;
- data->y_res = (data->max_y + 1) / y_mm;
+ if (unlikely(x_mm == 0 || y_mm == 0)) {
+ dev_warn(&client->dev,
+ "invalid physical dimensions: x_mm=%u, y_mm=%u\n",
+ x_mm, y_mm);
+ data->x_res = 1;
+ data->y_res = 1;
+ } else {
+ data->x_res = (data->max_x + 1) / x_mm;
+ data->y_res = (data->max_y + 1) / y_mm;
+ }
}
if (device_property_read_bool(&client->dev, "elan,clickpad"))
@@ -922,6 +939,7 @@ static void elan_report_contact(struct e
if (data->report_features & ETP_FEATURE_REPORT_MK) {
unsigned int mk_x, mk_y, area_x, area_y;
+ int adj_width_x, adj_width_y;
u8 mk_data = high_precision ?
packet[ETP_MK_DATA_OFFSET + contact_num] :
finger_data[3];
@@ -933,8 +951,14 @@ static void elan_report_contact(struct e
* To avoid treating large finger as palm, let's reduce
* the width x and y per trace.
*/
- area_x = mk_x * (data->width_x - ETP_FWIDTH_REDUCE);
- area_y = mk_y * (data->width_y - ETP_FWIDTH_REDUCE);
+
+ adj_width_x = data->width_x > ETP_FWIDTH_REDUCE ?
+ data->width_x - ETP_FWIDTH_REDUCE : 0;
+ adj_width_y = data->width_y > ETP_FWIDTH_REDUCE ?
+ data->width_y - ETP_FWIDTH_REDUCE : 0;
+
+ area_x = mk_x * adj_width_x;
+ area_y = mk_y * adj_width_y;
input_report_abs(input, ABS_TOOL_WIDTH, mk_x);
input_report_abs(input, ABS_MT_TOUCH_MAJOR,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 147/699] Input: goodix - clamp the device-reported contact count
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 146/699] Input: elan_i2c - prevent division by zero and arithmetic underflow Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 148/699] Input: iforce - bound the device-reported force-feedback effect index Greg Kroah-Hartman
` (555 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Hans de Goede,
Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 5ed62a96e06be4e94b8296b7932afee550a70e04 upstream.
goodix_ts_read_input_report() copies the number of touch points reported
by the device into an on-stack buffer
u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS];
which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only
runtime check bounds the per-interrupt count against ts->max_touch_num,
but that value is taken verbatim from a 4-bit field of the device
configuration block and is never clamped:
ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;
The nibble can be 0..15, so a malfunctioning, malicious or counterfeit
controller (or an attacker tampering with the I2C bus) can advertise up
to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num
of up to 15 and the second goodix_i2c_read() writes
ts->contact_size * (touch_num - 1) bytes past the one-contact header into
point_data - up to 30 bytes (45 with the 9-byte report format) beyond the
92-byte buffer: a stack out-of-bounds write.
Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts
point_data[] is sized for, when reading it from the configuration.
Fixes: a7ac7c95d468 ("Input: goodix - use max touch number from device config")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260612-b4-disp-6844625d-v1-1-df0aed080c9d@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/goodix.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -955,7 +955,8 @@ static void goodix_read_config(struct go
}
ts->int_trigger_type = ts->config[TRIGGER_LOC] & 0x03;
- ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f;
+ ts->max_touch_num = min(ts->config[MAX_CONTACTS_LOC] & 0x0f,
+ GOODIX_MAX_CONTACTS);
x_max = get_unaligned_le16(&ts->config[RESOLUTION_LOC]);
y_max = get_unaligned_le16(&ts->config[RESOLUTION_LOC + 2]);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 148/699] Input: iforce - bound the device-reported force-feedback effect index
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 147/699] Input: goodix - clamp the device-reported contact count Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 149/699] Input: touchwin - reset the packet index on every complete packet Greg Kroah-Hartman
` (554 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 0e9943d2e4c63496b6ca84bc66fd3c71d40558e2 upstream.
iforce_process_packet() handles a status report (packet id 0x02) by
taking a force-feedback effect index straight from the device wire and
using it to address the per-effect state array:
i = data[1] & 0x7f;
if (data[1] & 0x80) {
if (!test_and_set_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags))
...
} else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
iforce->core_effects[i].flags)) {
...
}
The index is masked only with 0x7f, so it ranges 0..127, but
core_effects[] holds only IFORCE_EFFECTS_MAX (32) entries. For an index
of 32..127 the test_and_set_bit()/test_and_clear_bit() is an
out-of-bounds single-bit read-modify-write past the array. core_effects[]
is the second-to-last member of struct iforce, so the write lands in the
trailing members and beyond the embedding kzalloc()'d iforce_serio /
iforce_usb object.
data[1] is unvalidated device payload on both transports (the USB
interrupt endpoint and serio), and the status path is not gated on force
feedback being present, so a malicious or counterfeit device can set or
clear a bit at an attacker-chosen offset past the object.
Reject an out-of-range index instead of indexing with it. Bound against
the array dimension IFORCE_EFFECTS_MAX rather than dev->ff->max_effects so
the check guarantees memory safety regardless of how many effects the
device registered. A legitimate "effect started/stopped" status always
carries an index below IFORCE_EFFECTS_MAX, so well-formed devices are
unaffected; the neighbouring mark_core_as_ready() loop is already bounded
and is left untouched.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260613-b4-disp-4828d263-v1-1-02320e1a89dd@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/iforce/iforce-packets.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
--- a/drivers/input/joystick/iforce/iforce-packets.c
+++ b/drivers/input/joystick/iforce/iforce-packets.c
@@ -192,14 +192,18 @@ void iforce_process_packet(struct iforce
/* Check if an effect was just started or stopped */
i = data[1] & 0x7f;
- if (data[1] & 0x80) {
- if (!test_and_set_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) {
- /* Report play event */
- input_report_ff_status(dev, i, FF_STATUS_PLAYING);
+ if (i < IFORCE_EFFECTS_MAX) {
+ if (data[1] & 0x80) {
+ if (!test_and_set_bit(FF_CORE_IS_PLAYED,
+ iforce->core_effects[i].flags)) {
+ /* Report play event */
+ input_report_ff_status(dev, i, FF_STATUS_PLAYING);
+ }
+ } else if (test_and_clear_bit(FF_CORE_IS_PLAYED,
+ iforce->core_effects[i].flags)) {
+ /* Report stop event */
+ input_report_ff_status(dev, i, FF_STATUS_STOPPED);
}
- } else if (test_and_clear_bit(FF_CORE_IS_PLAYED, iforce->core_effects[i].flags)) {
- /* Report stop event */
- input_report_ff_status(dev, i, FF_STATUS_STOPPED);
}
for (j = 3; j < len; j += 2)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 149/699] Input: touchwin - reset the packet index on every complete packet
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 148/699] Input: iforce - bound the device-reported force-feedback effect index Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 150/699] Input: maplemouse - fix NULL pointer dereference in open() Greg Kroah-Hartman
` (553 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 478cdd736f2ce3114f90e775d7358136d3977b94 upstream.
tw_interrupt() accumulates each non-zero serial byte into a fixed
three-byte buffer with a running index that is only reset once a full
packet has been received *and* the device's two Y bytes agree:
tw->data[tw->idx++] = data;
if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
...
tw->idx = 0;
}
The reset is gated on tw->data[1] == tw->data[2], a value the device
controls. A malicious, malfunctioning or counterfeit Touchwindow
peripheral can stream non-zero bytes whose 2nd and 3rd bytes differ: the
index reaches TW_LENGTH without the equality holding, is never reset, and
keeps growing, so tw->data[tw->idx++] walks off the end of the three-byte
array and the rest of the heap-allocated struct tw, one attacker-chosen
byte at a time -- an unbounded, device-driven heap out-of-bounds write.
Reset the index on every completed packet and report an event only when
the two Y bytes match, like the other serio touchscreen drivers do.
Fixes: 11ea3173d5f2 ("Input: add driver for Touchwin serial touchscreens")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260613-b4-disp-69921bfd-v1-1-82c036899959@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/touchwin.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/drivers/input/touchscreen/touchwin.c
+++ b/drivers/input/touchscreen/touchwin.c
@@ -63,12 +63,15 @@ static irqreturn_t tw_interrupt(struct s
if (data) { /* touch */
tw->touched = 1;
tw->data[tw->idx++] = data;
- /* verify length and that the two Y's are the same */
- if (tw->idx == TW_LENGTH && tw->data[1] == tw->data[2]) {
- input_report_abs(dev, ABS_X, tw->data[0]);
- input_report_abs(dev, ABS_Y, tw->data[1]);
- input_report_key(dev, BTN_TOUCH, 1);
- input_sync(dev);
+ /* a full packet ends the accumulation, valid or not */
+ if (tw->idx == TW_LENGTH) {
+ /* report only if the two Y's are the same */
+ if (tw->data[1] == tw->data[2]) {
+ input_report_abs(dev, ABS_X, tw->data[0]);
+ input_report_abs(dev, ABS_Y, tw->data[1]);
+ input_report_key(dev, BTN_TOUCH, 1);
+ input_sync(dev);
+ }
tw->idx = 0;
}
} else if (tw->touched) { /* untouch */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 150/699] Input: maplemouse - fix NULL pointer dereference in open()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 149/699] Input: touchwin - reset the packet index on every complete packet Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 151/699] Input: mms114 - fix multi-touch slot corruption Greg Kroah-Hartman
` (552 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Fuchs, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <fuchsfl@gmail.com>
commit ee89db004238bd0b034f2a6176e175561658750b upstream.
Commit 555c765b0cc2 ("Input: mouse - drop unnecessary calls to
input_set_drvdata") dropped the input_set_drvdata() call in probe
because the data appeared to be unused. However, dc_mouse_open() and
dc_mouse_close() were using maple_get_drvdata(to_maple_dev(&dev->dev)).
This appears to be accessing the data attached to an instance of
maple_device structure, while in reality this actually retrieves driver
data from the input device's embedded struct device (doing invalid
conversion of input device structure to maple device). After
input_set_drvdata() was removed, that lookup started returning NULL and
opening the input device dereferences mse->mdev.
Restore input_set_drvdata() and convert open() and close() to use
input_get_drvdata() so the dependency is no longer hidden.
Fixes: 6b3480855aad ("maple: input: fix up maple mouse driver")
Fixes: 555c765b0cc2 ("Input: mouse - drop unnecessary calls to input_set_drvdata")
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Link: https://patch.msgid.link/20260628230715.2982552-1-fuchsfl@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/maplemouse.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/input/mouse/maplemouse.c
+++ b/drivers/input/mouse/maplemouse.c
@@ -48,7 +48,7 @@ static void dc_mouse_callback(struct map
static int dc_mouse_open(struct input_dev *dev)
{
- struct dc_mouse *mse = maple_get_drvdata(to_maple_dev(&dev->dev));
+ struct dc_mouse *mse = input_get_drvdata(dev);
maple_getcond_callback(mse->mdev, dc_mouse_callback, HZ/50,
MAPLE_FUNC_MOUSE);
@@ -58,7 +58,7 @@ static int dc_mouse_open(struct input_de
static void dc_mouse_close(struct input_dev *dev)
{
- struct dc_mouse *mse = maple_get_drvdata(to_maple_dev(&dev->dev));
+ struct dc_mouse *mse = input_get_drvdata(dev);
maple_getcond_callback(mse->mdev, dc_mouse_callback, 0,
MAPLE_FUNC_MOUSE);
@@ -88,6 +88,7 @@ static int probe_maple_mouse(struct devi
mse->dev = input_dev;
mse->mdev = mdev;
+ input_set_drvdata(input_dev, mse);
input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
input_dev->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 151/699] Input: mms114 - fix multi-touch slot corruption
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 150/699] Input: maplemouse - fix NULL pointer dereference in open() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 152/699] Input: maple_keyb - set driver data before registering input device Greg Kroah-Hartman
` (551 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, sashiko-bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit adea84ee6cdea611146c4251d3c1616f5a09feca upstream.
If the touchscreen controller reports a touch ID of 0, the driver
calculates the slot ID as touch->id - 1, which underflows to UINT_MAX.
This is passed to input_mt_slot() as -1.
Since the input core ignores negative slot values, the active slot remains
unchanged. The driver then reports the touch coordinates for the previously
active slot, corrupting its state.
Fix this by rejecting touch reports with ID 0.
Fixes: 07b8481d4aff ("Input: add MELFAS mms114 touchscreen driver")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/mms114.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/touchscreen/mms114.c
+++ b/drivers/input/touchscreen/mms114.c
@@ -159,7 +159,7 @@ static void mms114_process_mt(struct mms
unsigned int x;
unsigned int y;
- if (touch->id > MMS114_MAX_TOUCH) {
+ if (touch->id == 0 || touch->id > MMS114_MAX_TOUCH) {
dev_err(&client->dev, "Wrong touch id (%d)\n", touch->id);
return;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 152/699] Input: maple_keyb - set driver data before registering input device
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 151/699] Input: mms114 - fix multi-touch slot corruption Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 153/699] Input: maplemouse " Greg Kroah-Hartman
` (550 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 536394ec81419b67d9f4f0028812c4372397be1b upstream.
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/maple_keyb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/input/keyboard/maple_keyb.c
+++ b/drivers/input/keyboard/maple_keyb.c
@@ -169,6 +169,8 @@ static int probe_maple_kbd(struct device
kbd->dev = idev;
memcpy(kbd->keycode, dc_kbd_keycode, sizeof(kbd->keycode));
+ maple_set_drvdata(mdev, kbd);
+
idev->name = mdev->product_name;
idev->evbit[0] = BIT(EV_KEY) | BIT(EV_REP);
idev->keycode = kbd->keycode;
@@ -193,8 +195,6 @@ static int probe_maple_kbd(struct device
mdev->driver = mdrv;
- maple_set_drvdata(mdev, kbd);
-
return error;
fail_register:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 153/699] Input: maplemouse - set driver data before registering input device
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 152/699] Input: maple_keyb - set driver data before registering input device Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 154/699] Input: maplecontrol " Greg Kroah-Hartman
` (549 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Fuchs, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 738f24bbbc95dd50cb4229d1ed62a05f29db2bda upstream.
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Tested-by: Florian Fuchs <fuchsfl@gmail.com>
Link: https://patch.msgid.link/akNXw45L_8bxD6QV@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/maplemouse.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/input/mouse/maplemouse.c
+++ b/drivers/input/mouse/maplemouse.c
@@ -88,6 +88,8 @@ static int probe_maple_mouse(struct devi
mse->dev = input_dev;
mse->mdev = mdev;
+ maple_set_drvdata(mdev, mse);
+
input_set_drvdata(input_dev, mse);
input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
input_dev->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
@@ -103,12 +105,12 @@ static int probe_maple_mouse(struct devi
goto fail_register;
mdev->driver = mdrv;
- maple_set_drvdata(mdev, mse);
return error;
fail_register:
input_free_device(input_dev);
+ maple_set_drvdata(mdev, NULL);
fail_nomem:
kfree(mse);
fail:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 154/699] Input: maplecontrol - set driver data before registering input device
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 153/699] Input: maplemouse " Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 155/699] RDMA/siw: bound Read Response placement to the RREAD length Greg Kroah-Hartman
` (548 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Fuchs, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit fe938ee497d58c644f6910cfe6ae155f6fb3e523 upstream.
Set maple driver data before calling input_register_device() to
ensure that it is available if the device is opened immediately and
the callback is triggered.
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Tested-by: Florian Fuchs <fuchsfl@gmail.com>
Link: https://patch.msgid.link/akNYib9hQFNN1fA9@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/maplecontrol.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/input/joystick/maplecontrol.c
+++ b/drivers/input/joystick/maplecontrol.c
@@ -112,6 +112,8 @@ static int probe_maple_controller(struct
pad->dev = idev;
pad->mdev = mdev;
+ maple_set_drvdata(mdev, pad);
+
idev->open = dc_pad_open;
idev->close = dc_pad_close;
@@ -146,7 +148,6 @@ static int probe_maple_controller(struct
goto fail;
mdev->driver = mdrv;
- maple_set_drvdata(mdev, pad);
return 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 155/699] RDMA/siw: bound Read Response placement to the RREAD length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 154/699] Input: maplecontrol " Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 156/699] fuse: fix device node leak in cuse_process_init_reply() Greg Kroah-Hartman
` (547 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Jason Gunthorpe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 7d29f7e9dbd844cae4d3e559cf78324b9642fd6b upstream.
In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
inbound Read Response DDP segment at sge->laddr + wqe->processed and then
accumulates wqe->processed, but it never checks the running total against
the sink buffer length on continuation segments. siw_check_sge() resolves
and validates the sink memory only on the first fragment (the if (!*mem)
branch), and siw_rresp_check_ntoh() compares the cumulative length against
wqe->bytes only on the final segment (the !frx->more_ddp_segs guard).
A connected siw peer that answers an outstanding RREAD with Read Response
segments that keep the DDP Last flag clear, carrying more total payload
than the RREAD requested, drives wqe->processed past the validated sink
buffer; the next siw_rx_data() call writes out of bounds at
sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP,
so the peer is the remote end of an established RDMA connection and needs
no local privilege.
Bound every segment before placement, exactly as siw_proc_send() and
siw_proc_write() already do for their tagged and untagged paths, and
terminate the connection with a base-or-bounds DDP error when the
Read Response would overrun the sink buffer.
This is the second receive-path length fix for this file. A separate
change rejects an MPA FPDU length that underflows the per-fragment
remainder in the header decode; that guard does not cover this case,
because here each individual segment length is self-consistent and only
the accumulated placement offset overruns the buffer.
Fixes: 8b6a361b8c48 ("rdma/siw: receive path")
Link: https://patch.msgid.link/r/20260602194700.2273758-1-michael.bommarito@gmail.com
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/sw/siw/siw_qp_rx.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/infiniband/sw/siw/siw_qp_rx.c
+++ b/drivers/infiniband/sw/siw/siw_qp_rx.c
@@ -848,6 +848,15 @@ int siw_proc_rresp(struct siw_qp *qp)
}
mem_p = *mem;
+ if (unlikely(wqe->processed + srx->fpdu_part_rem > wqe->bytes)) {
+ siw_dbg_qp(qp, "rresp len: %d + %d > %d\n",
+ wqe->processed, srx->fpdu_part_rem, wqe->bytes);
+ wqe->wc_status = SIW_WC_LOC_LEN_ERR;
+ siw_init_terminate(qp, TERM_ERROR_LAYER_DDP,
+ DDP_ETYPE_TAGGED_BUF,
+ DDP_ECODE_T_BASE_BOUNDS, 0);
+ return -EINVAL;
+ }
bytes = min(srx->fpdu_part_rem, srx->skb_new);
if (mem_p->mem_obj == NULL)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 156/699] fuse: fix device node leak in cuse_process_init_reply()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 155/699] RDMA/siw: bound Read Response placement to the RREAD length Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 157/699] fuse: re-lock request before returning from fuse_ref_folio() Greg Kroah-Hartman
` (546 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alberto Ruiz, Miklos Szeredi
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alberto Ruiz <aruiz@redhat.com>
commit 9fa4f7a53406430ee9982f2f636a15b338185122 upstream.
If device_add() succeeds during CUSE initialization but a subsequent
step (cdev_alloc() or cdev_add()) fails, the error path calls
put_device() without first calling device_del(). This leaks the
devtmpfs entry created by device_add(), leaving a stale /dev/<name>
node that persists until reboot.
Since the cuse_conn is never linked into cuse_conntbl on the failure
path, cuse_channel_release() sees cc->dev == NULL and skips
device_unregister(), so no other code path cleans up the node.
This has several consequences:
- The device name is permanently poisoned: any subsequent attempt to
create a CUSE device with the same name hits the stale sysfs entry,
device_add() fails, and the new device is aborted.
- The collision manifests as ENODEV returned to userspace with no
dmesg diagnostic, making it very difficult to debug.
- The failure is self-perpetuating: once a name is leaked, all future
attempts with that name fail identically.
Fix this by introducing an err_dev label that calls device_del() to
undo device_add() before falling through to err_unlock. The existing
err_unlock path from a device_add() failure correctly skips device_del()
since the device was never added.
Testing instructions can be found at the lore link below.
Link: https://lore.kernel.org/all/20260408-wip-cuse-leak-fix-v1-0-1c028d575e97@redhat.com/
Signed-off-by: Alberto Ruiz <aruiz@redhat.com>
Fixes: 151060ac1314 ("CUSE: implement CUSE - Character device in Userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/cuse.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -386,7 +386,7 @@ static void cuse_process_init_reply(stru
rc = -ENOMEM;
cdev = cdev_alloc();
if (!cdev)
- goto err_unlock;
+ goto err_dev;
cdev->owner = THIS_MODULE;
cdev->ops = &cuse_frontend_fops;
@@ -412,6 +412,8 @@ out:
err_cdev:
cdev_del(cdev);
+err_dev:
+ device_del(dev);
err_unlock:
mutex_unlock(&cuse_lock);
put_device(dev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 157/699] fuse: re-lock request before returning from fuse_ref_folio()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 156/699] fuse: fix device node leak in cuse_process_init_reply() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 158/699] sched/fair: Only update stats for allowed CPUs when looking for dst group Greg Kroah-Hartman
` (545 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Joanne Koong, Miklos Szeredi
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joanne Koong <joannelkoong@gmail.com>
commit b5befa80fdbe287a98480effed9564712924add5 upstream.
fuse_ref_folio() unlocks the request but does not re-lock it before
returning. fuse_chan_abort() can end the request and the async end
callback (eg fuse_writepage_free()) can free the args while the
subsequent copy chain logic after fuse_ref_folio() accesses them,
leading to use-after-free issues.
Fix this by locking the request in fuse_ref_folio() before returning.
Fixes: c3021629a0d8 ("fuse: support splice() reading from fuse device")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -927,7 +927,7 @@ static int fuse_ref_page(struct fuse_cop
cs->nr_segs++;
cs->len = 0;
- return 0;
+ return lock_request(cs->req);
}
/*
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 158/699] sched/fair: Only update stats for allowed CPUs when looking for dst group
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 157/699] fuse: re-lock request before returning from fuse_ref_folio() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 159/699] crypto: algif_skcipher - force synchronous processing on trees without ctx->state Greg Kroah-Hartman
` (544 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adam Li, Peter Zijlstra (Intel),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Li <adamli@os.amperecomputing.com>
[ Upstream commit 82d6e01a0699800efd8b048eb584c907ccb47b7a ]
Load imbalance is observed when the workload frequently forks new threads.
Due to CPU affinity, the workload can run on CPU 0-7 in the first
group, and only on CPU 8-11 in the second group. CPU 12-15 are always idle.
{ 0 1 2 3 4 5 6 7 } {8 9 10 11 12 13 14 15}
* * * * * * * * * * * *
When looking for dst group for newly forked threads, in many times
update_sg_wakeup_stats() reports the second group has more idle CPUs
than the first group. The scheduler thinks the second group is less
busy. Then it selects least busy CPUs among CPU 8-11. Therefore CPU 8-11
can be crowded with newly forked threads, at the same time CPU 0-7
can be idle.
A task may not use all the CPUs in a schedule group due to CPU affinity.
Only update schedule group statistics for allowed CPUs.
Signed-off-by: Adam Li <adamli@os.amperecomputing.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/sched/fair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index c11d59bea0ea81..fa85b84fdbc533 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -8969,7 +8969,7 @@ static inline void update_sg_wakeup_stats(struct sched_domain *sd,
if (sd->flags & SD_ASYM_CPUCAPACITY)
sgs->group_misfit_task_load = 1;
- for_each_cpu(i, sched_group_span(group)) {
+ for_each_cpu_and(i, sched_group_span(group), p->cpus_ptr) {
struct rq *rq = cpu_rq(i);
unsigned int local;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 159/699] crypto: algif_skcipher - force synchronous processing on trees without ctx->state
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 158/699] sched/fair: Only update stats for allowed CPUs when looking for dst group Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 160/699] tools/mm/slabinfo: fix total_objects attribute name Greg Kroah-Hartman
` (543 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammet Kaan KILINÇ,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
The AIO/async path in skcipher_recvmsg() passes the socket-wide ctx->iv
directly into the skcipher request. After io_submit() the socket lock is
dropped and the request is processed asynchronously, so a concurrent
sendmsg(ALG_SET_IV) can overwrite ctx->iv and make the in-flight request
run under an attacker-controlled IV. For CTR/stream modes this is
IV/keystream reuse and lets an unprivileged user recover the plaintext of
a concurrent operation.
Snapshotting ctx->iv into per-request storage for the async path is not
sufficient. For ciphers with statesize == 0 - which includes cbc and ctr -
the MSG_MORE inter-chunk IV chaining is carried solely by the in-place
req->iv writeback, which a snapshot redirects into per-request memory that
af_alg_free_resources() releases on completion, silently producing wrong
output. Writing the IV back from the completion callback instead is not
possible either: that would require lock_sock() there, but the callback can
run in softirq/atomic context, so it must not sleep.
Make the operation synchronous instead, which removes both the IV race and
any writeback race. This is equivalent to the upstream resolution, commit
fcc77d33a34c ("net: Remove support for AIO on sockets"), which removed the
AIO socket path across net/ entirely and so produces the same end state for
this file. This patch deviates from that commit deliberately: rather than
removing AIO socket support tree-wide, which would be far too invasive for
stable, it removes only the AIO branch in crypto/algif_skcipher.c.
io_submit() now completes synchronously; AF_ALG async is rarely used in
practice.
The -EIOCBQUEUED check in skcipher_recvmsg() is now dead but harmless,
and is left alone to keep the fix minimal.
Tested on 6.6.y: attacker IV injection dropped from 2296/200000 to 0/200000
after the change; MSG_MORE chunked CTR output bit-identical to single-shot.
Reported-by: Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Cc: <stable@vger.kernel.org>
Signed-off-by: Muhammet Kaan KILINÇ <muhammetkaankilinc@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/algif_skcipher.c | 49 +++++++++++++++--------------------------
1 file changed, 18 insertions(+), 31 deletions(-)
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 8b314260929fbb..6a1a71284fe823 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -107,37 +107,24 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
skcipher_request_set_crypt(&areq->cra_u.skcipher_req, areq->tsgl,
areq->first_rsgl.sgl.sg, len, ctx->iv);
- if (msg->msg_iocb && !is_sync_kiocb(msg->msg_iocb)) {
- /* AIO operation */
- sock_hold(sk);
- areq->iocb = msg->msg_iocb;
-
- /* Remember output size that will be generated. */
- areq->outlen = len;
-
- skcipher_request_set_callback(&areq->cra_u.skcipher_req,
- CRYPTO_TFM_REQ_MAY_SLEEP,
- af_alg_async_cb, areq);
- err = ctx->enc ?
- crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
- crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
-
- /* AIO operation in progress */
- if (err == -EINPROGRESS)
- return -EIOCBQUEUED;
-
- sock_put(sk);
- } else {
- /* Synchronous operation */
- skcipher_request_set_callback(&areq->cra_u.skcipher_req,
- CRYPTO_TFM_REQ_MAY_SLEEP |
- CRYPTO_TFM_REQ_MAY_BACKLOG,
- crypto_req_done, &ctx->wait);
- err = crypto_wait_req(ctx->enc ?
- crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
- crypto_skcipher_decrypt(&areq->cra_u.skcipher_req),
- &ctx->wait);
- }
+ /*
+ * Force synchronous processing. The async (AIO) path passed the
+ * socket-wide ctx->iv into the request, which the worker
+ * dereferenced after the socket lock was dropped, letting a
+ * concurrent sendmsg(ALG_SET_IV) inject an attacker IV. Mainline
+ * removed the AIO socket path in commit fcc77d33a34c ("net: Remove
+ * support for AIO on sockets"); these stable trees lack the
+ * per-request ctx->state used by newer kernels, so the minimal safe
+ * fix is to always complete synchronously.
+ */
+ skcipher_request_set_callback(&areq->cra_u.skcipher_req,
+ CRYPTO_TFM_REQ_MAY_SLEEP |
+ CRYPTO_TFM_REQ_MAY_BACKLOG,
+ crypto_req_done, &ctx->wait);
+ err = crypto_wait_req(ctx->enc ?
+ crypto_skcipher_encrypt(&areq->cra_u.skcipher_req) :
+ crypto_skcipher_decrypt(&areq->cra_u.skcipher_req),
+ &ctx->wait);
free:
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 160/699] tools/mm/slabinfo: fix total_objects attribute name
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 159/699] crypto: algif_skcipher - force synchronous processing on trees without ctx->state Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 161/699] crypto: af_alg - Remove zero-copy support from skcipher and aead Greg Kroah-Hartman
` (542 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yichong Chen, SeongJae Park,
Vlastimil Babka (SUSE), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
[ Upstream commit 892a7864730775c3dbee2a39e9ead4fa8d4256e7 ]
SLUB exports the total_objects sysfs attribute, but slabinfo tries to read
objects_total. As a result, the lookup fails and the field remains zero.
Use the correct attribute name and rename the corresponding structure
member to match.
Fixes: 205ab99dd103 ("slub: Update statistics handling for variable order slabs")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: SeongJae Park <sj@kernel.org>
Link: https://patch.msgid.link/96556748872BB47E+20260612071359.649946-1-chenyichong@uniontech.com
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/vm/slabinfo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
index 3ae985dc24b6d6..5819c4133e0d9c 100644
--- a/tools/vm/slabinfo.c
+++ b/tools/vm/slabinfo.c
@@ -33,7 +33,7 @@ struct slabinfo {
unsigned int hwcache_align, object_size, objs_per_slab;
unsigned int sanity_checks, slab_size, store_user, trace;
int order, poison, reclaim_account, red_zone;
- unsigned long partial, objects, slabs, objects_partial, objects_total;
+ unsigned long partial, objects, slabs, objects_partial, total_objects;
unsigned long alloc_fastpath, alloc_slowpath;
unsigned long free_fastpath, free_slowpath;
unsigned long free_frozen, free_add_partial, free_remove_partial;
@@ -1232,7 +1232,7 @@ static void read_slab_dir(void)
slab->object_size = get_obj("object_size");
slab->objects = get_obj("objects");
slab->objects_partial = get_obj("objects_partial");
- slab->objects_total = get_obj("objects_total");
+ slab->total_objects = get_obj("total_objects");
slab->objs_per_slab = get_obj("objs_per_slab");
slab->order = get_obj("order");
slab->partial = get_obj("partial");
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 161/699] crypto: af_alg - Remove zero-copy support from skcipher and aead
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 160/699] tools/mm/slabinfo: fix total_objects attribute name Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 162/699] media: uvcvideo: Avoid partial metadata buffers Greg Kroah-Hartman
` (541 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taeyang Lee, Feng Ning,
Demi Marie Obenour, Eric Biggers, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit ffdd2bc378953b525aca61902534e753f1f8e734 upstream.
The zero-copy support is one of the riskiest aspects of AF_ALG. It
allows userspace to request cryptographic operations directly on
pagecache pages of files like the 'su' binary. It also allows userspace
to concurrently modify the memory which is being operated on, a recipe
for TOCTOU vulnerabilities.
While zero-copy support is more valuable in other areas of the kernel
like the frequently used networking and file I/O code, it has far less
value in AF_ALG, which is a niche UAPI. AF_ALG primarily just exists
for backwards compatibility with a small set of userspace programs such
as 'iwd' that haven't yet been fixed to use userspace crypto code.
Originally AF_ALG was intended to be used to access hardware crypto
accelerators. However, it isn't an efficient interface for that anyway,
and it turned out to be rarely used in this way in practice.
Thus, the risks of the zero-copy support in AF_ALG vastly outweigh its
benefits. Let's just remove it.
This commit removes it from the "skcipher" and "aead" algorithm types.
"hash" will be handled separately.
This is a soft break, not a hard break. Even after this commit, it
still works to use splice() or sendfile() to transfer data to an AF_ALG
request socket from a pipe or any file, respectively. What changes is
just that the kernel now makes an internal, stable copy of the data
before doing the crypto operation. So performance is slightly reduced,
but the UAPI isn't broken. And, very importantly, it's much safer.
Tested with libkcapi/test.sh. All its test cases still pass. I also
verified that this would have prevented the copy.fail exploit as well.
I also used a custom test program to verify that sendfile() still works.
Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations")
Fixes: 400c40cf78da ("crypto: algif - add AEAD support")
Reported-by: Taeyang Lee <0wn@theori.io>
Link: https://copy.fail/
Reported-by: Feng Ning <feng@innora.ai>
Closes: https://lore.kernel.org/r/afYcc-tZFwvZZo76@ans-MacBook-Pro.local
Reviewed-by: Demi Marie Obenour <demiobenour@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/crypto/userspace-if.rst | 31 ++-------------
crypto/af_alg.c | 54 +++++----------------------
2 files changed, 14 insertions(+), 71 deletions(-)
diff --git a/Documentation/crypto/userspace-if.rst b/Documentation/crypto/userspace-if.rst
index b45dabbf69d685..90dbbd56c4e355 100644
--- a/Documentation/crypto/userspace-if.rst
+++ b/Documentation/crypto/userspace-if.rst
@@ -328,33 +328,10 @@ CRYPTO_USER_API_RNG_CAVP option:
Zero-Copy Interface
-------------------
-In addition to the send/write/read/recv system call family, the AF_ALG
-interface can be accessed with the zero-copy interface of
-splice/vmsplice. As the name indicates, the kernel tries to avoid a copy
-operation into kernel space.
-
-The zero-copy operation requires data to be aligned at the page
-boundary. Non-aligned data can be used as well, but may require more
-operations of the kernel which would defeat the speed gains obtained
-from the zero-copy interface.
-
-The system-inherent limit for the size of one zero-copy operation is 16
-pages. If more data is to be sent to AF_ALG, user space must slice the
-input into segments with a maximum size of 16 pages.
-
-Zero-copy can be used with the following code example (a complete
-working example is provided with libkcapi):
-
-::
-
- int pipes[2];
-
- pipe(pipes);
- /* input data in iov */
- vmsplice(pipes[1], iov, iovlen, SPLICE_F_GIFT);
- /* opfd is the file descriptor returned from accept() system call */
- splice(pipes[0], NULL, opfd, NULL, ret, 0);
- read(opfd, out, outlen);
+AF_ALG used to have zero-copy support, but it was removed due to it being a
+frequent source of vulnerabilities. For backwards compatibility the splice()
+and sendfile() system calls are still supported, but the kernel will make an
+internal copy of the data before passing it to the crypto code.
Setsockopt Interface
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 6acee8e0041a42..4af79af8d2f1eb 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -972,53 +972,19 @@ EXPORT_SYMBOL_GPL(af_alg_sendmsg);
ssize_t af_alg_sendpage(struct socket *sock, struct page *page,
int offset, size_t size, int flags)
{
- struct sock *sk = sock->sk;
- struct alg_sock *ask = alg_sk(sk);
- struct af_alg_ctx *ctx = ask->private;
- struct af_alg_tsgl *sgl;
- int err = -EINVAL;
+ struct bio_vec bvec;
+ struct msghdr msg = {
+ .msg_flags = flags,
+ };
if (flags & MSG_SENDPAGE_NOTLAST)
- flags |= MSG_MORE;
-
- lock_sock(sk);
- if (!ctx->more && ctx->used)
- goto unlock;
-
- if (!size)
- goto done;
-
- if (!af_alg_writable(sk)) {
- err = af_alg_wait_for_wmem(sk, flags);
- if (err)
- goto unlock;
- }
-
- err = af_alg_alloc_tsgl(sk);
- if (err)
- goto unlock;
-
- ctx->merge = 0;
- sgl = list_entry(ctx->tsgl_list.prev, struct af_alg_tsgl, list);
-
- if (sgl->cur)
- sg_unmark_end(sgl->sg + sgl->cur - 1);
-
- sg_mark_end(sgl->sg + sgl->cur);
-
- get_page(page);
- sg_set_page(sgl->sg + sgl->cur, page, size, offset);
- sgl->cur++;
- ctx->used += size;
-
-done:
- ctx->more = flags & MSG_MORE;
-
-unlock:
- af_alg_data_wakeup(sk);
- release_sock(sk);
+ msg.msg_flags |= MSG_MORE;
- return err ?: size;
+ bvec.bv_page = page;
+ bvec.bv_len = size;
+ bvec.bv_offset = offset;
+ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size);
+ return sock_sendmsg(sock, &msg);
}
EXPORT_SYMBOL_GPL(af_alg_sendpage);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 162/699] media: uvcvideo: Avoid partial metadata buffers
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 161/699] crypto: af_alg - Remove zero-copy support from skcipher and aead Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 163/699] media: uvcvideo: Fix buffer sequence in frame gaps Greg Kroah-Hartman
` (540 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Hans de Goede,
Hans Verkuil
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit a15b773fe4ffa450b56347cc506b2d1405600f5d upstream.
If the metadata queue that is empty receives a new buffer while we are
in the middle of processing a frame, the first metadata buffer will
contain partial information.
Avoid this by tracking the state of the metadata buffer and making sure
that it is in sync with the data buffer.
Now that we are at it, make sure that we skip buffers of size 1 or 0.
They are not allowed by the spec... but it is a simple check to add and
better be safe than sorry.
Fixes: 088ead255245 ("media: uvcvideo: Add a metadata device node")
Cc: stable@vger.kernel.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Link: https://patch.msgid.link/20260417-uvc-meta-partial-v2-2-31d274af7d2d@chromium.org
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1071,7 +1071,9 @@ static void uvc_video_stats_stop(struct
* uvc_video_decode_end will never be called with a NULL buffer.
*/
static int uvc_video_decode_start(struct uvc_streaming *stream,
- struct uvc_buffer *buf, const u8 *data, int len)
+ struct uvc_buffer *buf,
+ struct uvc_buffer *meta_buf,
+ const u8 *data, int len)
{
u8 fid;
@@ -1138,6 +1140,8 @@ static int uvc_video_decode_start(struct
/* TODO: Handle PTS and SCR. */
buf->state = UVC_BUF_STATE_ACTIVE;
+ if (meta_buf)
+ meta_buf->state = UVC_BUF_STATE_ACTIVE;
}
/* Mark the buffer as done if we're at the beginning of a new frame.
@@ -1306,7 +1310,7 @@ static void uvc_video_decode_meta(struct
ktime_t time;
const u8 *scr;
- if (!meta_buf || length == 2)
+ if (length <= 2 || !meta_buf || meta_buf->state != UVC_BUF_STATE_ACTIVE)
return;
has_pts = mem[1] & UVC_STREAM_PTS;
@@ -1422,7 +1426,7 @@ static void uvc_video_decode_isoc(struct
/* Decode the payload header. */
mem = urb->transfer_buffer + urb->iso_frame_desc[i].offset;
do {
- ret = uvc_video_decode_start(stream, buf, mem,
+ ret = uvc_video_decode_start(stream, buf, meta_buf, mem,
urb->iso_frame_desc[i].actual_length);
if (ret == -EAGAIN)
uvc_video_next_buffers(stream, &buf, &meta_buf);
@@ -1470,7 +1474,8 @@ static void uvc_video_decode_bulk(struct
*/
if (stream->bulk.header_size == 0 && !stream->bulk.skip_payload) {
do {
- ret = uvc_video_decode_start(stream, buf, mem, len);
+ ret = uvc_video_decode_start(stream, buf, meta_buf, mem,
+ len);
if (ret == -EAGAIN)
uvc_video_next_buffers(stream, &buf, &meta_buf);
} while (ret == -EAGAIN);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 163/699] media: uvcvideo: Fix buffer sequence in frame gaps
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 162/699] media: uvcvideo: Avoid partial metadata buffers Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 164/699] serial: msm: Disable DMA for kernel console UART Greg Kroah-Hartman
` (539 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ricardo Ribalda,
Hans de Goede, Hans Verkuil
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit 2f24ac8dd87983a55f0498898f34a5f2b735b802 upstream.
In UVC, the FID flips with every frame. For every FID flip, we increase
the stream sequence number.
Now, if a FID flips multiple times and there is no data transferred between
the flips, the buffer sequence number will be set to the value of the
stream sequence number after the first flip.
Userspace uses the buffer sequence number to determine if there have been
missing frames. With the current behaviour, userspace will think that the
gap is in the wrong location.
This patch modifies uvc_video_decode_start() to provide the correct buffer
sequence number and timestamp.
Cc: stable@kernel.org
Fixes: 650b95feee35 ("[media] uvcvideo: Generate discontinuous sequence numbers when frames are lost")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_video.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1096,6 +1096,19 @@ static int uvc_video_decode_start(struct
stream->sequence++;
if (stream->sequence)
uvc_video_stats_update(stream);
+
+ /*
+ * On a FID flip initialize sequence number and timestamp.
+ *
+ * The driver already takes care of injecting FID flips for
+ * UVC_QUIRK_STREAM_NO_FID and UVC_QUIRK_MJPEG_NO_EOF.
+ */
+ if (buf) {
+ buf->buf.field = V4L2_FIELD_NONE;
+ buf->buf.sequence = stream->sequence;
+ buf->buf.vb2_buf.timestamp =
+ ktime_to_ns(uvc_video_get_time());
+ }
}
uvc_video_clock_decode(stream, buf, data, len);
@@ -1134,10 +1147,6 @@ static int uvc_video_decode_start(struct
return -ENODATA;
}
- buf->buf.field = V4L2_FIELD_NONE;
- buf->buf.sequence = stream->sequence;
- buf->buf.vb2_buf.timestamp = ktime_to_ns(uvc_video_get_time());
-
/* TODO: Handle PTS and SCR. */
buf->state = UVC_BUF_STATE_ACTIVE;
if (meta_buf)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 164/699] serial: msm: Disable DMA for kernel console UART
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 163/699] media: uvcvideo: Fix buffer sequence in frame gaps Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 165/699] serial: 8250_omap: clear rx_running on zero-length DMA completes Greg Kroah-Hartman
` (538 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Stephan Gerhold,
Konrad Dybcio
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
commit 22dd2777e6c180e1c945b00f6d18550979436324 upstream.
At the moment, concurrent writes from userspace and the kernel to the
console can trigger a race condition that results in an infinite loop of
the same messages printed over and over again. This is most likely to
happen during system startup or shutdown when the init system starts/stops
a large number of system services that interact with various kernel code.
When userspace writes to the TTY device, the driver initiates an
asynchronous DMA transfer and releases the port lock. At the same moment,
the kernel printk path might grab the port lock and re-configure the UART
controller for PIO, without waiting for the DMA operation to complete. It
seems like this collision results in zero progress being reported for the
DMA engine, so the same text is printed to the console over and over again.
For the kernel console, we want a reliable output path that will be
functional even during crashes etc. So rather than implementing complex
code to synchronize the kernel console write routines with the userspace
DMA write routines, simply disable DMA for the console UART instance.
Similar checks exist in many other serial drivers, e.g. 8250_port.c,
imx.c, sh-sci.c etc.
Cc: stable <stable@kernel.org>
Fixes: 3a878c430fd6 ("tty: serial: msm: Add TX DMA support")
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://patch.msgid.link/20260706-serial-msm-console-dma-collision-v1-1-3179b8cb1d89@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/msm_serial.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -1216,7 +1216,8 @@ static int msm_startup(struct uart_port
data |= UART_MR1_AUTO_RFR_LEVEL0 & rfr_level;
msm_write(port, data, UART_MR1);
- if (msm_port->is_uartdm) {
+ /* Disable DMA for console to prevent PIO/DMA collisions */
+ if (msm_port->is_uartdm && !uart_console(port)) {
msm_request_tx_dma(msm_port, msm_port->uart.mapbase);
msm_request_rx_dma(msm_port, msm_port->uart.mapbase);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 165/699] serial: 8250_omap: clear rx_running on zero-length DMA completes
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 164/699] serial: msm: Disable DMA for kernel console UART Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 166/699] afs: Fix netns teardown to cancel the preallocation charger Greg Kroah-Hartman
` (537 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Matthias Feser, Moteen Shah
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
commit 061b627ba534230a18ec4d7251562af12325d06a upstream.
On AM33xx RX DMA only triggers when the FIFO reaches the
configured threshold (typically 48 bytes). For smaller bursts
no DMA request is issued and the FIFO is drained by RX timeout.
In this case __dma_rx_do_complete() can legitimately see count == 0.
The current code exits early in this case and does not clear
dma->rx_running, leaving the DMA state inconsistent. This can
prevent RX DMA from restarting and may cause
omap_8250_rx_dma_flush() to fail, marking DMA as broken.
Fix this by clearing dma->rx_running once the DMA transfer has
completed or been terminated, even if no data was transferred.
Fixes: a5fd8945a478 ("serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done")
Cc: stable <stable@kernel.org>
Signed-off-by: Matthias Feser <mfe@KBSgmbhfr.onmicrosoft.com>
Reviewed-by: Moteen Shah <m-shah@ti.com>
Link: https://patch.msgid.link/BE3P281MB55155F2F5795E411F5A65282EE0B2@BE3P281MB5515.DEUP281.PROD.OUTLOOK.COM
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_omap.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -883,11 +883,12 @@ static void __dma_rx_do_complete(struct
dev_err(p->port.dev, "teardown incomplete\n");
}
}
+
+ dma->rx_running = 0;
if (!count)
goto out;
ret = tty_insert_flip_string(tty_port, dma->rx_buf, count);
- dma->rx_running = 0;
p->port.icount.rx += ret;
p->port.icount.buf_overrun += count - ret;
out:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 166/699] afs: Fix netns teardown to cancel the preallocation charger
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 165/699] serial: 8250_omap: clear rx_running on zero-length DMA completes Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 167/699] afs: fix NULL pointer dereference in afs_get_tree() Greg Kroah-Hartman
` (536 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Horman, David Howells,
Li Daming, Ren Wei, Marc Dionne, Jeffrey Altman, linux-afs,
stable, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 47694fbc9d24ab6bf210f91e8efe06a10a478064 upstream.
Fix the teardown of an afs network namespace to make sure it cancels the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before incoming calls are disabled (i.e. listen 0).
Also, if net->live is false because the afs netns is being deleted, make
afs_charge_preallocation() skip charging and make afs_rx_new_call() avoid
requeuing the charger.
(This was found by AI review).
Fixes: 00e907127e6f ("rxrpc: Preallocate peers, conns and calls for incoming service requests")
Reported-by: Simon Horman <horms@kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Li Daming <d4n.for.sec@gmail.com>
cc: Ren Wei <n05ec@lzu.edu.cn>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260609140911.838677-5-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/rxrpc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -107,6 +107,7 @@ void afs_close_socket(struct afs_net *ne
{
_enter("");
+ cancel_work_sync(&net->charge_preallocation_work);
kernel_listen(net->socket, 0);
flush_workqueue(afs_async_calls);
@@ -749,7 +750,7 @@ void afs_charge_preallocation(struct wor
container_of(work, struct afs_net, charge_preallocation_work);
struct afs_call *call = net->spare_incoming_call;
- for (;;) {
+ while (READ_ONCE(net->live)) {
if (!call) {
call = afs_alloc_call(net, &afs_RXCMxxxx, GFP_KERNEL);
if (!call)
@@ -794,7 +795,8 @@ static void afs_rx_new_call(struct sock
{
struct afs_net *net = afs_sock2net(sk);
- queue_work(afs_wq, &net->charge_preallocation_work);
+ if (net->live)
+ queue_work(afs_wq, &net->charge_preallocation_work);
}
/*
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 167/699] afs: fix NULL pointer dereference in afs_get_tree()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 166/699] afs: Fix netns teardown to cancel the preallocation charger Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 168/699] afs: Fix further netns teardown to cancel the preallocation charger Greg Kroah-Hartman
` (535 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matvey Kovalev, David Howells,
Marc Dionne, linux-afs, Christian Brauner (Amutable)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matvey Kovalev <matvey.kovalev@ispras.ru>
commit 0b70716081c6462be9b2928ad736d0d527b09678 upstream.
afs_alloc_sbi() uses kzalloc for memory allocation. And, if
ctx->dyn_root is not null, as->cell and as->volume are null.
In trace_afs_get_tree() they are dereferenced.
KASAN error message:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 2 PID: 18478 Comm: syz-executor.7 Not tainted 5.10.246-syzkaller #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1
04/01/2014
RIP: 0010:perf_trace_afs_get_tree+0x1d9/0x550
include/trace/events/afs.h:1365
Call Trace:
trace_afs_get_tree include/trace/events/afs.h:1365 [inline]
afs_get_tree+0x922/0x1350 fs/afs/super.c:599
vfs_get_tree+0x8e/0x300 fs/super.c:1572
do_new_mount fs/namespace.c:3011 [inline]
path_mount+0x14a5/0x2220 fs/namespace.c:3341
do_mount fs/namespace.c:3354 [inline]
__do_sys_mount fs/namespace.c:3562 [inline]
__se_sys_mount fs/namespace.c:3539 [inline]
__x64_sys_mount+0x283/0x300 fs/namespace.c:3539
do_syscall_64+0x33/0x50 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x67/0xd1
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 80548b03991f5 ("afs: Add more tracepoints")
Cc: stable@vger.kernel.org
Signed-off-by: Matvey Kovalev <matvey.kovalev@ispras.ru>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-4-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/super.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -596,7 +596,8 @@ static int afs_get_tree(struct fs_contex
}
fc->root = dget(sb->s_root);
- trace_afs_get_tree(as->cell, as->volume);
+ if (!ctx->dyn_root)
+ trace_afs_get_tree(as->cell, as->volume);
_leave(" = 0 [%p]", sb);
return 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 168/699] afs: Fix further netns teardown to cancel the preallocation charger
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 167/699] afs: fix NULL pointer dereference in afs_get_tree() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 169/699] drm/tidss: Drop extra drm_mode_config_reset() call Greg Kroah-Hartman
` (534 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, David Howells,
Li Daming, Ren Wei, Marc Dionne, Jeffrey Altman, Simon Horman,
linux-afs, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 2daf8ac812c3d78c642fe7652f62e29df5e3da20 upstream.
When an afs network namespace is torn down, it cancels and waits for the
work item that keeps the preallocated rxrpc call/conn/peer queue charged
before disabling incoming (i.e. listen 0), but there's a small window in
which it can be requeued by an incoming call wending through the I/O
thread.
Fix this by cancelling the charger work item again after reducing the
listen backlog to zero.
Fixes: 47694fbc9d24 ("afs: Fix netns teardown to cancel the preallocation charger")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://sashiko.dev/#/patchset/20260609140911.838677-1-dhowells%40redhat.com
cc: Li Daming <d4n.for.sec@gmail.com>
cc: Ren Wei <n05ec@lzu.edu.cn>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
Link: https://patch.msgid.link/20260624163819.3017002-5-dhowells@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/rxrpc.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -108,8 +108,13 @@ void afs_close_socket(struct afs_net *ne
_enter("");
cancel_work_sync(&net->charge_preallocation_work);
+ /* Future work items should now see ->live is false. */
+
kernel_listen(net->socket, 0);
+
+ /* Make sure work items are no longer running. */
flush_workqueue(afs_async_calls);
+ cancel_work_sync(&net->charge_preallocation_work);
if (net->spare_incoming_call) {
afs_put_call(net->spare_incoming_call);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 169/699] drm/tidss: Drop extra drm_mode_config_reset() call
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 168/699] afs: Fix further netns teardown to cancel the preallocation charger Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 170/699] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure Greg Kroah-Hartman
` (533 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Tomi Valkeinen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit f468fef38716f667e805e0fa2c497c6b9c325bb9 ]
We are calling drm_mode_config_reset() twice at probe time. There's no
reason for this and the second call can be removed, reducing work at
probe time slightly.
Fixes: 32a1795f57ee ("drm/tidss: New driver for TI Keystone platform Display SubSystem")
Acked-by: Maxime Ripard <mripard@kernel.org>
Link: https://patch.msgid.link/20260311-tidss-minor-fixes-v2-1-cb4479784458@ideasonboard.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_kms.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c
index 09485c7f0d6fcc..48e72862c7144a 100644
--- a/drivers/gpu/drm/tidss/tidss_kms.c
+++ b/drivers/gpu/drm/tidss/tidss_kms.c
@@ -277,8 +277,6 @@ int tidss_modeset_init(struct tidss_device *tidss)
if (ret)
return ret;
- drm_mode_config_reset(ddev);
-
dev_dbg(tidss->dev, "%s done\n", __func__);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 170/699] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 169/699] drm/tidss: Drop extra drm_mode_config_reset() call Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 171/699] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() Greg Kroah-Hartman
` (532 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 82f1d6042611d45b8b9de423bbcb4e0ced9ec62b ]
radeon_ring_restore() takes ownership of the data buffer allocated by
radeon_ring_backup(). The caller (radeon_gpu_reset()) only frees it in
the non-restore branch; in the restore branch it relies on
radeon_ring_restore() to free it.
If radeon_ring_lock() fails, the function returned early without calling
kvfree(data), leaking the ring backup buffer on every GPU reset that
fails at the lock stage. During repeated GPU resets this causes
cumulative kernel memory exhaustion.
Free data before returning the error.
Fixes: 55d7c22192be ("drm/radeon: implement ring saving on reset v4")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_ring.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 37093cea24c59d..4da91b12c84dee 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -352,8 +352,10 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
/* restore the saved ring content */
r = radeon_ring_lock(rdev, ring, size);
- if (r)
+ if (r) {
+ kvfree(data);
return r;
+ }
for (i = 0; i < size; ++i) {
radeon_ring_write(ring, data[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 171/699] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 170/699] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 172/699] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer Greg Kroah-Hartman
` (531 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki (Intel),
Saravana Kannan, Danilo Krummrich, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
[ Upstream commit e9506871a8ea304cde48ff4a57226df2aadddae3 ]
dev_has_sync_state() reads dev->driver twice without holding
device_lock() -- once for the NULL check and once to dereference
->sync_state. Some callers only hold device_links_write_lock, which
doesn't prevent a concurrent unbind from clearing dev->driver via
device_unbind_cleanup().
Fix it by reading dev->driver exactly once with READ_ONCE(), pairing
with the WRITE_ONCE() in device_set_driver().
Link: https://lore.kernel.org/driver-core/DHW8QPU1VU1F.3P6PH69HLFBYC@kernel.org/
Fixes: ac338acf514e ("driver core: Add dev_has_sync_state()")
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Saravana Kannan <saravanak@kernel.org>
Link: https://patch.msgid.link/20260418162221.1121873-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/device.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/linux/device.h b/include/linux/device.h
index 77d6493c26a484..3575a28fee7f3c 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -842,9 +842,12 @@ static inline struct device_node *dev_of_node(struct device *dev)
static inline bool dev_has_sync_state(struct device *dev)
{
+ struct device_driver *drv;
+
if (!dev)
return false;
- if (dev->driver && dev->driver->sync_state)
+ drv = READ_ONCE(dev->driver);
+ if (drv && drv->sync_state)
return true;
if (dev->bus && dev->bus->sync_state)
return true;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 172/699] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 171/699] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 173/699] kconfig: fix potential NULL pointer dereference in conf_askvalue Greg Kroah-Hartman
` (530 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Ping-Ke Shih,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 6e76e9ed273dfb4b3333a5ebbb94958cc5752ab6 ]
In rtw_pci_rx_napi(), new_len is computed as the sum of pkt_len (14-bit
descriptor field, max 16383) and pkt_offset (drv_info_sz + shift, both
firmware-controlled). The result can exceed RTK_PCI_RX_BUF_SIZE (11478),
causing an out-of-bounds read from the pre-allocated DMA buffer when
skb_put_data copies new_len bytes. The USB transport already validates
this (rtw_usb_rx_data_put checks against RTW_USB_MAX_RECVBUF_SZ); the
PCIe path does not.
Add a check that new_len does not exceed the DMA buffer size.
Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20260421111434.3389674-1-tristmd@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index 676d861aaf9971..bc09e0225e44e0 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -980,6 +980,11 @@ static void rtw_pci_rx_isr(struct rtw_dev *rtwdev, struct rtw_pci *rtwpci,
* discard the frame if none available
*/
new_len = pkt_stat.pkt_len + pkt_offset;
+ if (unlikely(new_len > RTK_PCI_RX_BUF_SIZE)) {
+ rtw_dbg(rtwdev, RTW_DBG_RX,
+ "oversized RX packet: %u\n", new_len);
+ goto next_rp;
+ }
new = dev_alloc_skb(new_len);
if (WARN_ONCE(!new, "rx routine starvation\n"))
goto next_rp;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 173/699] kconfig: fix potential NULL pointer dereference in conf_askvalue
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 172/699] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 174/699] wifi: ath9k: fix OOB access from firmware tx status queue ID Greg Kroah-Hartman
` (529 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xingjing Deng, Nathan Chancellor,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingjing Deng <micro6947@gmail.com>
[ Upstream commit b9d21c32dca2167a614e66c9e27999b9e1c33d55 ]
In conf_askvalue(), the 'def' argument (retrieved via sym_get_string_value)
can be NULL. While current call sites ensure that 'def' is valid,
calling printf("%s\n", def) is technically undefined behavior and could
lead to a segmentation fault on certain libc implementations if the
function were called with a NULL pointer in the future.
Improve the robustness of conf_askvalue() by providing an empty string
as a fallback.
Additionally, remove the redundant re-initialization of the 'line'
buffer inside the !sym_is_changeable(sym) block, as it is already
properly initialized at the function entry.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Xingjing Deng <micro6947@gmail.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260306021709.27068-1-micro6947@gmail.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/conf.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index f6e548b8f79556..bc3a396bce99d5 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -94,9 +94,7 @@ static int conf_askvalue(struct symbol *sym, const char *def)
line[1] = 0;
if (!sym_is_changeable(sym)) {
- printf("%s\n", def);
- line[0] = '\n';
- line[1] = 0;
+ printf("%s\n", def ?: "");
return 0;
}
@@ -104,7 +102,7 @@ static int conf_askvalue(struct symbol *sym, const char *def)
case oldconfig:
case syncconfig:
if (sym_has_value(sym)) {
- printf("%s\n", def);
+ printf("%s\n", def ?: "");
return 0;
}
/* fall through */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 174/699] wifi: ath9k: fix OOB access from firmware tx status queue ID
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 173/699] kconfig: fix potential NULL pointer dereference in conf_askvalue Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 175/699] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint Greg Kroah-Hartman
` (528 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani,
Toke Høiland-Jørgensen, Jeff Johnson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 7ce2f118a2389e8f0a64068c6fe7cc7d40639be0 ]
ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
4-bit hardware field (0-15), but the txq array only has
ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
access.
Add a bounds check on ts.qid before using it as an array index.
Fixes: fce041beb03f ("ath9k: unify edma and non-edma tx code, improve tx fifo handling")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260415222343.1540564-1-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 84c68aefc171a7..cd175d9e729df3 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2695,6 +2695,11 @@ void ath_tx_edma_tasklet(struct ath_softc *sc)
continue;
}
+ if (ts.qid >= ATH9K_NUM_TX_QUEUES) {
+ ath_dbg(common, XMIT, "invalid qid %d\n", ts.qid);
+ continue;
+ }
+
txq = &sc->tx.txq[ts.qid];
ath_txq_lock(sc, txq);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 175/699] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 174/699] wifi: ath9k: fix OOB access from firmware tx status queue ID Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 176/699] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure Greg Kroah-Hartman
` (527 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Kevin Hilman (TI),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 2bc564f46b00dc4f4331fc337277ff3f5fac8a4e ]
The cpu_endpoint in mcasp0 specifies the TLV320AIC3106 codec as the
bitclock and frame master, but the phandles point to the codec's port
node (codec_port) rather than its endpoint node (codec_endpoint).
audio-graph-card calls simple_util_parse_daifmt() with ep_codec set to
the endpoint node (codec_endpoint). The function resolves the
bitclock-master phandle and checks whether it equals ep_codec. Since
codec_port is the parent of codec_endpoint, not the endpoint itself, the
comparison always evaluates to false. This causes the mcasp0 CPU side to
be silently configured as bitclock and frame master instead of the codec,
which is the opposite of the intended configuration.
Fix by pointing bitclock-master and frame-master to codec_endpoint.
Fixes: e5f89dbdebc5 ("ARM: dts: am335x-sl50: use audio-graph-card for sound")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Link: https://patch.msgid.link/20260325223411.123666-1-jihed.chaibi.dev@gmail.com
Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/am335x-sl50.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/am335x-sl50.dts b/arch/arm/boot/dts/am335x-sl50.dts
index f4684c8eaffef2..b65dc5c0826a58 100644
--- a/arch/arm/boot/dts/am335x-sl50.dts
+++ b/arch/arm/boot/dts/am335x-sl50.dts
@@ -557,8 +557,8 @@ cpu_endpoint: endpoint {
remote-endpoint = <&codec_endpoint>;
dai-format = "dsp_b";
- bitclock-master = <&codec_port>;
- frame-master = <&codec_port>;
+ bitclock-master = <&codec_endpoint>;
+ frame-master = <&codec_endpoint>;
bitclock-inversion;
clocks = <&audio_mclk>;
};
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 176/699] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 175/699] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 177/699] media: cedrus: Fix failure to clean up hardware on probe failure Greg Kroah-Hartman
` (526 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Guenter Roeck, Baolin Wang,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 96b3cfc3b8ad0524d12fed1e08bc5df3ff345f64 ]
The driver uses devm_add_action_or_reset() to register sprd_wdt_disable()
as a managed cleanup action.
When devm_watchdog_register_device() fails, the devm core will invoke
the cleanup action automatically.
The explicit sprd_wdt_disable() call in the error path is therefore
redundant and results in adouble cleanup.
Fixes: 78d9bfad2e89 ("watchdog: sprd_wdt: Convert to use device managed functions and other improvements")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://lore.kernel.org/r/20260223-sprd_wdt-v1-1-2e71f9a76ecb@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/sprd_wdt.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c
index b9b1daa9e2a4c7..9f1e20b49b2568 100644
--- a/drivers/watchdog/sprd_wdt.c
+++ b/drivers/watchdog/sprd_wdt.c
@@ -317,10 +317,9 @@ static int sprd_wdt_probe(struct platform_device *pdev)
watchdog_init_timeout(&wdt->wdd, 0, dev);
ret = devm_watchdog_register_device(dev, &wdt->wdd);
- if (ret) {
- sprd_wdt_disable(wdt);
+ if (ret)
return ret;
- }
+
platform_set_drvdata(pdev, wdt);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 177/699] media: cedrus: Fix failure to clean up hardware on probe failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 176/699] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 178/699] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path Greg Kroah-Hartman
` (525 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Andrey Skvortsov,
Paul Kocialkowski, Nicolas Dufresne, Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <samuel@sholland.org>
[ Upstream commit f0a22f1d602ed499a192284de5e811a73421f0c7 ]
If V4L2 device fails to register, then SRAM still be claimed and as a
result driver will not be able to probe again.
cedrus 1c0e000.video-codec: Failed to claim SRAM
cedrus 1c0e000.video-codec: Failed to probe hardware
cedrus 1c0e000.video-codec: probe with driver cedrus failed with error -16
cedrus_hw_remove undoes everything that was previously done by
cedrus_hw_probe, such as disabling runtime power management and
releasing the claimed SRAM and reserved memory region.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Fixes: 50e761516f2b ("media: platform: Add Cedrus VPU decoder driver")
Acked-by: Paul Kocialkowski <paulk@sys-base.io>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/media/sunxi/cedrus/cedrus.c b/drivers/staging/media/sunxi/cedrus/cedrus.c
index 28de90edf4cc59..d761ee3f33e5c5 100644
--- a/drivers/staging/media/sunxi/cedrus/cedrus.c
+++ b/drivers/staging/media/sunxi/cedrus/cedrus.c
@@ -420,7 +420,7 @@ static int cedrus_probe(struct platform_device *pdev)
ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev);
if (ret) {
dev_err(&pdev->dev, "Failed to register V4L2 device\n");
- return ret;
+ goto err_hw;
}
vfd = &dev->vfd;
@@ -481,6 +481,8 @@ static int cedrus_probe(struct platform_device *pdev)
v4l2_m2m_release(dev->m2m_dev);
err_v4l2:
v4l2_device_unregister(&dev->v4l2_dev);
+err_hw:
+ cedrus_hw_remove(dev);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 178/699] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 177/699] media: cedrus: Fix failure to clean up hardware on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 179/699] crypto: atmel-sha204a - fix blocking and non-blocking rng logic Greg Kroah-Hartman
` (524 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Andre Przywara,
Linus Walleij, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 334f7bcbdc79dc8e5b938ac3372453a5368221cf ]
In the error path of sunxi_pmx_request(), the code calls
regulator_put(s_reg->regulator) to release the regulator. However,
s_reg->regulator is only assigned after a successful regulator_enable().
This causes a memory leak: the regulator obtained via regulator_get()
is never properly released when regulator_enable() fails.
Fixes: dc1445584177 ("pinctrl: sunxi: Fix and simplify pin bank regulator handling")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Andre Przywara <andre.przywara@arm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/sunxi/pinctrl-sunxi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
index 0a50f37c63f403..2c8113182080d5 100644
--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
@@ -813,7 +813,7 @@ static int sunxi_pmx_request(struct pinctrl_dev *pctldev, unsigned offset)
return 0;
out:
- regulator_put(s_reg->regulator);
+ regulator_put(reg);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 179/699] crypto: atmel-sha204a - fix blocking and non-blocking rng logic
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 178/699] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 180/699] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve Greg Kroah-Hartman
` (523 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Lothar Rubusch,
Thorsten Blum, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lothar Rubusch <l.rubusch@gmail.com>
[ Upstream commit 319400fc5ee15db5793aa45f854968141326effc ]
The blocking and non-blocking paths were failing to provide valid entropy
due to improper buffer management. Reading the buffer starting from byte 1,
only fetch the 32 bytes of random data from the return message.
Tested on an Atmel SHA204A device.
Before (here for blocking), tests showed repeatedly reading reduced bytes.
$ head -c 32 /dev/hwrng | hexdump -C
00000000 02 28 85 b3 47 40 f2 ee 00 00 00 00 00 00 00 00 |.(..G@..........|
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000020
After, the result will be similar to the following:
$ head -c 32 /dev/hwrng | hexdump -C
00000000 5a fc 3f 13 14 68 fe 06 68 0a bd 04 83 6e 09 69 |Z.?..h..h....n.i|
00000010 75 ff cf 87 10 84 3b c9 c1 df ae eb 45 53 4c c3 |u.....;.....ESL.|
00000020
Fixes: da001fb651b0 ("crypto: atmel-i2c - add support for SHA204A random number generator")
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Lothar Rubusch <l.rubusch@gmail.com>
Tested-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/atmel-sha204a.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/atmel-sha204a.c b/drivers/crypto/atmel-sha204a.c
index 64d5ba13f4baf4..550f81ef48ddcf 100644
--- a/drivers/crypto/atmel-sha204a.c
+++ b/drivers/crypto/atmel-sha204a.c
@@ -47,8 +47,8 @@ static int atmel_sha204a_rng_read_nonblocking(struct hwrng *rng, void *data,
if (rng->priv) {
work_data = (struct atmel_i2c_work_data *)rng->priv;
- max = min(sizeof(work_data->cmd.data), max);
- memcpy(data, &work_data->cmd.data, max);
+ max = min(RANDOM_RSP_SIZE - CMD_OVERHEAD_SIZE, max);
+ memcpy(data, &work_data->cmd.data[RSP_DATA_IDX], max);
rng->priv = 0;
} else {
work_data = kmalloc(sizeof(*work_data), GFP_ATOMIC);
@@ -86,8 +86,8 @@ static int atmel_sha204a_rng_read(struct hwrng *rng, void *data, size_t max,
if (ret)
return ret;
- max = min(sizeof(cmd.data), max);
- memcpy(data, cmd.data, max);
+ max = min(RANDOM_RSP_SIZE - CMD_OVERHEAD_SIZE, max);
+ memcpy(data, &cmd.data[RSP_DATA_IDX], max);
return max;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 180/699] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 179/699] crypto: atmel-sha204a - fix blocking and non-blocking rng logic Greg Kroah-Hartman
@ 2026-07-21 15:18 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 181/699] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents Greg Kroah-Hartman
` (522 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:18 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Lukas Wunner,
Vitaly Chikunov, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit 2d7b2cfc59998baf5e8622a24dc28f69a5212e06 ]
The ->curve_oid check in ecrdsa_param_curve() rejects the valid enum
value 0 (OID_id_dsa_with_sha1), but look_up_OID() returns OID__NR on
lookup failure. Compare ->curve_oid with OID__NR instead to ensure that
only unknown OIDs return -EINVAL.
Fixes: 0d7a78643f69 ("crypto: ecrdsa - add EC-RDSA (GOST 34.10) algorithm")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/ecrdsa.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/ecrdsa.c b/crypto/ecrdsa.c
index 0a970261b107d9..bfb6dbfb4598f0 100644
--- a/crypto/ecrdsa.c
+++ b/crypto/ecrdsa.c
@@ -153,7 +153,7 @@ int ecrdsa_param_curve(void *context, size_t hdrlen, unsigned char tag,
struct ecrdsa_ctx *ctx = context;
ctx->curve_oid = look_up_OID(value, vlen);
- if (!ctx->curve_oid)
+ if (ctx->curve_oid == OID__NR)
return -EINVAL;
ctx->curve = get_curve_by_oid(ctx->curve_oid);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 181/699] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-07-21 15:18 ` [PATCH 5.10 180/699] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 182/699] iommu/amd: Fix a stale comment about which legacy mode is user visible Greg Kroah-Hartman
` (521 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit f7dd32c5179d7755de18e21d5674b08f9e5cb180 ]
pefile_digest_pe_contents() computes the trailing-data hash length as
pelen - (hashed_bytes + certs_size). A crafted PE can make the addition
exceed pelen, causing the unsigned subtraction to underflow to ~4 GiB.
This is passed to crypto_shash_update() which reads out of bounds and
panics on unmapped vmalloc guard pages.
BUG: unable to handle page fault for address: ffffc900038d8000
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:sha256_blocks_generic (lib/crypto/sha256.c:152)
Call Trace:
<TASK>
__sha256_update (lib/crypto/sha256.c:208)
crypto_sha256_update (crypto/sha256.c:142)
verify_pefile_signature (crypto/asymmetric_keys/verify_pefile.c:436)
kexec_kernel_verify_pe_sig (kernel/kexec_file.c:151)
__do_sys_kexec_file_load (kernel/kexec_file.c:406)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
</TASK>
Kernel panic - not syncing: Fatal exception
Validate that the addition does not overflow and the result does not
exceed pelen before the subtraction. Return -ELIBBAD on failure.
Fixes: af316fc442ef ("pefile: Digest the PE binary and compare to the PKCS#7 data")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/asymmetric_keys/verify_pefile.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
index 22beaf2213a224..7e5b392dcac79a 100644
--- a/crypto/asymmetric_keys/verify_pefile.c
+++ b/crypto/asymmetric_keys/verify_pefile.c
@@ -305,6 +305,8 @@ static int pefile_digest_pe_contents(const void *pebuf, unsigned int pelen,
if (pelen > hashed_bytes) {
tmp = hashed_bytes + ctx->certs_size;
+ if (tmp <= hashed_bytes || pelen < tmp)
+ return -ELIBBAD;
ret = crypto_shash_update(desc,
pebuf + hashed_bytes,
pelen - tmp);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 182/699] iommu/amd: Fix a stale comment about which legacy mode is user visible
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 181/699] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 183/699] clk: scmi: Fix clock rate rounding Greg Kroah-Hartman
` (520 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Vasant Hegde,
Wei Wang, Joerg Roedel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit 4bf53c2d0c08bbdaa32f2114281f1ddab61902bf ]
Update a stale comment about which of the legacy modes is visible to the
user, i.e. can be forced via amd_iommu_intr=legacy.
Fixes: b74aa02d7a30 ("iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system")
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Wei Wang <wei.w.wang@hotmail.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/amd_iommu_types.h | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index c4b1a652c2c7fa..e4a6752f349587 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -820,12 +820,13 @@ static inline int get_hpet_devid(int id)
}
enum amd_iommu_intr_mode_type {
- AMD_IOMMU_GUEST_IR_LEGACY,
-
- /* This mode is not visible to users. It is used when
- * we cannot fully enable vAPIC and fallback to only support
- * legacy interrupt remapping via 128-bit IRTE.
+ /*
+ * The legacy format mode is not visible to users to prevent the user
+ * from crashing x2APIC systems, which for all intents and purposes
+ * require 128-bit IRTEs. The legacy format will be forced as needed
+ * when hardware doesn't support 128-bit IRTEs.
*/
+ AMD_IOMMU_GUEST_IR_LEGACY,
AMD_IOMMU_GUEST_IR_LEGACY_GA,
AMD_IOMMU_GUEST_IR_VAPIC,
};
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 183/699] clk: scmi: Fix clock rate rounding
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 182/699] iommu/amd: Fix a stale comment about which legacy mode is user visible Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 184/699] thermal: hwmon: Fix critical temperature attribute removal Greg Kroah-Hartman
` (519 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Turquette, Stephen Boyd,
linux-clk, Cristian Marussi, Florian Fainelli, Geert Uytterhoeven,
Brian Masney, Sudeep Holla, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <cristian.marussi@arm.com>
[ Upstream commit d0c81a38d06d446d341532700b3a4a43d3b00eb1 ]
While the do_div() helper used for rounding expects its divisor argument
to be a 32bits quantity, the currently provided divisor parameter is a
64bit value that, as a consequence, is silently truncated and a possible
source of bugs.
Fix by using the proper div64_ul helper.
Cc: Michael Turquette <mturquette@baylibre.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: linux-clk@vger.kernel.org
Fixes: 7a8655e19bdb ("clk: scmi: Fix the rounding of clock rate")
Signed-off-by: Cristian Marussi <cristian.marussi@arm.com>
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260508153300.2224715-2-cristian.marussi@arm.com
Reviewed-by: Brian Masney <bmasney@redhat.com>
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-scmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/clk-scmi.c b/drivers/clk/clk-scmi.c
index c62636fb4aca8d..659f26d839eb5b 100644
--- a/drivers/clk/clk-scmi.c
+++ b/drivers/clk/clk-scmi.c
@@ -9,9 +9,9 @@
#include <linux/device.h>
#include <linux/err.h>
#include <linux/of.h>
+#include <linux/math64.h>
#include <linux/module.h>
#include <linux/scmi_protocol.h>
-#include <asm/div64.h>
struct scmi_clk {
u32 id;
@@ -59,7 +59,7 @@ static long scmi_clk_round_rate(struct clk_hw *hw, unsigned long rate,
ftmp = rate - fmin;
ftmp += clk->info->range.step_size - 1; /* to round up */
- do_div(ftmp, clk->info->range.step_size);
+ ftmp = div64_ul(ftmp, clk->info->range.step_size);
return ftmp * clk->info->range.step_size + fmin;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 184/699] thermal: hwmon: Fix critical temperature attribute removal
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 183/699] clk: scmi: Fix clock rate rounding Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 185/699] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() Greg Kroah-Hartman
` (518 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit c2114dbda05354dbcf4dfbb30a2c623e8611c43a ]
Since the return value of thermal_zone_crit_temp_valid() depends on
the behavior of the thermal zone .get_crit_temp() callback which
may change over time in theory, thermal_remove_hwmon_sysfs() may
attempt to remove a critical temperature attribute that has not
been created, passing a pointer to an uninitialized attribute
structure to device_remove_file().
To avoid that, set a flag in struct thermal_hwmon_temp after creating
a critical temperature attribute and use the value of that flag to
decide whether or not the attribute needs to be removed.
Fixes: e8db5d6736a7 ("thermal: hwmon: Make the check for critical temp valid consistent")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2437056.ElGaqSPkdT@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thermal/thermal_hwmon.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/thermal/thermal_hwmon.c b/drivers/thermal/thermal_hwmon.c
index 8b92e00ff23623..32d6091c20f783 100644
--- a/drivers/thermal/thermal_hwmon.c
+++ b/drivers/thermal/thermal_hwmon.c
@@ -39,6 +39,7 @@ struct thermal_hwmon_temp {
struct thermal_zone_device *tz;
struct thermal_hwmon_attr temp_input; /* hwmon sys attr */
struct thermal_hwmon_attr temp_crit; /* hwmon sys attr */
+ bool temp_crit_present;
};
static LIST_HEAD(thermal_hwmon_list);
@@ -188,6 +189,8 @@ int thermal_add_hwmon_sysfs(struct thermal_zone_device *tz)
&temp->temp_crit.attr);
if (result)
goto unregister_input;
+
+ temp->temp_crit_present = true;
}
mutex_lock(&thermal_hwmon_list_lock);
@@ -233,7 +236,7 @@ void thermal_remove_hwmon_sysfs(struct thermal_zone_device *tz)
}
device_remove_file(hwmon->device, &temp->temp_input.attr);
- if (thermal_zone_crit_temp_valid(tz))
+ if (temp->temp_crit_present)
device_remove_file(hwmon->device, &temp->temp_crit.attr);
mutex_lock(&thermal_hwmon_list_lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 185/699] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 184/699] thermal: hwmon: Fix critical temperature attribute removal Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 186/699] crypto: ccp - Treat zero-length cert chain as query for blob lengths Greg Kroah-Hartman
` (517 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet,
Toke Høiland-Jørgensen, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e300c7d470ad2726d6abf7d11b31b5d9912d9cf0 ]
hfsc_dump_class_stats() runs without qdisc spinlock being held.
Add READ_ONCE()/WRITE_ONCE() annotations around:
- cl->level
- cl->cl_vtperiod
- cl->cl_total
- cl->cl_cumul
Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260513080853.1383975-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hfsc.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 3a271ad16443b9..29879e728408a3 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -716,7 +716,7 @@ init_vf(struct hfsc_class *cl, unsigned int len)
rtsc_min(&cl->cl_virtual, &cl->cl_fsc, cl->cl_vt, cl->cl_total);
cl->cl_vtadj = 0;
- cl->cl_vtperiod++; /* increment vt period */
+ WRITE_ONCE(cl->cl_vtperiod, cl->cl_vtperiod + 1); /* increment vt period */
cl->cl_parentperiod = cl->cl_parent->cl_vtperiod;
if (cl->cl_parent->cl_nactive == 0)
cl->cl_parentperiod++;
@@ -758,7 +758,7 @@ update_vf(struct hfsc_class *cl, unsigned int len, u64 cur_time)
go_passive = 1;
for (; cl->cl_parent != NULL; cl = cl->cl_parent) {
- cl->cl_total += len;
+ WRITE_ONCE(cl->cl_total, cl->cl_total + len);
if (!(cl->cl_flags & HFSC_FSC) || cl->cl_nactive == 0)
continue;
@@ -848,7 +848,7 @@ hfsc_adjust_levels(struct hfsc_class *cl)
if (p->level >= level)
level = p->level + 1;
}
- cl->level = level;
+ WRITE_ONCE(cl->level, level);
} while ((cl = cl->cl_parent) != NULL);
}
@@ -1336,10 +1336,10 @@ hfsc_dump_class_stats(struct Qdisc *sch, unsigned long arg,
__u32 qlen;
qdisc_qstats_qlen_backlog(cl->qdisc, &qlen, &cl->qstats.backlog);
- xstats.level = cl->level;
- xstats.period = cl->cl_vtperiod;
- xstats.work = cl->cl_total;
- xstats.rtwork = cl->cl_cumul;
+ xstats.level = READ_ONCE(cl->level);
+ xstats.period = READ_ONCE(cl->cl_vtperiod);
+ xstats.work = READ_ONCE(cl->cl_total);
+ xstats.rtwork = READ_ONCE(cl->cl_cumul);
if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch), d, NULL, &cl->bstats) < 0 ||
gnet_stats_copy_rate_est(d, &cl->rate_est) < 0 ||
@@ -1458,15 +1458,15 @@ hfsc_change_qdisc(struct Qdisc *sch, struct nlattr *opt,
static void
hfsc_reset_class(struct hfsc_class *cl)
{
- cl->cl_total = 0;
- cl->cl_cumul = 0;
+ WRITE_ONCE(cl->cl_total, 0);
+ WRITE_ONCE(cl->cl_cumul, 0);
cl->cl_d = 0;
cl->cl_e = 0;
cl->cl_vt = 0;
cl->cl_vtadj = 0;
cl->cl_cvtmin = 0;
cl->cl_cvtoff = 0;
- cl->cl_vtperiod = 0;
+ WRITE_ONCE(cl->cl_vtperiod, 0);
cl->cl_parentperiod = 0;
cl->cl_f = 0;
cl->cl_myf = 0;
@@ -1632,7 +1632,7 @@ hfsc_dequeue(struct Qdisc *sch)
bstats_update(&cl->bstats, skb);
update_vf(cl, qdisc_pkt_len(skb), cur_time);
if (realtime)
- cl->cl_cumul += qdisc_pkt_len(skb);
+ WRITE_ONCE(cl->cl_cumul, cl->cl_cumul + qdisc_pkt_len(skb));
if (cl->cl_flags & HFSC_RSC) {
if (cl->qdisc->q.qlen != 0) {
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 186/699] crypto: ccp - Treat zero-length cert chain as query for blob lengths
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 185/699] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 187/699] net/sched: sch_htb: annotate data-races (I) Greg Kroah-Hartman
` (516 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Tom Lendacky,
Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit ef8c9dacda2871accd64e3eda951fef6b788b1ea ]
When handling a PDH export, treat a zero-length userspace cert chain buffer
as a request to query the length of the relevant blobs. Failure to account
for the zero-length buffer trips a BUG_ON() when running with
CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the
ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation).
kernel BUG at arch/x86/mm/physaddr.c:28 !
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded
Tainted: G W 6.18.16-smp-DEV #1 NONE
Tainted: [W]=WARN
Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025
RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28
RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293
RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600
RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010
RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff
R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000
R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000
FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0
Call Trace:
<TASK>
[<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308
[<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556
[<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline]
[<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline]
[<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584
[<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline]
[<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98
[<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fd3158eac39
</TASK>
Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting
the physical address is just arithmetic, and the PSP errors out before
trying to write to the garbage address (which it must, otherwise querying
the blob lengths would clobber memory at pfn=0).
Fixes: 76a2b524a4b1 ("crypto: ccp: Implement SEV_PDH_CERT_EXPORT ioctl command")
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/sev-dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
index a3427794577add..ae60bc97031478 100644
--- a/drivers/crypto/ccp/sev-dev.c
+++ b/drivers/crypto/ccp/sev-dev.c
@@ -787,7 +787,8 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)
/* Userspace wants to query the certificate length. */
if (!input.pdh_cert_address ||
!input.pdh_cert_len ||
- !input.cert_chain_address)
+ !input.cert_chain_address ||
+ !input.cert_chain_len)
goto cmd;
input_pdh_cert_address = (void __user *)input.pdh_cert_address;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 187/699] net/sched: sch_htb: annotate data-races (I)
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 186/699] crypto: ccp - Treat zero-length cert chain as query for blob lengths Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 188/699] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD Greg Kroah-Hartman
` (515 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e54c33503bf7cebb1c1790251ce90f1252678081 ]
htb_dump() runs without holding qdisc spinlock.
Add missing READ_ONCE()/WRITE_ONCE() annotations around
q->overlimits and q->direct_pkts.
Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260514095935.3926276-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_htb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index b301efa41c1ced..75ca5e5def3fea 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -536,7 +536,7 @@ htb_change_class_mode(struct htb_sched *q, struct htb_class *cl, s64 *diff)
if (new_mode == HTB_CANT_SEND) {
cl->overlimits++;
- q->overlimits++;
+ WRITE_ONCE(q->overlimits, q->overlimits + 1);
}
if (cl->prio_activity) { /* not necessary: speed optimization */
@@ -592,7 +592,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch,
/* enqueue to helper queue */
if (q->direct_queue.qlen < q->direct_qlen) {
__qdisc_enqueue_tail(skb, &q->direct_queue);
- q->direct_pkts++;
+ WRITE_ONCE(q->direct_pkts, q->direct_pkts + 1);
} else {
return qdisc_drop(skb, sch, to_free);
}
@@ -1050,12 +1050,12 @@ static int htb_dump(struct Qdisc *sch, struct sk_buff *skb)
struct nlattr *nest;
struct tc_htb_glob gopt;
- sch->qstats.overlimits = q->overlimits;
+ sch->qstats.overlimits = READ_ONCE(q->overlimits);
/* Its safe to not acquire qdisc lock. As we hold RTNL,
* no change can happen on the qdisc parameters.
*/
- gopt.direct_pkts = q->direct_pkts;
+ gopt.direct_pkts = READ_ONCE(q->direct_pkts);
gopt.version = HTB_VER;
gopt.rate2quantum = q->rate2quantum;
gopt.defcls = q->defcls;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 188/699] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 187/699] net/sched: sch_htb: annotate data-races (I) Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 189/699] RDMA/hns: Fix arithmetic overflow in calc_hem_config() Greg Kroah-Hartman
` (514 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linmao Li, Ido Schimmel,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linmao Li <lilinmao@kylinos.cn>
[ Upstream commit 627ac78f2741e2ebd2225e2e953b6964a8a9182f ]
addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD
via addrconf_dad_end(), which drops ifp->lock on return. The lock
is re-acquired after net_info_ratelimited(). A concurrent
ipv6_del_addr() can take the lock in that window, set ifp->state
to DEAD and run list_del_rcu(&ifp->if_list).
addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad:
and schedules a new dad_work. The work calls ipv6_del_addr()
again, hitting the already-poisoned list entry:
general protection fault: 0000 [#1] SMP NOPTI
CPU: 4 PID: 217 Comm: kworker/4:1
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:ipv6_del_addr+0xe9/0x280
RAX: dead000000000122
Call Trace:
addrconf_dad_stop+0x113/0x140
addrconf_dad_work+0x28c/0x430
process_one_work+0x1eb/0x3b0
worker_thread+0x4d/0x400
kthread+0x104/0x140
ret_from_fork+0x35/0x40
Fold the addrconf_dad_end() logic into addrconf_dad_failure() under
a single ifp->lock critical section. The STABLE_PRIVACY branch
temporarily drops ifp->lock around address regeneration, so at
lock_errdad: verify the state is still POSTDAD before transitioning
to ERRDAD; bail out otherwise to avoid overwriting a state set by
another path while the lock was released.
Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing to workqueue")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260513025509.3776405-1-lilinmao@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 251164ee646983..c0f84b2315528f 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2110,16 +2110,18 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
struct inet6_dev *idev = ifp->idev;
struct net *net = dev_net(ifp->idev->dev);
- if (addrconf_dad_end(ifp)) {
+ spin_lock_bh(&ifp->lock);
+
+ if (ifp->state != INET6_IFADDR_STATE_DAD) {
+ spin_unlock_bh(&ifp->lock);
in6_ifa_put(ifp);
return;
}
+ ifp->state = INET6_IFADDR_STATE_POSTDAD;
net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n",
ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source);
- spin_lock_bh(&ifp->lock);
-
if (ifp->flags & IFA_F_STABLE_PRIVACY) {
struct in6_addr new_addr;
struct inet6_ifaddr *ifp2;
@@ -2167,6 +2169,11 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp)
in6_ifa_put(ifp2);
lock_errdad:
spin_lock_bh(&ifp->lock);
+ if (ifp->state != INET6_IFADDR_STATE_POSTDAD) {
+ spin_unlock_bh(&ifp->lock);
+ in6_ifa_put(ifp);
+ return;
+ }
}
errdad:
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 189/699] RDMA/hns: Fix arithmetic overflow in calc_hem_config()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 188/699] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 190/699] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Greg Kroah-Hartman
` (513 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Chesnokov, Leon Romanovsky,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
[ Upstream commit a38e4410af9ad8b7ad2217254da06cd4dc21f0ed ]
If bt_num is 3 or 2, then the expressions like
l0_idx * chunk_ba_num + l1_idx are computed in 32-bit
arithmetic before being assigned to a u64 index field,
which can lead to overflow.
Cast the first operand to u64 to ensure the arithmetic
is performed in 64-bit.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 2f49de21f3e9 ("RDMA/hns: Optimize mhop get flow for multi-hop addressing")
Signed-off-by: Alexander Chesnokov <Alexander.Chesnokov@kaspersky.com>
Link: https://patch.msgid.link/20260413091527.39990-1-Alexander.Chesnokov@kaspersky.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_hem.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c
index 7cb98d09fb9b27..570a1bc24fd5a7 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hem.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hem.c
@@ -346,14 +346,14 @@ static int calc_hem_config(struct hns_roce_dev *hr_dev,
bt_num = hns_roce_get_bt_num(table->type, mhop->hop_num);
switch (bt_num) {
case 3:
- index->l1 = l0_idx * chunk_ba_num + l1_idx;
+ index->l1 = (u64)l0_idx * chunk_ba_num + l1_idx;
index->l0 = l0_idx;
- index->buf = l0_idx * chunk_ba_num * chunk_ba_num +
- l1_idx * chunk_ba_num + l2_idx;
+ index->buf = (u64)l0_idx * chunk_ba_num * chunk_ba_num +
+ (u64)l1_idx * chunk_ba_num + l2_idx;
break;
case 2:
index->l0 = l0_idx;
- index->buf = l0_idx * chunk_ba_num + l1_idx;
+ index->buf = (u64)l0_idx * chunk_ba_num + l1_idx;
break;
case 1:
index->buf = l0_idx;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 190/699] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 189/699] RDMA/hns: Fix arithmetic overflow in calc_hem_config() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 191/699] RDMA/srpt: fix integer overflow in immediate data length check Greg Kroah-Hartman
` (512 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prathamesh Deshpande, Yishai Hadas,
Leon Romanovsky, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
[ Upstream commit 43f8f7946814c8e5f464518246fdbc69b6e32326 ]
MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT() links event_sub into sub_list
before initializing the fields used by the shared error path.
If eventfd_ctx_fdget() then fails, the unwind path dereferences
event_sub->ev_file in uverbs_uobject_put() and calls
subscribe_event_xa_dealloc() with an unset xa_key_level1.
subscribe_event_xa_alloc() creates the XA entry exactly once for a given
key_level1, on the first occurrence of that key. The unwind path must
therefore call subscribe_event_xa_dealloc() exactly once for it as well.
Enforce that by adding devx_key_in_sub_list() and calling
subscribe_event_xa_dealloc() only when the last matching pending entry is
being cleaned up.
Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX")
Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
Link: https://patch.msgid.link/20260428224319.37682-1-prathameshdeshpande7@gmail.com
Reviewed-by: Yishai Hadas <yishaih@nvidia.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/devx.c | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index 679d85db26f4fd..361cd3c9780465 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -1746,6 +1746,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_OBJ_ASYNC_QUERY)(
return err;
}
+static bool devx_key_in_sub_list(struct list_head *list, u32 key_level1)
+{
+ struct devx_event_subscription *s;
+
+ list_for_each_entry(s, list, event_list)
+ if (s->xa_key_level1 == key_level1)
+ return true;
+
+ return false;
+}
+
static void
subscribe_event_xa_dealloc(struct mlx5_devx_event_table *devx_event_table,
u32 key_level1,
@@ -1995,10 +2006,17 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
num_alloc_xa_entries++;
event_sub = kzalloc(sizeof(*event_sub), GFP_KERNEL);
if (!event_sub) {
+ if (!devx_key_in_sub_list(&sub_list, key_level1))
+ subscribe_event_xa_dealloc(devx_event_table,
+ key_level1,
+ obj,
+ obj_id);
err = -ENOMEM;
goto err;
}
+ event_sub->ev_file = ev_file;
+ event_sub->xa_key_level1 = key_level1;
list_add_tail(&event_sub->event_list, &sub_list);
uverbs_uobject_get(&ev_file->uobj);
if (use_eventfd) {
@@ -2013,9 +2031,6 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
}
event_sub->cookie = cookie;
- event_sub->ev_file = ev_file;
- /* May be needed upon cleanup the devx object/subscription */
- event_sub->xa_key_level1 = key_level1;
event_sub->xa_key_level2 = obj_id;
INIT_LIST_HEAD(&event_sub->obj_list);
}
@@ -2060,10 +2075,11 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_DEVX_SUBSCRIBE_EVENT)(
list_for_each_entry_safe(event_sub, tmp_sub, &sub_list, event_list) {
list_del(&event_sub->event_list);
- subscribe_event_xa_dealloc(devx_event_table,
- event_sub->xa_key_level1,
- obj,
- obj_id);
+ if (!devx_key_in_sub_list(&sub_list, event_sub->xa_key_level1))
+ subscribe_event_xa_dealloc(devx_event_table,
+ event_sub->xa_key_level1,
+ obj,
+ obj_id);
if (event_sub->eventfd)
eventfd_ctx_put(event_sub->eventfd);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 191/699] RDMA/srpt: fix integer overflow in immediate data length check
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 190/699] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 192/699] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Greg Kroah-Hartman
` (511 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carlos Bilbao (Lambda),
Sara Venkatesh, Bart Van Assche, Leon Romanovsky, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sara Venkatesh <sarajvenkatesh@gmail.com>
[ Upstream commit eb4ecdf631fe00e8020bf461503cb9b7017ed796 ]
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
Fixes: 5dabcd0456d7 ("RDMA/srpt: Add support for immediate data")
Reported-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Signed-off-by: Sara Venkatesh <sarajvenkatesh@gmail.com>
Link: https://patch.msgid.link/20260504080036.3482415-1-sarajvenkatesh@gmail.com
Reviewed-by: Carlos Bilbao (Lambda) <carlos.bilbao@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srpt/ib_srpt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 960f870a952a52..5fce4cdb88eb46 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -1070,9 +1070,10 @@ static int srpt_get_desc_tbl(struct srpt_recv_ioctx *recv_ioctx,
struct srp_imm_buf *imm_buf = srpt_get_desc_buf(srp_cmd);
void *data = (void *)srp_cmd + imm_data_offset;
uint32_t len = be32_to_cpu(imm_buf->len);
- uint32_t req_size = imm_data_offset + len;
+ uint32_t req_size;
- if (req_size > srp_max_req_size) {
+ if (check_add_overflow((uint32_t)imm_data_offset, len, &req_size) ||
+ req_size > srp_max_req_size) {
pr_err("Immediate data (length %d + %d) exceeds request size %d\n",
imm_data_offset, len, srp_max_req_size);
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 192/699] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 191/699] RDMA/srpt: fix integer overflow in immediate data length check Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 193/699] sysfs: clamp show() return value in sysfs_kf_read() Greg Kroah-Hartman
` (510 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Andy Shevchenko,
Sakari Ailus, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 4e8156bd9517fa18c3613ea39c222c7035f0221e ]
atomisp_v4l2_framebuffer_to_css_frame() allocates memory for
temporary variable raw_black_frame, which must be released via
ia_css_frame_free() before the function returns. However, if
sh_css_set_black_frame() fails, the function returns immediately without
performing this cleanup, leading to a memory leak.
Fix this by assigning the return value of sh_css_set_black_frame() to
ret. This ensures that the error code is propagated while allowing the
execution to fall through to the ia_css_frame_free() cleanup call.
The bug was originally detected on v6.13-rc1 using an experimental
static analysis tool we are developing, and we have verified that the
issue persists in the latest mainline kernel. The tool is based on the
LLVM framework and is specifically designed to detect memory management
issues. It is currently under active development and not yet publicly
available.
We performed build testing on x86_64 with allyesconfig. Since triggering
this error path in atomisp requires specific Intel Atom ISP hardware and
firmware, we were unable to perform runtime testing and instead verified
the fix according to the code logic.
Fixes: 85b606e02ad7 ("media: atomisp: get rid of a bunch of other wrappers")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/atomisp/pci/atomisp_cmd.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/media/atomisp/pci/atomisp_cmd.c b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
index 613bd962022424..0e92a6156ed5b6 100644
--- a/drivers/staging/media/atomisp/pci/atomisp_cmd.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_cmd.c
@@ -4689,10 +4689,8 @@ int atomisp_fixed_pattern_table(struct atomisp_sub_device *asd,
if (ret)
return ret;
- if (sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
- raw_black_frame) != 0)
- return -ENOMEM;
-
+ ret = sh_css_set_black_frame(asd->stream_env[ATOMISP_INPUT_STREAM_GENERAL].stream,
+ raw_black_frame);
ia_css_frame_free(raw_black_frame);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 193/699] sysfs: clamp show() return value in sysfs_kf_read()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 192/699] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 194/699] net/sched: sch_drr: annotate data-races around cl->deficit Greg Kroah-Hartman
` (509 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, NeilBrown, Tejun Heo,
Rafael J. Wysocki (Intel), Danilo Krummrich, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 454257f6d124a92342dcbb7710c03dd6ef96c731 ]
sysfs_kf_seq_show() defends against buggy show() callbacks that return
larger than PAGE_SIZE by clamping the value and printing a warning.
sysfs_kf_read(), the prealloc variant, has no such defense.
The only current in-tree user of __ATTR_PREALLOC is drivers/md/md.c,
whose show() callbacks are well-behaved, so this is hardening against
future drivers doing foolish things and out-of-tree code doing even more
foolish things.
Cc: NeilBrown <neil@brown.name>
Cc: Tejun Heo <tj@kernel.org>
Fixes: 2b75869bba67 ("sysfs/kernfs: allow attributes to request write buffer be pre-allocated.")
Assisted-by: gregkh_clanker_t1000
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/2026052000-drove-unicycle-d61b@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/sysfs/file.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index f51b2396830f4a..d3dd04d3997d2d 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -117,6 +117,10 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf,
len = ops->show(kobj, of->kn->priv, buf);
if (len < 0)
return len;
+ if (len >= (ssize_t)PAGE_SIZE) {
+ printk("fill_read_buffer: %pS returned bad count\n", ops->show);
+ len = PAGE_SIZE - 1;
+ }
if (pos) {
if (len <= pos)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 194/699] net/sched: sch_drr: annotate data-races around cl->deficit
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 193/699] sysfs: clamp show() return value in sysfs_kf_read() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 195/699] media: rockchip: rga: fix too small buffer size Greg Kroah-Hartman
` (508 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit c67b104fd7982162885c5e43057ca761006748e2 ]
drr_dump_class_stats() runs without qdisc spinlock held.
Add missing READ_ONCE()/WRITE_ONCE() annotations around cl->deficit.
Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260519094618.2632073-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_drr.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 7200895d98c01e..5b78ce01b1e7f5 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -270,7 +270,7 @@ static int drr_dump_class_stats(struct Qdisc *sch, unsigned long arg,
memset(&xstats, 0, sizeof(xstats));
if (qlen)
- xstats.deficit = cl->deficit;
+ xstats.deficit = READ_ONCE(cl->deficit);
if (gnet_stats_copy_basic(qdisc_root_sleeping_running(sch),
d, NULL, &cl->bstats) < 0 ||
@@ -370,7 +370,7 @@ static int drr_enqueue(struct sk_buff *skb, struct Qdisc *sch,
if (!cl_is_active(cl)) {
list_add_tail(&cl->alist, &q->active);
- cl->deficit = cl->quantum;
+ WRITE_ONCE(cl->deficit, cl->quantum);
}
sch->qstats.backlog += len;
@@ -397,7 +397,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
len = qdisc_pkt_len(skb);
if (len <= cl->deficit) {
- cl->deficit -= len;
+ WRITE_ONCE(cl->deficit, cl->deficit - len);
skb = qdisc_dequeue_peeked(cl->qdisc);
if (unlikely(skb == NULL))
goto out;
@@ -411,7 +411,7 @@ static struct sk_buff *drr_dequeue(struct Qdisc *sch)
return skb;
}
- cl->deficit += cl->quantum;
+ WRITE_ONCE(cl->deficit, cl->deficit + cl->quantum);
list_move_tail(&cl->alist, &q->active);
}
out:
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 195/699] media: rockchip: rga: fix too small buffer size
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 194/699] net/sched: sch_drr: annotate data-races around cl->deficit Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 196/699] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() Greg Kroah-Hartman
` (507 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dufresne, Sven Püschel,
Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Püschel <s.pueschel@pengutronix.de>
[ Upstream commit 65017e26c065d1240b0512c15867ef1128034fd8 ]
Fix the command buffer size being only a quarter of the actual size.
The RGA_CMDBUF_SIZE macro was potentially intended to specify the length
of the cmdbuf u32 array pointer. But as it's used to specify the size of
the allocation, which is counted in bytes. Therefore adjust the macro
size to bytes as it better matches the variable name and adjust it's
users accordingly.
As the command buffer is relatively small, it probably didn't caused
an issue due to being smaller than a single page.
Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rga/rga-hw.c | 2 +-
drivers/media/platform/rockchip/rga/rga-hw.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c
index aaa96f256356b0..bdfb9bc3eb3f6d 100644
--- a/drivers/media/platform/rockchip/rga/rga-hw.c
+++ b/drivers/media/platform/rockchip/rga/rga-hw.c
@@ -379,7 +379,7 @@ static void rga_cmd_set(struct rga_ctx *ctx)
{
struct rockchip_rga *rga = ctx->rga;
- memset(rga->cmdbuf_virt, 0, RGA_CMDBUF_SIZE * 4);
+ memset(rga->cmdbuf_virt, 0, RGA_CMDBUF_SIZE);
rga_cmd_set_src_addr(ctx, rga->src_mmu_pages);
/*
diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h
index e8917e5630a48d..03990fd30f158c 100644
--- a/drivers/media/platform/rockchip/rga/rga-hw.h
+++ b/drivers/media/platform/rockchip/rga/rga-hw.h
@@ -6,7 +6,7 @@
#ifndef __RGA_HW_H__
#define __RGA_HW_H__
-#define RGA_CMDBUF_SIZE 0x20
+#define RGA_CMDBUF_SIZE 0x80
/* Hardware limits */
#define MAX_WIDTH 8192
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 196/699] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 195/699] media: rockchip: rga: fix too small buffer size Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 197/699] cpufreq: Documentation: fix sampling_down_factor range Greg Kroah-Hartman
` (506 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stepan Ionichev, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stepan Ionichev <sozdayvek@gmail.com>
[ Upstream commit 9582485a65eacfd7245ec7f0a9d7e2c34749d669 ]
When called with FWNODE_GRAPH_ENDPOINT_NEXT, the function walks every
endpoint under the requested port and, for any endpoint whose ID is
greater than or equal to the requested one, may store a fwnode
reference in best_ep via fwnode_handle_get(). If a later iteration
finds an exact-ID match, the function returns that endpoint directly
without dropping the reference held by best_ep, leaking it.
Drop the saved candidate before returning the exact-match endpoint.
This affects callers that use FWNODE_GRAPH_ENDPOINT_NEXT to ask for
the next endpoint with ID >= the requested one (used by a number of
media drivers, e.g. imx7/8, sun6i CSI, omap3isp, xilinx-csi2,
stm32-csi). Each leak retains a fwnode reference until reboot/unbind.
Fixes: 0fcc2bdc8aff ("device property: Add fwnode_graph_get_endpoint_by_id()")
Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com>
Link: https://patch.msgid.link/20260514171455.27271-1-sozdayvek@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/property.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/base/property.c b/drivers/base/property.c
index c26ce7fd6832fc..cbd0c2f1a041e8 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -1238,8 +1238,10 @@ fwnode_graph_get_endpoint_by_id(const struct fwnode_handle *fwnode,
if (fwnode_ep.port != port)
continue;
- if (fwnode_ep.id == endpoint)
+ if (fwnode_ep.id == endpoint) {
+ fwnode_handle_put(best_ep);
return ep;
+ }
if (!endpoint_next)
continue;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 197/699] cpufreq: Documentation: fix sampling_down_factor range
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 196/699] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 198/699] cpufreq: conservative: Simplify frequency limit handling Greg Kroah-Hartman
` (505 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhongqiu Han, Pengjie Zhang,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengjie Zhang <zhangpengjie2@huawei.com>
[ Upstream commit 85524e651d20944399322d46fb97960337831d43 ]
The ondemand governor implementation accepts sampling_down_factor values
from 1 to 100000 via MAX_SAMPLING_DOWN_FACTOR, but the documentation in
admin-guide/pm/cpufreq.rst still says the valid range is 1 to 100.
Update the documentation to match the actual code.
Fixes: 2a0e49279850 ("cpufreq: User/admin documentation update and consolidation")
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com>
Link: https://patch.msgid.link/20260518133457.2408463-1-zhangpengjie2@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/pm/cpufreq.rst | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index 6adb7988e0eb6d..d2f37309cca3b3 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -499,7 +499,7 @@ This governor exposes the following tunables:
of those tasks above 0 and set this attribute to 1.
``sampling_down_factor``
- Temporary multiplier, between 1 (default) and 100 inclusive, to apply to
+ Temporary multiplier, between 1 (default) and 100000 inclusive, to apply to
the ``sampling_rate`` value if the CPU load goes above ``up_threshold``.
This causes the next execution of the governor's worker routine (after
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 198/699] cpufreq: conservative: Simplify frequency limit handling
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 197/699] cpufreq: Documentation: fix sampling_down_factor range Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 199/699] pwm: imx27: Fix variable truncation in .apply() Greg Kroah-Hartman
` (504 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lifeng Zheng, Viresh Kumar,
Zhongqiu Han, Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lifeng Zheng <zhenglifeng1@huawei.com>
[ Upstream commit 3494dff89779b73a6c70481c982e0e96d336454a ]
cs_dbs_update() performs explicit checks against policy->min/max
before updating the target frequency. These checks are redundant as
__cpufreq_driver_target() already clamps the requested frequency to
the valid policy limits.
Remove the unnecessary boundary checks and simplify the update logic.
This also fixes an issue introduced by commit 00bfe05889e9 ("cpufreq:
conservative: Decrease frequency faster for deferred updates"), where
stale target comparisons could cause frequency updates to be skipped
entirely after deferred adjustments.
Closes: https://lore.kernel.org/all/20260421123545.1745998-1-zhenglifeng1@huawei.com/
Fixes: 00bfe05889e9 ("cpufreq: conservative: Decrease frequency faster for deferred updates")
Signed-off-by: Lifeng Zheng <zhenglifeng1@huawei.com>
Co-developed-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Link: https://patch.msgid.link/292e6d937890f135e30ec0d2107eaad47cb9a976.1779423281.git.viresh.kumar@linaro.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq_conservative.c | 12 +-----------
1 file changed, 1 insertion(+), 11 deletions(-)
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 3225c7b747b08e..5817a3b9d5b2ef 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -103,10 +103,6 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
if (load > dbs_data->up_threshold) {
dbs_info->down_skip = 0;
- /* if we are already at full speed then break out early */
- if (requested_freq == policy->max)
- goto out;
-
requested_freq += freq_step;
if (requested_freq > policy->max)
requested_freq = policy->max;
@@ -123,13 +119,7 @@ static unsigned int cs_dbs_update(struct cpufreq_policy *policy)
/* Check for frequency decrease */
if (load < cs_tuners->down_threshold) {
- /*
- * if we cannot reduce the frequency anymore, break out early
- */
- if (requested_freq == policy->min)
- goto out;
-
- if (requested_freq > freq_step)
+ if (requested_freq > policy->min + freq_step)
requested_freq -= freq_step;
else
requested_freq = policy->min;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 199/699] pwm: imx27: Fix variable truncation in .apply()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 198/699] cpufreq: conservative: Simplify frequency limit handling Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 200/699] bus: sunxi-rsb: Always check register address validity Greg Kroah-Hartman
` (503 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ronaldo Nunez, Frank Li,
Uwe Kleine-König, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronaldo Nunez <rnunez@baylibre.com>
[ Upstream commit dc9e08fdbcc3eb08a1d2b868b535081c44425e27 ]
Fix a variable truncation when calculating period in microseconds as
part of the solution for the ERR051198 in .apply() callback.
Example scenario:
- Period of 3us (PWMPR = 196 and prescaler = 1)
- Expected value in tmp: 198000000000 (NSEC_PER_SEC * (196 + 2) * 1)
- Actual value is 431504384 (truncation to u32)
Signed-off-by: Ronaldo Nunez <rnunez@baylibre.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260522191348.6227-1-rnunez@baylibre.com
Fixes: a25351e4c774 ("pwm: imx27: Workaround of the pwm output bug when decrease the duty cycle")
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-imx27.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/pwm/pwm-imx27.c b/drivers/pwm/pwm-imx27.c
index 3c7929ca3b9212..683435f075f19f 100644
--- a/drivers/pwm/pwm-imx27.c
+++ b/drivers/pwm/pwm-imx27.c
@@ -216,7 +216,7 @@ static void pwm_imx27_wait_fifo_slot(struct pwm_chip *chip,
static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
const struct pwm_state *state)
{
- unsigned long period_cycles, duty_cycles, prescale, period_us, tmp;
+ unsigned long period_cycles, duty_cycles, prescale, period_us;
struct pwm_imx27_chip *imx = to_pwm_imx27_chip(chip);
struct pwm_state cstate;
unsigned long long c;
@@ -225,6 +225,7 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
int val;
int ret;
u32 cr;
+ u64 tmp;
pwm_get_state(pwm, &cstate);
@@ -268,6 +269,11 @@ static int pwm_imx27_apply(struct pwm_chip *chip, struct pwm_device *pwm,
val = readl(imx->mmio_base + MX3_PWMPR);
val = val >= MX3_PWMPR_MAX ? MX3_PWMPR_MAX : val;
cr = readl(imx->mmio_base + MX3_PWMCR);
+
+ /*
+ * tmp stores period in nanoseconds. Result fits in u64 since
+ * val <= 0xfffe and prescaler in [1, 0x1000].
+ */
tmp = NSEC_PER_SEC * (u64)(val + 2) * MX3_PWMCR_PRESCALER_GET(cr);
tmp = DIV_ROUND_UP_ULL(tmp, clkrate);
period_us = DIV_ROUND_UP_ULL(tmp, 1000);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 200/699] bus: sunxi-rsb: Always check register address validity
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 199/699] pwm: imx27: Fix variable truncation in .apply() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 201/699] IB/mlx4: Fix refcount leak in add_port() error path Greg Kroah-Hartman
` (502 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Holland, Andrey Skvortsov,
Chen-Yu Tsai, Jernej Skrabec, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Holland <samuel@sholland.org>
[ Upstream commit 61192938a5870ac36edae81e4775b680dcf02c61 ]
The register address was already validated for read operations in
regmap_sunxi_rsb_reg_read before being truncated to a u8. Write operations
have the same set of possible addresses, and the address is being truncated
from u32 to u8 here as well, so the same check is needed.
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus")
Reviewed-by: Chen-Yu Tsai <wens@kernel.org>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20260301144939.1832806-1-andrej.skvortzov@gmail.com
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/sunxi-rsb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
index 98cbb18f17fa39..411bb5a3e92574 100644
--- a/drivers/bus/sunxi-rsb.c
+++ b/drivers/bus/sunxi-rsb.c
@@ -429,6 +429,9 @@ static int regmap_sunxi_rsb_reg_write(void *context, unsigned int reg,
struct sunxi_rsb_ctx *ctx = context;
struct sunxi_rsb_device *rdev = ctx->rdev;
+ if (reg > 0xff)
+ return -EINVAL;
+
return sunxi_rsb_write(rdev->rsb, rdev->rtaddr, reg, &val, ctx->size);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 201/699] IB/mlx4: Fix refcount leak in add_port() error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 200/699] bus: sunxi-rsb: Always check register address validity Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 202/699] RDMA/hns: Fix warning in poll cq direct mode Greg Kroah-Hartman
` (501 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Jason Gunthorpe,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 9a8826fdfbcd7ed2ccf745f5d54208358d939def ]
After kobject_init_and_add(), the lifetime of the embedded struct
kobject is expected to be managed through the kobject core reference
counting.
In add_port(), failure paths after kobject_init_and_add() must not free
struct mlx4_port directly, because the embedded kobject is then managed
by the kobject core. Freeing it directly leaves the kobject reference
counting unbalanced and can lead to incorrect lifetime handling.
Allocate the pkey and gid attribute arrays before kobject_init_and_add(),
so failures before kobject initialization can be handled by directly
freeing the allocated memory. Once kobject_init_and_add() has been
called, unwind later failures by removing any successfully created sysfs
groups, calling kobject_del(), and then releasing the embedded kobject
with kobject_put().
Fixes: c1e7e466120b ("IB/mlx4: Add iov directory in sysfs under the ib device")
Link: https://patch.msgid.link/r/20260518021910.972900-1-lgs201920130244@gmail.com
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx4/sysfs.c | 45 ++++++++++++++++++------------
1 file changed, 27 insertions(+), 18 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c
index 6c3a23ee3bc72e..f75bb58197dd27 100644
--- a/drivers/infiniband/hw/mlx4/sysfs.c
+++ b/drivers/infiniband/hw/mlx4/sysfs.c
@@ -648,12 +648,6 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
p->port_num = port_num;
p->slave = slave;
- ret = kobject_init_and_add(&p->kobj, &port_type,
- kobject_get(dev->dev_ports_parent[slave]),
- "%d", port_num);
- if (ret)
- goto err_alloc;
-
p->pkey_group.name = "pkey_idx";
p->pkey_group.attrs =
alloc_group_attrs(show_port_pkey,
@@ -661,13 +655,9 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
dev->dev->caps.pkey_table_len[port_num]);
if (!p->pkey_group.attrs) {
ret = -ENOMEM;
- goto err_alloc;
+ goto err_free_port;
}
- ret = sysfs_create_group(&p->kobj, &p->pkey_group);
- if (ret)
- goto err_free_pkey;
-
p->gid_group.name = "gid_idx";
p->gid_group.attrs = alloc_group_attrs(show_port_gid_idx, NULL, 1);
if (!p->gid_group.attrs) {
@@ -675,28 +665,47 @@ static int add_port(struct mlx4_ib_dev *dev, int port_num, int slave)
goto err_free_pkey;
}
+ ret = kobject_init_and_add(&p->kobj, &port_type,
+ kobject_get(dev->dev_ports_parent[slave]),
+ "%d", port_num);
+ if (ret)
+ goto err_put;
+
+ ret = sysfs_create_group(&p->kobj, &p->pkey_group);
+ if (ret)
+ goto err_del;
+
ret = sysfs_create_group(&p->kobj, &p->gid_group);
if (ret)
- goto err_free_gid;
+ goto err_remove_pkey;
ret = add_vf_smi_entries(p);
if (ret)
- goto err_free_gid;
+ goto err_remove_gid;
list_add_tail(&p->kobj.entry, &dev->pkeys.pkey_port_list[slave]);
return 0;
-err_free_gid:
- kfree(p->gid_group.attrs[0]);
- kfree(p->gid_group.attrs);
+err_remove_gid:
+ sysfs_remove_group(&p->kobj, &p->gid_group);
+
+err_remove_pkey:
+ sysfs_remove_group(&p->kobj, &p->pkey_group);
+
+err_del:
+ kobject_del(&p->kobj);
+
+err_put:
+ kobject_put(dev->dev_ports_parent[slave]);
+ kobject_put(&p->kobj);
+ return ret;
err_free_pkey:
for (i = 0; i < dev->dev->caps.pkey_table_len[port_num]; ++i)
kfree(p->pkey_group.attrs[i]);
kfree(p->pkey_group.attrs);
-err_alloc:
- kobject_put(dev->dev_ports_parent[slave]);
+err_free_port:
kfree(p);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 202/699] RDMA/hns: Fix warning in poll cq direct mode
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 201/699] IB/mlx4: Fix refcount leak in add_port() error path Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 203/699] PM: sleep: Use complete() in device_pm_sleep_init() Greg Kroah-Hartman
` (500 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lianfa Weng, Junxian Huang,
Jason Gunthorpe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lianfa Weng <wenglianfa@huawei.com>
[ Upstream commit 3f19c2a3852e6ba75f3e92dd5edc4e07f3d07f4a ]
CQs allocated by ib_alloc_cq() always have a comp_handler. Though
in direct mode this handler is never expected to be called, it
is still called when the driver is reset, triggering the following
WARN_ONCE():
Call trace:
ib_cq_completion_direct+0x38/0x60
hns_roce_cq_completion+0x54/0x90 (hns_roce_hw_v2]
hns_roce_handle_device_err+Ox1c8/0x340 [hns_roce_hw_v2]
hns_roce_hw_v2_uninit_instance.constprop.0+0x34/0x70 [hns_roce_hw_v2]
hns_roce_hw_v2_reset_notify+0xc4/0xe0 [hns_roce_hw_v2]
hclge_notify_roce_client+0x60/0xbc [hclge]
hclge_reset_rebuild+0x48/0x34c [hclge]
hclge_reset_subtask+0xcc/0xec [hclge]
hclge_reset_service_task+0x80/0x160 [hclge]
hclge_service_task+0x50/0x80 (hclge]
process_one_work+0x1cc/0x4d0
worker_thread+0x154/0x414
kthread+0x104/0x144
ret_from_fork+0x10/0x18
Fixes: f295e4cece5c ("RDMA/hns: Delete unnecessary callback functions for cq")
Link: https://patch.msgid.link/r/20260520055759.2354037-3-huangjunxian6@hisilicon.com
Signed-off-by: Lianfa Weng <wenglianfa@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c
index 9078855aad1842..ea0ddf2fa3f9a5 100644
--- a/drivers/infiniband/hw/hns/hns_roce_main.c
+++ b/drivers/infiniband/hw/hns/hns_roce_main.c
@@ -807,7 +807,7 @@ static void check_and_get_armed_cq(struct list_head *cq_list, struct ib_cq *cq)
unsigned long flags;
spin_lock_irqsave(&hr_cq->lock, flags);
- if (cq->comp_handler) {
+ if (cq->comp_handler && hr_cq->ib_cq.poll_ctx != IB_POLL_DIRECT) {
if (!hr_cq->is_armed) {
hr_cq->is_armed = 1;
list_add_tail(&hr_cq->node, cq_list);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 203/699] PM: sleep: Use complete() in device_pm_sleep_init()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 202/699] RDMA/hns: Fix warning in poll cq direct mode Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 204/699] MIPS: Fix big-endian stack argument fetching in o32 wrapper Greg Kroah-Hartman
` (499 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiakai Xu, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
[ Upstream commit 3855941f1e4069182c895d5093c5fa589f5b38bd ]
Replace complete_all() with complete() in device_pm_sleep_init() to allow
it to be called in atomic contexts without triggering a false-positive
WARNING from lockdep_assert_RT_in_threaded_ctx() when
CONFIG_PROVE_RAW_LOCK_NESTING is enabled.
device_pm_sleep_init() may be called during device initialization while
holding a raw_spinlock (e.g., from within device_initialize()), and
complete_all() is unsafe in atomic contexts on PREEMPT_RT kernels.
complete(), which is safe to call from any context, is sufficient here.
complete_all() sets the completion count to UINT_MAX/2 (permanently
signaled), while complete() increments it by 1. Since no threads can be
waiting during device initialization, both are functionally equivalent.
The completion is always reinitialized via reinit_completion() in
dpm_clear_async_state() before each suspend/resume cycle.
However, changing to complete() introduces a potential deadlock for
devices with no PM support (dev->power.no_pm = true). Such devices are
never added to the dpm_list and never go through dpm_clear_async_state(),
so their completion is never reinitialized. A parent device waiting on a
no_pm child across multiple suspend phases would consume the single-use
token in the first phase and block forever in the second.
Fix this by adding an early return in dpm_wait() when dev->power.no_pm is
set, since no_pm devices do not participate in system suspend/resume.
Fixes: 152e1d592071 ("PM: Prevent waiting forever on asynchronous resume after failing suspend")
Signed-off-by: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
[ rjw: Subject adjustment ]
Link: https://patch.msgid.link/20260523022314.2657232-1-xujiakai24@mails.ucas.ac.cn
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/power/main.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 964573e30d6910..24a7e280e30076 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -102,7 +102,7 @@ void device_pm_sleep_init(struct device *dev)
dev->power.is_noirq_suspended = false;
dev->power.is_late_suspended = false;
init_completion(&dev->power.completion);
- complete_all(&dev->power.completion);
+ complete(&dev->power.completion);
dev->power.wakeup = NULL;
INIT_LIST_HEAD(&dev->power.entry);
}
@@ -242,6 +242,10 @@ static void dpm_wait(struct device *dev, bool async)
if (!dev)
return;
+ /* Devices with no PM support don't use the completion. */
+ if (dev->power.no_pm)
+ return;
+
if (async || (pm_async_enabled && dev->power.async_suspend))
wait_for_completion(&dev->power.completion);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 204/699] MIPS: Fix big-endian stack argument fetching in o32 wrapper
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 203/699] PM: sleep: Use complete() in device_pm_sleep_init() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 205/699] MIPS: DEC: Remove do_IRQ() call indirection Greg Kroah-Hartman
` (498 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
[ Upstream commit 8e0780d30b1b51248e42895b7acc7a20f147b40b ]
Fix an issue in call_o32() where the upper 32-bit half of incoming n64
stack arguments is fetched and used for outgoing o32 stack arguments on
big-endian platforms.
This code was adapted from arch/mips/dec/prom/call_o32.S which was meant
for a little-endian platform only and therefore using 32-bit loads from
64-bit stack slot locations holding incoming stack arguments resulted in
correct values being retrieved for data that is expected to be 32-bit.
This works on little-endian platforms where the lower 32-bit half of the
64-bit value is located at every 64-bit stack slot location. However on
big-endian platforms the lower 32-bit half is instead located at offset
4 from every 64-bit stack slot location.
So to fix the issue the offset of 4 would have to be used on big-endian
platforms only, or alternatively a 64-bit load from the 64-bit stack
slot location can be used across the board, as the subsequent 32-bit
store to the corresponding outgoing stack argument slot will correctly
truncate the value and cause no unpredictable result. We already take
advantage of this architectural feature for the incoming arguments held
in $a6 and $a7 registers, since the o32 wrapper does not know how many
incoming arguments there are and consequently propagates incoming data
which may not be 32-bit.
Since this code is generally supposed to be used with the stack located
in cached memory there is no extra overhead expected for 64-bit loads as
opposed to 32-bit ones, so pick this variant for code simplicity.
Fixes: 231a35d37293 ("[MIPS] RM: Collected changes")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/fw/lib/call_o32.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/fw/lib/call_o32.S b/arch/mips/fw/lib/call_o32.S
index ee856709e0b600..77533cfbdfc10b 100644
--- a/arch/mips/fw/lib/call_o32.S
+++ b/arch/mips/fw/lib/call_o32.S
@@ -74,7 +74,7 @@ NESTED(call_o32, O32_FRAMESZ, ra)
PTR_LA t1,6*O32_SZREG(fp)
li t2,O32_ARGC-6
1:
- lw t3,(t0)
+ ld t3,(t0)
REG_ADDU t0,SZREG
sw t3,(t1)
REG_SUBU t2,1
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 205/699] MIPS: DEC: Remove do_IRQ() call indirection
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 204/699] MIPS: Fix big-endian stack argument fetching in o32 wrapper Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 206/699] mtd: spi-nor: Drop duplicate Kconfig dependency Greg Kroah-Hartman
` (497 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
[ Upstream commit 35554eadc1b127bb5294504a4ac8f3a5dd9e299d ]
As from commit 8f99a1626535 ("MIPS: Tracing: Add IRQENTRY_EXIT section
for MIPS") do_IRQ() is not a macro anymore and can be invoked directly
from assembly code, as a tail call. Remove the dec_irq_dispatch() stub
then and the indirection previously introduced with commit 187933f23679
("[MIPS] do_IRQ cleanup"), improving performance by reducing the number
of control flow changes and the overall instruction count, while fixing
a compiler's complaint about a missing prototype for said stub:
arch/mips/dec/setup.c:780:25: warning: no previous prototype for 'dec_irq_dispatch' [-Wmissing-prototypes]
780 | asmlinkage unsigned int dec_irq_dispatch(unsigned int irq)
| ^~~~~~~~~~~~~~~~
(which gets promoted to a compilation error with CONFIG_WERROR).
Fixes: 8f99a1626535 ("MIPS: Tracing: Add IRQENTRY_EXIT section for MIPS")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/dec/int-handler.S | 2 +-
arch/mips/dec/setup.c | 6 ------
2 files changed, 1 insertion(+), 7 deletions(-)
diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S
index 011d1d678840aa..a0b439c90488fc 100644
--- a/arch/mips/dec/int-handler.S
+++ b/arch/mips/dec/int-handler.S
@@ -277,7 +277,7 @@
srlv t3,t1,t2
handle_it:
- j dec_irq_dispatch
+ j do_IRQ
nop
#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT)
diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c
index 99b9b29750db3c..ec0aa4ef2778a6 100644
--- a/arch/mips/dec/setup.c
+++ b/arch/mips/dec/setup.c
@@ -776,9 +776,3 @@ void __init arch_init_irq(void)
pr_err("Failed to register halt interrupt\n");
}
}
-
-asmlinkage unsigned int dec_irq_dispatch(unsigned int irq)
-{
- do_IRQ(irq);
- return 0;
-}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 206/699] mtd: spi-nor: Drop duplicate Kconfig dependency
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 205/699] MIPS: DEC: Remove do_IRQ() call indirection Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 207/699] nvme-multipath: fix flex array size in struct nvme_ns_head Greg Kroah-Hartman
` (496 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Michael Walle,
Pratyush Yadav, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
[ Upstream commit a6470e2162e9c3779a4bd6ff3bed1b81d796e46e ]
I do not think the MTD dependency is needed twice. This is likely a
duplicate coming from a former rebase when the spi-nor core got cleaned
up a while ago. Remove the extra line.
Fixes: b35b9a10362d ("mtd: spi-nor: Move m25p80 code in spi-nor.c")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/mtd/spi-nor/Kconfig b/drivers/mtd/spi-nor/Kconfig
index ffc4b380f2b16d..665ec75f81ed00 100644
--- a/drivers/mtd/spi-nor/Kconfig
+++ b/drivers/mtd/spi-nor/Kconfig
@@ -1,7 +1,6 @@
# SPDX-License-Identifier: GPL-2.0-only
menuconfig MTD_SPI_NOR
tristate "SPI NOR device support"
- depends on MTD
depends on MTD && SPI_MASTER
select SPI_MEM
help
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 207/699] nvme-multipath: fix flex array size in struct nvme_ns_head
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 206/699] mtd: spi-nor: Drop duplicate Kconfig dependency Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 208/699] workqueue: drop spurious * from print_worker_info() fn declaration Greg Kroah-Hartman
` (495 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Kumar Chaurasiya (IBM),
Hannes Reinecke, John Garry, Christoph Hellwig, Nilay Shroff,
Keith Busch, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilay Shroff <nilay@linux.ibm.com>
[ Upstream commit 001e57554de81aa79c25c18fd53911d8a415c304 ]
struct nvme_ns_head contains a flexible array member, current_path[],
which is indexed using the NUMA node ID:
head->current_path[numa_node_id()]
The structure is currently allocated as:
size = sizeof(struct nvme_ns_head) +
(num_possible_nodes() * sizeof(struct nvme_ns *));
head = kzalloc(size, GFP_KERNEL);
This allocation assumes that NUMA node IDs are sequential and densely
packed from 0 .. num_possible_nodes() - 1. While this assumption holds
on many systems, it is not always true on some architectures such as
powerpc.
On some powerpc systems, NUMA node IDs can be sparse. For example:
NUMA:
NUMA node(s): 6
NUMA node0 CPU(s): 80-159
NUMA node8 CPU(s): 0-79
NUMA node252 CPU(s):
NUMA node253 CPU(s):
NUMA node254 CPU(s):
NUMA node255 CPU(s):
That is, the possible/online NUMA node IDs are: 0, 8, 252, 253, 254, 255
In this case: num_possible_nodes() = 6
So memory is allocated for only 6 entries in current_path[]. However,
the array is later indexed using the actual NUMA node ID. As a result,
accesses such as:
head->current_path[8] or
head->current_path[252]
goes out of bounds, leading to the following KASAN splat:
==================================================================
BUG: KASAN: slab-out-of-bounds in nvme_mpath_revalidate_paths+0x22c/0x290 [nvme_core]
Write of size 8 at addr c00020003bda35b8 by task kworker/u641:2/1997
CPU: 1 UID: 0 PID: 1997 Comm: kworker/u641:2 Not tainted 7.1.0-rc5-dirty #14 PREEMPT(lazy)
Hardware name: 8335-GTH POWER9 0x4e1202 opal:skiboot-v6.5.3-35-g1851b2a06 PowerNV
Workqueue: async async_run_entry_fn
Call Trace:
[c000200037fa7510] [c0000000021c23d4] dump_stack_lvl+0x88/0xdc (unreliable)
[c000200037fa7540] [c0000000009fda90] print_report+0x22c/0x67c
[c000200037fa7630] [c0000000009fd508] kasan_report+0x108/0x220
[c000200037fa7740] [c0000000009fff48] __asan_store8+0xe8/0x120
[c000200037fa7760] [c008000018e76474] nvme_mpath_revalidate_paths+0x22c/0x290 [nvme_core]
[c000200037fa7800] [c008000018e6556c] nvme_update_ns_info+0x4a4/0x5e0 [nvme_core]
[c000200037fa7a50] [c008000018e66270] nvme_alloc_ns+0x6d8/0x1a70 [nvme_core]
[c000200037fa7c20] [c008000018e679fc] nvme_scan_ns+0x3f4/0x630 [nvme_core]
[c000200037fa7d10] [c00000000031f22c] async_run_entry_fn+0x9c/0x3a0
[c000200037fa7db0] [c0000000002fa544] process_one_work+0x414/0xa10
[c000200037fa7ec0] [c0000000002fbf00] worker_thread+0x320/0x640
[c000200037fa7f80] [c00000000030d0f8] kthread+0x278/0x290
[c000200037fa7fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18
Allocated by task 1997 on cpu 1 at 35.928317s:
The buggy address belongs to the object at c00020003bda3000
which belongs to the cache kmalloc-rnd-15-2k of size 2048
The buggy address is located 16 bytes to the right of
allocated 1448-byte region [c00020003bda3000, c00020003bda35a8)
The buggy address belongs to the physical page:
Memory state around the buggy address:
c00020003bda3480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c00020003bda3500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>c00020003bda3580: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
^
c00020003bda3600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
c00020003bda3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Fix this by allocating the flexible array using nr_node_ids instead
of num_possible_nodes(). Since nr_node_ids represents the maximum
possible NUMA node IDs, indexing current_path[] using numa_node_id()
becomes safe even on systems with sparse node IDs.
Fixes: f333444708f8 ("nvme: take node locality into account when selecting a path")
Tested-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index cb9b38e142edd5..56913db1f44588 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3806,7 +3806,7 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl,
int ret = -ENOMEM;
#ifdef CONFIG_NVME_MULTIPATH
- size += num_possible_nodes() * sizeof(struct nvme_ns *);
+ size += nr_node_ids * sizeof(struct nvme_ns *);
#endif
head = kzalloc(size, GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 208/699] workqueue: drop spurious * from print_worker_info() fn declaration
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 207/699] nvme-multipath: fix flex array size in struct nvme_ns_head Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 209/699] ipv6: guard against possible NULL deref in __in6_dev_stats_get() Greg Kroah-Hartman
` (494 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Breno Leitao, Tejun Heo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 611583a76ea97991b0f65ec1ff099eac7fe0bae4 ]
print_worker_info() declares its local 'fn' as work_func_t * but
worker->current_func has type work_func_t (a function pointer). The
extra level of indirection is wrong and only happens to be harmless
today because every supported Linux architecture has
sizeof(work_func_t) == sizeof(work_func_t *):
copy_from_kernel_nofault() reads the correct number of bytes by
accident, and %ps still resolves the printed address because the
stored value is the function address regardless of declared type.
On any future ABI where sizeof(void (*)()) differs from
sizeof(void *), the nofault copy would transfer the wrong number of
bytes and the subsequent %ps would print an incorrect address.
Match the field type so the intent is explicit and the code does not
silently rely on equal pointer sizes.
Fixes: 3d1cb2059d93 ("workqueue: include workqueue info when printing debug dump of a worker task")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/workqueue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 63140e4dd5dfca..eeda0e263cbfa1 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4651,7 +4651,7 @@ EXPORT_SYMBOL_GPL(set_worker_desc);
*/
void print_worker_info(const char *log_lvl, struct task_struct *task)
{
- work_func_t *fn = NULL;
+ work_func_t fn = NULL;
char name[WQ_NAME_LEN] = { };
char desc[WORKER_DESC_LEN] = { };
struct pool_workqueue *pwq = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 209/699] ipv6: guard against possible NULL deref in __in6_dev_stats_get()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 208/699] workqueue: drop spurious * from print_worker_info() fn declaration Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 210/699] net/sched: cls_bpf: prevent unbounded recursion in offload rollback Greg Kroah-Hartman
` (493 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Stephen Suryaputra,
Ido Schimmel, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 507541c2a8eeb76c02bd2511958f73a8cfa3e1bc ]
dev_get_by_index_rcu() could return NULL if the original physical
device is unregistered.
Found by Sashiko.
Fixes: e1ae5c2ea478 ("vrf: Increment Icmp6InMsgs on the original netdev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stephen Suryaputra <ssuryaextr@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260526145529.3587126-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/addrconf.h | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index f666d3628d6aa8..0d6a20841d3ac8 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -334,8 +334,11 @@ static inline struct inet6_dev *__in6_dev_get(const struct net_device *dev)
static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device *dev,
const struct sk_buff *skb)
{
- if (netif_is_l3_master(dev))
+ if (netif_is_l3_master(dev)) {
dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb));
+ if (!dev)
+ return NULL;
+ }
return __in6_dev_get(dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 210/699] net/sched: cls_bpf: prevent unbounded recursion in offload rollback
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 209/699] ipv6: guard against possible NULL deref in __in6_dev_stats_get() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 211/699] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() Greg Kroah-Hartman
` (492 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Jiayuan Chen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
[ Upstream commit 27db54b90bcc7c37867fe664107fa25ea6a116e4 ]
Quan Sun reported [1] a stack overflow in cls_bpf_offload_cmd().
Reproducer on netdevsim: add a skip_sw cls_bpf filter, set the
bpf_tc_accept debugfs knob to 0, then `tc filter replace`. The replace
calls tc_setup_cb_replace() which fails. cls_bpf_offload_cmd() then
swaps prog/oldprog and recursively calls itself to roll back. But
bpf_tc_accept=0 makes the rollback fail too, which triggers yet another
rollback frame with the same arguments, and so on until the stack is
exhausted.
bpf_tc_accept is just a convenient knob for the reproducer. Any driver
whose tc_setup_cb_replace() fails twice in a row can hit the same loop,
so this is not a netdevsim-only issue.
Two ways to fix it:
1) Have the rollback call tc_setup_cb_add() on oldprog instead of
re-entering cls_bpf_offload_cmd().
2) Mark the rollback frame with a flag and skip a second-level
rollback from inside it.
Go with (2). It is the smaller change and keeps the original behaviour:
the rollback still goes through tc_setup_cb_replace(), so the driver
gets one real chance to restore its state. If that attempt also fails,
we just return the original error instead of recursing.
[1]: https://lore.kernel.org/bpf/ce5a6005-3c5e-4696-9e05-eba9461dc860@std.uestc.edu.cn/T/#u
Fixes: 102740bd9436 ("cls_bpf: fix offload assumptions after callback conversion")
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260526025529.24382-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_bpf.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c
index 6e3e63db0e0168..70bb1482c8736e 100644
--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -143,7 +143,8 @@ static bool cls_bpf_is_ebpf(const struct cls_bpf_prog *prog)
static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
struct cls_bpf_prog *oldprog,
- struct netlink_ext_ack *extack)
+ struct netlink_ext_ack *extack,
+ bool is_rollback)
{
struct tcf_block *block = tp->chain->block;
struct tc_cls_bpf_offload cls_bpf = {};
@@ -178,7 +179,8 @@ static int cls_bpf_offload_cmd(struct tcf_proto *tp, struct cls_bpf_prog *prog,
&oldprog->in_hw_count, true);
if (prog && err) {
- cls_bpf_offload_cmd(tp, oldprog, prog, extack);
+ if (!is_rollback)
+ cls_bpf_offload_cmd(tp, oldprog, prog, extack, true);
return err;
}
@@ -209,7 +211,7 @@ static int cls_bpf_offload(struct tcf_proto *tp, struct cls_bpf_prog *prog,
if (!prog && !oldprog)
return 0;
- return cls_bpf_offload_cmd(tp, prog, oldprog, extack);
+ return cls_bpf_offload_cmd(tp, prog, oldprog, extack, false);
}
static void cls_bpf_stop_offload(struct tcf_proto *tp,
@@ -218,7 +220,7 @@ static void cls_bpf_stop_offload(struct tcf_proto *tp,
{
int err;
- err = cls_bpf_offload_cmd(tp, NULL, prog, extack);
+ err = cls_bpf_offload_cmd(tp, NULL, prog, extack, false);
if (err)
pr_err("Stopping hardware offload failed: %d\n", err);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 211/699] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 210/699] net/sched: cls_bpf: prevent unbounded recursion in offload rollback Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 212/699] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() Greg Kroah-Hartman
` (491 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Gu, Mikko Perttunen,
Thierry Reding, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 63a3998d792ab5c45304bf879e385a31fa923b61 ]
The of_for_each_phandle() macro increments the reference count of the
device node it iterates over. If the loop exits early, the reference must
be released manually.
In tegra_dc_has_output(), the function returns true immediately when a
match is found, failing to release the current node's reference.
Fix this by adding a call to of_node_put() before returning from the loop.
Fixes: c57997bce423 ("drm/tegra: sor: Add Tegra186 support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260128-dc-v1-1-a88205826301@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/dc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index dbcbe91a462a9c..cff8f545515f46 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -93,8 +93,10 @@ bool tegra_dc_has_output(struct tegra_dc *dc, struct device *dev)
int err;
of_for_each_phandle(&it, err, np, "nvidia,outputs", NULL, 0)
- if (it.node == dev->of_node)
+ if (it.node == dev->of_node) {
+ of_node_put(it.node);
return true;
+ }
return false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 212/699] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 211/699] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 213/699] ocfs2: dont BUG_ON an invalid journal dinode Greg Kroah-Hartman
` (490 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Alexandre Bounine,
Chul Kim, Matt Porter, Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit fc15e3a30ddd950f009c76765331783b9af94a87 ]
With a list_for_each() loop, if we don't find the item we are looking for
in the list, then the loop exits with the iterator, which is "dbell" in
this loop, pointing to invalid memory.
This code uses the "found" variable to determine if we have found the
doorbell we are looking for or not. However, the problem that the "found"
variable needs to be set to false at the start of each iteration,
otherwise after the first correct doorbell, then everything is marked as
found.
Reset the "found" to false at the start of the iteration and move the
variable inside the loop.
Link: https://lore.kernel.org/af2WHMZiqMwdYveO@stanley.mountain
Fixes: 48618fb4e522 ("RapidIO: add mport driver for Tsi721 bridge")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Chul Kim <chul.kim@idt.com>
Cc: Matt Porter <mporter@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rapidio/devices/tsi721.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 4dd31dd9feeabb..c9a1388549389b 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -384,7 +384,6 @@ static void tsi721_db_dpc(struct work_struct *work)
idb_work);
struct rio_mport *mport;
struct rio_dbell *dbell;
- int found = 0;
u32 wr_ptr, rd_ptr;
u64 *idb_entry;
u32 regval;
@@ -402,6 +401,8 @@ static void tsi721_db_dpc(struct work_struct *work)
rd_ptr = ioread32(priv->regs + TSI721_IDQ_RP(IDB_QUEUE)) % IDB_QSIZE;
while (wr_ptr != rd_ptr) {
+ int found = 0;
+
idb_entry = (u64 *)(priv->idb_base +
(TSI721_IDB_ENTRY_SIZE * rd_ptr));
rd_ptr++;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 213/699] ocfs2: dont BUG_ON an invalid journal dinode
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 212/699] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 214/699] ocfs2: kill osb->system_file_mutex lock Greg Kroah-Hartman
` (489 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhengYuan Huang, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengYuan Huang <gality369@gmail.com>
[ Upstream commit c0438198c28b1d22c272751af5e717c11d9fa8dd ]
[BUG]
A fuzzed OCFS2 image can corrupt the current slot journal dinode while
mount is still in progress. The mount path first reports the invalid
journal block and then crashes in shutdown:
kernel BUG at fs/ocfs2/journal.c:1034!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ocfs2_journal_toggle_dirty+0x2d6/0x340 fs/ocfs2/journal.c:1034
Call Trace:
ocfs2_journal_shutdown+0x414/0xc30 fs/ocfs2/journal.c:1116
ocfs2_mount_volume fs/ocfs2/super.c:1785 [inline]
ocfs2_fill_super+0x30a9/0x3cd0 fs/ocfs2/super.c:1083
get_tree_bdev_flags+0x38b/0x640 fs/super.c:1698
get_tree_bdev+0x24/0x40 fs/super.c:1721
ocfs2_get_tree+0x21/0x30 fs/ocfs2/super.c:1184
vfs_get_tree+0x9a/0x370 fs/super.c:1758
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3642 [inline]
do_new_mount fs/namespace.c:3718 [inline]
path_mount+0x5b8/0x1ea0 fs/namespace.c:4028
do_mount fs/namespace.c:4041 [inline]
__do_sys_mount fs/namespace.c:4229 [inline]
__se_sys_mount fs/namespace.c:4206 [inline]
__x64_sys_mount+0x282/0x320 fs/namespace.c:4206
...
[CAUSE]
ocfs2_journal_toggle_dirty() used to return -EIO when journal->j_bh no
longer contained a valid dinode, because the startup and shutdown paths
already handled that failure. Commit 10995aa2451a
("ocfs2: Morph the haphazard OCFS2_IS_VALID_DINODE() checks.") changed
the check to a BUG_ON() under the assumption that the journal dinode had
already been validated. That turns an unexpected invalid journal dinode
during mount teardown into a kernel crash instead of a normal mount
failure.
[FIX]
Replace the BUG_ON() with WARN_ON() and return -EIO. This keeps the
invariant warning for debugging, but restores the original behavior of
failing startup or shutdown cleanly instead of panicking the kernel.
Link: https://lore.kernel.org/20260512024115.4036371-1-gality369@gmail.com
Fixes: 10995aa2451a ("ocfs2: Morph the haphazard OCFS2_IS_VALID_DINODE() checks.")
Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/journal.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
index 02a1d2e99af194..a37db6e88a3d1f 100644
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -968,11 +968,8 @@ static int ocfs2_journal_toggle_dirty(struct ocfs2_super *osb,
struct ocfs2_dinode *fe;
fe = (struct ocfs2_dinode *)bh->b_data;
-
- /* The journal bh on the osb always comes from ocfs2_journal_init()
- * and was validated there inside ocfs2_inode_lock_full(). It's a
- * code bug if we mess it up. */
- BUG_ON(!OCFS2_IS_VALID_DINODE(fe));
+ if (WARN_ON(!OCFS2_IS_VALID_DINODE(fe)))
+ return -EIO;
flags = le32_to_cpu(fe->id1.journal1.ij_flags);
if (dirty)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 214/699] ocfs2: kill osb->system_file_mutex lock
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 213/699] ocfs2: dont BUG_ON an invalid journal dinode Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 215/699] drm/msm/dp: fix HPD state status bit shift value Greg Kroah-Hartman
` (488 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tetsuo Handa, Heming Zhao, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit f5b1910e23f1233c8d4185268b2e659df2bc5dbf ]
Commit 43b10a20372d ("ocfs2: avoid system inode ref confusion by adding
mutex lock") tried to avoid a refcount leak caused by allowing multiple
threads to call igrab(inode). But addition of osb->system_file_mutex made
locking dependency complicated and is causing lockdep to warn about
possibility of AB-BA deadlock.
Since _ocfs2_get_system_file_inode() returns the same inode for the same
input arguments, we don't need to serialize
_ocfs2_get_system_file_inode(). What we need to make sure is that
igrab(inode) is called for only once(). Therefore, replace
osb->system_file_mutex with cmpxchg()-based locking.
Link: https://lore.kernel.org/fea8d1fd-afb0-4302-a560-c202e2ef7afd@I-love.SAKURA.ne.jp
Fixes: 43b10a20372d ("ocfs2: avoid system inode ref confusion by adding mutex lock")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Acked-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/ocfs2.h | 2 --
fs/ocfs2/super.c | 2 --
fs/ocfs2/sysfile.c | 9 +++------
3 files changed, 3 insertions(+), 10 deletions(-)
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index ea616c3ab09a37..f046edf129a436 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -469,8 +469,6 @@ struct ocfs2_super
struct rb_root osb_rf_lock_tree;
struct ocfs2_refcount_tree *osb_ref_tree_lru;
- struct mutex system_file_mutex;
-
/*
* OCFS2 needs to schedule several different types of work which
* require cluster locking, disk I/O, recovery waits, etc. Since these
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 41ecdfa9b31e83..684ede0eddb4cd 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -2062,8 +2062,6 @@ static int ocfs2_initialize_super(struct super_block *sb,
spin_lock_init(&osb->osb_xattr_lock);
ocfs2_init_steal_slots(osb);
- mutex_init(&osb->system_file_mutex);
-
atomic_set(&osb->alloc_stats.moves, 0);
atomic_set(&osb->alloc_stats.local_data, 0);
atomic_set(&osb->alloc_stats.bitmap_data, 0);
diff --git a/fs/ocfs2/sysfile.c b/fs/ocfs2/sysfile.c
index bb701c4e449f1d..d3115b36d31d97 100644
--- a/fs/ocfs2/sysfile.c
+++ b/fs/ocfs2/sysfile.c
@@ -100,11 +100,9 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
} else
arr = get_local_system_inode(osb, type, slot);
- mutex_lock(&osb->system_file_mutex);
if (arr && ((inode = *arr) != NULL)) {
/* get a ref in addition to the array ref */
inode = igrab(inode);
- mutex_unlock(&osb->system_file_mutex);
BUG_ON(!inode);
return inode;
@@ -114,11 +112,10 @@ struct inode *ocfs2_get_system_file_inode(struct ocfs2_super *osb,
inode = _ocfs2_get_system_file_inode(osb, type, slot);
/* add one more if putting into array for first time */
- if (arr && inode) {
- *arr = igrab(inode);
- BUG_ON(!*arr);
+ if (inode && arr && !*arr && !cmpxchg(&(*arr), NULL, inode)) {
+ inode = igrab(inode);
+ BUG_ON(!inode);
}
- mutex_unlock(&osb->system_file_mutex);
return inode;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 215/699] drm/msm/dp: fix HPD state status bit shift value
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 214/699] ocfs2: kill osb->system_file_mutex lock Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 216/699] drm/msm/dp: Fix the ISR_* enum values Greg Kroah-Hartman
` (487 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jessica Zhang, Konrad Dybcio,
Dmitry Baryshkov, Sasha Levin, Val Packett, Yongxing Mou
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
[ Upstream commit 2e6c2e81d81251623c458a60e2a57447dcbc988e ]
The HPD state status is the 3 most significant bits, not 4 bits of the
HPD_INT_STATUS register.
Fix the bit shift macro so that the correct bits are returned in
msm_dp_aux_is_link_connected().
Fixes: 19e52bcb27c2 ("drm/msm/dp: return correct connection status after suspend")
Signed-off-by: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Tested-by: Val Packett <val@packett.cool> # x1e80100-dell-latitude-7455
Tested-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> # Hamoa IOT EVK, QCS8300 Ride
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/727611/
Link: https://lore.kernel.org/r/20260524-hpd-refactor-v6-1-cf3ab488dd7b@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dp/dp_reg.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_reg.h b/drivers/gpu/drm/msm/dp/dp_reg.h
index 176a503ece9c04..92c69864ad7228 100644
--- a/drivers/gpu/drm/msm/dp/dp_reg.h
+++ b/drivers/gpu/drm/msm/dp/dp_reg.h
@@ -32,8 +32,8 @@
#define DP_DP_IRQ_HPD_INT_ACK (0x00000002)
#define DP_DP_HPD_REPLUG_INT_ACK (0x00000004)
#define DP_DP_HPD_UNPLUG_INT_ACK (0x00000008)
-#define DP_DP_HPD_STATE_STATUS_BITS_MASK (0x0000000F)
-#define DP_DP_HPD_STATE_STATUS_BITS_SHIFT (0x1C)
+#define DP_DP_HPD_STATE_STATUS_BITS_MASK (0x00000007)
+#define DP_DP_HPD_STATE_STATUS_BITS_SHIFT (0x1D)
#define REG_DP_DP_HPD_INT_MASK (0x0000000C)
#define DP_DP_HPD_PLUG_INT_MASK (0x00000001)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 216/699] drm/msm/dp: Fix the ISR_* enum values
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 215/699] drm/msm/dp: fix HPD state status bit shift value Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 217/699] media: qcom: venus: drop extra padding in NV12 raw size calculation Greg Kroah-Hartman
` (486 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jessica Zhang, Konrad Dybcio,
Dmitry Baryshkov, Sasha Levin, Val Packett, Yongxing Mou
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
[ Upstream commit 3fbfdc3b1d48cc115a86953e5df0c76cd2efc42b ]
The ISR_HPD_* enum should represent values that can be read from the
REG_DP_DP_HPD_INT_STATUS register. Swap ISR_HPD_IO_GLITCH_COUNT and
ISR_HPD_REPLUG_COUNT to map them correctly to register values.
While we are at it, correct the spelling for ISR_HPD_REPLUG_COUNT.
Fixes: 8ede2ecc3e5e ("drm/msm/dp: Add DP compliance tests on Snapdragon Chipsets")
Signed-off-by: Jessica Zhang <jessica.zhang@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Tested-by: Val Packett <val@packett.cool> # x1e80100-dell-latitude-7455
Tested-by: Yongxing Mou <yongxing.mou@oss.qualcomm.com> # Hamoa IOT EVK, QCS8300 Ride
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/727602/
Link: https://lore.kernel.org/r/20260524-hpd-refactor-v6-2-cf3ab488dd7b@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dp/dp_display.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 4da8cea76a1159..89010b7a6a5414 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -34,9 +34,9 @@ enum {
ISR_DISCONNECTED,
ISR_CONNECT_PENDING,
ISR_CONNECTED,
- ISR_HPD_REPLUG_COUNT,
+ ISR_HPD_IO_GLITCH_COUNT,
ISR_IRQ_HPD_PULSE_COUNT,
- ISR_HPD_LO_GLITH_COUNT,
+ ISR_HPD_REPLUG_COUNT,
};
/* event thread connection state */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 217/699] media: qcom: venus: drop extra padding in NV12 raw size calculation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 216/699] drm/msm/dp: Fix the ISR_* enum values Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 218/699] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback Greg Kroah-Hartman
` (485 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Renjiang Han, Dikshita Agarwal,
Bryan ODonoghue, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Renjiang Han <renjiang.han@oss.qualcomm.com>
[ Upstream commit e1c9adabb268cc5d56723b7df1da49e59070f309 ]
get_framesize_raw_nv12() currently adds SZ_4K to the UV plane size and an
additional SZ_8K to the total buffer size. This inflates the calculated
sizeimage and leads userspace to over-allocate buffers without a clear
requirement.
Remove the extra SZ_4K/SZ_8K padding and compute the NV12 size as the sum
of Y and UV planes, keeping the final ALIGN(size, SZ_4K) intact.
Fixes: e1cb72de702ad ("media: venus: helpers: move frame size calculations on common place")
Signed-off-by: Renjiang Han <renjiang.han@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/qcom/venus/helpers.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
index dcf9fc0da1ce42..d590c845ea2675 100644
--- a/drivers/media/platform/qcom/venus/helpers.c
+++ b/drivers/media/platform/qcom/venus/helpers.c
@@ -834,8 +834,8 @@ static u32 get_framesize_raw_nv12(u32 width, u32 height)
uv_sclines = ALIGN(((height + 1) >> 1), 16);
y_plane = y_stride * y_sclines;
- uv_plane = uv_stride * uv_sclines + SZ_4K;
- size = y_plane + uv_plane + SZ_8K;
+ uv_plane = uv_stride * uv_sclines;
+ size = y_plane + uv_plane;
return ALIGN(size, SZ_4K);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 218/699] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 217/699] media: qcom: venus: drop extra padding in NV12 raw size calculation Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 219/699] ARM: imx3: Fix CCM node reference leak Greg Kroah-Hartman
` (484 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Baokun Li, Jan Kara,
Theodore Tso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit d99748ef1695ce17eaf51c64b7a06952fa7cddab ]
In EXT4_GOING_FLAGS_LOGFLUSH mode, the EXT4_FLAGS_SHUTDOWN flag was set
before calling ext4_force_commit(). This caused ordered-mode data
writeback (triggered by journal commit) to fail with -EIO, since
ext4_do_writepages() checks for the shutdown flag. The journal would
then be aborted prematurely before the commit could succeed.
Fix this by calling ext4_force_commit() first, then setting the
shutdown flag, so that pending data can be written back correctly.
Note that moving ext4_force_commit() before setting the shutdown flag
creates a small window in which new writes may occur and generate new
journal transactions. When the journal is subsequently aborted, the
new transactions will not be able to write to disk. This is intentional
because LOGFLUSH's semantics are to flush pre-existing journal entries
before shutdown, not to guarantee atomicity for writes that race with
the ioctl.
Fixes: 783d94854499 ("ext4: add EXT4_IOC_GOINGDOWN ioctl")
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20260424104201.1930823-1-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/ioctl.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index b6da12b4c8a82c..0d1c69c5a088e7 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -638,11 +638,17 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg)
thaw_bdev(sb->s_bdev, sb);
break;
case EXT4_GOING_FLAGS_LOGFLUSH:
+ /*
+ * Call ext4_force_commit() before setting EXT4_FLAGS_SHUTDOWN.
+ * This is because in data=ordered mode, journal commit
+ * triggers data writeback which fails if shutdown is already
+ * set, causing the journal to be aborted prematurely before
+ * the commit succeeds.
+ */
+ (void) ext4_force_commit(sb);
set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags);
- if (sbi->s_journal && !is_journal_aborted(sbi->s_journal)) {
- (void) ext4_force_commit(sb);
+ if (sbi->s_journal && !is_journal_aborted(sbi->s_journal))
jbd2_journal_abort(sbi->s_journal, -ESHUTDOWN);
- }
break;
case EXT4_GOING_FLAGS_NOLOGFLUSH:
set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 219/699] ARM: imx3: Fix CCM node reference leak
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 218/699] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 220/699] ARM: imx31: Fix IIM mapping leak in revision check Greg Kroah-Hartman
` (483 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Frank Li, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 36d46348eb5fc4bc505cd2290ddd70c25fbe6bb3 ]
of_find_compatible_node() returns a referenced device node. The i.MX31
and i.MX35 early init paths use the node to map the CCM registers with
of_iomap(), but never drop the node reference.
Release the node after the mapping is created.
Fixes: 2cf98d12958c ("ARM: imx3: Retrieve the CCM base address from devicetree")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/mm-imx3.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm/mach-imx/mm-imx3.c b/arch/arm/mach-imx/mm-imx3.c
index 5056438e5b4276..02d056ff73e63c 100644
--- a/arch/arm/mach-imx/mm-imx3.c
+++ b/arch/arm/mach-imx/mm-imx3.c
@@ -107,6 +107,7 @@ void __init imx31_init_early(void)
arm_pm_idle = imx31_idle;
np = of_find_compatible_node(NULL, NULL, "fsl,imx31-ccm");
mx3_ccm_base = of_iomap(np, 0);
+ of_node_put(np);
BUG_ON(!mx3_ccm_base);
}
@@ -156,6 +157,7 @@ void __init imx35_init_early(void)
arch_ioremap_caller = imx3_ioremap_caller;
np = of_find_compatible_node(NULL, NULL, "fsl,imx35-ccm");
mx3_ccm_base = of_iomap(np, 0);
+ of_node_put(np);
BUG_ON(!mx3_ccm_base);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 220/699] ARM: imx31: Fix IIM mapping leak in revision check
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 219/699] ARM: imx3: Fix CCM node reference leak Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 221/699] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" Greg Kroah-Hartman
` (482 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuho Choi, Frank Li, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit ccb4b54b8ecf1ebafef96d538cd6c5c8455bb390 ]
mx31_read_cpu_rev() maps the IIM registers with of_iomap() to read the
silicon revision, but returns without unmapping the MMIO mapping.
Keep the normalized revision value in a local variable and route the
return path through iounmap() after the revision register has been read.
Fixes: 3172225d45bd ("ARM: imx31: Retrieve the IIM base address from devicetree")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-imx/cpu-imx31.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mach-imx/cpu-imx31.c b/arch/arm/mach-imx/cpu-imx31.c
index 35c544924e5095..e81ef9e36a1fab 100644
--- a/arch/arm/mach-imx/cpu-imx31.c
+++ b/arch/arm/mach-imx/cpu-imx31.c
@@ -36,6 +36,7 @@ static int mx31_read_cpu_rev(void)
void __iomem *iim_base;
struct device_node *np;
u32 i, srev;
+ int rev = IMX_CHIP_REVISION_UNKNOWN;
np = of_find_compatible_node(NULL, NULL, "fsl,imx31-iim");
iim_base = of_iomap(np, 0);
@@ -48,13 +49,17 @@ static int mx31_read_cpu_rev(void)
for (i = 0; i < ARRAY_SIZE(mx31_cpu_type); i++)
if (srev == mx31_cpu_type[i].srev) {
+ rev = mx31_cpu_type[i].rev;
imx_print_silicon_rev(mx31_cpu_type[i].name,
mx31_cpu_type[i].rev);
- return mx31_cpu_type[i].rev;
+ goto out;
}
imx_print_silicon_rev("i.MX31", IMX_CHIP_REVISION_UNKNOWN);
- return IMX_CHIP_REVISION_UNKNOWN;
+
+out:
+ iounmap(iim_base);
+ return rev;
}
int mx31_revision(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 221/699] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 220/699] ARM: imx31: Fix IIM mapping leak in revision check Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 222/699] scsi: pm8001: Fix error code in non_fatal_log_show() Greg Kroah-Hartman
` (481 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Wilck, Don Brace, storagedev,
Ranjan Kumar, Sathya Prakash Veerichetty, Kashyap Desai,
Sumit Saxena, mpi3mr-linuxdrv.pdl, MPT-FusionLinux.pdl, Yihang Li,
Christoph Hellwig, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <martin.wilck@suse.com>
[ Upstream commit 8c292e89bd831c8a13e92f3429ef66bbe0b83677 ]
This reverts commit 37c4e72b0651e7697eb338cd1fb09feef472cc1a.
Said commit causes excessive resource usage and even system freeze with
some controllers, e.g. smartpqi and hisi_sas. The justification provided
by the patch authors [1] was supporting a special mode of the mpi3mr and
mpt3sas, so-called "Tri-mode", in which NVMe drives are exposed as SCSI
devices on a separate channel. While that's useful for these drivers, it
seems wrong to cause major breakage for other drivers for the sake of
this feature.
[1] https://lore.kernel.org/linux-scsi/CAFdVvOwjy+2ORJ6uJkspiLTPF05481U7gcS4QohFOFGPqAs8ig@mail.gmail.com/
Fixes: 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans")
Signed-off-by: Martin Wilck <martin.wilck@suse.com>
Cc: Don Brace <don.brace@microchip.com>
Cc: storagedev@microchip.com
Cc: Ranjan Kumar <ranjan.kumar@broadcom.com>
Cc: Sathya Prakash Veerichetty <sathya.prakash@broadcom.com>
Cc: Kashyap Desai <kashyap.desai@broadcom.com>
Cc: Sumit Saxena <sumit.saxena@broadcom.com>
Cc: mpi3mr-linuxdrv.pdl@broadcom.com
Cc: MPT-FusionLinux.pdl@broadcom.com
Cc: Yihang Li <liyihang9@h-partners.c>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260513174236.430465-3-mwilck@suse.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_scan.c | 2 +-
drivers/scsi/scsi_transport_sas.c | 60 +++++++------------------------
2 files changed, 13 insertions(+), 49 deletions(-)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 1dea44c1c568d3..e8703b043805e5 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -1686,7 +1686,7 @@ int scsi_scan_host_selected(struct Scsi_Host *shost, unsigned int channel,
return 0;
}
-EXPORT_SYMBOL(scsi_scan_host_selected);
+
static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
{
struct scsi_device *sdev;
diff --git a/drivers/scsi/scsi_transport_sas.c b/drivers/scsi/scsi_transport_sas.c
index 8766ec93652ca0..c6256fdc24b10c 100644
--- a/drivers/scsi/scsi_transport_sas.c
+++ b/drivers/scsi/scsi_transport_sas.c
@@ -41,8 +41,6 @@
#include <scsi/scsi_transport_sas.h>
#include "scsi_sas_internal.h"
-#include "scsi_priv.h"
-
struct sas_host_attrs {
struct list_head rphy_list;
struct mutex lock;
@@ -1654,22 +1652,6 @@ int scsi_is_sas_rphy(const struct device *dev)
}
EXPORT_SYMBOL(scsi_is_sas_rphy);
-static void scan_channel_zero(struct Scsi_Host *shost, uint id, u64 lun)
-{
- struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
- struct sas_rphy *rphy;
-
- list_for_each_entry(rphy, &sas_host->rphy_list, list) {
- if (rphy->identify.device_type != SAS_END_DEVICE ||
- rphy->scsi_target_id == -1)
- continue;
-
- if (id == SCAN_WILD_CARD || id == rphy->scsi_target_id) {
- scsi_scan_target(&rphy->dev, 0, rphy->scsi_target_id,
- lun, SCSI_SCAN_MANUAL);
- }
- }
-}
/*
* SCSI scan helper
@@ -1679,41 +1661,23 @@ static int sas_user_scan(struct Scsi_Host *shost, uint channel,
uint id, u64 lun)
{
struct sas_host_attrs *sas_host = to_sas_host_attrs(shost);
- int res = 0;
- int i;
-
- switch (channel) {
- case 0:
- mutex_lock(&sas_host->lock);
- scan_channel_zero(shost, id, lun);
- mutex_unlock(&sas_host->lock);
- break;
-
- case SCAN_WILD_CARD:
- mutex_lock(&sas_host->lock);
- scan_channel_zero(shost, id, lun);
- mutex_unlock(&sas_host->lock);
+ struct sas_rphy *rphy;
- for (i = 1; i <= shost->max_channel; i++) {
- res = scsi_scan_host_selected(shost, i, id, lun,
- SCSI_SCAN_MANUAL);
- if (res)
- goto exit_scan;
- }
- break;
+ mutex_lock(&sas_host->lock);
+ list_for_each_entry(rphy, &sas_host->rphy_list, list) {
+ if (rphy->identify.device_type != SAS_END_DEVICE ||
+ rphy->scsi_target_id == -1)
+ continue;
- default:
- if (channel <= shost->max_channel) {
- res = scsi_scan_host_selected(shost, channel, id, lun,
- SCSI_SCAN_MANUAL);
- } else {
- res = -EINVAL;
+ if ((channel == SCAN_WILD_CARD || channel == 0) &&
+ (id == SCAN_WILD_CARD || id == rphy->scsi_target_id)) {
+ scsi_scan_target(&rphy->dev, 0, rphy->scsi_target_id,
+ lun, SCSI_SCAN_MANUAL);
}
- break;
}
+ mutex_unlock(&sas_host->lock);
-exit_scan:
- return res;
+ return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 222/699] scsi: pm8001: Fix error code in non_fatal_log_show()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 221/699] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 223/699] mm/fake-numa: fix under-allocation detection in uniform split Greg Kroah-Hartman
` (480 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Jack Wang,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 1b6f03b7ae9ee27054c55bb55a69d05555a78516 ]
The non_fatal_log_show() function is supposed to return negative error
codes on failure. But because the error codes are saved in a u32 and
then cast to signed long, they end up being high positive values instead
of negative. Remove the intermediary u32 variable to fix this bug.
Fixes: dba2cc03b9db ("scsi: pm80xx: sysfs attribute for non fatal dump")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Link: https://patch.msgid.link/ahs-bEsBJH0KhnsX@stanley.mountain
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_ctl.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index d5d5965fa7a0e9..467f77664efb90 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -588,10 +588,7 @@ static DEVICE_ATTR(fatal_log, S_IRUGO, pm8001_ctl_fatal_log_show, NULL);
static ssize_t non_fatal_log_show(struct device *cdev,
struct device_attribute *attr, char *buf)
{
- u32 count;
-
- count = pm80xx_get_non_fatal_dump(cdev, attr, buf);
- return count;
+ return pm80xx_get_non_fatal_dump(cdev, attr, buf);
}
static DEVICE_ATTR_RO(non_fatal_log);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 223/699] mm/fake-numa: fix under-allocation detection in uniform split
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 222/699] scsi: pm8001: Fix error code in non_fatal_log_show() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 224/699] lib/test_meminit: use && for bools Greg Kroah-Hartman
` (479 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sang-Heon Jeon, Donghyeon Lee,
Munhui Chae, Mike Rapoport (Microsoft), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sang-Heon Jeon <ekffu200098@gmail.com>
[ Upstream commit 3a3fc1dfd6a958615ebaab8fb251e89fc2b3f2f2 ]
When splitting NUMA node uniformly, split_nodes_size_interleave_uniform()
returns the next absolute node ID, not the number of nodes created.
The existing under-allocation detection logic compares next absolute node
ID (ret) and request count (n), which only works when nid starts at 0.
For example, on a system with 2 physical NUMA nodes (node 0: 2GB, node
1: 128MB) and numa=fake=8U, 8 fake nodes are successfully created from
node 0 and split_nodes_size_interleave_uniform() returns 8. For node 1,
fake node nid starts at 8, but only 4 fake nodes are created due to
current FAKE_NODE_MIN_SIZE being 32MB, and
split_nodes_size_interleave_uniform() returns 12. By existing
under-allocation detection logic, "ret < n" (12 < 8) is false, so the
under-allocation will not be detected.
Fix under-allocation detection logic to compare the number of actually
created nodes (ret - nid) against the request count (n). Also skip
under-allocation detection logic for memoryless physical nodes where no
fake nodes are created.
Also, fix the outdated comment describing
split_nodes_size_interleave_uniform() to match the actual return value.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Reported-by: Donghyeon Lee <asd142513@gmail.com>
Reported-by: Munhui Chae <mochae@student.42seoul.kr>
Fixes: cc9aec03e58f ("x86/numa_emulation: Introduce uniform split capability") # 4.19
Link: https://patch.msgid.link/20260417135805.1758378-1-ekffu200098@gmail.com
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/mm/numa_emulation.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
index 87d77cc52f86e0..de4dc033de6437 100644
--- a/arch/x86/mm/numa_emulation.c
+++ b/arch/x86/mm/numa_emulation.c
@@ -211,7 +211,7 @@ static u64 uniform_size(u64 max_addr, u64 base, u64 hole, int nr_nodes)
* Sets up fake nodes of `size' interleaved over physical nodes ranging from
* `addr' to `max_addr'.
*
- * Returns zero on success or negative on error.
+ * Returns node ID of the next node on success or negative error code.
*/
static int __init split_nodes_size_interleave_uniform(struct numa_meminfo *ei,
struct numa_meminfo *pi,
@@ -395,7 +395,7 @@ void __init numa_emulation(struct numa_meminfo *numa_meminfo, int numa_dist_cnt)
if (strchr(emu_cmdline, 'U')) {
nodemask_t physnode_mask = numa_nodes_parsed;
unsigned long n;
- int nid = 0;
+ int nid = 0, nr_created;
n = simple_strtoul(emu_cmdline, &emu_cmdline, 0);
ret = -1;
@@ -413,9 +413,18 @@ void __init numa_emulation(struct numa_meminfo *numa_meminfo, int numa_dist_cnt)
n, &pi.blk[0], nid);
if (ret < 0)
break;
- if (ret < n) {
+
+ /*
+ * If no memory was found for this physical node,
+ * skip the under-allocation check.
+ */
+ if (ret == nid)
+ continue;
+
+ nr_created = ret - nid;
+ if (nr_created < n) {
pr_info("%s: phys: %d only got %d of %ld nodes, failing\n",
- __func__, i, ret, n);
+ __func__, i, nr_created, n);
ret = -1;
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 224/699] lib/test_meminit: use && for bools
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 223/699] mm/fake-numa: fix under-allocation detection in uniform split Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 225/699] bpftool: Use libbpf error code for flow dissector query Greg Kroah-Hartman
` (478 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Potapenko, Dan Carpenter,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
[ Upstream commit 8e0c2085c978ed6d9764d79fc785920360096f21 ]
As pointed out by Dan Carpenter, test_kmemcache() was using a bitwise AND
on two bools instead of a boolean AND. Fix this for the sake of code
cleanliness.
Link: https://lore.kernel.org/20260504100637.1535762-1-glider@google.com
Fixes: 5015a300a522 ("lib: introduce test_meminit module")
Signed-off-by: Alexander Potapenko <glider@google.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/kernel-janitors/afOcIan1ap9kD26M@stanley.mountain/
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/test_meminit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/test_meminit.c b/lib/test_meminit.c
index 0f1a3bd09b7b5c..9e031f4c39b64f 100644
--- a/lib/test_meminit.c
+++ b/lib/test_meminit.c
@@ -358,7 +358,7 @@ static int __init test_kmemcache(int *total_failures)
ctor = flags & 1;
rcu = flags & 2;
zero = flags & 4;
- if (ctor & zero)
+ if (ctor && zero)
continue;
num_tests += do_kmem_cache_size(size, ctor, rcu, zero,
&failures);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 225/699] bpftool: Use libbpf error code for flow dissector query
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 224/699] lib/test_meminit: use && for bools Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 226/699] perf/x86/amd/core: Always use the NMI latency mitigation Greg Kroah-Hartman
` (477 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Woojin Ji, Andrii Nakryiko,
Leon Hwang, Yonghong Song, Quentin Monnet, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Woojin Ji <random6.xyz@gmail.com>
[ Upstream commit 8a7f2bff2165e53595d1e91c160b340f978c0ab7 ]
bpf_prog_query() returns a negative errno on failure.
query_flow_dissector() currently closes the namespace fd and then reads
errno to decide whether -EINVAL means that the running kernel does not
support flow dissector queries.
That errno check controls behavior, not just diagnostics: -EINVAL is
handled as a non-fatal old-kernel case, while any other error makes bpftool
net fail.
The namespace fd is opened read-only, so close() is not expected to
commonly fail in normal use. Still, the BPF_PROG_QUERY error is already
available in err, and reading errno after an intervening close() is
fragile. If close() does change errno, the compatibility branch may be
based on close()'s error instead of the BPF_PROG_QUERY result.
This was reproduced with an LD_PRELOAD fault injector that forced
BPF_PROG_QUERY for BPF_FLOW_DISSECTOR to fail with EINVAL and then
forced close() on the netns fd to fail with EIO. The unpatched bpftool
reported "can't query prog: Input/output error". With this change, the
same injected failure is handled as the intended non-fatal EINVAL
compatibility case.
Use the libbpf-returned error code instead. Keep the existing errno reset
in the non-fatal path to preserve batch mode behavior. The success path
is unchanged.
Fixes: 7f0c57fec80f ("bpftool: show flow_dissector attachment status")
Signed-off-by: Woojin Ji <random6.xyz@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Leon Hwang <leon.hwang@linux.dev>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/bpf/20260603003339.33791-1-random6.xyz@gmail.com
Assisted-by: ChatGPT:gpt-5.5
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/net.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
index 7f0421713e1cda..211eeead78bd1c 100644
--- a/tools/bpf/bpftool/net.c
+++ b/tools/bpf/bpftool/net.c
@@ -503,14 +503,14 @@ static int query_flow_dissector(struct bpf_attach_info *attach_info)
&attach_flags, prog_ids, &prog_cnt);
close(fd);
if (err) {
- if (errno == EINVAL) {
+ if (err == -EINVAL) {
/* Older kernel's don't support querying
* flow dissector programs.
*/
errno = 0;
return 0;
}
- p_err("can't query prog: %s", strerror(errno));
+ p_err("can't query prog: %s", strerror(-err));
return -1;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 226/699] perf/x86/amd/core: Always use the NMI latency mitigation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 225/699] bpftool: Use libbpf error code for flow dissector query Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 227/699] ocfs2: rebase copied fsdlm LVB pointers in locking_state Greg Kroah-Hartman
` (476 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sandipan Das, Peter Zijlstra (Intel),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan.das@amd.com>
[ Upstream commit 73a4c02f94a98d94480c3e5c81450215a4da05ba ]
Commit df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation
to use a timestamp") fixed handling of late-arriving NMIs but limited
the mitigation to processors having X86_FEATURE_PERFCTR_CORE. However,
it is unclear if processors without this feature are also affected.
When Mediated vPMU is enabled on affected hardware, it is also possible
to bypass the fix inside KVM guests if X86_FEATURE_PERFCTR_CORE is
removed from the guest CPUID (e.g. using "-cpu host,-perfctr-core" with
QEMU). Hence, use the mitigation at all times.
Fixes: df4d29732fda ("perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp")
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/29a3c970da289ab8f24282933bdb36545c0403e8.1780325517.git.sandipan.das@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/amd/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
index afc955340f81c4..1698cb2e8c0a34 100644
--- a/arch/x86/events/amd/core.c
+++ b/arch/x86/events/amd/core.c
@@ -943,12 +943,12 @@ static int __init amd_core_pmu_init(void)
u64 even_ctr_mask = 0ULL;
int i;
- if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE))
- return 0;
-
/* Avoid calculating the value each time in the NMI handler */
perf_nmi_window = msecs_to_jiffies(100);
+ if (!boot_cpu_has(X86_FEATURE_PERFCTR_CORE))
+ return 0;
+
/*
* If core performance counter extensions exists, we must use
* MSR_F15H_PERF_CTL/MSR_F15H_PERF_CTR msrs. See also
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 227/699] ocfs2: rebase copied fsdlm LVB pointers in locking_state
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 226/699] perf/x86/amd/core: Always use the NMI latency mitigation Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 228/699] ocfs2: fix buffer head management in ocfs2_read_blocks() Greg Kroah-Hartman
` (475 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Cen, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit 93612d48fa42b3d1a637eb9279e15281c611c000 ]
The locking_state debugfs iterator snapshots struct ocfs2_lock_res by
value under ocfs2_dlm_tracking_lock and later formats that copy in
ocfs2_dlm_seq_show(). That is fine for the inline fields, but the
userspace fsdlm stack stores the LVB through lksb_fsdlm.sb_lvbptr. Once
the iterator drops the tracking lock, a copied non-NULL sb_lvbptr still
points into the original lockres owner, so teardown can free that
container before the debugfs dump walks the raw LVB bytes.
Rebase the copied sb_lvbptr to the copied l_lksb before dumping the raw
LVB. The seq snapshot already carries the inline LVB storage reserved in
struct ocfs2_dlm_lksb, so the debugfs reader can dump the copied bytes
without borrowing the original lockres lifetime.
The buggy scenario involves two paths, with each column showing the order
within that path:
locking_state reader: lockres teardown:
1. ocfs2_dlm_seq_start()/next() 1. file release or another owner
copies struct ocfs2_lock_res teardown reaches
2. ocfs2_dlm_seq_show() formats ocfs2_lock_res_free()
the copied row 2. the lockres is removed from the
3. ocfs2_dlm_lvb() follows the tracking list
copied sb_lvbptr 3. the owner frees the original
lockres container
Validation reproduced this kernel report:
KASAN slab-use-after-free in ocfs2_dlm_seq_show+0x1bd/0x430
RIP: 0033:0x7f8ec4b1e29d
The buggy address belongs to the object at ffff88810a1e0800 which belongs
to the cache kmalloc-1k of size 1024
The buggy address is located 368 bytes inside of freed 1024-byte region
[ffff88810a1e0800, ffff88810a1e0c00)
Read of size 1
Call trace:
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
ocfs2_dlm_seq_show+0x1bd/0x430 (fs/ocfs2/dlmglue.c:3137)
srso_alias_return_thunk+0x5/0xfbef5
__virt_addr_valid+0x19f/0x330
kasan_report+0xe0/0x110
seq_read_iter+0x29d/0x790
seq_read+0x20a/0x280
find_held_lock+0x2b/0x80
rcu_read_unlock+0x18/0x70
full_proxy_read+0x9e/0xd0
vfs_read+0x12c/0x590
ksys_read+0xd2/0x170
do_user_addr_fault+0x65a/0x890
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
ocfs2_file_open+0x13e/0x300
do_dentry_open+0x233/0x7f0
vfs_open+0x5a/0x1b0
path_openat+0x66d/0x1540
do_file_open+0x186/0x2b0
do_sys_openat2+0xce/0x150
__x64_sys_openat+0xd0/0x140
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task stack:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x313/0x590
ocfs2_file_release+0x138/0x260
__fput+0x1df/0x4b0
fput_close_sync+0xd2/0x170
__x64_sys_close+0x55/0x90
do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Link: https://lore.kernel.org/20260525041726.4112882-1-rollkingzzc@gmail.com
Fixes: cf4d8d75d8ab ("ocfs2: add fsdlm to stackglue")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dlmglue.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index 345dbe901398cc..14b471fc3de4d3 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -3126,6 +3126,22 @@ static void *ocfs2_dlm_seq_next(struct seq_file *m, void *v, loff_t *pos)
* - Add last pr/ex unlock times and first lock wait time in usecs
*/
#define OCFS2_DLM_DEBUG_STR_VERSION 4
+
+/*
+ * The debug iterator snapshots lockres by value, so a userspace-stack LVB
+ * pointer copied from the original lockres must be rebased to the copied
+ * lksb before the dump walks the raw bytes.
+ */
+static void ocfs2_dlm_seq_rebase_lvb(struct ocfs2_lock_res *lockres)
+{
+ if (!ocfs2_stack_supports_plocks())
+ return;
+
+ if (lockres->l_lksb.lksb_fsdlm.sb_lvbptr)
+ lockres->l_lksb.lksb_fsdlm.sb_lvbptr =
+ (char *)&lockres->l_lksb + sizeof(struct dlm_lksb);
+}
+
static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
{
int i;
@@ -3186,6 +3202,7 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
lockres->l_blocking);
/* Dump the raw LVB */
+ ocfs2_dlm_seq_rebase_lvb(lockres);
lvb = ocfs2_dlm_lvb(&lockres->l_lksb);
for(i = 0; i < DLM_LVB_LEN; i++)
seq_printf(m, "0x%x\t", lvb[i]);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 228/699] ocfs2: fix buffer head management in ocfs2_read_blocks()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 227/699] ocfs2: rebase copied fsdlm LVB pointers in locking_state Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 229/699] ocfs2: reject FITRIM ranges shorter than a cluster Greg Kroah-Hartman
` (474 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov,
syzbot+caacd220635a9cc3bac9, Joseph Qi, Mark Fasheh, Joel Becker,
Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao, Andrew Morton,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 6371a07148ee979af22a9d6f4c277462953a9a4a ]
In ocfs2_read_blocks(), caller should't assume that buffer head returned
by 'sb_getblk()' is exclusively owned and so 'put_bh()' always drops
b_count from 1 to 0. If it is not so, buffer head remains on hold and
likely to be returned by the next call to 'sb_getblk()' unchanged - that
is, with BH_Uptodate bit set even if it has failed validation previously,
thus allowing to insert that buffer head into OCFS2 metadata cache and
submit it to upper layers. To avoid such a scenario, BH_Uptodate should
be cleared immediately after 'validate()' callback has detected some data
inconsistency.
Link: https://lore.kernel.org/20260529094128.494293-1-dmantipov@yandex.ru
Fixes: cf76c78595ca ("ocfs2: don't put and assigning null to bh allocated outside")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reported-by: syzbot+caacd220635a9cc3bac9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=caacd220635a9cc3bac9
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/buffer_head_io.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
index c8a6e3480be1cb..86cd20ff9e44e2 100644
--- a/fs/ocfs2/buffer_head_io.c
+++ b/fs/ocfs2/buffer_head_io.c
@@ -352,8 +352,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
wait_on_buffer(bh);
put_bh(bh);
bhs[i] = NULL;
- } else if (bh && buffer_uptodate(bh)) {
- clear_buffer_uptodate(bh);
}
continue;
}
@@ -382,8 +380,11 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
BUG_ON(buffer_jbd(bh));
clear_buffer_needs_validate(bh);
status = validate(sb, bh);
- if (status)
+ if (status) {
+ if (buffer_uptodate(bh))
+ clear_buffer_uptodate(bh);
goto read_failure;
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 229/699] ocfs2: reject FITRIM ranges shorter than a cluster
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 228/699] ocfs2: fix buffer head management in ocfs2_read_blocks() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 230/699] ocfs2/dlm: require a ref for locking_state debugfs open Greg Kroah-Hartman
` (473 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Cen, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit ca1afd88f5eaaff9168e1466e5401385edf59543 ]
ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its
too-short range validation only checks sb->s_blocksize.
On filesystems with a cluster size larger than the block size, a FITRIM
range that is at least one block but shorter than one cluster is accepted
and shifted down to len == 0. The later start + len - 1 and len -= ...
arithmetic then underflows and can drive trimming past the requested
range.
Reject ranges shorter than s_clustersize instead. That preserves the
existing -EINVAL behavior for requests that cannot discard even one
allocation unit and keeps zero-cluster trims out of the group walk.
Link: https://lore.kernel.org/20260528151247.361854-1-rollkingzzc@gmail.com
Fixes: aa89762c5480 ("ocfs2: return EINVAL if the given range to discard is less than block size")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index 82593871c4e1fd..a1c50a44961a6f 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -7541,7 +7541,7 @@ int ocfs2_trim_mainbm(struct super_block *sb, struct fstrim_range *range)
len = range->len >> osb->s_clustersize_bits;
minlen = range->minlen >> osb->s_clustersize_bits;
- if (minlen >= osb->bitmap_cpg || range->len < sb->s_blocksize)
+ if (minlen >= osb->bitmap_cpg || range->len < osb->s_clustersize)
return -EINVAL;
trace_ocfs2_trim_mainbm(start, len, minlen);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 230/699] ocfs2/dlm: require a ref for locking_state debugfs open
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 229/699] ocfs2: reject FITRIM ranges shorter than a cluster Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 231/699] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() Greg Kroah-Hartman
` (472 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Cen, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Cen <rollkingzzc@gmail.com>
[ Upstream commit 03ad858ce8064861ea580021976dc19b7aabb549 ]
debug_lockres_open() copies inode->i_private into struct debug_lockres and
debug_lockres_release() later drops that pointer with dlm_put(). That
only works if open successfully pins the struct dlm_ctxt.
Today open calls dlm_grab(dlm) but ignores its return value. Once the
last domain unregister has removed the context from dlm_domains,
dlm_grab() returns NULL, yet open still stores the raw pointer and returns
success. The later release path is outside the debugfs removal barrier,
so it can call dlm_put() after dlm_free_ctxt_mem() has freed the context.
KASAN reports this as a slab-use-after-free in dlm_put() called from
debug_lockres_release().
Fail the open when dlm_grab() cannot acquire the reference and unwind the
seq_file private state before returning. That keeps locking_state from
handing out a file descriptor whose release path does not own the
dlm_ctxt.
The buggy scenario involves two paths, with each column showing the order
within that path:
locking_state debugfs open: last domain unregister:
1. debug_lockres_open() reads 1. dlm_unregister_domain() calls
inode->i_private. dlm_complete_dlm_shutdown().
2. debug_lockres_open() calls 2. shutdown removes the dlm_ctxt from
dlm_grab(dlm) and gets NULL. dlm_domains.
3. open still stores the raw dlm 3. final teardown reaches
pointer in dl->dl_ctxt and dlm_free_ctxt_mem() and frees it.
returns success.
4. debug_lockres_release() later
calls dlm_put(dl->dl_ctxt).
Validation reproduced this kernel report:
KASAN slab-use-after-free in dlm_put+0x82/0x200
RIP: 0033:0x7f4d349bc9e0
The buggy address belongs to the object at ffff888103a3c000 which belongs
to the cache kmalloc-2k of size 2048
The buggy address is located 816 bytes inside of freed 2048-byte region
[ffff888103a3c000, ffff888103a3c800)
Write of size 4
Call trace:
dump_stack_lvl+0x66/0xa0 (?:?)
print_report+0xd0/0x630 (?:?)
dlm_put+0x82/0x200 (?:?)
srso_alias_return_thunk+0x5/0xfbef5 (?:?)
__virt_addr_valid+0x188/0x2f0 (?:?)
kasan_report+0xe4/0x120 (?:?)
kasan_check_range+0x105/0x1b0 (?:?)
debug_lockres_release+0x53/0x80 (fs/ocfs2/dlm/dlmdebug.c:587)
dlm_put+0x9/0x200 (?:?)
debug_lockres_release+0x5c/0x80 (fs/ocfs2/dlm/dlmdebug.c:587)
full_proxy_release+0x67/0x90 (?:?)
__fput+0x1df/0x4b0 (?:?)
do_raw_spin_lock+0x10f/0x1b0 (?:?)
fput_close_sync+0xd2/0x170 (?:?)
__x64_sys_close+0x55/0x90 (?:?)
do_syscall_64+0x10c/0x640 (arch/x86/entry/syscall_64.c:87)
irqentry_exit+0xac/0x6e0 (?:?)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
Freed by task stack:
kasan_save_stack+0x33/0x60 (?:?)
kasan_save_track+0x14/0x30 (?:?)
kasan_save_free_info+0x3b/0x60 (?:?)
__kasan_slab_free+0x5f/0x80 (?:?)
kfree+0x30f/0x580 (?:?)
dlm_put+0x1ce/0x200 (?:?)
dlm_unregister_domain+0xf6/0xb30 (?:?)
o2cb_cluster_disconnect+0x6b/0x90 (?:?)
ocfs2_cluster_disconnect+0x41/0x70 (?:?)
ocfs2_dlm_shutdown+0x1c4/0x220 (?:?)
ocfs2_dismount_volume+0x38a/0x550 (?:?)
generic_shutdown_super+0xc3/0x220 (?:?)
kill_block_super+0x29/0x60 (?:?)
deactivate_locked_super+0x66/0xe0 (?:?)
cleanup_mnt+0x13d/0x210 (?:?)
task_work_run+0xfa/0x170 (?:?)
exit_to_user_mode_loop+0xd6/0x430 (?:?)
do_syscall_64+0x3cb/0x640 (arch/x86/entry/syscall_64.c:87)
entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)
Link: https://lore.kernel.org/20260531044714.1640172-1-rollkingzzc@gmail.com
Fixes: 4e3d24ed1a12 ("ocfs2/dlm: Dumps the lockres' into a debugfs file")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Zhang Cen <rollkingzzc@gmail.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/dlm/dlmdebug.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c
index 4b8b41d23e91d5..bdda2e6b4e731b 100644
--- a/fs/ocfs2/dlm/dlmdebug.c
+++ b/fs/ocfs2/dlm/dlmdebug.c
@@ -614,6 +614,7 @@ static int debug_lockres_open(struct inode *inode, struct file *file)
struct dlm_ctxt *dlm = inode->i_private;
struct debug_lockres *dl;
void *buf;
+ int status = -ENOMEM;
buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
if (!buf)
@@ -626,16 +627,23 @@ static int debug_lockres_open(struct inode *inode, struct file *file)
dl->dl_len = PAGE_SIZE;
dl->dl_buf = buf;
- dlm_grab(dlm);
- dl->dl_ctxt = dlm;
+ /* ->release uses dl_ctxt after open, so it needs a real pin. */
+ dl->dl_ctxt = dlm_grab(dlm);
+ if (!dl->dl_ctxt) {
+ status = -ENOENT;
+ goto bailseq;
+ }
return 0;
+bailseq:
+ seq_release_private(inode, file);
bailfree:
kfree(buf);
bail:
- mlog_errno(-ENOMEM);
- return -ENOMEM;
+ if (status != -ENOENT)
+ mlog_errno(status);
+ return status;
}
static int debug_lockres_release(struct inode *inode, struct file *file)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 231/699] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 230/699] ocfs2/dlm: require a ref for locking_state debugfs open Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 232/699] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures Greg Kroah-Hartman
` (471 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joseph Qi, Ginger, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@linux.alibaba.com>
[ Upstream commit 57dcfd9049d497c31151787a0696d59f0a98f8e6 ]
Move atomic_inc(&ocfs2_control_opened) and the handshake state update
inside ocfs2_control_lock to close a race window where
ocfs2_control_release() can observe ocfs2_control_opened dropping to zero
(resetting ocfs2_control_this_node and running_proto) while
ocfs2_control_install_private() is about to bump the counter and mark the
connection valid.
Link: https://lore.kernel.org/20260601121618.1263346-1-joseph.qi@linux.alibaba.com
Fixes: 3cfd4ab6b6b4 ("ocfs2: Add the local node id to the handshake.")
Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Reported-by: Ginger <ginger.jzllee@gmail.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/stack_user.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/fs/ocfs2/stack_user.c b/fs/ocfs2/stack_user.c
index c7a0625954c603..eebfee986b0595 100644
--- a/fs/ocfs2/stack_user.c
+++ b/fs/ocfs2/stack_user.c
@@ -328,18 +328,14 @@ static int ocfs2_control_install_private(struct file *file)
ocfs2_control_this_node = p->op_this_node;
running_proto.pv_major = p->op_proto.pv_major;
running_proto.pv_minor = p->op_proto.pv_minor;
- }
-
-out_unlock:
- mutex_unlock(&ocfs2_control_lock);
-
- if (!rc && set_p) {
- /* We set the global values successfully */
atomic_inc(&ocfs2_control_opened);
ocfs2_control_set_handshake_state(file,
OCFS2_CONTROL_HANDSHAKE_VALID);
}
+out_unlock:
+ mutex_unlock(&ocfs2_control_lock);
+
return rc;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 232/699] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 231/699] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 233/699] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock Greg Kroah-Hartman
` (470 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit a625c94144c9b66d32e1f374f909f38db46161c1 ]
The MSS calculation in nf_osf_match_one() manually shifts bytes to
construct a 16-bit value before passing it to ntohs().
This works on little-endian hosts but it does not work on big-endian as
the bytes are being always shifted and set in the same way for all
architectures.
Use get_unaligned_be16() to fix this on big-endian systems. It also
simplifies the code.
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_osf.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index eee87713420dc8..96a5bf099b7691 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -95,11 +95,7 @@ static bool nf_osf_match_one(const struct sk_buff *skb,
switch (*optp) {
case OSFOPT_MSS:
- mss = optp[3];
- mss <<= 8;
- mss |= optp[2];
-
- mss = ntohs((__force __be16)mss);
+ mss = get_unaligned_be16(&optp[2]);
break;
case OSFOPT_TS:
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 233/699] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 232/699] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 234/699] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp Greg Kroah-Hartman
` (469 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fernando Fernandez Mancera,
Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 9e37388b8070afe73d4ab2d973b28593ed65f3ad ]
nf_ct_seqadj_init() is called without holding the ct lock. This can race
with nf_ct_seq_adjust() when a connection is in CLOSE state due to an
RST or connection reopening. In addition for SYN_RECV state, concurrent
processing of packets can trigger nf_ct_seq_adjust() too. These
situations create a read/write data race.
As synproxy is the only user of nf_ct_seqadj_init() at the moment, fix
this by holding ct->lock inside nf_ct_seqadj_init() until all is done.
Fixes: 48b1de4c110a ("netfilter: add SYNPROXY core/target")
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_seqadj.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 3066449f8bd8a3..bcb4adf9879dcf 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -17,12 +17,14 @@ int nf_ct_seqadj_init(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
if (off == 0)
return 0;
+ spin_lock_bh(&ct->lock);
set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
seqadj = nfct_seqadj(ct);
this_way = &seqadj->seq[dir];
this_way->offset_before = off;
this_way->offset_after = off;
+ spin_unlock_bh(&ct->lock);
return 0;
}
EXPORT_SYMBOL_GPL(nf_ct_seqadj_init);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 234/699] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 233/699] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 235/699] bpf: Update transport_header when encapsulating UDP tunnel in lwt Greg Kroah-Hartman
` (468 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit b0f02608fbcd607b5131cceb91fc0a035264e61c ]
For GRE flows, validate that the ct master helper (if any) is pptp
before calling nf_ct_gre_keymap_destroy(), so the helper data area
can be accessed safely. Note that only the pptp helper provides a
.destroy callback.
Fixes: e56894356f60 ("netfilter: conntrack: remove l4proto destroy hook")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_core.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index aea25823fbc14b..e2330c3456b039 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -585,9 +585,23 @@ static void destroy_gre_conntrack(struct nf_conn *ct)
{
#ifdef CONFIG_NF_CT_PROTO_GRE
struct nf_conn *master = ct->master;
+ struct nf_conn_help *help;
+
+ if (!master)
+ return;
+
+ help = nfct_help(master);
+ if (help) {
+ struct nf_conntrack_helper *helper;
- if (master)
- nf_ct_gre_keymap_destroy(master);
+ rcu_read_lock();
+ helper = rcu_dereference(help->helper);
+ /* Only pptp helper has a destroy callback. */
+ if (helper && helper->destroy)
+ nf_ct_gre_keymap_destroy(master);
+
+ rcu_read_unlock();
+ }
#endif
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 235/699] bpf: Update transport_header when encapsulating UDP tunnel in lwt
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 234/699] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 236/699] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication Greg Kroah-Hartman
` (467 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Hwang, Leon Hwang,
Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit 82d7d0adbc678064543e9d254864f6b4ea4a388c ]
Currently, bpf_lwt_push_ip_encap() does not update skb->transport_header.
When a driver, e.g. ice, reuses the stale skb->transport_header to
offload checksum computation to NIC hardware, VxLAN packets encapsulated
by bpf_lwt_push_encap() helper may be dropped due to incorrect checksum.
Update skb->transport_header in bpf_lwt_push_ip_encap() whenever the
encapsulated packet uses UDP, so checksum offload works correctly.
Fixes: 52f278774e79 ("bpf: implement BPF_LWT_ENCAP_IP mode in bpf_lwt_push_encap")
Cc: Leon Hwang <leon.huangfu@shopee.com>
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20260602150931.49629-2-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/lwt_bpf.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index f6c327c7badb4c..8c41532b4fe8fb 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -589,6 +589,7 @@ static int handle_gso_encap(struct sk_buff *skb, bool ipv4, int encap_len)
int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
{
+ bool is_udp_tunnel;
struct iphdr *iph;
bool ipv4;
int err;
@@ -602,10 +603,16 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
ipv4 = true;
if (unlikely(len < iph->ihl * 4))
return -EINVAL;
+ is_udp_tunnel = iph->protocol == IPPROTO_UDP;
+ if (unlikely(is_udp_tunnel && len < iph->ihl * 4 + sizeof(struct udphdr)))
+ return -EINVAL;
} else if (iph->version == 6) {
ipv4 = false;
if (unlikely(len < sizeof(struct ipv6hdr)))
return -EINVAL;
+ is_udp_tunnel = ((struct ipv6hdr *)iph)->nexthdr == NEXTHDR_UDP;
+ if (unlikely(is_udp_tunnel && len < sizeof(struct ipv6hdr) + sizeof(struct udphdr)))
+ return -EINVAL;
} else {
return -EINVAL;
}
@@ -627,6 +634,11 @@ int bpf_lwt_push_ip_encap(struct sk_buff *skb, void *hdr, u32 len, bool ingress)
if (ingress)
skb_postpush_rcsum(skb, iph, len);
skb_reset_network_header(skb);
+ if (is_udp_tunnel) {
+ size_t iph_sz = ipv4 ? iph->ihl * 4 : sizeof(struct ipv6hdr);
+
+ skb_set_transport_header(skb, skb_network_offset(skb) + iph_sz);
+ }
memcpy(skb_network_header(skb), hdr, len);
bpf_compute_data_pointers(skb);
skb_clear_hash(skb);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 236/699] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 235/699] bpf: Update transport_header when encapsulating UDP tunnel in lwt Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 237/699] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe Greg Kroah-Hartman
` (466 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tristan Madani, Loic Poulain,
Jeff Johnson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit df2187acfca6c6cca372c5d35f42394d9c270b09 ]
The firmware-controlled rsp->count field is used as the loop bound for
indexing into the flexible rsp->regs[] array without validation against
the message length. A count exceeding the actual data causes out-of-
bounds reads from the heap-allocated message buffer.
Add a check that count fits within the received message.
Fixes: 43efa3c0f241 ("wcn36xx: Implement print_reg indication")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Link: https://patch.msgid.link/20260421135018.352774-3-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/wcn36xx/smd.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 7f00cb6f5e16b3..900ee1e8ffdd3e 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -2697,6 +2697,12 @@ static int wcn36xx_smd_print_reg_info_ind(struct wcn36xx *wcn,
return -EIO;
}
+ if (rsp->count > (len - sizeof(*rsp)) / sizeof(rsp->regs[0])) {
+ wcn36xx_warn("Truncated print reg info indication: count %u, len %zu\n",
+ rsp->count, len);
+ return -EIO;
+ }
+
wcn36xx_dbg(WCN36XX_DBG_HAL,
"reginfo indication, scenario: 0x%x reason: 0x%x\n",
rsp->scenario, rsp->reason);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 237/699] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 236/699] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 238/699] ACPI: IPMI: Fix message kref handling on dead device Greg Kroah-Hartman
` (465 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rui Qi, Paul Walmsley, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Qi <qirui.001@bytedance.com>
[ Upstream commit 8ac35bac70e7e581d673b76878f7691cdadc33b8 ]
In the non-frame-pointer version of walk_stackframe, each value read
from the stack is treated as a potential return address and has 0x4
subtracted before being used as the program counter. This was intended
to convert the return address (the instruction after a call) back to
the call site, but it is incorrect:
1. RISC-V has variable-length instructions due to the RVC (compressed
instruction) extension. A call instruction can be either 4 bytes
(regular) or 2 bytes (compressed, e.g. c.jal). Subtracting a fixed
0x4 assumes all call instructions are 4 bytes, which is wrong for
compressed instructions.
2. Stack traces conventionally report return addresses, not call sites.
Other architectures (ARM64, x86, ARM) do not subtract instruction
size from return addresses in their stack unwinding code.
3. The frame-pointer version of walk_stackframe already dropped the
-0x4 offset. Commit b785ec129bd9 ("riscv/ftrace: Add
HAVE_FUNCTION_GRAPH_RET_ADDR_PTR support") replaced "pc =
frame->ra - 0x4" with ftrace_graph_ret_addr(), and the commit
message explicitly noted that "the original calculation, pc =
frame->ra - 4, is buggy when the instruction at the return address
happened to be a compressed inst." The non-FP version was simply
overlooked.
Remove the bogus -0x4 offset to match the FP version and the
conventions used by other architectures.
Fixes: 5d8544e2d007 ("RISC-V: Generic library routines and assembly")
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Link: https://patch.msgid.link/20260603115329.791603-2-qirui.001@bytedance.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/stacktrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/kernel/stacktrace.c b/arch/riscv/kernel/stacktrace.c
index 9c34735c1e771d..6905f396640562 100644
--- a/arch/riscv/kernel/stacktrace.c
+++ b/arch/riscv/kernel/stacktrace.c
@@ -96,7 +96,7 @@ void notrace walk_stackframe(struct task_struct *task,
while (!kstack_end(ksp)) {
if (__kernel_text_address(pc) && unlikely(fn(pc, arg)))
break;
- pc = READ_ONCE_NOCHECK(*ksp++) - 0x4;
+ pc = READ_ONCE_NOCHECK(*ksp++);
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 238/699] ACPI: IPMI: Fix message kref handling on dead device
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 237/699] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 239/699] cpufreq: Documentation: fix conservative governor freq_step description Greg Kroah-Hartman
` (464 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuho Choi, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuho Choi <dbgh9129@gmail.com>
[ Upstream commit 63320db6a5d84ec3fed8b3d36ba5244d07ddd108 ]
acpi_ipmi_space_handler() takes an extra reference on tx_msg before
checking whether the selected IPMI device is dead. The reference
belongs to the tx_msg_list entry and is normally dropped by
ipmi_cancel_tx_msg() or ipmi_flush_tx_msg() after the message is removed
from the list.
On the dead-device path, the message has not been queued yet, but the
error path still calls ipmi_msg_release() directly. That bypasses
kref_put() and frees tx_msg while the queued-message reference is still
recorded in the kref count.
Take the queued-message reference only after the dead-device check
succeeds, immediately before adding tx_msg to the list.
Fixes: 7b9844772237 ("ACPI / IPMI: Add reference counting for ACPI IPMI transfers")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260603163108.2149359-1-dbgh9129@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_ipmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpi_ipmi.c b/drivers/acpi/acpi_ipmi.c
index 9d6c0fc120d77d..d8fd2f9294047d 100644
--- a/drivers/acpi/acpi_ipmi.c
+++ b/drivers/acpi/acpi_ipmi.c
@@ -549,7 +549,6 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
return AE_TYPE;
}
- acpi_ipmi_msg_get(tx_msg);
mutex_lock(&driver_data.ipmi_lock);
/* Do not add a tx_msg that can not be flushed. */
if (ipmi_device->dead) {
@@ -557,6 +556,7 @@ acpi_ipmi_space_handler(u32 function, acpi_physical_address address,
ipmi_msg_release(tx_msg);
return AE_NOT_EXIST;
}
+ acpi_ipmi_msg_get(tx_msg);
spin_lock_irqsave(&ipmi_device->tx_msg_lock, flags);
list_add_tail(&tx_msg->head, &ipmi_device->tx_msg_list);
spin_unlock_irqrestore(&ipmi_device->tx_msg_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 239/699] cpufreq: Documentation: fix conservative governor freq_step description
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 238/699] ACPI: IPMI: Fix message kref handling on dead device Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 240/699] spi: ep93xx: fix double-free of zeropage on DMA setup failure Greg Kroah-Hartman
` (463 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengjie Zhang, Zhongqiu Han,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengjie Zhang <zhangpengjie2@huawei.com>
[ Upstream commit 03120e1425262c7d11f93362a88e579a1720390b ]
The conservative governor documentation incorrectly states that setting
freq_step to 0 will use the default 5% frequency step. In reality, since
at least commit 8e677ce83bf4 ("[CPUFREQ] conservative: fixup governor to
function more like ondemand logic"), freq_step=0 has always caused the
governor to skip frequency updates entirely.
Correct the documentation to reflect the actual behavior: freq_step=0
disables frequency changes by the governor entirely.
Fixes: 2a0e49279850 ("cpufreq: User/admin documentation update and consolidation")
Signed-off-by: Pengjie Zhang <zhangpengjie2@huawei.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
[ rjw: Subject adjustment ]
Link: https://patch.msgid.link/20260603055635.1549943-1-zhangpengjie2@huawei.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/admin-guide/pm/cpufreq.rst | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Documentation/admin-guide/pm/cpufreq.rst b/Documentation/admin-guide/pm/cpufreq.rst
index d2f37309cca3b3..5247eabb92065a 100644
--- a/Documentation/admin-guide/pm/cpufreq.rst
+++ b/Documentation/admin-guide/pm/cpufreq.rst
@@ -569,8 +569,8 @@ This governor exposes the following tunables:
100 (5 by default).
This is how much the frequency is allowed to change in one go. Setting
- it to 0 will cause the default frequency step (5 percent) to be used
- and setting it to 100 effectively causes the governor to periodically
+ it to 0 disables frequency changes by the governor entirely and setting
+ it to 100 effectively causes the governor to periodically
switch the frequency between the ``scaling_min_freq`` and
``scaling_max_freq`` policy limits.
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 240/699] spi: ep93xx: fix double-free of zeropage on DMA setup failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 239/699] cpufreq: Documentation: fix conservative governor freq_step description Greg Kroah-Hartman
@ 2026-07-21 15:19 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 241/699] firmware_loader: Fix recursive lock in device_cache_fw_images() Greg Kroah-Hartman
` (462 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:19 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 7886054b06f762f62054957a8f6de0f14e6b7541 ]
If DMA setup fails after allocating the zeropage, the error path frees
the page but leaves espi->zeropage dangling. A subsequent call to
ep93xx_spi_release_dma() sees the non-NULL pointer and frees the page
again.
Clear the pointer after freeing in the error path of
ep93xx_spi_setup_dma().
Fixes: 626a96db1169 ("spi/ep93xx: add DMA support")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Link: https://patch.msgid.link/20260529-ep93xx-v1-1-9185070ca1fc@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-ep93xx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/spi/spi-ep93xx.c b/drivers/spi/spi-ep93xx.c
index aa676559d2738b..b78495f4020960 100644
--- a/drivers/spi/spi-ep93xx.c
+++ b/drivers/spi/spi-ep93xx.c
@@ -625,6 +625,7 @@ static int ep93xx_spi_setup_dma(struct ep93xx_spi *espi)
espi->dma_rx = NULL;
fail_free_page:
free_page((unsigned long)espi->zeropage);
+ espi->zeropage = NULL;
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 241/699] firmware_loader: Fix recursive lock in device_cache_fw_images()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2026-07-21 15:19 ` [PATCH 5.10 240/699] spi: ep93xx: fix double-free of zeropage on DMA setup failure Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 242/699] configfs: fix lockless traversals of ->s_children Greg Kroah-Hartman
` (461 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e70e4c6f6eee43357ba7,
Dmitry Vyukov, Danilo Krummrich, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <dvyukov@google.com>
[ Upstream commit d3ec78f8f8d48a04a9fac38d47275c34645e5103 ]
A recursive locking deadlock can occur in the firmware loader's power
management notification handler.
During system suspend or hibernation preparation, fw_pm_notify() calls
device_cache_fw_images(). This function acquires fw_lock to set the
firmware cache state to FW_LOADER_START_CACHE and then iterates over all
devices using dpm_for_each_dev() while still holding the lock.
For each device, dev_cache_fw_image() schedules asynchronous work to cache
the firmware. If memory allocation for the async work entry fails (e.g., in
out-of-memory conditions), async_schedule_node_domain() falls back to
executing the work function synchronously in the current thread.
The synchronous execution path (__async_dev_cache_fw_image() ->
cache_firmware() -> request_firmware() -> assign_fw()) attempts to acquire
fw_lock again. Since the current thread already holds fw_lock, this results
in a recursive locking deadlock.
Fix this by releasing fw_lock immediately after updating the cache state
and before calling dpm_for_each_dev(). The lock is only needed to protect
the state update. Concurrent firmware requests will correctly see the
FW_LOADER_START_CACHE state and use the piggyback mechanism, which is
independently protected by its own fwc->name_lock.
Fixes: ac39b3ea73aa ("firmware loader: let caching firmware piggyback on loading firmware")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+e70e4c6f6eee43357ba7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e70e4c6f6eee43357ba7
Link: https://syzkaller.appspot.com/ai_job?id=8b4af9fd-24af-423f-8acb-1159fd34c1a5
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Link: https://patch.msgid.link/48b092a5-f49d-48a4-95f4-f65bebfc6bc3@mail.kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/firmware_loader/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
index a83bf68450ed08..97853c7ea33f43 100644
--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -1442,9 +1442,10 @@ static void device_cache_fw_images(void)
mutex_lock(&fw_lock);
fwc->state = FW_LOADER_START_CACHE;
- dpm_for_each_dev(NULL, dev_cache_fw_image);
mutex_unlock(&fw_lock);
+ dpm_for_each_dev(NULL, dev_cache_fw_image);
+
/* wait for completion of caching firmware for all devices */
async_synchronize_full_domain(&fw_cache_domain);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 242/699] configfs: fix lockless traversals of ->s_children
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 241/699] firmware_loader: Fix recursive lock in device_cache_fw_images() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 243/699] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 Greg Kroah-Hartman
` (460 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Al Viro, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 9b9e8bb81c41fd27e7b57a1c936fde140548535f ]
Having the parent directory locked protects entries from removal
by another thread, but it does *not* protect cursors from being
moved around by lseek() - or freed, for that matter.
Fixes: 6f6107640625 ("configfs: Introduce configfs_dirent_lock")
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/configfs/dir.c | 54 +++++++++++++++++++++++++++++++++++------------
1 file changed, 41 insertions(+), 13 deletions(-)
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index fcacee2b3c0f2e..ef86e4510c1c5b 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -227,15 +227,16 @@ static int configfs_dirent_exists(struct configfs_dirent *parent_sd,
{
struct configfs_dirent * sd;
+ spin_lock(&configfs_dirent_lock);
list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
if (sd->s_element) {
- const unsigned char *existing = configfs_get_name(sd);
- if (strcmp(existing, new))
- continue;
- else
+ if (strcmp(configfs_get_name(sd), new) == 0) {
+ spin_unlock(&configfs_dirent_lock);
return -EEXIST;
+ }
}
}
+ spin_unlock(&configfs_dirent_lock);
return 0;
}
@@ -574,11 +575,28 @@ static void configfs_detach_rollback(struct dentry *dentry)
configfs_detach_rollback(sd->s_dentry);
}
+/*
+ * Find the next non-cursor. configfs_dirent_lock held by caller.
+ */
+static struct configfs_dirent *next_dirent(struct configfs_dirent *parent,
+ struct configfs_dirent *last)
+{
+ struct configfs_dirent *s;
+
+ s = list_prepare_entry(last, &parent->s_children, s_sibling);
+
+ list_for_each_entry_continue(s, &parent->s_children, s_sibling) {
+ if (s->s_element)
+ return s;
+ }
+ return NULL;
+}
+
static void detach_attrs(struct config_item * item)
{
struct dentry * dentry = dget(item->ci_dentry);
- struct configfs_dirent * parent_sd;
- struct configfs_dirent * sd, * tmp;
+ struct configfs_dirent *parent_sd;
+ struct configfs_dirent *sd, *next;
if (!dentry)
return;
@@ -587,15 +605,19 @@ static void detach_attrs(struct config_item * item)
dentry->d_name.name);
parent_sd = dentry->d_fsdata;
- list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) {
- if (!sd->s_element || !(sd->s_type & CONFIGFS_NOT_PINNED))
+
+ spin_lock(&configfs_dirent_lock);
+ for (sd = next_dirent(parent_sd, NULL); sd; sd = next) {
+ next = next_dirent(parent_sd, sd);
+ if (!(sd->s_type & CONFIGFS_NOT_PINNED))
continue;
- spin_lock(&configfs_dirent_lock);
list_del_init(&sd->s_sibling);
spin_unlock(&configfs_dirent_lock);
configfs_drop_dentry(sd, dentry);
configfs_put(sd);
+ spin_lock(&configfs_dirent_lock);
}
+ spin_unlock(&configfs_dirent_lock);
/**
* Drop reference from dget() on entrance.
@@ -644,18 +666,20 @@ static void detach_groups(struct config_group *group)
struct dentry * dentry = dget(group->cg_item.ci_dentry);
struct dentry *child;
struct configfs_dirent *parent_sd;
- struct configfs_dirent *sd, *tmp;
+ struct configfs_dirent *sd, *next;
if (!dentry)
return;
parent_sd = dentry->d_fsdata;
- list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) {
- if (!sd->s_element ||
- !(sd->s_type & CONFIGFS_USET_DEFAULT))
+ spin_lock(&configfs_dirent_lock);
+ for (sd = next_dirent(parent_sd, NULL); sd; sd = next) {
+ next = next_dirent(parent_sd, sd);
+ if (!(sd->s_type & CONFIGFS_USET_DEFAULT))
continue;
child = sd->s_dentry;
+ spin_unlock(&configfs_dirent_lock);
inode_lock(d_inode(child));
@@ -667,7 +691,9 @@ static void detach_groups(struct config_group *group)
d_delete(child);
dput(child);
+ spin_lock(&configfs_dirent_lock);
}
+ spin_unlock(&configfs_dirent_lock);
/**
* Drop reference from dget() on entrance.
@@ -1119,6 +1145,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd,
struct configfs_dirent *p;
struct configfs_dirent *ret = NULL;
+ spin_lock(&configfs_dirent_lock);
list_for_each_entry(p, &root_sd->s_children, s_sibling) {
if (p->s_type & CONFIGFS_DIR &&
p->s_element == subsys_item) {
@@ -1126,6 +1153,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd,
break;
}
}
+ spin_unlock(&configfs_dirent_lock);
return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 243/699] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 242/699] configfs: fix lockless traversals of ->s_children Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 244/699] pinctrl: mediatek: mt8167: " Greg Kroah-Hartman
` (459 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Leonardo Scorcia, Linus Walleij,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <l.scorcia@gmail.com>
[ Upstream commit 1c3044cab23a056ea28da47da1cdd667a39df0b8 ]
The correct Schmitt trigger register offset for pins 34-39 is 0xA00.
Signed-off-by: Luca Leonardo Scorcia <l.scorcia@gmail.com>
Fixes: 264667112ef0 ("pinctrl: mediatek: Add MT8516 Pinctrl driver")
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-mt8516.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8516.c b/drivers/pinctrl/mediatek/pinctrl-mt8516.c
index b375426aa61e41..9e0f447bb35089 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mt8516.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mt8516.c
@@ -252,7 +252,7 @@ static const struct mtk_pin_ies_smt_set mt8516_smt_set[] = {
MTK_PIN_IES_SMT_SPEC(24, 25, 0xA00, 12),
MTK_PIN_IES_SMT_SPEC(26, 30, 0xA00, 0),
MTK_PIN_IES_SMT_SPEC(31, 33, 0xA00, 1),
- MTK_PIN_IES_SMT_SPEC(34, 39, 0xA900, 2),
+ MTK_PIN_IES_SMT_SPEC(34, 39, 0xA00, 2),
MTK_PIN_IES_SMT_SPEC(40, 40, 0xA10, 11),
MTK_PIN_IES_SMT_SPEC(41, 43, 0xA00, 10),
MTK_PIN_IES_SMT_SPEC(44, 47, 0xA00, 11),
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 244/699] pinctrl: mediatek: mt8167: Fix Schmitt trigger register offset of pins 34-39
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 243/699] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 245/699] hwspinlock: qcom: avoid uninitialized struct members Greg Kroah-Hartman
` (458 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Leonardo Scorcia, Linus Walleij,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Leonardo Scorcia <l.scorcia@gmail.com>
[ Upstream commit 439bc91d20188901dac698bed4921caac76d9074 ]
The correct Schmitt trigger register offset for pins 34-39 is 0xA00. Value
was verified with SoC data sheet.
Signed-off-by: Luca Leonardo Scorcia <l.scorcia@gmail.com>
Fixes: 82d70627e94a ("pinctrl: mediatek: Add MT8167 Pinctrl driver")
Signed-off-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/mediatek/pinctrl-mt8167.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-mt8167.c b/drivers/pinctrl/mediatek/pinctrl-mt8167.c
index 7b68886bad1608..d0ac84f4d3fb63 100644
--- a/drivers/pinctrl/mediatek/pinctrl-mt8167.c
+++ b/drivers/pinctrl/mediatek/pinctrl-mt8167.c
@@ -252,7 +252,7 @@ static const struct mtk_pin_ies_smt_set mt8167_smt_set[] = {
MTK_PIN_IES_SMT_SPEC(24, 25, 0xA00, 12),
MTK_PIN_IES_SMT_SPEC(26, 30, 0xA00, 0),
MTK_PIN_IES_SMT_SPEC(31, 33, 0xA00, 1),
- MTK_PIN_IES_SMT_SPEC(34, 39, 0xA900, 2),
+ MTK_PIN_IES_SMT_SPEC(34, 39, 0xA00, 2),
MTK_PIN_IES_SMT_SPEC(40, 40, 0xA10, 11),
MTK_PIN_IES_SMT_SPEC(41, 43, 0xA00, 10),
MTK_PIN_IES_SMT_SPEC(44, 47, 0xA00, 11),
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 245/699] hwspinlock: qcom: avoid uninitialized struct members
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 244/699] pinctrl: mediatek: mt8167: " Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 246/699] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() Greg Kroah-Hartman
` (457 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 8752c396ce3b2136b3d4c906fe103f6efb6782d9 ]
The reg_field is allocated on stack, so using the REG_FIELD macro will
ensure that unused members do not have uninitialized values.
Fixes: 19a0f61224d2 ("hwspinlock: qcom: Add support for Qualcomm HW Mutex block")
Link: https://sashiko.dev/#/patchset/20260319105947.6237-1-wsa%2Brenesas%40sang-engineering.com
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260512091339.31085-2-wsa+renesas@sang-engineering.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwspinlock/qcom_hwspinlock.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/hwspinlock/qcom_hwspinlock.c b/drivers/hwspinlock/qcom_hwspinlock.c
index e4991466486397..6a2a2f3e618554 100644
--- a/drivers/hwspinlock/qcom_hwspinlock.c
+++ b/drivers/hwspinlock/qcom_hwspinlock.c
@@ -129,7 +129,6 @@ static struct regmap *qcom_hwspinlock_probe_mmio(struct platform_device *pdev,
static int qcom_hwspinlock_probe(struct platform_device *pdev)
{
struct hwspinlock_device *bank;
- struct reg_field field;
struct regmap *regmap;
size_t array_size;
u32 stride;
@@ -151,9 +150,7 @@ static int qcom_hwspinlock_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, bank);
for (i = 0; i < QCOM_MUTEX_NUM_LOCKS; i++) {
- field.reg = base + i * stride;
- field.lsb = 0;
- field.msb = 31;
+ struct reg_field field = REG_FIELD(base + i * stride, 0, 31);
bank->lock[i].priv = devm_regmap_field_alloc(&pdev->dev,
regmap, field);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 246/699] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 245/699] hwspinlock: qcom: avoid uninitialized struct members Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 247/699] fbdev: sm501fb: Fix buffer errors in OF binding code Greg Kroah-Hartman
` (456 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Boris Burkov,
Qu Wenruo, Filipe Manana, David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 486f8298b6188ff11ef1f4be7f1d5d2e4d1b1fae ]
In the beginning of the loop, we try to obtain a locked delayed ref head,
if 'locked_ref' is currently NULL, by calling btrfs_select_ref_head(),
which can return an error pointer. If the error pointer is -EAGAIN we do
a continue and go back to the beginning of the loop, which will not try
again to call btrfs_select_ref_head() since 'locked_ref' is no longer
NULL but it's ERR_PTR(-EAGAIN), and then we do:
spin_lock(&locked_ref->lock);
against a ERR_PTR(-EAGAIN) value, generating an invalid pointer
dereference.
Fix this by ensuring that 'locked_ref' is set to NULL when
btrfs_select_ref_head() returns ERR_PTR(-EAGAIN) and incrementing 'count'
as well, to prevent infinite looping. We do this by doing a goto to the
bottom of the loop that already sets 'locked_ref' to NULL and does a
cond_resched(), with an increment to 'count' right before the goto.
These measures were in place before the refactoring in commit 0110a4c43451
("btrfs: refactor __btrfs_run_delayed_refs loop") but were unintentionally
lost afterwards.
Reported-by: Dan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/linux-btrfs/ag8ARRwykv8bpJ87@stanley.mountain/
Fixes: 0110a4c43451 ("btrfs: refactor __btrfs_run_delayed_refs loop")
Reviewed-by: Boris Burkov <boris@bur.io>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 9207fe878dd201..906905ffe6c043 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1995,7 +1995,8 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
locked_ref = btrfs_obtain_ref_head(trans);
if (IS_ERR_OR_NULL(locked_ref)) {
if (PTR_ERR(locked_ref) == -EAGAIN) {
- continue;
+ count++;
+ goto again;
} else {
break;
}
@@ -2044,7 +2045,7 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
* Either success case or btrfs_run_delayed_refs_for_head
* returned -EAGAIN, meaning we need to select another head
*/
-
+again:
locked_ref = NULL;
cond_resched();
} while ((nr != -1 && count < nr) || locked_ref);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 247/699] fbdev: sm501fb: Fix buffer errors in OF binding code
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 246/699] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 248/699] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified Greg Kroah-Hartman
` (455 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Laight, Helge Deller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Laight <david.laight.linux@gmail.com>
[ Upstream commit d8421e09382cfe0bd2a044c8b0a822f64855dd4e ]
The code that gets the frame buffer mode from OF has 'use after free',
'buffer overrun' and memory leaks.
info->edid_data isn't free if the probe functions fail or if
pd->def_mode is set.
If both the CRT and PANEL are enabled info->edid_data is used after
being freed and is freed twice.
The string returned by of_get_property(np, "mode", &len) is just
written over either the static "640x480-16@60" or the module parameter
string without any regard for the length (which is most likely longer).
Use kstrump() for the OF mode and free everything before freeing 'info.
Fixes: 4295f9bf74a88 ("video, sm501: add OF binding to support SM501")
Signed-off-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/sm501fb.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/video/fbdev/sm501fb.c b/drivers/video/fbdev/sm501fb.c
index 3c46838651b061..b556789974cdcc 100644
--- a/drivers/video/fbdev/sm501fb.c
+++ b/drivers/video/fbdev/sm501fb.c
@@ -95,6 +95,7 @@ struct sm501fb_info {
void __iomem *fbmem; /* remapped framebuffer */
size_t fbmem_len; /* length of remapped region */
u8 *edid_data;
+ char *fb_mode;
};
/* per-framebuffer private data */
@@ -1788,12 +1789,11 @@ static int sm501fb_init_fb(struct fb_info *fb, enum sm501_controller head,
fb->var.yres_virtual = fb->var.yres;
} else {
if (info->edid_data) {
- ret = fb_find_mode(&fb->var, fb, fb_mode,
+ ret = fb_find_mode(&fb->var, fb,
+ info->fb_mode ?: fb_mode,
fb->monspecs.modedb,
fb->monspecs.modedb_len,
&sm501_default_mode, default_bpp);
- /* edid_data is no longer needed, free it */
- kfree(info->edid_data);
} else {
ret = fb_find_mode(&fb->var, fb,
NULL, NULL, 0, NULL, 8);
@@ -1969,7 +1969,7 @@ static int sm501fb_probe(struct platform_device *pdev)
/* Get EDID */
cp = of_get_property(np, "mode", &len);
if (cp)
- strcpy(fb_mode, cp);
+ info->fb_mode = kstrdup(cp, GFP_KERNEL);
prop = of_get_property(np, "edid", &len);
if (prop && len == EDID_LENGTH) {
info->edid_data = kmemdup(prop, EDID_LENGTH,
@@ -2026,6 +2026,12 @@ static int sm501fb_probe(struct platform_device *pdev)
goto err_started_crt;
}
+ /* These aren't needed any more */
+ kfree(info->edid_data);
+ kfree(info->fb_mode);
+ info->edid_data = NULL;
+ info->fb_mode = NULL;
+
/* we registered, return ok */
return 0;
@@ -2043,6 +2049,8 @@ static int sm501fb_probe(struct platform_device *pdev)
framebuffer_release(info->fb[HEAD_CRT]);
err_alloc:
+ kfree(info->edid_data);
+ kfree(info->fb_mode);
kfree(info);
return ret;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 248/699] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 247/699] fbdev: sm501fb: Fix buffer errors in OF binding code Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 249/699] vhost/vdpa: validate virtqueue index in mmap and fault paths Greg Kroah-Hartman
` (454 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit bade9a3150d44ed20b8c6484c4c8a943b7289abb ]
Sashiko noticed mlx4 was using whatever random access flags were provided
when IB_MR_REREG_ACCESS is not used. Since IB_MR_REREG_TRANS needs
access_flags it used the random ones which means it doesn't work sensibly
if userspace provides only IB_MR_REREG_TRANS.
Keep track of the current access_flag of the MR and use it if the user
does not specify one.
Also fixup a little confusion around mmr.access, it is the HW access flags
so the convert_access() was missing. But nothing reads this by the time
rereg_mr can happen.
Fixes: 9376932d0c26 ("IB/mlx4_ib: Add support for user MR re-registration")
Link: https://patch.msgid.link/r/0-v1-29ca7a402625+ddd6-mlx4_rereg_flags_jgg@nvidia.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx4/mlx4_ib.h | 1 +
drivers/infiniband/hw/mlx4/mr.c | 9 +++++++--
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 58df06492d69e4..a6470e407ff762 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -136,6 +136,7 @@ struct mlx4_ib_mr {
dma_addr_t page_map;
u32 npages;
u32 max_pages;
+ int access_flags;
struct mlx4_mr mmr;
struct ib_umem *umem;
size_t page_map_size;
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 0f303e8aa13776..27c3be0bd7b969 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -439,6 +439,7 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
if (err)
goto err_mr;
+ mr->access_flags = access_flags;
mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key;
mr->ibmr.page_size = 1U << shift;
@@ -496,6 +497,8 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags,
if (err)
goto release_mpt_entry;
+ } else {
+ mr_access_flags = mmr->access_flags;
}
if (flags & IB_MR_REREG_TRANS) {
@@ -537,8 +540,10 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags,
* return a failure. But dereg_mr will free the resources.
*/
err = mlx4_mr_hw_write_mpt(dev->dev, &mmr->mmr, pmpt_entry);
- if (!err && flags & IB_MR_REREG_ACCESS)
- mmr->mmr.access = mr_access_flags;
+ if (!err && flags & IB_MR_REREG_ACCESS) {
+ mmr->access_flags = mr_access_flags;
+ mmr->mmr.access = convert_access(mr_access_flags);
+ }
release_mpt_entry:
mlx4_mr_hw_put_mpt(dev->dev, pmpt_entry);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 249/699] vhost/vdpa: validate virtqueue index in mmap and fault paths
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 248/699] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 250/699] tools/virtio: check mmap return value in vringh_test Greg Kroah-Hartman
` (453 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eugenio Pérez,
Michael S. Tsirkin, Qihang Tang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang Tang <q.h.hack.winter@gmail.com>
[ Upstream commit 929e4f044621c8cc30b612fb74e1410bef09e41b ]
vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a
virtqueue index for get_vq_notification(), but they do not validate
that the index is smaller than v->nvqs.
The ioctl path already performs both a bounds check and
array_index_nospec(), but the mmap/fault path only checks that the
index fits in u16. This allows an out-of-range queue index to reach
driver-specific get_vq_notification() callbacks.
Fix this by extracting a unified vhost_vdpa_get_vq_notification()
helper that validates the queue index against v->nvqs and applies
array_index_nospec() before calling the driver callback. Both the
mmap and fault paths use this helper, and the bounds checking is
consolidated into a single location.
>From source inspection, the most defensible impact is out-of-bounds
access in the callback path, potentially leading to invalid PFN
remaps and crash/DoS.
Fixes: ddd89d0a059d ("vhost_vdpa: support doorbell mapping via mmap")
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Qihang Tang <q.h.hack.winter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260508075821.92656-1-q.h.hack.winter@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vhost/vdpa.c | 29 ++++++++++++++++++++++-------
1 file changed, 22 insertions(+), 7 deletions(-)
diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index 61d11e7317acdc..c1fb70f840340d 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -960,16 +960,32 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep)
}
#ifdef CONFIG_MMU
-static vm_fault_t vhost_vdpa_fault(struct vm_fault *vmf)
+static int
+vhost_vdpa_get_vq_notification(struct vhost_vdpa *v, unsigned long index,
+ struct vdpa_notification_area *notify)
{
- struct vhost_vdpa *v = vmf->vma->vm_file->private_data;
struct vdpa_device *vdpa = v->vdpa;
const struct vdpa_config_ops *ops = vdpa->config;
+
+ if (index > 65535 || index >= v->nvqs)
+ return -EINVAL;
+
+ index = array_index_nospec(index, v->nvqs);
+
+ *notify = ops->get_vq_notification(vdpa, index);
+
+ return 0;
+}
+
+static vm_fault_t vhost_vdpa_fault(struct vm_fault *vmf)
+{
+ struct vhost_vdpa *v = vmf->vma->vm_file->private_data;
struct vdpa_notification_area notify;
struct vm_area_struct *vma = vmf->vma;
- u16 index = vma->vm_pgoff;
+ unsigned long index = vma->vm_pgoff;
- notify = ops->get_vq_notification(vdpa, index);
+ if (vhost_vdpa_get_vq_notification(v, index, ¬ify))
+ return VM_FAULT_SIGBUS;
return vmf_insert_pfn(vma, vmf->address & PAGE_MASK, PFN_DOWN(notify.addr));
}
@@ -992,8 +1008,6 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
return -EINVAL;
if (vma->vm_flags & VM_READ)
return -EINVAL;
- if (index > 65535)
- return -EINVAL;
if (!ops->get_vq_notification)
return -ENOTSUPP;
@@ -1001,7 +1015,8 @@ static int vhost_vdpa_mmap(struct file *file, struct vm_area_struct *vma)
* support the doorbell which sits on the page boundary and
* does not share the page with other registers.
*/
- notify = ops->get_vq_notification(vdpa, index);
+ if (vhost_vdpa_get_vq_notification(v, index, ¬ify))
+ return -EINVAL;
if (notify.addr & (PAGE_SIZE - 1))
return -EINVAL;
if (vma->vm_end - vma->vm_start != notify.size)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 250/699] tools/virtio: check mmap return value in vringh_test
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 249/699] vhost/vdpa: validate virtqueue index in mmap and fault paths Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 251/699] bonding: 3ad: fix mux port state on oper down Greg Kroah-Hartman
` (452 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, longlong yan, Michael S. Tsirkin,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: longlong yan <yanlonglong@kylinos.cn>
[ Upstream commit ec6177dfe98b9be1c3ede6c0dfe4394ea2a76959 ]
In parallel_test(), the return values of mmap() for both host_map and
guest_map are not checked against MAP_FAILED. If mmap() fails, the
subsequent code will dereference the invalid pointer, leading to a
segmentation fault.
Add MAP_FAILED checks after both mmap() calls, using err() to report
the error and exit, consistent with the existing error handling style
in this file (e.g., the open() call on line 149).
Fixes: 1515c5ce26ae ("tools/virtio: add vring_test.")
Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260605021446.1611-1-yanlonglong@kylinos.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/virtio/vringh_test.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/virtio/vringh_test.c b/tools/virtio/vringh_test.c
index 98ff808d6f0c2d..16f3723b467129 100644
--- a/tools/virtio/vringh_test.c
+++ b/tools/virtio/vringh_test.c
@@ -159,7 +159,12 @@ static int parallel_test(u64 features,
/* Parent and child use separate addresses, to check our mapping logic! */
host_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
+ if (host_map == MAP_FAILED)
+ err(1, "mmap host_map");
+
guest_map = mmap(NULL, mapsize, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
+ if (guest_map == MAP_FAILED)
+ err(1, "mmap guest_map");
pipe(to_guest);
pipe(to_host);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 251/699] bonding: 3ad: fix mux port state on oper down
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 250/699] tools/virtio: check mmap return value in vringh_test Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 252/699] fs: efs: remove unneeded debug prints Greg Kroah-Hartman
` (451 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Louis Scalbert, Jay Vosburgh,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Scalbert <louis.scalbert@6wind.com>
[ Upstream commit 807afc7544b865d4d09068a415fd5b71bf5665cc ]
When the bonding interface has carrier down due to the absence of
usable slaves and a slave transitions from down to up, the bonding
interface briefly goes carrier up, then down again, and finally up
once LACP negotiates collecting and distributing on the port.
When lacp_strict mode is on, the interface should not transition to
carrier up until LACP negotiation is complete.
This happens because the actor and partner port states remain in
Collecting_Distributing when the port goes down. When the port
comes back up, it temporarily remains in this state until LACP
renegotiation occurs.
Previously this was mostly cosmetic, but since the bonding carrier
state may depend on the LACP negotiation state, it causes the
interface to flap.
According to IEEE 802.3ad-2000 and IEEE 802.1ax-2014, Collecting and
Distributing should be reset when a port goes down:
- In the Receive state machine, port_enabled == FALSE causes a
transition to the PORT_DISABLED state, which is expected to clear
Partner_Oper_Port_State.Synchronization.
- In the Mux state machine, Partner_Oper_Port_State.Synchronization ==
FALSE causes a transition to the ATTACHED state, which disables
Collecting and Distributing.
However, Partner_Oper_Port_State.Synchronization is not cleared in the
PORT_DISABLED state.
Clear Partner_Oper_Port_State.Synchronization in the Receive
PORT_DISABLED state.
Fixes: 655f8919d549 ("bonding: add min links parameter to 802.3ad")
Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
Acked-by: Jay Vosburgh <jv@jvosburgh.net>
Link: https://patch.msgid.link/20260603150331.1919611-6-louis.scalbert@6wind.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/bonding/bond_3ad.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 320e5461853f77..7683808c66128b 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1153,6 +1153,7 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
fallthrough;
case AD_RX_PORT_DISABLED:
port->sm_vars &= ~AD_PORT_MATCHED;
+ port->partner_oper.port_state &= ~LACP_STATE_SYNCHRONIZATION;
break;
case AD_RX_LACP_DISABLED:
port->sm_vars &= ~AD_PORT_SELECTED;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 252/699] fs: efs: remove unneeded debug prints
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 251/699] bonding: 3ad: fix mux port state on oper down Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 253/699] RDMA/mlx5: Fix undefined shift of user RQ WQE size Greg Kroah-Hartman
` (450 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxwell Doose, Andrew Morton,
Fabian Frederick, Christian Brauner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxwell Doose <m32285159@gmail.com>
[ Upstream commit 89009392c80da5da00876c8334ff20028e6e3eb6 ]
The current code uses debug prints conditionally compiled with #ifdef
DEBUG. However, that code, when compiled, causes compiler errors due to
incompatible formatters and undefined variables, notably:
fs/efs/file.c: In function `efs_get_block':
fs/efs/file.c:26:35: error: `block' undeclared (first use in this
function); did you mean `iblock'?
26 | __func__, block, inode->i_blocks, inode->i_size);
| ^~~~~
and:
fs/efs/file.c: In function `efs_bmap':
./include/linux/kern_levels.h:5:25: error: format `%ld' expects
argument of type `long int', but argument 4 has type `blkcnt_t' {aka
`long long unsigned int'} [-Werror=format=]
5 | #define KERN_SOH "\001" /* ASCII Start Of Header */
| ^~~~~~
which also extends to the other formatters. As this part of the code has
been dead for just about 14 years now, it has not been modernized to stay
compatible with the most recent gcc compilers. Fix these issues by
removing the debug prints.
Link: https://lore.kernel.org/20260605035251.89305-2-m32285159@gmail.com
Fixes: f403d1dbac6d ("fs/efs: add pr_fmt / use __func__")
Signed-off-by: Maxwell Doose <m32285159@gmail.com>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Fabian Frederick <fabf@skynet.be>
Cc: Christian Brauner <brauner@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/efs/file.c | 21 +++------------------
1 file changed, 3 insertions(+), 18 deletions(-)
diff --git a/fs/efs/file.c b/fs/efs/file.c
index 9e641da6fab276..9153dfe79bbcc9 100644
--- a/fs/efs/file.c
+++ b/fs/efs/file.c
@@ -18,16 +18,9 @@ int efs_get_block(struct inode *inode, sector_t iblock,
if (create)
return error;
- if (iblock >= inode->i_blocks) {
-#ifdef DEBUG
- /*
- * i have no idea why this happens as often as it does
- */
- pr_warn("%s(): block %d >= %ld (filesize %ld)\n",
- __func__, block, inode->i_blocks, inode->i_size);
-#endif
+ if (iblock >= inode->i_blocks)
return 0;
- }
+
phys = efs_map_block(inode, iblock);
if (phys)
map_bh(bh_result, inode->i_sb, phys);
@@ -42,16 +35,8 @@ int efs_bmap(struct inode *inode, efs_block_t block) {
}
/* are we about to read past the end of a file ? */
- if (!(block < inode->i_blocks)) {
-#ifdef DEBUG
- /*
- * i have no idea why this happens as often as it does
- */
- pr_warn("%s(): block %d >= %ld (filesize %ld)\n",
- __func__, block, inode->i_blocks, inode->i_size);
-#endif
+ if (!(block < inode->i_blocks))
return 0;
- }
return efs_map_block(inode, block);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 253/699] RDMA/mlx5: Fix undefined shift of user RQ WQE size
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 252/699] fs: efs: remove unneeded debug prints Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 254/699] ASoC: fsl: fsl_audmix: Validate written enum values Greg Kroah-Hartman
` (449 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Edward Srouji,
Jason Gunthorpe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit d881d60223aac8fdc12b227d89c76e131e92a9cd ]
set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on
the user-provided rq_wqe_shift, which is only checked to be greater than
32, so shifts of 32 are still accepted. A shift of 31 also overflows a
signed integer, leading to undefined behavior.
Use check_shl_overflow() to compute the RQ WQE size and reject any
invalid values.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Link: https://patch.msgid.link/r/20260611-maher-sec-fixes-v1-1-cd8eb2542869@nvidia.com
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Signed-off-by: Edward Srouji <edwards@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/qp.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index a00dde2f3fd39f..8f83629ceb8af6 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -369,16 +369,13 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap,
if (ucmd) {
qp->rq.wqe_cnt = ucmd->rq_wqe_count;
- if (ucmd->rq_wqe_shift > BITS_PER_BYTE * sizeof(ucmd->rq_wqe_shift))
- return -EINVAL;
qp->rq.wqe_shift = ucmd->rq_wqe_shift;
- if ((1 << qp->rq.wqe_shift) /
- sizeof(struct mlx5_wqe_data_seg) <
- wq_sig)
+ if (check_shl_overflow(1, qp->rq.wqe_shift, &wqe_size))
+ return -EINVAL;
+ if (wqe_size / sizeof(struct mlx5_wqe_data_seg) < wq_sig)
return -EINVAL;
qp->rq.max_gs =
- (1 << qp->rq.wqe_shift) /
- sizeof(struct mlx5_wqe_data_seg) -
+ wqe_size / sizeof(struct mlx5_wqe_data_seg) -
wq_sig;
qp->rq.max_post = qp->rq.wqe_cnt;
} else {
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 254/699] ASoC: fsl: fsl_audmix: Validate written enum values
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 253/699] RDMA/mlx5: Fix undefined shift of user RQ WQE size Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 255/699] ASoC: tegra: tegra210_ahub: Validate written enum value Greg Kroah-Hartman
` (448 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 3cd17e4e2871114d5579fa7bc8da66faf7fc1930 ]
fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src()
convert the user-provided enum item with snd_soc_enum_item_to_val()
before checking whether the item is within the enum's item count.
The generic snd_soc_put_enum_double() helper performs that
validation, but these callbacks use the converted value first: the
clock-source path tests it with BIT(), and the output-source path
indexes the prms transition table with it.
Reject out-of-range enum items before converting them.
Fixes: be1df61cf06e ("ASoC: fsl: Add Audio Mixer CPU DAI driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-4-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_audmix.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/sound/soc/fsl/fsl_audmix.c b/sound/soc/fsl/fsl_audmix.c
index 7ad5925772e8e1..f78e626d9a092c 100644
--- a/sound/soc/fsl/fsl_audmix.c
+++ b/sound/soc/fsl/fsl_audmix.c
@@ -117,6 +117,9 @@ static int fsl_audmix_put_mix_clk_src(struct snd_kcontrol *kcontrol,
unsigned int *item = ucontrol->value.enumerated.item;
unsigned int reg_val, val, mix_clk;
+ if (item[0] >= e->items)
+ return -EINVAL;
+
/* Get current state */
reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
mix_clk = ((reg_val & FSL_AUDMIX_CTR_MIXCLK_MASK)
@@ -157,6 +160,9 @@ static int fsl_audmix_put_out_src(struct snd_kcontrol *kcontrol,
unsigned int reg_val, val, mask = 0, ctr = 0;
int ret;
+ if (item[0] >= e->items)
+ return -EINVAL;
+
/* Get current state */
reg_val = snd_soc_component_read(comp, FSL_AUDMIX_CTR);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 255/699] ASoC: tegra: tegra210_ahub: Validate written enum value
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 254/699] ASoC: fsl: fsl_audmix: Validate written enum values Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 256/699] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump() Greg Kroah-Hartman
` (447 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
[ Upstream commit 1d8aabb413b5638670dfd1162169edc0ba276a2e ]
tegra_ahub_put_value_enum() reads e->values[item[0]] before
checking whether item[0] is within the enum item range. The existing
check therefore happens too late to prevent an out-of-range read of the
values array.
Move the check before the array access.
Fixes: 16e1bcc2caf4 ("ASoC: tegra: Add Tegra210 based AHUB driver")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://patch.msgid.link/20260609124317.38046-5-sammiee5311@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra210_ahub.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/sound/soc/tegra/tegra210_ahub.c b/sound/soc/tegra/tegra210_ahub.c
index 686c8ff46ec8a1..3050ad46348c94 100644
--- a/sound/soc/tegra/tegra210_ahub.c
+++ b/sound/soc/tegra/tegra210_ahub.c
@@ -60,13 +60,15 @@ static int tegra_ahub_put_value_enum(struct snd_kcontrol *kctl,
struct soc_enum *e = (struct soc_enum *)kctl->private_value;
struct snd_soc_dapm_update update[TEGRA_XBAR_UPDATE_MAX_REG] = { };
unsigned int *item = uctl->value.enumerated.item;
- unsigned int value = e->values[item[0]];
+ unsigned int value;
unsigned int i, bit_pos, reg_idx = 0, reg_val = 0;
int change = 0;
if (item[0] >= e->items)
return -EINVAL;
+ value = e->values[item[0]];
+
if (value) {
/* Get the register index and value to set */
reg_idx = (value - 1) / (8 * cmpnt->val_bytes);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 256/699] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump().
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 255/699] ASoC: tegra: tegra210_ahub: Validate written enum value Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 257/699] sctp: validate embedded address parameter length Greg Kroah-Hartman
` (446 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Ido Schimmel,
David Ahern, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 2821e85c058f81c9948a2fb1a634f7b47457d51c ]
rocker_router_fib_event() calls fib_rule_get() during RCU dump.
If the fib_rule is dying, refcount_inc() will complain about it.
Let's call refcount_inc_not_zero() in fib_rules_dump().
Fixes: 5d7bfd141924 ("ipv4: fib_rules: Dump FIB rules when registering FIB notifier")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20260610061744.2030996-3-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/fib_rules.h | 5 +++++
net/core/fib_rules.c | 6 +++++-
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index bd07484ab9dd5f..5a5d84a3fe6a40 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -128,6 +128,11 @@ static inline void fib_rule_get(struct fib_rule *rule)
refcount_inc(&rule->refcnt);
}
+static inline bool fib_rule_get_safe(struct fib_rule *rule)
+{
+ return refcount_inc_not_zero(&rule->refcnt);
+}
+
static inline void fib_rule_put(struct fib_rule *rule)
{
if (refcount_dec_and_test(&rule->refcnt))
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index a6159624eec046..b4f125685256f8 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -328,7 +328,7 @@ int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
if (err != -EAGAIN) {
if ((arg->flags & FIB_LOOKUP_NOREF) ||
- likely(refcount_inc_not_zero(&rule->refcnt))) {
+ likely(fib_rule_get_safe(rule))) {
arg->rule = rule;
goto out;
}
@@ -386,8 +386,12 @@ int fib_rules_dump(struct net *net, struct notifier_block *nb, int family,
if (!ops)
return -EAFNOSUPPORT;
list_for_each_entry_rcu(rule, &ops->rules_list, list) {
+ if (!fib_rule_get_safe(rule))
+ continue;
+
err = call_fib_rule_notifier(nb, FIB_EVENT_RULE_ADD,
rule, family, extack);
+ fib_rule_put(rule);
if (err)
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 257/699] sctp: validate embedded address parameter length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 256/699] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 258/699] net/sched: sch_hfsc: Dont make class passive twice Greg Kroah-Hartman
` (445 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko, Xin Long, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit e9361d0ca55c4af12aac09e2572852fa91046229 ]
sctp_verify_asconf() and sctp_verify_param() only validate ADD_IP, DEL_IP,
and SET_PRIMARY parameters against a fixed minimum size of sizeof(struct
sctp_addip_param) + sizeof(struct sctp_paramhdr). This ensures the outer
parameter is large enough to contain an embedded address parameter header,
but does not verify that the embedded address parameter's declared length
fits within the bounds of the outer parameter.
Later, sctp_process_param() and sctp_process_asconf_param() extract the
embedded address parameter and pass it to af->from_addr_param(), which uses
the address parameter length to parse the variable-length address payload.
A malformed peer can therefore advertise an embedded address parameter
length that exceeds the remaining bytes in the enclosing parameter.
Validate that addr_param->p.length does not exceed the space available
after the sctp_addip_param header before processing the embedded address
parameter. Reject malformed parameters when the embedded address length
extends beyond the enclosing parameter bounds.
This prevents out-of-bounds reads when parsing malformed parameters carried
in INIT or ASCONF processing paths.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: sashiko <sashiko-bot@kernel.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/7838b86b69f52add28808fb59034c8f992e97b2d.1781043268.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/sm_make_chunk.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 85cc11a85b383a..e9d89409cb5ee9 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2624,6 +2624,9 @@ static int sctp_process_param(struct sctp_association *asoc,
goto fall_through;
addr_param = param.v + sizeof(struct sctp_addip_param);
+ if (ntohs(addr_param->p.length) >
+ ntohs(param.p->length) - sizeof(struct sctp_addip_param))
+ break;
af = sctp_get_af_specific(param_type2af(addr_param->p.type));
if (!af)
@@ -3022,13 +3025,16 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
union sctp_addr addr;
struct sctp_af *af;
- addr_param = (void *)asconf_param + sizeof(*asconf_param);
-
if (asconf_param->param_hdr.type != SCTP_PARAM_ADD_IP &&
asconf_param->param_hdr.type != SCTP_PARAM_DEL_IP &&
asconf_param->param_hdr.type != SCTP_PARAM_SET_PRIMARY)
return SCTP_ERROR_UNKNOWN_PARAM;
+ addr_param = (void *)asconf_param + sizeof(*asconf_param);
+ if (ntohs(addr_param->p.length) >
+ ntohs(asconf_param->param_hdr.length) - sizeof(*asconf_param))
+ return SCTP_ERROR_PROTO_VIOLATION;
+
switch (addr_param->p.type) {
case SCTP_PARAM_IPV6_ADDRESS:
if (!asoc->peer.ipv6_address)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 258/699] net/sched: sch_hfsc: Dont make class passive twice
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 257/699] sctp: validate embedded address parameter length Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 259/699] tipc: require net admin for TIPCv2 netlink mutators Greg Kroah-Hartman
` (444 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anirudh Gupta, Jamal Hadi Salim,
Victor Nogueira, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <victor@mojatatu.com>
[ Upstream commit 90b662ea25f5e83bb3b8ccec5b93ced810b92fb8 ]
update_vf() is called from two places for the same class during a single
dequeue when the class's child qdisc (e.g. codel/fq_codel) drops its last
packets while dequeuing:
1. The child calls qdisc_tree_reduce_backlog(), which, now that the child
is empty, invokes hfsc_qlen_notify() -> update_vf(cl, 0, 0) and turns
the class passive (cl_nactive is decremented up the hierarchy).
2. hfsc_dequeue() then calls update_vf(cl, qdisc_pkt_len(skb), cur_time)
to charge the dequeued bytes.
On the second call the class is already passive, but its child qdisc is
still empty, so update_vf() arms go_passive again:
if (cl->qdisc->q.qlen == 0 && cl->cl_flags & HFSC_FSC)
go_passive = 1;
The leaf is then skipped by the cl_nactive == 0 check inside the loop,
which does not clear go_passive, so the stale go_passive propagates to the
parent and decrements its cl_nactive a second time. A parent that still
has other active children is driven to cl_nactive == 0 and removed from
the vttree, even though those siblings are still backlogged. They are
never dequeued again and the qdisc stalls.
Fix this by only arming go_passive when the class is actually active, so an
already-passive class no longer triggers a second passive transition. The
byte accounting (cl->cl_total += len) still runs for every ancestor, so
dequeued bytes continue to be counted exactly once.
Fixes: 51eb3b65544c ("sch_hfsc: make hfsc_qlen_notify() idempotent")
Reported-by: Anirudh Gupta <anirudhrudr@gmail.com>
Closes: https://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Tested-by: Anirudh Gupta <anirudhrudr@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260610132824.3027549-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hfsc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 29879e728408a3..b5e7eb023812a8 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -754,7 +754,7 @@ update_vf(struct hfsc_class *cl, unsigned int len, u64 cur_time)
u64 f; /* , myf_bound, delta; */
int go_passive = 0;
- if (cl->qdisc->q.qlen == 0 && cl->cl_flags & HFSC_FSC)
+ if (cl->qdisc->q.qlen == 0 && cl->cl_flags & HFSC_FSC && cl->cl_nactive)
go_passive = 1;
for (; cl->cl_parent != NULL; cl = cl->cl_parent) {
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 259/699] tipc: require net admin for TIPCv2 netlink mutators
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 258/699] net/sched: sch_hfsc: Dont make class passive twice Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 260/699] tipc: prevent snt_unacked underflow on CONN_ACK Greg Kroah-Hartman
` (443 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Tung Nguyen,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit 86b0c540e2ea397cde021eecd24145f7c16a3d4e ]
TIPCv2 registers mutating generic-netlink operations without admin
permission flags. Generic netlink only checks CAP_NET_ADMIN when an
operation sets GENL_ADMIN_PERM or GENL_UNS_ADMIN_PERM, so a local
unprivileged process can currently change TIPC state through commands
such as TIPC_NL_NET_SET, TIPC_NL_KEY_SET, TIPC_NL_KEY_FLUSH, and
bearer enable/disable.
The legacy TIPC netlink API already checks netlink_net_capable(...,
CAP_NET_ADMIN) for administrative commands. Give the TIPCv2 mutators
the equivalent generic-netlink gate. Use GENL_UNS_ADMIN_PERM, which
maps to the same namespace-aware CAP_NET_ADMIN check that
netlink_net_capable() performs, so the behaviour matches the legacy
path and keeps working for CAP_NET_ADMIN holders in a non-initial user
namespace (containers).
A QEMU/KASAN repro run as uid/gid 65534 with zero effective
capabilities previously succeeded in changing the network id and node
identity, setting and flushing key material, and enabling/disabling a
UDP bearer. With this patch applied the same operations fail with
-EPERM.
Fixes: 0655f6a8635b ("tipc: add bearer disable/enable to new netlink api")
Link: https://lore.kernel.org/all/20260604163102.2658553-1-dominik.czarnota@trailofbits.com/
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260610124003.3831170-2-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/netlink.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index f10ed873858f8a..35e167de0fcf78 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -152,11 +152,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_BEARER_DISABLE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_disable,
},
{
.cmd = TIPC_NL_BEARER_ENABLE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_enable,
},
{
@@ -168,11 +170,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_BEARER_ADD,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_add,
},
{
.cmd = TIPC_NL_BEARER_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_bearer_set,
},
{
@@ -197,11 +201,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_LINK_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_set_link,
},
{
.cmd = TIPC_NL_LINK_RESET_STATS,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_reset_link_stats,
},
{
@@ -213,6 +219,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_MEDIA_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_media_set,
},
{
@@ -228,6 +235,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_NET_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_net_set,
},
{
@@ -238,6 +246,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_MON_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_set_monitor,
},
{
@@ -255,6 +264,7 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_PEER_REMOVE,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_peer_rm,
},
#ifdef CONFIG_TIPC_MEDIA_UDP
@@ -269,11 +279,13 @@ static const struct genl_ops tipc_genl_v2_ops[] = {
{
.cmd = TIPC_NL_KEY_SET,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_set_key,
},
{
.cmd = TIPC_NL_KEY_FLUSH,
.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
+ .flags = GENL_UNS_ADMIN_PERM,
.doit = tipc_nl_node_flush_key,
},
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 260/699] tipc: prevent snt_unacked underflow on CONN_ACK
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 259/699] tipc: require net admin for TIPCv2 netlink mutators Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 261/699] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Greg Kroah-Hartman
` (442 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Tung Nguyen,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
[ Upstream commit ab3e10b44ba5411779aac7afd2477917dd77750f ]
tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count
from the unsigned 16-bit send counter snt_unacked without checking that it
does not exceed the number of messages actually outstanding:
tsk->snt_unacked -= msg_conn_ack(hdr);
msg_conn_ack() is read straight from a received CONN_MANAGER/CONN_ACK
message. If the ack count is larger than snt_unacked, the subtraction
wraps to a near-maximum value, leaving tsk_conn_cong() permanently true
and starving the connection of further transmits.
Validate the ACK count at the start of the CONN_ACK block and drop the
message if it acknowledges more messages than are outstanding. A peer (or,
for a local connection, the connected peer socket) can otherwise wedge a
TIPC connection's send side by sending an oversized connection ack.
Fixes: 10724cc7bb78 ("tipc: redesign connection-level flow control")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260610124003.3831170-3-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/socket.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 5adfd0d854a2b2..321f3317e3271c 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1354,6 +1354,9 @@ static void tipc_sk_conn_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb,
__skb_queue_tail(xmitq, skb);
return;
} else if (mtyp == CONN_ACK) {
+ if (tsk->snt_unacked < msg_conn_ack(hdr))
+ goto exit;
+
was_cong = tsk_conn_cong(tsk);
tipc_sk_push_backlog(tsk, msg_nagle_ack(hdr));
tsk->snt_unacked -= msg_conn_ack(hdr);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 261/699] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 260/699] tipc: prevent snt_unacked underflow on CONN_ACK Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 262/699] crypto: cavium/cpt " Greg Kroah-Hartman
` (441 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 7891c64c0520519782470ba29bac8a5761e295d8 ]
The sg_cleanup path used list[i] instead of list[j] when unmapping DMA
buffers, leaking successfully mapped entries and repeatedly unmapping
the failed one.
Fixes: 10b4f09491bf ("crypto: marvell - add the Virtual Function driver for CPT")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c b/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c
index c80baf1ad90b2f..89030e2711ce41 100644
--- a/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c
+++ b/drivers/crypto/marvell/octeontx/otx_cptvf_reqmgr.c
@@ -157,8 +157,8 @@ static inline int setup_sgio_components(struct pci_dev *pdev,
sg_cleanup:
for (j = 0; j < i; j++) {
if (list[j].dma_addr) {
- dma_unmap_single(&pdev->dev, list[i].dma_addr,
- list[i].size, DMA_BIDIRECTIONAL);
+ dma_unmap_single(&pdev->dev, list[j].dma_addr,
+ list[j].size, DMA_BIDIRECTIONAL);
}
list[j].dma_addr = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 262/699] crypto: cavium/cpt - fix DMA cleanup using wrong loop index
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 261/699] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 263/699] crypto: rng - Free default RNG on module exit Greg Kroah-Hartman
` (440 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Felix Gu, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Gu <ustc.gu@gmail.com>
[ Upstream commit 9dbf173bd32d5f81b005008b682bfb50aa093455 ]
The sg_cleanup error path used list[i] instead of list[j] when unmapping
DMA buffers, leaking successfully mapped entries and repeatedly unmapping
the failed one.
Fixes: c694b233295b ("crypto: cavium - Add the Virtual Function driver for CPT")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/cavium/cpt/cptvf_reqmanager.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
index 4fe7898c85615a..fb55c5b1ddedbd 100644
--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
+++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c
@@ -108,8 +108,8 @@ static int setup_sgio_components(struct cpt_vf *cptvf, struct buf_ptr *list,
sg_cleanup:
for (j = 0; j < i; j++) {
if (list[j].dma_addr) {
- dma_unmap_single(&pdev->dev, list[i].dma_addr,
- list[i].size, DMA_BIDIRECTIONAL);
+ dma_unmap_single(&pdev->dev, list[j].dma_addr,
+ list[j].size, DMA_BIDIRECTIONAL);
}
list[j].dma_addr = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 263/699] crypto: rng - Free default RNG on module exit
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 262/699] crypto: cavium/cpt " Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 264/699] spi: xilinx: use FIFO occupancy register to determine buffer size Greg Kroah-Hartman
` (439 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 606ba888b98e0d26a2c4e5c8dc0542e3ad8f0f3a ]
When the rng module is removed the default RNG will be leaked.
Call crypto_del_default_rng to free it if possible.
Fixes: 7cecadb7cca8 ("crypto: rng - Do not free default RNG when it becomes unused")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/rng.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/crypto/rng.c b/crypto/rng.c
index a2bf2efb7937f9..5992cdb392c50a 100644
--- a/crypto/rng.c
+++ b/crypto/rng.c
@@ -232,5 +232,16 @@ void crypto_unregister_rngs(struct rng_alg *algs, int count)
}
EXPORT_SYMBOL_GPL(crypto_unregister_rngs);
+static void __exit rng_exit(void)
+{
+ int err;
+
+ err = crypto_del_default_rng();
+ if (err)
+ pr_err("Failed delete default RNG: %d\n", err);
+}
+
+module_exit(rng_exit);
+
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Random Number Generator");
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 264/699] spi: xilinx: use FIFO occupancy register to determine buffer size
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 263/699] crypto: rng - Free default RNG on module exit Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 265/699] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Greg Kroah-Hartman
` (438 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars Pöschel, Michal Simek,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lars Pöschel <lars.poeschel@edag.com>
[ Upstream commit 47f3b5365536e8c38f264824ab15fdb74454e066 ]
The method the driver uses to determine the size of the FIFO has a
problem. What it currently does is this:
It stops the SPI hardware and writes to the TX FIFO register until TX
FIFO FULL asserts in the status register. But the hardware does not only
have the FIFO, it also has a shift register which can hold a byte. This
can be seen, when writing a byte to the FIFO (while the SPI hardware is
stopped,) the TX FIFO EMPTY is still empty. So, if we have a FIFO size
of 16 for example, the current method returns a 17.
This is a problem, at least when using the driver in irq mode. The same
size determined for the TX FIFO is also assumed for the RX FIFO. When a
SPI transaction wants to write the amount of the FIFO size or more
bytes, the following happens, for example with 16 bytes FIFO size:
The driver stops the SPI hardware and writes 17 bytes to the TX FIFO and
starts the SPI hardware and goes sleep.
The hardware then shifts out 17 bytes (FIFO + shift register) and
simultaneously reads bytes into the RX FIFO, but it only has 16 places,
so it looses one byte. Then TX FIFO empty asserts, wakes the driver
again, which has a fast path and reads 16 bytes from the RX FIFO, but
before reading the last 17th byte (which is lost) it does this:
sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
if (!(sr & XSPI_SR_RX_EMPTY_MASK)) {
xilinx_spi_rx(xspi);
rx_words--;
}
It reads the status register and checks if the RX FIFO is not empty.
But it is empty in our case. So this check spins in a while loop
forever locking the driver.
This patch fixes the logic to determine the FIFO size.
Fixes: 4c9a761402d7 ("spi/xilinx: Simplify spi_fill_tx_fifo")
Signed-off-by: Lars Pöschel <lars.poeschel@edag.com>
Reviewed-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/20260612105244.9076-1-lars.poeschel.linux@edag.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-xilinx.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c
index d497fc4bc19ebd..337ccdaa057c2c 100644
--- a/drivers/spi/spi-xilinx.c
+++ b/drivers/spi/spi-xilinx.c
@@ -369,11 +369,18 @@ static int xilinx_spi_find_buffer_size(struct xilinx_spi *xspi)
xspi->regs + XIPIF_V123B_RESETR_OFFSET);
/* Fill the Tx FIFO with as many words as possible */
- do {
+ while (1) {
xspi->write_fn(0, xspi->regs + XSPI_TXD_OFFSET);
sr = xspi->read_fn(xspi->regs + XSPI_SR_OFFSET);
+ if (sr & XSPI_SR_TX_FULL_MASK)
+ break;
+
n_words++;
- } while (!(sr & XSPI_SR_TX_FULL_MASK));
+ }
+
+ /* Handle the NO FIFO case separately */
+ if (!n_words)
+ return 1;
return n_words;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 265/699] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 264/699] spi: xilinx: use FIFO occupancy register to determine buffer size Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 266/699] net/sched: sch_codel: " Greg Kroah-Hartman
` (437 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anirudh Gupta, Jamal Hadi Salim,
Victor Nogueira, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <victor@mojatatu.com>
[ Upstream commit 097f6fc7b1ae362dd7a9444b2572162fda73b284 ]
Whenever fq_codel drops packets during peek, it calls
qdisc_tree_reduce_backlog. An issue arises because it calls
qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops
to zero, but peek returns an skb, the parent's qlen_notify callback will be
executed even though fq_codel still has 1 packet on the queue and, thus,
will mistakenly deactivate the parent's class causing issues like a recent
report [1] and a wild memory access in qfq:
[ 29.371146][ T360] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
[ 29.371666][ T360] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
[ 29.371987][ T360] CPU: 6 UID: 0 PID: 360 Comm: tc Not tainted 7.1.0-rc5-00285-gc530e5b2dbc6-dirty #82 PREEMPT(full)
[ 29.372384][ T360] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 29.372620][ T360] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq
[ 29.373544][ T360] RSP: 0018:ffff888102417370 EFLAGS: 00010216
[ 29.373800][ T360] RAX: 0000000000000000 RBX: ffff88811224d568 RCX: dffffc0000000000
[ 29.374079][ T360] RDX: 1ffff11021fe1543 RSI: ffff88810ff0aa00 RDI: dffffc0000000000
[ 29.374368][ T360] RBP: ffff88811224c280 R08: dead000000000122 R09: 1bd5a00000000024
[ 29.374649][ T360] R10: fffffbfff7940329 R11: fffffbfff7940329 R12: 0000000000000000
[ 29.374926][ T360] R13: dead000000000100 R14: ffff88811224d580 R15: ffff88811224d578
[ 29.375207][ T360] FS: 00007f5b794e5780(0000) GS:ffff88815d1e9000(0000) knlGS:0000000000000000
[ 29.375545][ T360] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 29.375823][ T360] CR2: 000055ffb091f000 CR3: 000000010a305000 CR4: 0000000000750ef0
[ 29.376103][ T360] PKRU: 55555554
[ 29.376258][ T360] Call Trace:
[ 29.376401][ T360] <TASK>
...
[ 29.376885][ T360] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq
[ 29.377074][ T360] qdisc_reset (net/sched/sch_generic.c:1057)
[ 29.377414][ T360] __qdisc_destroy (net/sched/sch_generic.c:1096)
[ 29.377600][ T360] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)
[ 29.378593][ T360] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)
Fix this by only calling qdisc_tree_reduce_backlog in peek after the
qlen is restored.
[1] http://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Fixes: 342debc12183 ("codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()")
Reported-by: Anirudh Gupta <anirudhrudr@gmail.com>
Closes: https://lore.kernel.org/netdev/CAN2cbVe79oj0O9==m4+4x3v+O+qzRagA=2=wkrp9i9=CqYvyZA@mail.gmail.com/
Tested-by: Anirudh Gupta <anirudhrudr@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260610192855.3121513-2-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_fq_codel.c | 41 ++++++++++++++++++++++++++++++++++++++--
1 file changed, 39 insertions(+), 2 deletions(-)
diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
index 10bdc0de394cc5..ae1d19bb6c5561 100644
--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -278,7 +278,7 @@ static void drop_func(struct sk_buff *skb, void *ctx)
qdisc_qstats_drop(sch);
}
-static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
+static struct sk_buff *__fq_codel_dequeue(struct Qdisc *sch)
{
struct fq_codel_sched_data *q = qdisc_priv(sch);
struct sk_buff *skb;
@@ -315,12 +315,49 @@ static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
qdisc_bstats_update(sch, skb);
flow->deficit -= qdisc_pkt_len(skb);
+ return skb;
+}
+
+static void fq_codel_dequeue_drop(struct Qdisc *sch)
+{
+ struct fq_codel_sched_data *q = qdisc_priv(sch);
+
if (q->cstats.drop_count) {
qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
q->cstats.drop_len);
q->cstats.drop_count = 0;
q->cstats.drop_len = 0;
}
+}
+
+static struct sk_buff *fq_codel_dequeue(struct Qdisc *sch)
+{
+ struct sk_buff *skb;
+
+ skb = __fq_codel_dequeue(sch);
+
+ fq_codel_dequeue_drop(sch);
+
+ return skb;
+}
+
+static struct sk_buff *fq_codel_peek(struct Qdisc *sch)
+{
+ struct sk_buff *skb = skb_peek(&sch->gso_skb);
+
+ if (!skb) {
+ skb = __fq_codel_dequeue(sch);
+
+ if (skb) {
+ __skb_queue_head(&sch->gso_skb, skb);
+ /* it's still part of the queue */
+ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ }
+
+ fq_codel_dequeue_drop(sch);
+ }
+
return skb;
}
@@ -702,7 +739,7 @@ static struct Qdisc_ops fq_codel_qdisc_ops __read_mostly = {
.priv_size = sizeof(struct fq_codel_sched_data),
.enqueue = fq_codel_enqueue,
.dequeue = fq_codel_dequeue,
- .peek = qdisc_peek_dequeued,
+ .peek = fq_codel_peek,
.init = fq_codel_init,
.reset = fq_codel_reset,
.destroy = fq_codel_destroy,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 266/699] net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 265/699] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 267/699] kcm: use WRITE_ONCE() when changing lower socket callbacks Greg Kroah-Hartman
` (436 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jamal Hadi Salim, Victor Nogueira,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Victor Nogueira <victor@mojatatu.com>
[ Upstream commit 52f1da34c9f4d5bdc1e8b44242da5c7ba8db85f3 ]
Whenever codel drops packets during peek, it calls
qdisc_tree_reduce_backlog. An issue arises because it calls
qdisc_tree_reduce_backlog before it reincrements the qlen. If qlen drops
to zero, but peek returns an skb, the parent's qlen_notify callback will
be executed even though codel still has 1 packet on the queue and, thus,
will mistakenly deactivate the parent's class causing issues like a wild
memory access when qfq has codel as a child:
[ 36.339843][ T370] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
[ 36.340408][ T370] KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
[ 36.340737][ T370] CPU: 2 UID: 0 PID: 370 Comm: tc Not tainted 7.1.0-rc5-00287-g66e13b626592 #87 PREEMPT(full)
[ 36.341113][ T370] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 36.341357][ T370] RIP: 0010:qfq_deactivate_agg (include/linux/list.h:1029 (discriminator 2) include/linux/list.h:1043 (discriminator 2) net/sched/sch_qfq.c:1369 (discriminator 2) net/sched/sch_qfq.c:1395 (discriminator 2)) sch_qfq
[ 36.342221][ T370] RSP: 0018:ffff8881100ef370 EFLAGS: 00010216
[ 36.342422][ T370] RAX: 0000000000000000 RBX: ffff8881058a9568 RCX: dffffc0000000000
[ 36.342664][ T370] RDX: 1ffff11021064dc3 RSI: ffff888108326e00 RDI: dffffc0000000000
[ 36.342905][ T370] RBP: ffff8881058a8280 R08: dead000000000122 R09: 1bd5a00000000024
[ 36.343140][ T370] R10: fffffbfff2940329 R11: fffffbfff2940329 R12: 0000000000000000
[ 36.343383][ T370] R13: dead000000000100 R14: ffff8881058a9580 R15: ffff8881058a9578
[ 36.343631][ T370] FS: 00007fc04b0ca780(0000) GS:ffff888184fef000(0000) knlGS:0000000000000000
[ 36.343911][ T370] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.344116][ T370] CR2: 0000557c02c02000 CR3: 000000010e0ba000 CR4: 0000000000750ef0
[ 36.344359][ T370] PKRU: 55555554
[ 36.344481][ T370] Call Trace:
...
[ 36.345054][ T370] qfq_reset_qdisc (net/sched/sch_qfq.c:357 net/sched/sch_qfq.c:1487) sch_qfq
[ 36.345222][ T370] qdisc_reset (net/sched/sch_generic.c:1057)
[ 36.345503][ T370] __qdisc_destroy (net/sched/sch_generic.c:1096)
[ 36.345677][ T370] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159)
[ 36.346335][ T370] tc_get_qdisc (net/sched/sch_api.c:1528 net/sched/sch_api.c:1556)
Fix this by only calling qdisc_tree_reduce_backlog in peek after the
qlen is restored.
Fixes: 342debc12183 ("codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()")
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260610192855.3121513-3-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_codel.c | 48 ++++++++++++++++++++++++++++++++++++++-----
1 file changed, 43 insertions(+), 5 deletions(-)
diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c
index 0d4228bfd1a02f..1cd09d3fe5efe9 100644
--- a/net/sched/sch_codel.c
+++ b/net/sched/sch_codel.c
@@ -86,7 +86,7 @@ static void drop_func(struct sk_buff *skb, void *ctx)
qdisc_qstats_drop(sch);
}
-static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
+static struct sk_buff *__codel_qdisc_dequeue(struct Qdisc *sch)
{
struct codel_sched_data *q = qdisc_priv(sch);
struct sk_buff *skb;
@@ -95,13 +95,51 @@ static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
&q->stats, qdisc_pkt_len, codel_get_enqueue_time,
drop_func, dequeue_func);
+ if (skb)
+ qdisc_bstats_update(sch, skb);
+ return skb;
+}
+
+static void codel_dequeue_drop(struct Qdisc *sch)
+{
+ struct codel_sched_data *q = qdisc_priv(sch);
+
if (q->stats.drop_count) {
- qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
+ qdisc_tree_reduce_backlog(sch, q->stats.drop_count,
+ q->stats.drop_len);
q->stats.drop_count = 0;
q->stats.drop_len = 0;
}
- if (skb)
- qdisc_bstats_update(sch, skb);
+}
+
+static struct sk_buff *codel_qdisc_dequeue(struct Qdisc *sch)
+{
+ struct sk_buff *skb;
+
+ skb = __codel_qdisc_dequeue(sch);
+
+ codel_dequeue_drop(sch);
+
+ return skb;
+}
+
+static struct sk_buff *codel_peek(struct Qdisc *sch)
+{
+ struct sk_buff *skb = skb_peek(&sch->gso_skb);
+
+ if (!skb) {
+ skb = __codel_qdisc_dequeue(sch);
+
+ if (skb) {
+ __skb_queue_head(&sch->gso_skb, skb);
+ /* it's still part of the queue */
+ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ }
+
+ codel_dequeue_drop(sch);
+ }
+
return skb;
}
@@ -279,7 +317,7 @@ static struct Qdisc_ops codel_qdisc_ops __read_mostly = {
.enqueue = codel_qdisc_enqueue,
.dequeue = codel_qdisc_dequeue,
- .peek = qdisc_peek_dequeued,
+ .peek = codel_peek,
.init = codel_init,
.reset = codel_reset,
.change = codel_change,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 267/699] kcm: use WRITE_ONCE() when changing lower socket callbacks
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 266/699] net/sched: sch_codel: " Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 268/699] netfilter: nf_conncount: callers must hold rcu read lock Greg Kroah-Hartman
` (435 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 47186409c092cd7dd70350999186c700233e854d ]
kcm_attach() replaces a live lower TCP socket's sk_data_ready and
sk_write_space callbacks with KCM handlers, and kcm_unattach() restores
them later. Those callback-pointer updates are still plain stores even
though the same fields can be read and invoked concurrently on other
CPUs.
If another CPU observes an older callback snapshot after the live field
has already been restored, callback execution can run with a mismatched
target and sk_user_data state, leading to stale or misdirected wakeups.
Use WRITE_ONCE() for the callback replacement and restore operations so
these shared callback fields follow the same visibility contract already
established by the earlier 4022 fixes.
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260611053543.2429462-1-runyu.xiao@seu.edu.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/kcm/kcmsock.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 2f2840aa4a8129..df3ca6a9791e6c 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1404,8 +1404,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
psock->save_write_space = csk->sk_write_space;
psock->save_state_change = csk->sk_state_change;
csk->sk_user_data = psock;
- csk->sk_data_ready = psock_data_ready;
- csk->sk_write_space = psock_write_space;
+ WRITE_ONCE(csk->sk_data_ready, psock_data_ready);
+ WRITE_ONCE(csk->sk_write_space, psock_write_space);
csk->sk_state_change = psock_state_change;
write_unlock_bh(&csk->sk_callback_lock);
@@ -1481,8 +1481,8 @@ static void kcm_unattach(struct kcm_psock *psock)
*/
write_lock_bh(&csk->sk_callback_lock);
csk->sk_user_data = NULL;
- csk->sk_data_ready = psock->save_data_ready;
- csk->sk_write_space = psock->save_write_space;
+ WRITE_ONCE(csk->sk_data_ready, psock->save_data_ready);
+ WRITE_ONCE(csk->sk_write_space, psock->save_write_space);
csk->sk_state_change = psock->save_state_change;
strp_stop(&psock->strp);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 268/699] netfilter: nf_conncount: callers must hold rcu read lock
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 267/699] kcm: use WRITE_ONCE() when changing lower socket callbacks Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 269/699] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Greg Kroah-Hartman
` (434 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 64d7d5abe2160bba369b4a8f06bdf5630573bab0 ]
rcu_derefence_raw() should not have been used here, it concealed this bug.
Its used because struct rb_node lacks __rcu annotated pointers, so plain
rcu_derefence causes sparse warnings.
The major tradeoff is that rcu_derefence_raw() doesn't warn when the caller
isn't in a rcu read section.
Extend the rcu read lock scope accordingly and cause sparse warnings,
those warnings are the lesser evil.
Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit")
Closes: https://sashiko.dev/#/patchset/20260603230610.7900-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conncount.c | 6 +++---
net/openvswitch/conntrack.c | 2 +-
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index ae9ad439449fa5..b9265a8cdb2bc4 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -499,7 +499,7 @@ count_tree(struct net *net,
hash = jhash2(key, data->keylen, conncount_rnd) % CONNCOUNT_SLOTS;
root = &data->root[hash];
- parent = rcu_dereference_raw(root->rb_node);
+ parent = rcu_dereference(root->rb_node);
while (parent) {
int diff;
@@ -507,9 +507,9 @@ count_tree(struct net *net,
diff = key_diff(key, rbconn->key, data->keylen);
if (diff < 0) {
- parent = rcu_dereference_raw(parent->rb_left);
+ parent = rcu_dereference(parent->rb_left);
} else if (diff > 0) {
- parent = rcu_dereference_raw(parent->rb_right);
+ parent = rcu_dereference(parent->rb_right);
} else {
int ret;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index 2a106d03a2011a..50a345ccd94309 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -2076,10 +2076,10 @@ static int ovs_ct_limit_get_zone_limit(struct net *net,
} else {
rcu_read_lock();
limit = ct_limit_get(info, zone);
- rcu_read_unlock();
err = __ovs_ct_limit_get_zone_limit(
net, info->data, zone, limit, reply);
+ rcu_read_unlock();
if (err)
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 269/699] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 268/699] netfilter: nf_conncount: callers must hold rcu read lock Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 270/699] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Greg Kroah-Hartman
` (433 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Xinyu Ma, Jiayuan Chen,
Emil Tsalapatis, Kuniyuki Iwashima, Weiming Shi,
Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit 0c0a8ed85349dae298712d79cb276acfeb794d82 ]
When the scatterlist ring is full or nearly full, bpf_msg_push_data()
enters a copy fallback path and computes copy + len for the page
allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING
and both are u32, a crafted len can wrap the sum to a small value,
causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
Call Trace:
__asan_memcpy (mm/kasan/shadow.c:105)
bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)
bpf_prog_9ed8b5711920a7d7+0x2e/0x36
sk_psock_msg_verdict (net/core/skmsg.c:934)
tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)
__sys_sendto (net/socket.c:2206)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add an overflow check before the allocation.
Link: https://lore.kernel.org/all/20260424155913.A19FDC19425@smtp.kernel.org
Fixes: 6fff607e2f14 ("bpf: sk_msg program helper bpf_msg_push_data")
Tested-by: Xiang Mei <xmei5@asu.edu>
Tested-by: Xinyu Ma <mmmxny@gmail.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://lore.kernel.org/r/20260615021959.140010-2-jiayuan.chen@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index 0ce845d58f09a4..a767f46741f8e9 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2819,6 +2819,9 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_msg *, msg, u32, start,
if (!space || (space == 1 && start != offset))
copy = msg->sg.data[i].length;
+ if (unlikely(copy + len < copy))
+ return -EINVAL;
+
page = alloc_pages(__GFP_NOWARN | GFP_ATOMIC | __GFP_COMP,
get_order(copy + len));
if (unlikely(!page))
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 270/699] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 269/699] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 271/699] MIPS: mm: Fix out-of-bounds write in maar_res_walk() Greg Kroah-Hartman
` (432 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Emil Tsalapatis,
Kuniyuki Iwashima, Sechang Lim, Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sechang Lim <rhkrqnwk98@gmail.com>
[ Upstream commit a48802fb2cd2d1e23651989f8ff4d15e9d5dad54 ]
start and len are u32, so
u64 last = start + len;
evaluates start + len in 32-bit and wraps before storing it in last.
The bounds check
if (start >= offset + l || last > msg->sg.size)
return -EINVAL;
can then be passed with an out-of-range start/len, after which the pop
loop runs off the end of the scatterlist and sk_msg_shift_left() calls
put_page() on the empty msg->sg.end slot:
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]
RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]
RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984
Call Trace:
<TASK>
bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8
bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746
sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934
tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]
tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583
__sock_sendmsg+0x153/0x1c0 net/socket.c:802
__sys_sendto+0x326/0x430 net/socket.c:2265
__x64_sys_sendto+0xe3/0x100 net/socket.c:2268
do_syscall_64+0x14c/0x480
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Widen the addition with a (u64) cast so the bound is evaluated in
64-bit and a len near U32_MAX no longer wraps below msg->sg.size.
While here, change pop from int to u32. It counts bytes against the
unsigned scatterlist lengths and can never be negative, so the signed
type only invites sign-confusion in the pop loop.
Fixes: 7246d8ed4dcc ("bpf: helper to pop data from messages")
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://lore.kernel.org/r/20260615021959.140010-6-jiayuan.chen@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index a767f46741f8e9..18d8094d87591a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2985,8 +2985,8 @@ BPF_CALL_4(bpf_msg_pop_data, struct sk_msg *, msg, u32, start,
u32, len, u64, flags)
{
u32 i = 0, l = 0, space, offset = 0;
- u64 last = start + len;
- int pop;
+ u64 last = (u64)start + len;
+ u32 pop;
if (unlikely(flags))
return -EINVAL;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 271/699] MIPS: mm: Fix out-of-bounds write in maar_res_walk()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 270/699] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 272/699] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Greg Kroah-Hartman
` (431 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yadan Fan, Thomas Bogendoerfer,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yadan Fan <ydfan@suse.com>
[ Upstream commit 1b001b16bc88f3f7817e228acfd91ee01bdcfcce ]
maar_res_walk() uses wi->num_cfg as the index into the fixed-size
wi->cfg array, but checks whether the array is full only after it has
filled the selected entry. If walk_system_ram_range() reports more than
16 memory ranges, the overflow call writes one struct maar_config past
the end of the array before WARN_ON() prevents num_cfg from advancing.
Move the full-array check before taking the array slot and return non-zero
when the scratch array is full, so walk_system_ram_range() terminates the
walk instead of invoking the callback for further ranges.
Fixes: a5718fe8f70f ("MIPS: mm: Drop boot_mem_map")
Signed-off-by: Yadan Fan <ydfan@suse.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/mm/init.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/mips/mm/init.c b/arch/mips/mm/init.c
index 32e7b869a29105..bd819340d1ffae 100644
--- a/arch/mips/mm/init.c
+++ b/arch/mips/mm/init.c
@@ -277,9 +277,15 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
void *data)
{
struct maar_walk_info *wi = data;
- struct maar_config *cfg = &wi->cfg[wi->num_cfg];
+ struct maar_config *cfg;
unsigned int maar_align;
+ /* Ensure we don't overflow the cfg array */
+ if (WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
+ return -1;
+
+ cfg = &wi->cfg[wi->num_cfg];
+
/* MAAR registers hold physical addresses right shifted by 4 bits */
maar_align = BIT(MIPS_MAAR_ADDR_SHIFT + 4);
@@ -288,9 +294,7 @@ static int maar_res_walk(unsigned long start_pfn, unsigned long nr_pages,
cfg->upper = ALIGN_DOWN(PFN_PHYS(start_pfn + nr_pages), maar_align) - 1;
cfg->attrs = MIPS_MAAR_S;
- /* Ensure we don't overflow the cfg array */
- if (!WARN_ON(wi->num_cfg >= ARRAY_SIZE(wi->cfg)))
- wi->num_cfg++;
+ wi->num_cfg++;
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 272/699] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 271/699] MIPS: mm: Fix out-of-bounds write in maar_res_walk() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 273/699] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Greg Kroah-Hartman
` (430 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shrikanth Hegde, Aboorva Devarajan,
Madhavan Srinivasan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
[ Upstream commit 81e3a86030462824a67d697739cf3f387f4ba350 ]
fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at
the 'out:' label, but only calls the matching get_cpu_var() after the
'i < 0' early-return check. When event->hw.idx is negative the
function jumps to 'out:' without having taken get_cpu_var(), and the
trailing put_cpu_var() then issues an unmatched preempt_enable(),
underflowing preempt_count.
On a CONFIG_PREEMPT=y kernel preempt_count would underflow and
eventually present as a 'scheduling while atomic' BUG.
Move put_cpu_var() to pair with get_cpu_var() so the percpu access is
correctly bracketed and the 'out:' label only handles perf_pmu_enable.
Fixes: a11106544f33 ("powerpc/perf: e500 support")
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260605082912.305100-2-aboorvad@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/perf/core-fsl-emb.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-emb.c
index 1a53ab08447cbe..31037df4178ca2 100644
--- a/arch/powerpc/perf/core-fsl-emb.c
+++ b/arch/powerpc/perf/core-fsl-emb.c
@@ -366,9 +366,10 @@ static void fsl_emb_pmu_del(struct perf_event *event, int flags)
cpuhw->n_events--;
+ put_cpu_var(cpu_hw_events);
+
out:
perf_pmu_enable(event->pmu);
- put_cpu_var(cpu_hw_events);
}
static void fsl_emb_pmu_start(struct perf_event *event, int ef_flags)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 273/699] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 272/699] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 274/699] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Greg Kroah-Hartman
` (429 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aboorva Devarajan,
Madhavan Srinivasan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
[ Upstream commit 0ecd26e93e698c8327521910fc6296f5b84a4b92 ]
pnv_kexec_wait_secondaries_down() calls get_cpu() to obtain the current
CPU id but never calls the matching put_cpu(), leaking one
preempt_disable() nesting level on every invocation.
In practice the imbalance does not trigger a visible splat because the
kexec teardown path is a one-way trip: IRQs are already disabled, no
schedule() occurs after the leak, and default_machine_kexec() overwrites
preempt_count with HARDIRQ_OFFSET before jumping into kexec_sequence()
which never returns. However the bookkeeping is still wrong.
The function only needs the current CPU id, and this path runs with
interrupts disabled and the CPU pinned, so the preempt_disable()
side-effect of get_cpu() is unnecessary. Replace it with
raw_smp_processor_id().
Fixes: 298b34d7d578 ("powerpc/powernv: Fix kexec races going back to OPAL")
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260605082912.305100-3-aboorvad@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/setup.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c
index 1a2f12dc05525c..7b2f83a737d686 100644
--- a/arch/powerpc/platforms/powernv/setup.c
+++ b/arch/powerpc/platforms/powernv/setup.c
@@ -362,7 +362,8 @@ static void pnv_kexec_wait_secondaries_down(void)
{
int my_cpu, i, notified = -1;
- my_cpu = get_cpu();
+ /* Called with interrupts disabled, so the CPU is pinned. */
+ my_cpu = raw_smp_processor_id();
for_each_online_cpu(i) {
uint8_t status;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 274/699] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 273/699] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 275/699] KEYS: Use acquire when reading state in keyring search Greg Kroah-Hartman
` (428 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aboorva Devarajan, Shrikanth Hegde,
Madhavan Srinivasan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aboorva Devarajan <aboorvad@linux.ibm.com>
[ Upstream commit 5c86f1c1f972761a04bf22f4c0618d1aa714185b ]
kexec_prepare_cpus_wait() calls get_cpu() internally to obtain the
current CPU id. kexec_prepare_cpus() calls kexec_prepare_cpus_wait()
twice -- once for KEXEC_STATE_IRQS_OFF and once for
KEXEC_STATE_REAL_MODE -- but only issues a single put_cpu() at the end,
leaving preempt_count elevated by one extra nesting level.
In practice the imbalance does not trigger a 'scheduling while atomic'
splat because the kexec path is a one-way trip: IRQs are already
disabled, no schedule() occurs after the leak, and
default_machine_kexec() overwrites preempt_count with HARDIRQ_OFFSET
before jumping into kexec_sequence() which never returns. However the
bookkeeping is still wrong.
kexec_prepare_cpus() calls local_irq_disable()/hard_irq_disable()
before invoking kexec_prepare_cpus_wait(), so the CPU is already pinned
and the get_cpu()/put_cpu() preempt_disable() bracketing is unnecessary.
Only the current CPU id is needed, so replace get_cpu() with
raw_smp_processor_id() and drop the now-unneeded put_cpu().
Fixes: 1fc711f7ffb0 ("powerpc/kexec: Fix race in kexec shutdown")
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260605082912.305100-4-aboorvad@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kexec/core_64.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/arch/powerpc/kexec/core_64.c b/arch/powerpc/kexec/core_64.c
index 8a449b2d8715d8..348120e3c0ea53 100644
--- a/arch/powerpc/kexec/core_64.c
+++ b/arch/powerpc/kexec/core_64.c
@@ -163,7 +163,7 @@ static void kexec_prepare_cpus_wait(int wait_state)
int my_cpu, i, notified=-1;
hw_breakpoint_disable();
- my_cpu = get_cpu();
+ my_cpu = raw_smp_processor_id();
/* Make sure each CPU has at least made it to the state we need.
*
* FIXME: There is a (slim) chance of a problem if not all of the CPUs
@@ -242,8 +242,6 @@ static void kexec_prepare_cpus(void)
/* after we tell the others to go down */
if (ppc_md.kexec_cpu_down)
ppc_md.kexec_cpu_down(0, 0);
-
- put_cpu();
}
#else /* ! SMP */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 275/699] KEYS: Use acquire when reading state in keyring search
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 274/699] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 276/699] tipc: fix UAF in tipc_l2_send_msg() Greg Kroah-Hartman
` (427 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Jarkko Sakkinen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
[ Upstream commit c1201b37f666f6466ab1fd3a381c2b7a4b7e9fee ]
The negative-key race fix added release/acquire ordering for key use.
Publish payload before state; read state before payload.
keyring_search_iterator() still uses READ_ONCE() before match callbacks.
An asymmetric match callback calls asymmetric_key_ids(), which reads
key->payload.data[asym_key_ids].
Use key_read_state() there to complete that ordering.
Fixes: 363b02dab09b ("KEYS: Fix race between updating and finding a negative key")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20260529033406.20673-1-hanguidong02@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/keys/keyring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 9f0fc81a3a7b95..3f609316a096e9 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -576,7 +576,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
struct keyring_search_context *ctx = iterator_data;
const struct key *key = keyring_ptr_to_key(object);
unsigned long kflags = READ_ONCE(key->flags);
- short state = READ_ONCE(key->state);
+ short state = key_read_state(key);
kenter("{%d}", key->serial);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 276/699] tipc: fix UAF in tipc_l2_send_msg()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 275/699] KEYS: Use acquire when reading state in keyring search Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 277/699] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) Greg Kroah-Hartman
` (426 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+64ec81389cbad56a8c35,
Eric Dumazet, Jon Maloy, Tung Nguyen, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit f4c3d89fc986b0da196ddfc6cfe0ea5d5d08bec6 ]
Syzbot reported a slab-use-after-free in ipvlan_hard_header() when
called from tipc_l2_send_msg().
The root cause is that tipc_disable_l2_media() calls synchronize_net()
while b->media_ptr is still valid. This allows concurrent RCU readers
to obtain the device pointer after synchronize_net() has finished.
The pointer is cleared later in bearer_disable(), but without any
subsequent synchronization, allowing the device to be freed while
still in use by readers.
Fix this by clearing b->media_ptr in tipc_disable_l2_media() before
calling synchronize_net().
This is safe to do now because the call order in bearer_disable()
was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic")
to call tipc_node_delete_links() (which needs the pointer) before
disable_media().
Fixes: 282b3a056225 ("tipc: send out RESET immediately when link goes down")
https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
Reported-by: syzbot+64ec81389cbad56a8c35@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jon Maloy <jmaloy@redhat.com>
Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Link: https://patch.msgid.link/20260612135949.4010482-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/bearer.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index 69dfb043100858..7f4d825dc775df 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -469,6 +469,7 @@ void tipc_disable_l2_media(struct tipc_bearer *b)
dev = (struct net_device *)rtnl_dereference(b->media_ptr);
dev_remove_pack(&b->pt);
RCU_INIT_POINTER(dev->tipc_ptr, NULL);
+ RCU_INIT_POINTER(b->media_ptr, NULL);
synchronize_net();
dev_put(dev);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 277/699] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 276/699] tipc: fix UAF in tipc_l2_send_msg() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 278/699] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Greg Kroah-Hartman
` (425 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+ebdb22d461c904fc3cb2,
Eric Dumazet, Kuniyuki Iwashima, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 ]
When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535).
This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535.
However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel.
If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will
be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer
dereference because local TCP packets do not use frag_list.
Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from
ip6_default_advmss() when MTU is large.
Also update the stale comment in ip6_default_advmss() which suggested
that IPV6_MAXPLEN is returned to mean "any MSS".
Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes")
Reported-by: syzbot+ebdb22d461c904fc3cb2@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a2c3193.8812e0fc.3c3fa4.0001.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612162517.83394-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/route.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9726c5002dbdfc..039e1304b03136 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3072,11 +3072,11 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst)
/*
* Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
* corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
- * IPV6_MAXPLEN is also valid and means: "any MSS,
- * rely only on pmtu discovery"
+ * Limit the default MSS to GSO_BY_FRAGS - 1 to avoid
+ * collision with the GSO_BY_FRAGS magic value (0xFFFF).
*/
if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
- mtu = IPV6_MAXPLEN;
+ mtu = min_t(unsigned int, IPV6_MAXPLEN, GSO_BY_FRAGS - 1);
return mtu;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 278/699] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 277/699] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 279/699] net/9p: fix race condition on rdma->state in trans_rdma.c Greg Kroah-Hartman
` (424 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b225d4dfce6219600c42,
Aleksandr Nogikh, Heming Zhao, Mark Fasheh, Joel Becker,
Junxiao Bi, Joseph Qi, Changwei Ge, Jun Piao, Andrew Morton,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <nogikh@google.com>
[ Upstream commit ff6f26c58421614b02694ac9d219ac61d924bc68 ]
A circular locking dependency involves INODE_ALLOC_SYSTEM_INODE,
EXTENT_ALLOC_SYSTEM_INODE, and ORPHAN_DIR_SYSTEM_INODE.
1. ocfs2_mknod() acquires INODE_ALLOC then EXTENT_ALLOC.
2. ocfs2_dio_end_io_write() acquires EXTENT_ALLOC for unwritten
extents, then ORPHAN_DIR via ocfs2_del_inode_from_orphan() while still
holding EXTENT_ALLOC.
3. ocfs2_wipe_inode() acquires ORPHAN_DIR then INODE_ALLOC via
ocfs2_remove_inode.
Break the cycle in ocfs2_dio_end_io_write() by freeing the allocation
contexts (releasing EXTENT_ALLOC) before acquiring ORPHAN_DIR.
WARNING: possible circular locking dependency detected
------------------------------------------------------
is trying to acquire lock:
ffff8881e78b33a0
(&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}, at:
ocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299
but task is already holding lock:
ffff8881e78b4fa0
(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}, at:
ocfs2_evict_inode+0xe97/0x43b0 fs/ocfs2/inode.c:1299
the existing dependency chain (in reverse order) is:
-> #2 (&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]){+.+.}-{4:4}:
inode_lock include/linux/fs.h:1029 [inline]
ocfs2_del_inode_from_orphan+0x12e/0x7a0 fs/ocfs2/namei.c:2728
ocfs2_dio_end_io+0xf9c/0x1370 fs/ocfs2/aops.c:2418
dio_complete+0x25b/0x790 fs/direct-io.c:281
-> #1 (&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
inode_lock include/linux/fs.h:1029 [inline]
ocfs2_reserve_suballoc_bits+0x16d/0x4840 fs/ocfs2/suballoc.c:882
ocfs2_reserve_new_metadata_blocks+0x415/0x9a0
fs/ocfs2/suballoc.c:1078
ocfs2_mknod+0x10f3/0x2260 fs/ocfs2/namei.c:351
-> #0 (&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]){+.+.}-{4:4}:
__lock_acquire+0x15a5/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
down_write+0x96/0x200 kernel/locking/rwsem.c:1625
inode_lock include/linux/fs.h:1029 [inline]
ocfs2_remove_inode fs/ocfs2/inode.c:733 [inline]
ocfs2_wipe_inode fs/ocfs2/inode.c:896 [inline]
ocfs2_delete_inode fs/ocfs2/inode.c:1157 [inline]
ocfs2_evict_inode+0x1539/0x43b0 fs/ocfs2/inode.c:1299
Chain exists of:
&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE] -->
&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE] -->
&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);
lock(&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]);
lock(&ocfs2_sysfile_lock_key[ORPHAN_DIR_SYSTEM_INODE]);
lock(&ocfs2_sysfile_lock_key[INODE_ALLOC_SYSTEM_INODE]);
*** DEADLOCK ***
Link: https://lore.kernel.org/97c902a6-3bcf-43ea-9b70-f1f136a6c3f2@mail.kernel.org
Fixes: d647c5b2fbf8 ("ocfs2: split transactions in dio completion to avoid credit exhaustion")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+b225d4dfce6219600c42@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b225d4dfce6219600c42
Link: https://syzkaller.appspot.com/ai_job?id=0b53ce1e-2972-4192-aa85-8097a702762c
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Heming Zhao <heming.zhao@suse.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/aops.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
index 02556d212f4f65..cd54477529a083 100644
--- a/fs/ocfs2/aops.c
+++ b/fs/ocfs2/aops.c
@@ -2403,6 +2403,15 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
unlock:
up_write(&oi->ip_alloc_sem);
+ if (data_ac) {
+ ocfs2_free_alloc_context(data_ac);
+ data_ac = NULL;
+ }
+ if (meta_ac) {
+ ocfs2_free_alloc_context(meta_ac);
+ meta_ac = NULL;
+ }
+
/* everything looks good, let's start the cleanup */
if (!ret && dwc->dw_orphaned) {
BUG_ON(dwc->dw_writer_pid != task_pid_nr(current));
@@ -2414,10 +2423,6 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
ocfs2_inode_unlock(inode, 1);
brelse(di_bh);
out:
- if (data_ac)
- ocfs2_free_alloc_context(data_ac);
- if (meta_ac)
- ocfs2_free_alloc_context(meta_ac);
ocfs2_run_deallocs(osb, &dealloc);
ocfs2_dio_free_write_ctx(inode, dwc);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 279/699] net/9p: fix race condition on rdma->state in trans_rdma.c
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 278/699] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 280/699] staging: nvec: fix use-after-free in nvec_rx_completed() Greg Kroah-Hartman
` (423 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Dominique Martinet, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit 7d54894a1ee265a72d70f7cae1da6cc774cccc71 ]
The rdma->state field is modified without holding req_lock in both
recv_done() and p9_cm_event_handler(), while rdma_request() accesses
the same field under the req_lock spinlock. This inconsistent locking
creates a race condition:
- recv_done() running in softirq completion context sets
rdma->state = P9_RDMA_FLUSHING without acquiring req_lock
- p9_cm_event_handler() modifies rdma->state at multiple points
(ADDR_RESOLVED, ROUTE_RESOLVED, ESTABLISHED, CLOSED) without
req_lock
- rdma_request() uses spin_lock_irqsave(&rdma->req_lock, flags) to
protect the read-modify-write of rdma->state
The race can cause lost state transitions: recv_done() or the CM
event handler could set state to FLUSHING/CLOSED while rdma_request()
is concurrently checking or modifying state under the lock, leading to
the FLUSHING transition being silently overwritten by CLOSING. This
corrupts the connection state machine and can cause use-after-free on
RDMA request objects during teardown.
Fix by adding req_lock protection to all rdma->state modifications in
recv_done() and p9_cm_event_handler(), matching the pattern already
used in rdma_request(). Use spin_lock_irqsave/spin_unlock_irqrestore
in the CM event handler since it can race with recv_done() which runs
in softirq context.
Tested with a kernel module that races two threads (simulating
rdma_request and recv_done/CM handler) on rdma->state with proper
locking: 5.5M+ FLUSHING writes over 27M iterations with 0 lost
transitions.
Fixes: 473c7dd1d7b5 ("9p/rdma: remove useless check in cm_event_handler")
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: GLM:GLM-5.1
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Message-ID: <20260529073933.77315-1-zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/9p/trans_rdma.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 7217bd9886e36d..dd98b09b61a0c0 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -241,25 +241,36 @@ p9_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event)
{
struct p9_client *c = id->context;
struct p9_trans_rdma *rdma = c->trans;
+ unsigned long flags;
+
switch (event->event) {
case RDMA_CM_EVENT_ADDR_RESOLVED:
+ spin_lock_irqsave(&rdma->req_lock, flags);
BUG_ON(rdma->state != P9_RDMA_INIT);
rdma->state = P9_RDMA_ADDR_RESOLVED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
break;
case RDMA_CM_EVENT_ROUTE_RESOLVED:
+ spin_lock_irqsave(&rdma->req_lock, flags);
BUG_ON(rdma->state != P9_RDMA_ADDR_RESOLVED);
rdma->state = P9_RDMA_ROUTE_RESOLVED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
break;
case RDMA_CM_EVENT_ESTABLISHED:
+ spin_lock_irqsave(&rdma->req_lock, flags);
BUG_ON(rdma->state != P9_RDMA_ROUTE_RESOLVED);
rdma->state = P9_RDMA_CONNECTED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
break;
case RDMA_CM_EVENT_DISCONNECTED:
- if (rdma)
+ if (rdma) {
+ spin_lock_irqsave(&rdma->req_lock, flags);
rdma->state = P9_RDMA_CLOSED;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
+ }
c->status = Disconnected;
break;
@@ -297,6 +308,7 @@ recv_done(struct ib_cq *cq, struct ib_wc *wc)
struct p9_req_t *req;
int err = 0;
int16_t tag;
+ unsigned long flags;
req = NULL;
ib_dma_unmap_single(rdma->cm_id->device, c->busa, client->msize,
@@ -333,7 +345,10 @@ recv_done(struct ib_cq *cq, struct ib_wc *wc)
err_out:
p9_debug(P9_DEBUG_ERROR, "req %p err %d status %d\n",
req, err, wc->status);
- rdma->state = P9_RDMA_FLUSHING;
+ spin_lock_irqsave(&rdma->req_lock, flags);
+ if (rdma->state < P9_RDMA_FLUSHING)
+ rdma->state = P9_RDMA_FLUSHING;
+ spin_unlock_irqrestore(&rdma->req_lock, flags);
client->status = Disconnected;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 280/699] staging: nvec: fix use-after-free in nvec_rx_completed()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 279/699] net/9p: fix race condition on rdma->state in trans_rdma.c Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 281/699] coresight: cti: Fix DT filter signals silently ignored Greg Kroah-Hartman
` (422 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Alexandru Hossu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
[ Upstream commit 26813881181deb3a32fbb59eadb2599cbe8423f6 ]
In nvec_rx_completed(), when an incomplete RX transfer is detected,
nvec_msg_free() is called to return the message back to the pool by
clearing its 'used' atomic flag. Immediately after this, the code
accesses nvec->rx->data[0] to check the message type.
Since nvec_msg_free() marks the pool slot as available via atomic_set(),
any concurrent or subsequent call to nvec_msg_alloc() could claim that
same slot and overwrite its data[] array. Reading nvec->rx->data[0] after
freeing the message is therefore a use-after-free.
Fix this by saving the message type byte before calling nvec_msg_free(),
then using the saved value for the battery quirk check.
Fixes: d6bdcf2e1019 ("staging: nvec: Add battery quirk to ignore incomplete responses")
Reviewed-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260427081713.3401874-2-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/nvec/nvec.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/nvec/nvec.c b/drivers/staging/nvec/nvec.c
index a80996b2f5ce4a..49fdb486b01976 100644
--- a/drivers/staging/nvec/nvec.c
+++ b/drivers/staging/nvec/nvec.c
@@ -488,6 +488,8 @@ static void nvec_tx_completed(struct nvec_chip *nvec)
static void nvec_rx_completed(struct nvec_chip *nvec)
{
if (nvec->rx->pos != nvec_msg_size(nvec->rx)) {
+ unsigned char msg_type = nvec->rx->data[0];
+
dev_err(nvec->dev, "RX incomplete: Expected %u bytes, got %u\n",
(uint)nvec_msg_size(nvec->rx),
(uint)nvec->rx->pos);
@@ -496,7 +498,7 @@ static void nvec_rx_completed(struct nvec_chip *nvec)
nvec->state = 0;
/* Battery quirk - Often incomplete, and likes to crash */
- if (nvec->rx->data[0] == NVEC_BAT)
+ if (msg_type == NVEC_BAT)
complete(&nvec->ec_transfer);
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 281/699] coresight: cti: Fix DT filter signals silently ignored
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 280/699] staging: nvec: fix use-after-free in nvec_rx_completed() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 282/699] x86/platform/olpc: xo15: Drop wakeup source on driver removal Greg Kroah-Hartman
` (421 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yingchao Deng, Leo Yan,
Suzuki K Poulose, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yingchao Deng <yingchao.deng@oss.qualcomm.com>
[ Upstream commit 551bb2fd5e4ed63d33aa11f07102cce5179b7595 ]
In cti_plat_process_filter_sigs(), after allocating a temporary
cti_trig_grp struct via kzalloc_obj(), the code never assigns tg->nr_sigs
= nr_filter_sigs. Since kzalloc zero-initialises the struct, tg->nr_sigs
remains 0. cti_plat_read_trig_group() guards with:
if (!tgrp->nr_sigs)
return 0;
so it returns immediately without reading any signal indices from DT.
Fix by assigning tg->nr_sigs before calling cti_plat_read_trig_group().
Fixes: a5614770ab97 ("coresight: cti: Add device tree support for custom CTI")
Signed-off-by: Yingchao Deng <yingchao.deng@oss.qualcomm.com>
Reviewed-by: Leo Yan <leo.yan@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260426-nr_sigs-v1-1-3b9df99dab97@oss.qualcomm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-cti-platform.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwtracing/coresight/coresight-cti-platform.c b/drivers/hwtracing/coresight/coresight-cti-platform.c
index 98f830c6ed5070..c4cfa1c255c2bf 100644
--- a/drivers/hwtracing/coresight/coresight-cti-platform.c
+++ b/drivers/hwtracing/coresight/coresight-cti-platform.c
@@ -329,6 +329,7 @@ static int cti_plat_process_filter_sigs(struct cti_drvdata *drvdata,
if (!tg)
return -ENOMEM;
+ tg->nr_sigs = nr_filter_sigs;
err = cti_plat_read_trig_group(tg, fwnode, CTI_DT_FILTER_OUT_SIGS);
if (!err)
drvdata->config.trig_out_filter |= tg->used_mask;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 282/699] x86/platform/olpc: xo15: Drop wakeup source on driver removal
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 281/699] coresight: cti: Fix DT filter signals silently ignored Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 283/699] platform/x86: xo15-ebook: Fix wakeup source and GPE handling Greg Kroah-Hartman
` (420 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki,
Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit cc966553e6ff0849978b5754531b768b0ff54985 ]
Prevent leaking a wakeup source object after removing the driver by
adding appropriate cleanup code to its remove callback function.
Fixes: a0f30f592d2d ("x86, olpc: Add XO-1.5 SCI driver")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2069931.usQuhbGJ8B@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/platform/olpc/olpc-xo15-sci.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c
index 85f4638764d69b..8fb28e56491534 100644
--- a/arch/x86/platform/olpc/olpc-xo15-sci.c
+++ b/arch/x86/platform/olpc/olpc-xo15-sci.c
@@ -185,6 +185,7 @@ static int xo15_sci_add(struct acpi_device *device)
static int xo15_sci_remove(struct acpi_device *device)
{
+ device_init_wakeup(&device->dev, false);
acpi_disable_gpe(NULL, xo15_sci_gpe);
acpi_remove_gpe_handler(NULL, xo15_sci_gpe, xo15_sci_gpe_handler);
cancel_work_sync(&sci_work);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 283/699] platform/x86: xo15-ebook: Fix wakeup source and GPE handling
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 282/699] x86/platform/olpc: xo15: Drop wakeup source on driver removal Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 284/699] perf sched: Add missing mmap2 handler in timehist Greg Kroah-Hartman
` (419 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki,
Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit b2fc2c6ebbd2d49935c8960755d8170faead2159 ]
The device_set_wakeup_enable() call in ebook_switch_add() doesn't
actually do anything because power.can_wakeup is not set for ACPI
device objects. Moreover, had it done anything, it would have
registered a wakeup source object that wouldn't have been used
going forward and that wakeup source would have been leaked after
driver removal because ebook_switch_remove() doesn't clean it up.
Accordingly, remove that call from ebook_switch_add().
Also prevent leaking an enabled ACPI GPE after removing the driver by
adding appropriate cleanup code to ebook_switch_remove().
Fixes: 89ca11771a4b ("OLPC XO-1.5 ebook switch driver")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1966125.tdWV9SEqCh@rafael.j.wysocki
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/xo15-ebook.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/xo15-ebook.c b/drivers/platform/x86/xo15-ebook.c
index 8337c99d2ce25b..6cd0aa80c2fbd3 100644
--- a/drivers/platform/x86/xo15-ebook.c
+++ b/drivers/platform/x86/xo15-ebook.c
@@ -40,6 +40,7 @@ MODULE_DEVICE_TABLE(acpi, ebook_device_ids);
struct ebook_switch {
struct input_dev *input;
char phys[32]; /* for input device */
+ bool gpe_enabled;
};
static int ebook_send_state(struct acpi_device *device)
@@ -133,7 +134,7 @@ static int ebook_switch_add(struct acpi_device *device)
/* Button's GPE is run-wake GPE */
acpi_enable_gpe(device->wakeup.gpe_device,
device->wakeup.gpe_number);
- device_set_wakeup_enable(&device->dev, true);
+ button->gpe_enabled = true;
}
return 0;
@@ -149,6 +150,10 @@ static int ebook_switch_remove(struct acpi_device *device)
{
struct ebook_switch *button = acpi_driver_data(device);
+ if (button->gpe_enabled)
+ acpi_disable_gpe(device->wakeup.gpe_device,
+ device->wakeup.gpe_number);
+
input_unregister_device(button->input);
kfree(button);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 284/699] perf sched: Add missing mmap2 handler in timehist
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 283/699] platform/x86: xo15-ebook: Fix wakeup source and GPE handling Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 285/699] staging: most: video: avoid double free on video register failure Greg Kroah-Hartman
` (418 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Adrian Hunter,
David Ahern, Gabriel Marin, Ingo Molnar, James Clark, Jiri Olsa,
Namhyung Kim, Peter Zijlstra, Arnaldo Carvalho de Melo,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 91182741369b261c441e63e6678893032a6d7e4c ]
perf_sched__timehist() registers event handlers for options using the
sched->tool struct. It registers handlers for MMAP, COMM, EXIT, FORK, etc.
but completely omits registering a handler for MMAP2 events.
Failing to register both MMAP and MMAP2 handlers causes modern systems
(which primarily output MMAP2 records) to silently drop VMA map mappings.
This results in uninitialized machine/thread mapping structures, making it
impossible to resolve shared library instruction pointers (IPs) to dynamic
symbols/DSOs during timehist callchain analysis.
Fix this by correctly registering perf_event__process_mmap2 in
sched->tool inside perf_sched__timehist().
Fixes: 49394a2a24c78ce0 ("perf sched timehist: Introduce timehist command")
Assisted-by: Gemini-CLI:Google Gemini 3
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Gabriel Marin <gmx@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 4f8658f5f9deee..bff2158987b305 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -3001,6 +3001,7 @@ static int perf_sched__timehist(struct perf_sched *sched)
*/
sched->tool.sample = perf_timehist__process_sample;
sched->tool.mmap = perf_event__process_mmap;
+ sched->tool.mmap2 = perf_event__process_mmap2;
sched->tool.comm = perf_event__process_comm;
sched->tool.exit = perf_event__process_exit;
sched->tool.fork = perf_event__process_fork;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 285/699] staging: most: video: avoid double free on video register failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 284/699] perf sched: Add missing mmap2 handler in timehist Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 286/699] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() Greg Kroah-Hartman
` (417 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit 7cb1c5b32a2bfde961fff8d5204526b609bcb30a ]
comp_register_videodev() allocates a video_device with
video_device_alloc() and releases it if video_register_device() fails.
This can double free the video_device when __video_register_device()
reaches device_register() and that call fails:
video_register_device()
-> __video_register_device()
-> device_register() fails
-> put_device(&vdev->dev)
-> v4l2_device_release()
-> vdev->release(vdev)
-> video_device_release(vdev)
comp_register_videodev()
-> video_device_release(mdev->vdev)
Use video_device_release_empty() while registering the device so that
registration failure paths do not free mdev->vdev through vdev->release().
comp_register_videodev() then releases mdev->vdev exactly once on failure.
Restore video_device_release() after successful registration so the
registered device keeps its normal lifetime handling.
This issue was found by a static analysis tool I am developing.
Fixes: eab231c0398a ("staging: most: v4l2-aim: remove unnecessary label err_vbi_dev")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260517111218.945796-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/most/video/video.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/most/video/video.c b/drivers/staging/most/video/video.c
index 829df899b99303..f239c9a57d855a 100644
--- a/drivers/staging/most/video/video.c
+++ b/drivers/staging/most/video/video.c
@@ -416,6 +416,7 @@ static int comp_register_videodev(struct most_video_dev *mdev)
/* Fill the video capture device struct */
*mdev->vdev = comp_videodev_template;
+ mdev->vdev->release = video_device_release_empty;
mdev->vdev->v4l2_dev = &mdev->v4l2_dev;
mdev->vdev->lock = &mdev->lock;
snprintf(mdev->vdev->name, sizeof(mdev->vdev->name), "MOST: %s",
@@ -428,9 +429,13 @@ static int comp_register_videodev(struct most_video_dev *mdev)
v4l2_err(&mdev->v4l2_dev, "video_register_device failed (%d)\n",
ret);
video_device_release(mdev->vdev);
+ return ret;
}
- return ret;
+ mdev->vdev->release = video_device_release;
+
+ return 0;
+
}
static void comp_unregister_videodev(struct most_video_dev *mdev)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 286/699] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 285/699] staging: most: video: avoid double free on video register failure Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 287/699] usb: host: max3421: Reject hub port requests for non-existent ports Greg Kroah-Hartman
` (416 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit cff06b03b530ae1fe8a13e93a7848f2130e00fb4 ]
The `max3421_hub_control()` function handles USB hub class requests
to the virtual root hub. In the `default` branches of both the
`ClearPortFeature` and `SetPortFeature` switch statements, it modifies
`max3421_hcd->port_status` by left shifting 1 by the request's `value`
parameter. However, it does not validate whether this shift will exceed
the width of `port_status`.
So if a malicious userspace task with access to the root hub via
/dev/bus/usb/.../001 issues a USBDEVFS_CONTROL ioctl with `wValue`
greater than or equal to 32, the left shift operation invokes
shift-out-of-bounds undefined behavior. This results in arbitrary
bit corruption of `port_status`, including the normally-immutable
change bits, which can bypass internal state checks and confuse the
hub status.
Fix this by rejecting requests whose `value` exceeds the shift width
before performing the shift.
This issue was found using a KLEE-based symbolic execution tool for
kernel drivers that I'm currently developing.
Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://patch.msgid.link/20260518224901.1887013-1-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/max3421-hcd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 7ab8c518dfc2b5..7425b12595c7d2 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1703,6 +1703,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
!pdata->vbus_active_level);
fallthrough;
default:
+ if (value >= 32)
+ goto error;
max3421_hcd->port_status &= ~(1 << value);
}
break;
@@ -1756,6 +1758,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
max3421_reset_port(hcd);
fallthrough;
default:
+ if (value >= 32)
+ goto error;
if ((max3421_hcd->port_status & USB_PORT_STAT_POWER)
!= 0)
max3421_hcd->port_status |= (1 << value);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 287/699] usb: host: max3421: Reject hub port requests for non-existent ports
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 286/699] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 288/699] char: tlclk: fix use-after-free in tlclk_cleanup() Greg Kroah-Hartman
` (415 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern, Seungjin Bae,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 11b5c101e2fd206104b05bc92554d356989423a8 ]
The `max3421_hub_control()` function handles USB hub class requests
to the virtual root hub. The `GetPortStatus` case correctly rejects
requests with `index != 1`, since the virtual root hub has only a
single port. However, the `ClearPortFeature` and `SetPortFeature`
cases lack the same check.
Fix this by extending the `index != 1` rejection to both cases,
matching the existing behavior of `GetPortStatus`.
Fixes: 2d53139f3162 ("Add support for using a MAX3421E chip as a host driver.")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://patch.msgid.link/20260518224901.1887013-3-eeodqql09@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/max3421-hcd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 7425b12595c7d2..e4d2197eb5bb71 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -1694,6 +1694,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
case ClearHubFeature:
break;
case ClearPortFeature:
+ if (index != 1)
+ goto error;
switch (value) {
case USB_PORT_FEAT_SUSPEND:
break;
@@ -1737,6 +1739,8 @@ max3421_hub_control(struct usb_hcd *hcd, u16 type_req, u16 value, u16 index,
break;
case SetPortFeature:
+ if (index != 1)
+ goto error;
switch (value) {
case USB_PORT_FEAT_LINK_STATE:
case USB_PORT_FEAT_U1_TIMEOUT:
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 288/699] char: tlclk: fix use-after-free in tlclk_cleanup()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 287/699] usb: host: max3421: Reject hub port requests for non-existent ports Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 289/699] iio: light: si1133: reset counter to prevent race condition Greg Kroah-Hartman
` (414 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, James Kim, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Kim <james010kim@gmail.com>
[ Upstream commit bbf003b7794d6ad6f939fdd29f1f1bde8ac554c1 ]
This patch improves the module cleanup process in the tlclk driver to
prevent potential use-after-free and race conditions.
Currently, the file_operations structure does not specify the .owner
field, which could allow the module to be unloaded while user-space
processes are still interacting with the device. Additionally, the
tlclk_cleanup() function frees the alarm_events memory before ensuring
that blocked processes in the waitqueue are fully awakened and that the
switchover_timer has completed.
To address these cases, this patch:
- Sets '.owner = THIS_MODULE' in tlclk_fops to safely defer module
unloading while the device is in use.
- Updates tlclk_cleanup() to explicitly wake up all blocked readers
(wake_up_all), properly release hardware I/O regions, and safely
delete the timer (timer_delete_sync) prior to freeing memory.
Fixes: 1a80ba882730 ("[PATCH] Telecom Clock Driver for MPCBL0010 ATCA computer blade")
Signed-off-by: James Kim <james010kim@gmail.com>
Link: https://patch.msgid.link/20260503101131.64219-1-james010kim@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/tlclk.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 896a3550fba9f3..6b993744f2d781 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -263,6 +263,7 @@ static ssize_t tlclk_read(struct file *filp, char __user *buf, size_t count,
}
static const struct file_operations tlclk_fops = {
+ .owner = THIS_MODULE,
.read = tlclk_read,
.open = tlclk_open,
.release = tlclk_release,
@@ -852,6 +853,9 @@ static void __exit tlclk_cleanup(void)
misc_deregister(&tlclk_miscdev);
unregister_chrdev(tlclk_major, "telco_clock");
+ got_event = 1;
+ wake_up_all(&wq);
+
release_region(TLCLK_BASE, 8);
del_timer_sync(&switchover_timer);
kfree(alarm_events);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 289/699] iio: light: si1133: reset counter to prevent race condition
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 288/699] char: tlclk: fix use-after-free in tlclk_cleanup() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 290/699] iio: light: si1133: prevent race condition on timeout Greg Kroah-Hartman
` (413 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Joshua Crofts,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit 0a5f45ed2342aabae1e32c72558d15be28940a95 ]
Sashiko reported a potential race condition happening when the driver
returns an errno after a timeout in the si1133_command() function. The
premature exit causes the hardware and software counters to become out
of sync by not updating data->rsp_seq, therefore the internal hardware
counter keeps incrementing.
Fix this by adding a call to si1133_cmd_reset_counter() before returning
from timeout.
Fixes: e01e7eaf37d8 ("iio: light: introduce si1133")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260428-si1133-checkup-v2-5-70ad14bfefe2%40gmail.com
Assisted-by: gemini:gemini-3.1-pro-preview
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/si1133.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/iio/light/si1133.c b/drivers/iio/light/si1133.c
index c280b41950036a..02d1882cdfdf0a 100644
--- a/drivers/iio/light/si1133.c
+++ b/drivers/iio/light/si1133.c
@@ -427,6 +427,11 @@ static int si1133_command(struct si1133_data *data, u8 cmd)
dev_warn(dev,
"Failed to read command %#02hhx, ret=%d\n",
cmd, err);
+ /*
+ * Reset counter on err to prevent software and hardware
+ * counters being out of sync.
+ */
+ si1133_cmd_reset_counter(data);
goto out;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 290/699] iio: light: si1133: prevent race condition on timeout
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 289/699] iio: light: si1133: reset counter to prevent race condition Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 291/699] iio: magnetometer: ak8975: fix potential kernel stack memory leak Greg Kroah-Hartman
` (412 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Joshua Crofts,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit 8c50a95ceb230d17801758a9e41ffbbbe46f8b4d ]
Sashiko reported a bug where the si1133_command exits on timeout
without halting the sensor or masking the interrupt. If the sensor
completes the command later, any subsequent command to the sensor
will cause the IRQ handler to complete immediately, returning stale
data to the driver all while the command hasn't finished yet, shifting
all potential reads in the future.
Fix this by masking the IRQ if wait_for_completion_timeout() fails.
When initiating a new command, do a dummy read of the IRQ_STATUS
register and turn the IRQ back on.
Fixes: e01e7eaf37d8 ("iio: light: introduce si1133")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/message/20260428-si1133-checkup-v2-5-70ad14bfefe2%40gmail.com
Assisted-by: gemini:gemini-3.1-pro-preview
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/light/si1133.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/light/si1133.c b/drivers/iio/light/si1133.c
index 02d1882cdfdf0a..8dae058c5d64ea 100644
--- a/drivers/iio/light/si1133.c
+++ b/drivers/iio/light/si1133.c
@@ -395,8 +395,14 @@ static int si1133_command(struct si1133_data *data, u8 cmd)
expected_seq = (data->rsp_seq + 1) & SI1133_MAX_CMD_CTR;
- if (cmd == SI1133_CMD_FORCE)
+ if (cmd == SI1133_CMD_FORCE) {
+ /* Flush pending IRQs from a previous timeout. */
+ regmap_read(data->regmap, SI1133_REG_IRQ_STATUS, &resp);
+ regmap_write(data->regmap, SI1133_REG_IRQ_ENABLE,
+ SI1133_IRQ_CHANNEL_ENABLE);
+
reinit_completion(&data->completion);
+ }
err = regmap_write(data->regmap, SI1133_REG_COMMAND, cmd);
if (err) {
@@ -409,6 +415,7 @@ static int si1133_command(struct si1133_data *data, u8 cmd)
/* wait for irq */
if (!wait_for_completion_timeout(&data->completion,
msecs_to_jiffies(SI1133_COMPLETION_TIMEOUT_MS))) {
+ regmap_write(data->regmap, SI1133_REG_IRQ_ENABLE, 0);
err = -ETIMEDOUT;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 291/699] iio: magnetometer: ak8975: fix potential kernel stack memory leak
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 290/699] iio: light: si1133: prevent race condition on timeout Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 292/699] iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Greg Kroah-Hartman
` (411 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Joshua Crofts,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Crofts <joshua.crofts1@gmail.com>
[ Upstream commit a9a00d727b7bbc5e913a919530a9dd468935bf95 ]
Currently in the AK8975 driver there are four instances where potential
uninitialized kernel stack memory leaks can occur. If
i2c_smbus_read_i2c_block_data_or_emulated() returns a value less than
the size of the buffer, uninitialized bytes are retained in the buffer
and later the buffer is passed on to IIO buffers, potentially leaking
memory to userspace.
Fix this by adding checks whether the return value of the function is
equal to the size of the buffer and subsequently if the value is
lesser than zero to distinguish from a returned error code.
Fixes: bc11ca4a0b84 ("iio:magnetometer:ak8975: triggered buffer support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-ak8975-fix-v1-1-104ea605dd54%40gmail.com
Signed-off-by: Joshua Crofts <joshua.crofts1@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/magnetometer/ak8975.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
index b16306b91a9b19..4516459e92cca9 100644
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -437,6 +437,10 @@ static int ak8975_who_i_am(struct i2c_client *client,
dev_err(&client->dev, "Error reading WIA\n");
return ret;
}
+ if (ret != sizeof(wia_val)) {
+ dev_err(&client->dev, "Error reading WIA\n");
+ return -EIO;
+ }
if (wia_val[0] != AK8975_DEVICE_ID)
return -ENODEV;
@@ -549,6 +553,10 @@ static int ak8975_setup(struct i2c_client *client)
dev_err(&client->dev, "Not able to read asa data\n");
return ret;
}
+ if (ret != sizeof(data->asa)) {
+ dev_err(&client->dev, "Error reading asa data\n");
+ return -EIO;
+ }
/* After reading fuse ROM data set power-down mode */
ret = ak8975_set_mode(data, POWER_DOWN);
@@ -688,6 +696,10 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val)
sizeof(rval), (u8*)&rval);
if (ret < 0)
goto exit;
+ if (ret != sizeof(rval)) {
+ ret = -EIO;
+ goto exit;
+ }
/* Read out ST2 for release lock on measurment data. */
ret = i2c_smbus_read_byte_data(client, data->def->ctrl_regs[ST2]);
@@ -817,6 +829,8 @@ static void ak8975_fill_buffer(struct iio_dev *indio_dev)
(u8 *)fval);
if (ret < 0)
goto unlock;
+ if (ret != sizeof(fval))
+ goto unlock;
mutex_unlock(&data->lock);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 292/699] iio: accel: mma8452: handle I2C read error(s) in mma8452_read()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 291/699] iio: magnetometer: ak8975: fix potential kernel stack memory leak Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 293/699] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter Greg Kroah-Hartman
` (410 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sanjay Chitroda, Jonathan Cameron,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjay Chitroda <sanjayembeddedse@gmail.com>
[ Upstream commit 5bdff291d20c31b365d9ddfe9c426fbfb41da5bb ]
Currently, If i2c_smbus_read_i2c_block_data() fails but
mma8452_set_runtime_pm_state() succeeds, mma8452_read() returns 0.
As a result, the caller mma8452_read_raw() assumes the read was
successful and proceeds to use a buffer containing uninitialized
stack memory.
Add proper checking of the I2C read return value and propagate errors
to the caller.
Fixes: 96c0cb2bbfe0 ("iio: mma8452: add support for runtime power management")
Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/accel/mma8452.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c
index 760ee0685034bb..b8ab2b0627a3c4 100644
--- a/drivers/iio/accel/mma8452.c
+++ b/drivers/iio/accel/mma8452.c
@@ -254,6 +254,8 @@ static int mma8452_read(struct mma8452_data *data, __be16 buf[3])
ret = i2c_smbus_read_i2c_block_data(data->client, MMA8452_OUT_X,
3 * sizeof(__be16), (u8 *)buf);
+ if (ret < 0)
+ return ret;
ret = mma8452_set_runtime_pm_state(data->client, false);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 293/699] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 292/699] iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 294/699] perf: Fix off-by-one stack buffer overflow in kallsyms__parse() Greg Kroah-Hartman
` (409 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rosen Penev, Benjamin Tissoires,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit f22a5db8a7d38152556f230d6d68e59dbc27971b ]
The @dev member described in the kernel-doc does not exist in the
struct. Remove the stale entry.
Fixes: 0610430e3dea ("HID: logitech-hidpp: add input_device ptr to struct hidpp_device")
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index d31f2737b13dca..8b05aad21970cf 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -150,7 +150,6 @@ struct hidpp_battery {
/**
* struct hidpp_scroll_counter - Utility class for processing high-resolution
* scroll events.
- * @dev: the input device for which events should be reported.
* @wheel_multiplier: the scalar multiplier to be applied to each wheel event
* @remainder: counts the number of high-resolution units moved since the last
* low-resolution event (REL_WHEEL or REL_HWHEEL) was sent. Should
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 294/699] perf: Fix off-by-one stack buffer overflow in kallsyms__parse()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 293/699] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 295/699] perf sched: Clean up idle_threads entry on init failure Greg Kroah-Hartman
` (408 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rui Qi, Namhyung Kim, Adrian Hunter,
Alexander Shishkin, Ian Rogers, Ingo Molnar, James Clark,
Jiri Olsa, Mark Rutland, Peter Zijlstra, Arnaldo Carvalho de Melo,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Qi <qirui.001@bytedance.com>
[ Upstream commit 68018df3f55eba96a20dd703f5f276a6518f4963 ]
In kallsyms__parse(), the loop reading symbol names iterates with i <
sizeof(symbol_name), which allows i to reach sizeof(symbol_name) upon
loop exit. The subsequent symbol_name[i] = '\0' then writes one byte
past the end of the stack-allocated symbol_name[] array.
Fix this by changing the loop bound to KSYM_NAME_LEN, so the null
terminator always lands within the array. The overflow is triggerable by
a kallsyms entry with a symbol name of KSYM_NAME_LEN+1 or more
characters (e.g., long Rust mangled names or a malicious
/proc/kallsyms).
Fixes: 53df2b9344128984 ("libsymbols kallsyms: Parse using io api")
Signed-off-by: Rui Qi <qirui.001@bytedance.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/symbol/kallsyms.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/lib/symbol/kallsyms.c b/tools/lib/symbol/kallsyms.c
index e335ac2b9e1972..d64bd9cc82a90e 100644
--- a/tools/lib/symbol/kallsyms.c
+++ b/tools/lib/symbol/kallsyms.c
@@ -60,7 +60,7 @@ int kallsyms__parse(const char *filename, void *arg,
read_to_eol(&io);
continue;
}
- for (i = 0; i < sizeof(symbol_name); i++) {
+ for (i = 0; i < KSYM_NAME_LEN; i++) {
ch = io__get_char(&io);
if (ch < 0 || ch == '\n')
break;
@@ -68,6 +68,9 @@ int kallsyms__parse(const char *filename, void *arg,
}
symbol_name[i] = '\0';
+ if (i == KSYM_NAME_LEN)
+ read_to_eol(&io);
+
err = process_symbol(arg, symbol_name, symbol_type, start);
if (err)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 295/699] perf sched: Clean up idle_threads entry on init failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 294/699] perf: Fix off-by-one stack buffer overflow in kallsyms__parse() Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 296/699] perf sched: Replace BUG_ON and add NULL checks in replay event helpers Greg Kroah-Hartman
` (407 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, David Ahern,
Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit cda5a94ad9181cd60cbf04be11d524201bf489a2 ]
get_idle_thread() allocates a thread via thread__new() and stores it in
idle_threads[cpu], then calls init_idle_thread() to set up the private
data. If init_idle_thread() fails (e.g. OOM for the idle_thread_runtime
struct), the function returns NULL but leaves the partially initialized
thread in idle_threads[cpu].
On subsequent calls for the same CPU, get_idle_thread() finds a non-NULL
idle_threads[cpu], skips allocation, and returns thread__get() on a
thread that has no priv data. Callers then get a thread whose
thread__priv() returns NULL, leading to unexpected behavior.
Release the thread and reset the slot to NULL on init failure so the
entry doesn't persist in a corrupted state.
Fixes: 49394a2a24c7 ("perf sched timehist: Introduce timehist command")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: David Ahern <dsahern@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index bff2158987b305..735245be784886 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -2279,8 +2279,11 @@ static struct thread *get_idle_thread(int cpu)
idle_threads[cpu] = thread__new(0, 0);
if (idle_threads[cpu]) {
- if (init_idle_thread(idle_threads[cpu]) < 0)
+ if (init_idle_thread(idle_threads[cpu]) < 0) {
+ /* clean up so next call doesn't find a half-initialized thread */
+ thread__zput(idle_threads[cpu]);
return NULL;
+ }
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 296/699] perf sched: Replace BUG_ON and add NULL checks in replay event helpers
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 295/699] perf sched: Clean up idle_threads entry on init failure Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 297/699] perf mmap: Fix NULL deref in aio cleanup on alloc failure Greg Kroah-Hartman
` (406 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ingo Molnar,
Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 75eafe4a3a93a0143a20c0cc286bfb9008ac1478 ]
get_new_event() has three issues:
1. The zalloc() result is dereferenced without a NULL check, crashing
on allocation failure.
2. BUG_ON(!task->atoms) kills the process when realloc() fails.
Since perf.data is untrusted input, this should be a graceful error.
3. The realloc pattern assigns directly to task->atoms, losing the old
pointer on failure. task->nr_events is also incremented before the
realloc, leaving corrupted state on failure.
Fix get_new_event() to:
- Check the zalloc() result before dereferencing
- Use a temporary for realloc() to avoid losing the old pointer
- Increment nr_events only after successful realloc
- Return NULL instead of calling BUG_ON on failure
Also fix add_sched_event_wakeup() where zalloc() for wait_sem is
passed to sem_init() without a NULL check.
Update all callers (add_sched_event_run, add_sched_event_wakeup,
add_sched_event_sleep) to handle NULL returns by returning early.
The replay may produce incomplete output on OOM but will not crash.
Fixes: ec156764d424 ("perf sched: Import schedbench.c")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 28 +++++++++++++++++++++++++---
1 file changed, 25 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 735245be784886..ef535cf8d77a4e 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -361,14 +361,25 @@ get_new_event(struct task_desc *task, u64 timestamp)
struct sched_atom *event = zalloc(sizeof(*event));
unsigned long idx = task->nr_events;
size_t size;
+ struct sched_atom **atoms_p;
+
+ if (event == NULL) {
+ pr_err("ERROR: sched: failed to allocate event\n");
+ return NULL;
+ }
event->timestamp = timestamp;
event->nr = idx;
+ size = sizeof(struct sched_atom *) * (task->nr_events + 1);
+ atoms_p = realloc(task->atoms, size);
+ if (!atoms_p) {
+ pr_err("ERROR: sched: failed to grow atoms array\n");
+ free(event);
+ return NULL;
+ }
+ task->atoms = atoms_p;
task->nr_events++;
- size = sizeof(struct sched_atom *) * task->nr_events;
- task->atoms = realloc(task->atoms, size);
- BUG_ON(!task->atoms);
task->atoms[idx] = event;
@@ -399,6 +410,8 @@ static void add_sched_event_run(struct perf_sched *sched, struct task_desc *task
}
event = get_new_event(task, timestamp);
+ if (event == NULL)
+ return;
event->type = SCHED_EVENT_RUN;
event->duration = duration;
@@ -412,6 +425,8 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t
struct sched_atom *event, *wakee_event;
event = get_new_event(task, timestamp);
+ if (event == NULL)
+ return;
event->type = SCHED_EVENT_WAKEUP;
event->wakee = wakee;
@@ -426,6 +441,10 @@ static void add_sched_event_wakeup(struct perf_sched *sched, struct task_desc *t
}
wakee_event->wait_sem = zalloc(sizeof(*wakee_event->wait_sem));
+ if (!wakee_event->wait_sem) {
+ pr_err("ERROR: sched: failed to allocate semaphore\n");
+ return;
+ }
sem_init(wakee_event->wait_sem, 0, 0);
wakee_event->specific_wait = 1;
event->wait_sem = wakee_event->wait_sem;
@@ -438,6 +457,9 @@ static void add_sched_event_sleep(struct perf_sched *sched, struct task_desc *ta
{
struct sched_atom *event = get_new_event(task, timestamp);
+ if (event == NULL)
+ return;
+
event->type = SCHED_EVENT_SLEEP;
sched->nr_sleep_events++;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 297/699] perf mmap: Fix NULL deref in aio cleanup on alloc failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 296/699] perf sched: Replace BUG_ON and add NULL checks in replay event helpers Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 298/699] perf c2c: Fix use-after-free in he__get_c2c_hists() error path Greg Kroah-Hartman
` (405 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Alexey Budankov,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 25627346b10e6a564610ea2c49dc6dd54812226d ]
perf_mmap__aio_mmap() sets map->aio.nr_cblocks before allocating the
data array. If calloc() for aiocb or cblocks fails before the data
array is allocated, the return -1 path leads to perf_mmap__aio_munmap()
which loops nr_cblocks times calling perf_mmap__aio_free(). Both
versions of perf_mmap__aio_free() (NUMA and non-NUMA) dereference
map->aio.data[idx] without checking if data is NULL, causing a NULL
pointer dereference.
Add NULL checks for map->aio.data at the top of both
perf_mmap__aio_free() variants so the cleanup path is safe when
allocation fails partway through perf_mmap__aio_mmap().
Fixes: d3d1af6f011a553a ("perf record: Enable asynchronous trace writing")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/mmap.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index ab7108d22428b5..35ca944970a957 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -88,10 +88,10 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx)
static void perf_mmap__aio_free(struct mmap *map, int idx)
{
- if (map->aio.data[idx]) {
- munmap(map->aio.data[idx], mmap__mmap_len(map));
- map->aio.data[idx] = NULL;
- }
+ if (!map->aio.data || !map->aio.data[idx])
+ return;
+ munmap(map->aio.data[idx], mmap__mmap_len(map));
+ map->aio.data[idx] = NULL;
}
static int perf_mmap__aio_bind(struct mmap *map, int idx, int cpu, int affinity)
@@ -134,6 +134,8 @@ static int perf_mmap__aio_alloc(struct mmap *map, int idx)
static void perf_mmap__aio_free(struct mmap *map, int idx)
{
+ if (!map->aio.data)
+ return;
zfree(&(map->aio.data[idx]));
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 298/699] perf c2c: Fix use-after-free in he__get_c2c_hists() error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 297/699] perf mmap: Fix NULL deref in aio cleanup on alloc failure Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 299/699] dmaengine: Fix possible use after free Greg Kroah-Hartman
` (404 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 5e5e6196d737c5be03d20647428316b36621608d ]
he__get_c2c_hists() assigns c2c_he->hists before calling
c2c_hists__init(). If init fails, the error path calls free(hists)
but leaves c2c_he->hists pointing to freed memory. On teardown,
c2c_he_free() finds the non-NULL pointer and calls
hists__delete_entries() on it, causing a use-after-free.
Set c2c_he->hists to NULL before freeing so teardown skips the
already-freed allocation.
Fixes: b2252ae67b687d2b ("perf c2c report: Decode c2c_stats for hist entries")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-c2c.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c
index fb7d01f3961b7e..d48b00a829dc66 100644
--- a/tools/perf/builtin-c2c.c
+++ b/tools/perf/builtin-c2c.c
@@ -201,6 +201,7 @@ he__get_c2c_hists(struct hist_entry *he,
ret = c2c_hists__init(hists, sort, nr_header_lines);
if (ret) {
+ c2c_he->hists = NULL;
free(hists);
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 299/699] dmaengine: Fix possible use after free
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 298/699] perf c2c: Fix use-after-free in he__get_c2c_hists() error path Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 300/699] clk: qcom: a53: Corrected frequency multiplier for 1152MHz Greg Kroah-Hartman
` (403 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuno Sá, Frank Li, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sá <nuno.sa@analog.com>
[ Upstream commit 92f853f0645aebf1d05d333e97ab7c342ace1892 ]
In dma_release_channel(), check chan->device->privatecnt after call
dma_chan_put(). However, dma_chan_put() call dma_device_put() which could
release the last reference of the device if the DMA provider is already
gone and hence free it.
Fixes it by moving dma_chan_put() after the check.
Fixes: 0f571515c332 ("dmaengine: Add privatecnt to revert DMA_PRIVATE property")
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260424-dma-dmac-handle-vunmap-v4-1-90f43412fdc0@analog.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dmaengine.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 9559ebd61f3bb6..68078e83d57560 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -906,11 +906,12 @@ void dma_release_channel(struct dma_chan *chan)
mutex_lock(&dma_list_mutex);
WARN_ONCE(chan->client_count != 1,
"chan reference count %d != 1\n", chan->client_count);
- dma_chan_put(chan);
/* drop PRIVATE cap enabled by __dma_request_channel() */
if (--chan->device->privatecnt == 0)
dma_cap_clear(DMA_PRIVATE, chan->device->cap_mask);
+ dma_chan_put(chan);
+
if (chan->slave) {
sysfs_remove_link(&chan->dev->device.kobj, DMA_SLAVE_NAME);
sysfs_remove_link(&chan->slave->kobj, chan->name);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 300/699] clk: qcom: a53: Corrected frequency multiplier for 1152MHz
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 299/699] dmaengine: Fix possible use after free Greg Kroah-Hartman
@ 2026-07-21 15:20 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 301/699] pNFS/filelayout: fix cheking if a layout is striped Greg Kroah-Hartman
` (402 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:20 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phillip Varney, Konrad Dybcio,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phillip Varney <pbvarney@protonmail.com>
[ Upstream commit bb56147ea9fce98ebde1d367335ba006cba61fbd ]
The 1152MHz frequency entry for the a53 currently selects a multiplier of 62, giving 1190MHz. This changes the mulitiplier to 60 giving the intended 1152MHz.
Signed-off-by: Phillip Varney <pbvarney@protonmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Fixes: 0c6ab1b8f894 ("clk: qcom: Add A53 PLL support")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260605005502.313928-1-pbvarney@protonmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/a53-pll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/a53-pll.c b/drivers/clk/qcom/a53-pll.c
index af6ac17c7daeb6..ffb775e0062ebe 100644
--- a/drivers/clk/qcom/a53-pll.c
+++ b/drivers/clk/qcom/a53-pll.c
@@ -18,7 +18,7 @@
static const struct pll_freq_tbl a53pll_freq[] = {
{ 998400000, 52, 0x0, 0x1, 0 },
{ 1094400000, 57, 0x0, 0x1, 0 },
- { 1152000000, 62, 0x0, 0x1, 0 },
+ { 1152000000, 60, 0x0, 0x1, 0 },
{ 1209600000, 63, 0x0, 0x1, 0 },
{ 1248000000, 65, 0x0, 0x1, 0 },
{ 1363200000, 71, 0x0, 0x1, 0 },
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 301/699] pNFS/filelayout: fix cheking if a layout is striped
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2026-07-21 15:20 ` [PATCH 5.10 300/699] clk: qcom: a53: Corrected frequency multiplier for 1152MHz Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 302/699] NFSv4/pnfs: defer return_range callbacks until after inode unlock Greg Kroah-Hartman
` (401 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 91668417d4e925c98cae4a55b1b9860380ddbf16 ]
A layout can still be striped with num_fh = 1 as it is perfectly possible
that both MDS and DSs can handle the same filehandle. Hence check according
to stripe_count > 1, which is the correct check to begin with.
We should not be called with flseg->dsaddr = NULL, but if for some reason
we do, return our best guess with is flseg->num_fh > 1.
Fixes: a6b9d2fa0024 ("pNFS/filelayout: Fix coalescing test for single DS")
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/filelayout/filelayout.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 2ed8b6885b0919..a98f1f90d53cd7 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -784,6 +784,8 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,
static bool
filelayout_lseg_is_striped(const struct nfs4_filelayout_segment *flseg)
{
+ if (flseg->dsaddr)
+ return flseg->dsaddr->stripe_count > 1;
return flseg->num_fh > 1;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 302/699] NFSv4/pnfs: defer return_range callbacks until after inode unlock
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 301/699] pNFS/filelayout: fix cheking if a layout is striped Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 303/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors Greg Kroah-Hartman
` (400 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dai Ngo, Anna Schumaker, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dai Ngo <dai.ngo@oracle.com>
[ Upstream commit 77b160b2d863d37f36b6c38e80a7d259ce939e69 ]
Sometimes unmounting an NFS filesystem mounted with pNFS SCSI
layouts triggers the following warning:
BUG: scheduling while atomic: umount.nfs4/...
__schedule_bug+0xbd/0x100
schedule_debug.constprop.0+0x19f/0x220
__schedule+0x10d/0x10a0
schedule+0x74/0x190
schedule_timeout+0xf5/0x220
io_schedule_timeout+0xd5/0x160
__wait_for_common+0x186/0x4b0
blk_execute_rq+0x2ef/0x3a0
scsi_execute_cmd+0x1ff/0x700
sd_pr_out_command.isra.0+0x242/0x380 [sd_mod]
bl_unregister_scsi.constprop.0+0x109/0x3c0 [blocklayoutdriver]
bl_unregister_dev+0x175/0x1c0 [blocklayoutdriver]
bl_free_device+0x1f/0x1b0 [blocklayoutdriver]
bl_free_deviceid_node+0x12/0x30 [blocklayoutdriver]
nfs4_put_deviceid_node+0x171/0x360 [nfsv4]
ext_tree_remove+0x11c/0x1d0 [blocklayoutdriver]
_pnfs_return_layout+0x416/0x900 [nfsv4]
nfs4_evict_inode+0x108/0x130 [nfsv4]
evict+0x316/0x750
dispose_list+0xf1/0x1a0
evict_inodes+0x33f/0x440
generic_shutdown_super+0xc9/0x4e0
kill_anon_super+0x3a/0x90
nfs_kill_super+0x44/0x60 [nfs]
deactivate_locked_super+0xb8/0x1b0
cleanup_mnt+0x25a/0x380
task_work_run+0x13e/0x210
exit_to_user_mode_loop+0x169/0x400
do_syscall_64+0x467/0x1550
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The warning occurs because the block layout driver unregisters the SCSI
device while the inode lock is still held. Device unregistration issues
a SCSI PR command, which may sleep, resulting in a "scheduling while
atomic" warning.
During layout return, ext_tree_remove() invokes the layout driver's
return_range callback while holding the inode lock. For block layouts,
this callback eventually calls bl_unregister_scsi(), which may block in
scsi_execute_cmd() while issuing PR commands to the device.
Fix this by deferring the return_range callbacks until after the inode
lock has been released. The layout header reference count is incremented
before invoking return_range(), ensuring that the layout header remains
valid while the layout driver removes extents from the extent tree.
Fixes: c88953d87f5c8 ("pnfs: add return_range method")
Signed-off-by: Dai Ngo <dai.ngo@oracle.com>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/callback_proc.c | 9 +++++----
fs/nfs/pnfs.c | 4 ++--
2 files changed, 7 insertions(+), 6 deletions(-)
diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
index bfdd2122407397..dc4b9e7593fdbc 100644
--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -243,6 +243,7 @@ static u32 initiate_file_draining(struct nfs_client *clp,
struct pnfs_layout_hdr *lo;
u32 rv = NFS4ERR_NOMATCHING_LAYOUT;
LIST_HEAD(free_me_list);
+ bool return_range = false;
ino = nfs_layout_find_inode(clp, &args->cbl_fh, &args->cbl_stateid);
if (IS_ERR(ino)) {
@@ -287,13 +288,13 @@ static u32 initiate_file_draining(struct nfs_client *clp,
/* Embrace your forgetfulness! */
rv = NFS4ERR_NOMATCHING_LAYOUT;
- if (NFS_SERVER(ino)->pnfs_curr_ld->return_range) {
- NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo,
- &args->cbl_range);
- }
+ return_range = true;
}
unlock:
spin_unlock(&ino->i_lock);
+ if (return_range && NFS_SERVER(ino)->pnfs_curr_ld->return_range)
+ NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo,
+ &args->cbl_range);
pnfs_free_lseg_list(&free_me_list);
/* Free all lsegs that are attached to commit buckets */
nfs_commit_inode(ino, 0);
diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index bc0754bba078f0..47b8032f7f4770 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -1378,8 +1378,6 @@ _pnfs_return_layout(struct inode *ino)
pnfs_clear_layoutcommit(ino, &tmp_list);
pnfs_mark_matching_lsegs_return(lo, &tmp_list, &range, 0);
- if (NFS_SERVER(ino)->pnfs_curr_ld->return_range)
- NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range);
/* Don't send a LAYOUTRETURN if list was initially empty */
if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
@@ -1391,6 +1389,8 @@ _pnfs_return_layout(struct inode *ino)
send = pnfs_prepare_layoutreturn(lo, &stateid, &cred, NULL);
spin_unlock(&ino->i_lock);
+ if (NFS_SERVER(ino)->pnfs_curr_ld->return_range)
+ NFS_SERVER(ino)->pnfs_curr_ld->return_range(lo, &range);
if (send)
status = pnfs_send_layoutreturn(lo, &stateid, &cred, IOMODE_ANY, true);
out_wait_layoutreturn:
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 303/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 302/699] NFSv4/pnfs: defer return_range callbacks until after inode unlock Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 304/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write Greg Kroah-Hartman
` (399 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 7a375cafc14ed151508f908ea5681caf0a9cc1d6 ]
Commit f06bedfa62d5 ("pNFS/flexfiles: don't attempt pnfs on fatal DS
errors") teaches ff_layout_{read,write}_pagelist() to return
PNFS_NOT_ATTEMPTED when nfs4_ff_layout_prepare_ds() fails with a
nfs_error_is_fatal() errno (e.g. -ETIMEDOUT from a SOFTCONN connect
deadline, -ENOMEM, -ERESTARTSYS), so that the client gives up instead
of spinning. pnfs_do_{read,write}() then dispatches the I/O through
pnfs_{read,write}_through_mds() → nfs_pageio_reset_{read,write}_mds().
That fallback is unconditional and silently violates FF_FLAGS_NO_IO_THRU_MDS:
when the layout segment carries the flag (typically single-mirror
appliance layouts where MDS I/O is explicitly forbidden), the
out_failed: path's \`&& !ds_fatal_error\` clause overrides the flag's
short-circuit through ff_layout_avoid_mds_available_ds() and routes
the I/O to the MDS file handle anyway.
This is reachable in practice during a data-server restart: SOFTCONN
exhaustion produces -ETIMEDOUT, which is fatal per nfs_error_is_fatal(),
which triggers PNFS_NOT_ATTEMPTED, which silently goes to MDS.
Preserve the upstream "don't spin on fatal errors" intent for layouts
that permit MDS fallback. For layouts with FF_FLAGS_NO_IO_THRU_MDS
set, mark the layout for return and request PNFS_TRY_AGAIN instead;
if the server cannot supply a usable layout the failure now surfaces
cleanly via pnfs_update_layout(), rather than via silent MDS I/O that
contradicts the flag.
Fixes: f06bedfa62d5 ("pNFS/flexfiles: don't attempt pnfs on fatal DS errors")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 01d9922ee71297..62fb30fc728c39 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -1883,6 +1883,14 @@ ff_layout_read_pagelist(struct nfs_pgio_header *hdr)
out_failed:
if (ff_layout_avoid_mds_available_ds(lseg) && !ds_fatal_error)
return PNFS_TRY_AGAIN;
+ if (ff_layout_no_fallback_to_mds(lseg)) {
+ /*
+ * FF_FLAGS_NO_IO_THRU_MDS: force fresh LAYOUTGET,
+ * never fall through to MDS I/O.
+ */
+ pnfs_error_mark_layout_for_return(hdr->inode, lseg);
+ return PNFS_TRY_AGAIN;
+ }
trace_pnfs_mds_fallback_read_pagelist(hdr->inode,
hdr->args.offset, hdr->args.count,
IOMODE_READ, NFS_I(hdr->inode)->layout, lseg);
@@ -1954,6 +1962,14 @@ ff_layout_write_pagelist(struct nfs_pgio_header *hdr, int sync)
out_failed:
if (ff_layout_avoid_mds_available_ds(lseg) && !ds_fatal_error)
return PNFS_TRY_AGAIN;
+ if (ff_layout_no_fallback_to_mds(lseg)) {
+ /*
+ * FF_FLAGS_NO_IO_THRU_MDS: force fresh LAYOUTGET,
+ * never fall through to MDS I/O.
+ */
+ pnfs_error_mark_layout_for_return(hdr->inode, lseg);
+ return PNFS_TRY_AGAIN;
+ }
trace_pnfs_mds_fallback_write_pagelist(hdr->inode,
hdr->args.offset, hdr->args.count,
IOMODE_RW, NFS_I(hdr->inode)->layout, lseg);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 304/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 303/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 305/699] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro Greg Kroah-Hartman
` (398 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
[ Upstream commit 1d62e659c0bf11649cf48e002c2a55d148f2610a ]
The FF_FLAGS_NO_IO_THRU_MDS flag lives on each lseg, so any fallback
decision made when there is no current lseg (e.g. between LAYOUTRETURN
and the next LAYOUTGET) cannot run the per-lseg check.
Introduce a sticky hdr-level ditto for FF_FLAGS_NO_IO_THRU_MDS in
struct nfs4_flexfile_layout::flags (NFS4_FF_HDR_NO_IO_THRU_MDS bit),
set whenever ff_layout_alloc_lseg() parses an lseg with the flag. The
bit is never cleared for the lifetime of the layout hdr; the server is
assumed to be consistent in its no-fallback policy per file.
kzalloc() in ff_layout_alloc_layout_hdr() zero-initializes the field.
Use the new ff_layout_hdr_no_fallback_to_mds() helper to gate
ff_layout_pg_get_mirror_count_write(): when pnfs_update_layout() returns
NULL (e.g. NFS_LAYOUT_BULK_RECALL, pnfs_layout_io_test_failed,
pnfs_layoutgets_blocked) the existing code unconditionally calls
nfs_pageio_reset_write_mds(). This is a source of unwanted WRITE to
MDS. Fix it by checking NFS4_FF_HDR_NO_IO_THRU_MDS bit, and if set
surface -EAGAIN instead; the writepage-side caller (nfs_do_writepage()
for buffered, nfs_direct_write_reschedule() for O_DIRECT) then
redirties the request so writeback retries via pNFS.
Fixes: 260074cd8413 ("pNFS/flexfiles: Add support for FF_FLAGS_NO_IO_THRU_MDS")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Anna Schumaker <anna.schumaker@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/flexfilelayout/flexfilelayout.c | 13 +++++++++++++
fs/nfs/flexfilelayout/flexfilelayout.h | 16 ++++++++++++++++
2 files changed, 29 insertions(+)
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
index 62fb30fc728c39..ec4387a2570329 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -533,6 +533,9 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh,
if (!p)
goto out_sort_mirrors;
fls->flags = be32_to_cpup(p);
+ if (fls->flags & FF_FLAGS_NO_IO_THRU_MDS)
+ set_bit(NFS4_FF_HDR_NO_IO_THRU_MDS,
+ &FF_LAYOUT_FROM_HDR(lh)->flags);
p = xdr_inline_decode(&stream, 4);
if (!p)
@@ -995,6 +998,16 @@ ff_layout_pg_get_mirror_count_write(struct nfs_pageio_descriptor *pgio,
0, NFS4_MAX_UINT64, IOMODE_RW,
NFS_I(pgio->pg_inode)->layout,
pgio->pg_lseg);
+ if (NFS_I(pgio->pg_inode)->layout &&
+ ff_layout_hdr_no_fallback_to_mds(NFS_I(pgio->pg_inode)->layout)) {
+ /*
+ * FF_FLAGS_NO_IO_THRU_MDS: no current lseg but the server's
+ * policy forbids MDS fallback. Surface -EAGAIN so writeback
+ * retries rather than silently issuing the WRITE via MDS.
+ */
+ pgio->pg_error = -EAGAIN;
+ goto out;
+ }
/* no lseg means that pnfs is not in use, so no mirroring here */
nfs_pageio_reset_write_mds(pgio);
out:
diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h
index 354a031c69b172..1d4294c6a7ec48 100644
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -102,12 +102,16 @@ struct nfs4_ff_layout_segment {
struct nfs4_ff_layout_mirror *mirror_array[];
};
+/* nfs4_flexfile_layout::flags bit indices */
+#define NFS4_FF_HDR_NO_IO_THRU_MDS 0 /* any lseg has had FF_FLAGS_NO_IO_THRU_MDS */
+
struct nfs4_flexfile_layout {
struct pnfs_layout_hdr generic_hdr;
struct pnfs_ds_commit_info commit_info;
struct list_head mirrors;
struct list_head error_list; /* nfs4_ff_layout_ds_err */
ktime_t last_report_time; /* Layoutstat report times */
+ unsigned long flags;
};
struct nfs4_flexfile_layoutreturn_args {
@@ -174,6 +178,18 @@ ff_layout_no_fallback_to_mds(struct pnfs_layout_segment *lseg)
return FF_LAYOUT_LSEG(lseg)->flags & FF_FLAGS_NO_IO_THRU_MDS;
}
+/*
+ * Sticky hdr-level mirror of FF_FLAGS_NO_IO_THRU_MDS so callers that have
+ * no current lseg (e.g. between LAYOUTRETURN and the next LAYOUTGET) can
+ * still honor the no-MDS-fallback policy.
+ */
+static inline bool
+ff_layout_hdr_no_fallback_to_mds(struct pnfs_layout_hdr *lo)
+{
+ return test_bit(NFS4_FF_HDR_NO_IO_THRU_MDS,
+ &FF_LAYOUT_FROM_HDR(lo)->flags);
+}
+
static inline bool
ff_layout_no_read_on_rw(struct pnfs_layout_segment *lseg)
{
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 305/699] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 304/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 306/699] perf tools: Fix get_max_num() size_t underflow on empty sysfs file Greg Kroah-Hartman
` (397 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Manivannan Sadhasivam,
Krzysztof Wilczyński, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 282305d7e9c0e27fd8b4df34b7cd5506a1eccdd6 ]
The original PCIE_FTS_NUM_L0(x) macro was buggy due to improper operator
precedence, where ((x) & 0xff << 8) was evaluated as ((x) & 0xff00).
Instead of just fixing the parentheses, use the standard FIELD_PREP()
macro. This makes the code more robust by automatically handling masks
and shifts, while also adding compile-time type and range checking to
ensure the value fits within PCIE_FTS_NUM_MASK.
Fixes: 637cfacae96f ("PCI: mediatek: Add MediaTek PCIe host controller support")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
[mani: added the bitfield header include spotted by Sashiko]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Link: https://patch.msgid.link/20260515005552.2343-1-lirongqing@baidu.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-mediatek.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index bab962ec7ab468..c33335f3f8e249 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -7,6 +7,7 @@
* Honghui Zhang <honghui.zhang@mediatek.com>
*/
+#include <linux/bitfield.h>
#include <linux/clk.h>
#include <linux/delay.h>
#include <linux/iopoll.h>
@@ -58,7 +59,7 @@
/* MediaTek specific configuration registers */
#define PCIE_FTS_NUM 0x70c
#define PCIE_FTS_NUM_MASK GENMASK(15, 8)
-#define PCIE_FTS_NUM_L0(x) ((x) & 0xff << 8)
+#define PCIE_FTS_NUM_L0(x) FIELD_PREP(PCIE_FTS_NUM_MASK, x)
#define PCIE_FC_CREDIT 0x73c
#define PCIE_FC_CREDIT_MASK (GENMASK(31, 31) | GENMASK(28, 16))
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 306/699] perf tools: Fix get_max_num() size_t underflow on empty sysfs file
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 305/699] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 307/699] perf tools: Use perf_env__get_cpu_topology() in machine__resolve() Greg Kroah-Hartman
` (396 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers, Don Zickus,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 0a012113bb3a44482c163f16f4db03ccaa37a339 ]
get_max_num() reads a sysfs file (cpu/possible, cpu/present, or
node/possible) and scans backward from the end to find the last
number. If the file is empty, filename__read_str() returns num == 0.
The loop `while (--num)` decrements the size_t from 0 to SIZE_MAX,
reading backward across the heap until a comma or hyphen is found
or unmapped memory is hit.
Add an early return for empty files before the backward scan.
Fixes: 7780c25bae59fd04 ("perf tools: Allow ability to map cpus to nodes easily")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Don Zickus <dzickus@redhat.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/cpumap.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index dc5c5e6fc502d5..9a9759df3e70f9 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -280,6 +280,12 @@ static int get_max_num(char *path, int *max)
buf[num] = '\0';
+ /* empty file — nothing to parse */
+ if (num == 0) {
+ err = -1;
+ goto out;
+ }
+
/* start on the right, to find highest node num */
while (--num) {
if ((buf[num] == ',') || (buf[num] == '-')) {
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 307/699] perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 306/699] perf tools: Fix get_max_num() size_t underflow on empty sysfs file Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 308/699] PCI: rcar-host: Remove unused LIST_HEAD(res) Greg Kroah-Hartman
` (395 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers, Kan Liang,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 5484b43a0ec8231c36fba6ead654cb72dbba8b8f ]
machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail. Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.
Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.
Fixes: 0c4c4debb0adda4c ("perf tools: Add processor socket info to hist_entry and addr_location")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/event.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index 7e440fa90c9383..50de291e528518 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -12,6 +12,7 @@
#include <linux/zalloc.h>
#include "cpumap.h"
#include "dso.h"
+#include "env.h"
#include "event.h"
#include "debug.h"
#include "hist.h"
@@ -656,8 +657,18 @@ int machine__resolve(struct machine *machine, struct addr_location *al,
if (al->cpu >= 0) {
struct perf_env *env = machine->env;
- if (env && env->cpu)
- al->socket = env->cpu[al->cpu].socket_id;
+ /*
+ * Bounds-check al->cpu (s32) before casting to struct perf_cpu
+ * (int16_t): without this, e.g. 65536 truncates to 0 and silently
+ * returns CPU 0's topology. Can go once perf_cpu.cpu is widened.
+ */
+ if (env && al->cpu < env->nr_cpus_avail) {
+ struct cpu_topology_map *topo;
+
+ topo = perf_env__get_cpu_topology(env, (struct perf_cpu){ al->cpu });
+ if (topo)
+ al->socket = topo->socket_id;
+ }
}
if (al->map) {
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 308/699] PCI: rcar-host: Remove unused LIST_HEAD(res)
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 307/699] perf tools: Use perf_env__get_cpu_topology() in machine__resolve() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 309/699] perf sched: Fix idle-hist callchain display using wrong rb_first variant Greg Kroah-Hartman
` (394 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lad Prabhakar, Manivannan Sadhasivam,
Geert Uytterhoeven, Marek Vasut, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 6ba90ce2069ae923b0ec787aebdf2d786e5d2a58 ]
Remove the unused LIST_HEAD(res) declaration from rcar_pcie_hw_enable().
The macro instantiation defines an unused 'struct list_head res' variable,
which conflicts with a valid resource loop-local 'struct resource *res'
declaration further down in the function, triggering a compiler variable
shadowing warning:
drivers/pci/controller/pcie-rcar-host.c:357:34: warning: declaration of 'res' shadows a previous local [-Wshadow]
357 | struct resource *res = win->res;
Fixes: ce351636c67f75a9 ("PCI: rcar: Add suspend/resume")
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Link: https://patch.msgid.link/20260521091256.15737-1-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-rcar-host.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-rcar-host.c b/drivers/pci/controller/pcie-rcar-host.c
index 2bee09b16255d0..62d261ee8ff774 100644
--- a/drivers/pci/controller/pcie-rcar-host.c
+++ b/drivers/pci/controller/pcie-rcar-host.c
@@ -261,7 +261,6 @@ static void rcar_pcie_hw_enable(struct rcar_pcie_host *host)
struct rcar_pcie *pcie = &host->pcie;
struct pci_host_bridge *bridge = pci_host_bridge_from_priv(host);
struct resource_entry *win;
- LIST_HEAD(res);
int i = 0;
/* Try setting 5 GT/s link speed */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 309/699] perf sched: Fix idle-hist callchain display using wrong rb_first variant
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 308/699] PCI: rcar-host: Remove unused LIST_HEAD(res) Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 310/699] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() Greg Kroah-Hartman
` (393 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Davidlohr Bueso,
Namhyung Kim, Ian Rogers, Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit d9b99dc8148e0c1f5da3942131b47e0d21187a32 ]
timehist_print_idlehist_callchain() calls rb_first_cached() on
sorted_root, but the sort function (callchain_param.sort) populates it
via rb_insert_color() on the plain rb_root member — not the cached
variant. This means rb_leftmost is never set, so rb_first_cached()
always returns NULL and the entire callchain summary is silently
dropped from --idle-hist output.
The original code in ba957ebb54893aca ("perf sched timehist: Show
callchains for idle stat") was correct — it used struct rb_root and
rb_first(). The bug was introduced when sorted_root was converted to
rb_root_cached without converting the sort insertion path to use
rb_insert_color_cached().
Use rb_first(&root->rb_root) to match how the tree was populated.
Fixes: cb4c13a5137766c3 ("perf sched: Use cached rbtrees")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Acked-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-sched.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index ef535cf8d77a4e..c5d31851a64d2c 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -2820,7 +2820,8 @@ static size_t timehist_print_idlehist_callchain(struct rb_root_cached *root)
size_t ret = 0;
FILE *fp = stdout;
struct callchain_node *chain;
- struct rb_node *rb_node = rb_first_cached(root);
+ /* sort() uses rb_insert_color() on rb_root, not rb_root_cached */
+ struct rb_node *rb_node = rb_first(&root->rb_root);
printf(" %16s %8s %s\n", "Idle time (msec)", "Count", "Callchains");
printf(" %.16s %.8s %.50s\n", graph_dotted_line, graph_dotted_line,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 310/699] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 309/699] perf sched: Fix idle-hist callchain display using wrong rb_first variant Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 311/699] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Greg Kroah-Hartman
` (392 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers, Song Liu,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit cab3a9331ed0b3f884dd61c8a25b3cf123705982 ]
Both functions accumulate formatted output via ret += snprintf(buf + ret,
size - ret, ...). If the buffer is too small and snprintf() returns more
than the remaining space, ret exceeds size and the next 'size - ret'
underflows, causing snprintf() to write past the buffer end.
Switch to scnprintf() which returns the actual number of bytes written,
making the accumulation safe.
Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Song Liu <song@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-event.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index c4de19eba3880b..67295ca1d14b86 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -29,7 +29,7 @@ static int snprintf_hex(char *buf, size_t size, unsigned char *data, size_t len)
size_t i;
for (i = 0; i < len; i++)
- ret += snprintf(buf + ret, size - ret, "%02x", data[i]);
+ ret += scnprintf(buf + ret, size - ret, "%02x", data[i]);
return ret;
}
@@ -130,7 +130,7 @@ static int synthesize_bpf_prog_name(char *buf, int size,
const struct btf_type *t;
int name_len;
- name_len = snprintf(buf, size, "bpf_prog_");
+ name_len = scnprintf(buf, size, "bpf_prog_");
name_len += snprintf_hex(buf + name_len, size - name_len,
prog_tags[sub_id], BPF_TAG_SIZE);
if (btf) {
@@ -143,9 +143,10 @@ static int synthesize_bpf_prog_name(char *buf, int size,
short_name = info->name;
} else
short_name = "F";
- if (short_name)
- name_len += snprintf(buf + name_len, size - name_len,
- "_%s", short_name);
+ if (short_name) {
+ name_len += scnprintf(buf + name_len, size - name_len,
+ "_%s", short_name);
+ }
return name_len;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 311/699] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 310/699] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 312/699] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file Greg Kroah-Hartman
` (391 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 227a8748742f0263f1fe3131449b44563b77a209 ]
hists__scnprintf_title() accumulates formatted output into a buffer
using scnprintf() for all filter clauses except the UID filter, which
uses snprintf(). If the buffer fills up and snprintf() returns more
than the remaining space, printed exceeds size and the next 'size -
printed' underflows, causing later scnprintf() calls to write past
the buffer.
Switch the UID filter clause to scnprintf() to match the rest of the
function.
Fixes: 25c312dbf88ca402 ("perf hists: Move hists__scnprintf_title() away from the TUI code")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/hist.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 8a793e4c9400a7..97a9531e26ed5c 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -2728,9 +2728,10 @@ int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool sh
ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events);
- if (hists->uid_filter_str)
- printed += snprintf(bf + printed, size - printed,
- ", UID: %s", hists->uid_filter_str);
+ if (hists->uid_filter_str) {
+ printed += scnprintf(bf + printed, size - printed,
+ ", UID: %s", hists->uid_filter_str);
+ }
if (thread) {
if (hists__has(hists, thread)) {
printed += scnprintf(bf + printed, size - printed,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 312/699] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 311/699] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 313/699] tools lib api: Fix missing null termination in filename__read_int/ull() Greg Kroah-Hartman
` (390 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Stephane Eranian,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 33035f7dd4e49f3f117e70c5e36c8c1ae88d37f2 ]
perf_pmu__parse_scale() reads a PMU scale file then accesses
scale[sret - 1] to strip a trailing newline. Only sret < 0 is
guarded, so an empty file (sret == 0) causes scale[-1] — a stack
buffer underflow that reads and potentially writes out of bounds.
perf_pmu__parse_unit() has the same pattern: alias->unit[sret - 1]
with sret == 0 accesses the byte before the struct member, which
may corrupt the adjacent pmu_name pointer field.
Change both guards from sret < 0 to sret <= 0 so that empty files
are treated as read errors.
Fixes: 410136f5dd96b601 ("tools/perf/stat: Add event unit and scale support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Stephane Eranian <eranian@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/pmu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index d322305bc18281..914375179b00e8 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -158,7 +158,7 @@ static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *
goto error;
sret = read(fd, scale, sizeof(scale)-1);
- if (sret < 0)
+ if (sret <= 0)
goto error;
if (scale[sret - 1] == '\n')
@@ -185,7 +185,7 @@ static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *n
return -1;
sret = read(fd, alias->unit, UNIT_MAX_LEN);
- if (sret < 0)
+ if (sret <= 0)
goto error;
close(fd);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 313/699] tools lib api: Fix missing null termination in filename__read_int/ull()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 312/699] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 314/699] perf symbols: Fix signed overflow in sysfs__read_build_id() size check Greg Kroah-Hartman
` (389 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 52b1f9678499b13b7aeb0186d9c6f486c043283f ]
filename__read_int() passes a stack buffer to read() using the full
sizeof(line) and then hands it to atoi() without null-terminating.
If a sysfs file fills the 64-byte buffer exactly, atoi() reads past
the array into uninitialized stack memory.
filename__read_ull_base() has the same issue with strtoull().
Fix both by reading sizeof(line) - 1 bytes and explicitly
null-terminating after a successful read.
Fixes: 3a351127cbc682c3 ("tools lib fs: Adopt filename__read_int from tools/perf/")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/api/fs/fs.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index 82f53d81a7a784..e102714c6845e8 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -321,11 +321,14 @@ int filename__read_int(const char *filename, int *value)
{
char line[64];
int fd = open(filename, O_RDONLY), err = -1;
+ ssize_t n;
if (fd < 0)
return -1;
- if (read(fd, line, sizeof(line)) > 0) {
+ n = read(fd, line, sizeof(line) - 1);
+ if (n > 0) {
+ line[n] = '\0';
*value = atoi(line);
err = 0;
}
@@ -339,11 +342,14 @@ static int filename__read_ull_base(const char *filename,
{
char line[64];
int fd = open(filename, O_RDONLY), err = -1;
+ ssize_t n;
if (fd < 0)
return -1;
- if (read(fd, line, sizeof(line)) > 0) {
+ n = read(fd, line, sizeof(line) - 1);
+ if (n > 0) {
+ line[n] = '\0';
*value = strtoull(line, NULL, base);
if (*value != ULLONG_MAX)
err = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 314/699] perf symbols: Fix signed overflow in sysfs__read_build_id() size check
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 313/699] tools lib api: Fix missing null termination in filename__read_int/ull() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 315/699] perf symbols: Bounds-check .gnu_debuglink section data Greg Kroah-Hartman
` (388 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 6eaa8ee3e2abe5112e80e94c27196bb175689469 ]
sysfs__read_build_id() reads ELF note headers from sysfs files. The
note's namesz and descsz fields are used to compute the skip size:
int n = namesz + descsz;
if (n > (int)sizeof(bf))
Both namesz and descsz are size_t from NOTE_ALIGN() of 32-bit note
header fields. Their sum can exceed INT_MAX, overflowing the signed
int n to a negative value. The check n > sizeof(bf) then evaluates
false (negative < positive in signed comparison), and read(fd, bf, n)
reinterprets the negative n as a huge size_t count — the kernel writes
up to MAX_RW_COUNT bytes into the 8192-byte stack buffer.
In practice the overflow is bounded by the sysfs file's actual size,
so a real sysfs notes file won't trigger it organically. But crafted
input (e.g. via a mounted debugfs/sysfs image) could.
Fix by validating namesz and descsz individually against the buffer
size before summing, and change n to size_t to avoid the signed
overflow entirely.
Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index b171d134ce87aa..907796a4699282 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -656,14 +656,17 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid)
} else if (read(fd, bf, descsz) != (ssize_t)descsz)
break;
} else {
- int n = namesz + descsz;
+ size_t n;
- if (n > (int)sizeof(bf)) {
+ /* int sum of namesz+descsz can overflow negative, bypassing size check */
+ if (namesz > sizeof(bf) || descsz > sizeof(bf) - namesz) {
n = sizeof(bf);
pr_debug("%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n",
__func__, filename, nhdr.n_namesz, nhdr.n_descsz);
+ } else {
+ n = namesz + descsz;
}
- if (read(fd, bf, n) != n)
+ if (read(fd, bf, n) != (ssize_t)n)
break;
}
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 315/699] perf symbols: Bounds-check .gnu_debuglink section data
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 314/699] perf symbols: Fix signed overflow in sysfs__read_build_id() size check Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 316/699] perf tools: Fix thread__set_comm_from_proc() on empty comm file Greg Kroah-Hartman
` (387 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 9c74f0aab398cb32ab250401f323c0fdc9a3a496 ]
filename__read_debuglink() copies .gnu_debuglink section data into a
caller-provided buffer via:
strncpy(debuglink, data->d_buf, size);
where size is PATH_MAX. If the ELF section is smaller than size and
lacks a null terminator, strncpy reads past data->d_buf into adjacent
memory. A malformed ELF file can trigger this, potentially causing a
segfault or leaking heap data.
Additionally, strncpy does not guarantee null termination when the
source fills the buffer.
Replace with an explicit memcpy bounded by both the output buffer
size and the actual section data size (data->d_size), followed by
explicit null termination.
Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 907796a4699282..2ebceeff87c6f4 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -753,7 +753,14 @@ int filename__read_debuglink(const char *filename, char *debuglink,
goto out_elf_end;
/* the start of this section is a zero-terminated string */
- strncpy(debuglink, data->d_buf, size);
+ if (data->d_size > 0) {
+ size_t len = min(size - 1, data->d_size);
+
+ memcpy(debuglink, data->d_buf, len);
+ debuglink[len] = '\0';
+ } else {
+ debuglink[0] = '\0';
+ }
err = 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 316/699] perf tools: Fix thread__set_comm_from_proc() on empty comm file
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 315/699] perf symbols: Bounds-check .gnu_debuglink section data Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 317/699] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback Greg Kroah-Hartman
` (386 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 31d596054550f793508abe7dd593853ece47d428 ]
thread__set_comm_from_proc() calls procfs__read_str() then strips
the trailing newline via comm[sz - 1] = '\0'. procfs__read_str()
allocates the buffer before reading, so on an empty /proc/pid/comm
(reachable during late exit teardown) it returns success with sz = 0
and an unterminated heap buffer.
The sz - 1 underflow was the original sashiko finding: it writes a
null byte before the allocation. But even with a sz > 0 guard on
the newline strip, the unterminated buffer would still be passed to
thread__set_comm() which calls strlen() — an unbounded heap read.
Fix by treating sz == 0 as failure: free the buffer and return -1.
This is consistent with pmu.c's perf_pmu__parse_scale/unit which
already treat len == 0 from filename__read_str as an error.
Fixes: 2f3027ac28bf6bc3 ("perf thread: Introduce method to set comm from /proc/pid/self")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/thread.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index 665e5c0618ed3d..6840a2d357b6a6 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -282,6 +282,11 @@ int thread__set_comm_from_proc(struct thread *thread)
if (!(snprintf(path, sizeof(path), "%d/task/%d/comm",
thread->pid_, thread->tid) >= (int)sizeof(path)) &&
procfs__read_str(path, &comm, &sz) == 0) {
+ /* sz==0: read got nothing, e.g. race during exit teardown */
+ if (sz == 0) {
+ free(comm);
+ return -1;
+ }
comm[sz - 1] = '\0';
err = thread__set_comm(thread, comm, 0);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 317/699] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 316/699] perf tools: Fix thread__set_comm_from_proc() on empty comm file Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 318/699] tools lib api: Fix filename__write_int() writing uninitialized stack data Greg Kroah-Hartman
` (385 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 1b4e9fbdeabc549965e70ac0cd8095d57ff6df06 ]
When sysfs__read_build_id() matches NT_GNU_BUILD_ID with the right
namesz but the name content is not "GNU", it falls back to reading
descsz bytes into the stack buffer bf[BUFSIZ]:
} else if (read(fd, bf, descsz) != (ssize_t)descsz)
Unlike the else branch which validates namesz + descsz against
sizeof(bf), this path passes descsz directly to read() without any
bounds check. A crafted sysfs file with a large n_descsz overflows
the 8192-byte stack buffer.
Add a descsz > sizeof(bf) check before the read, breaking out of
the loop on oversized values.
Fixes: e5a1845fc0aeca85 ("perf symbols: Split out util/symbol-elf.c")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 2ebceeff87c6f4..bf11448eb4177d 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -653,8 +653,13 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid)
err = 0;
break;
}
- } else if (read(fd, bf, descsz) != (ssize_t)descsz)
- break;
+ } else {
+ /* descsz from untrusted file — clamp to buffer */
+ if (descsz > sizeof(bf))
+ break;
+ if (read(fd, bf, descsz) != (ssize_t)descsz)
+ break;
+ }
} else {
size_t n;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 318/699] tools lib api: Fix filename__write_int() writing uninitialized stack data
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 317/699] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 319/699] tools lib api: Fix mount_overload() snprintf truncation and toupper range Greg Kroah-Hartman
` (384 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Kan Liang,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 438ece06185696e14c63c6113d5e2d34ec0a9680 ]
filename__write_int() formats an integer into a 64-byte buffer with
sprintf() then passes sizeof(buf) (64) as the write length. This
writes all 64 bytes including uninitialized stack data past the
formatted string. Most sysfs files reject the oversized write,
making the function always return -1.
Fix by capturing the sprintf() return value and using it as the
write length.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 3b00ea938653d136 ("tools lib api fs: Add sysfs__write_int function")
Cc: Kan Liang <kan.liang@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/api/fs/fs.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index e102714c6845e8..e13034cb0b6315 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -432,12 +432,13 @@ int filename__write_int(const char *filename, int value)
{
int fd = open(filename, O_WRONLY), err = -1;
char buf[64];
+ int len;
if (fd < 0)
return err;
- sprintf(buf, "%d", value);
- if (write(fd, buf, sizeof(buf)) == sizeof(buf))
+ len = sprintf(buf, "%d", value);
+ if (write(fd, buf, len) == len)
err = 0;
close(fd);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 319/699] tools lib api: Fix mount_overload() snprintf truncation and toupper range
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 318/699] tools lib api: Fix filename__write_int() writing uninitialized stack data Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 320/699] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() Greg Kroah-Hartman
` (383 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Jiri Olsa,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit fd1f70776add263f8ef38a87ae593c75303f1dcd ]
mount_overload() builds an environment variable name like
"PERF_SYSFS_ENVIRONMENT" from fs->name. Two bugs:
1) snprintf() uses name_len as the buffer size instead of sizeof(upper_name).
For fs->name = "sysfs" (len=5), the output is truncated to "PERF" (4
chars + null), so getenv() never finds the intended variable.
2) mem_toupper() only uppercases name_len bytes, converting just the "PERF"
prefix rather than the full string including the filesystem name portion.
Fix by using sizeof(upper_name) for snprintf and strlen(upper_name) for
mem_toupper, so the full "PERF_SYSFS_ENVIRONMENT" string is correctly
formatted and uppercased.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 73ca85ad364769ff ("tools lib api fs: Add FSTYPE__mount() method")
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/api/fs/fs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c
index e13034cb0b6315..d8a55846883059 100644
--- a/tools/lib/api/fs/fs.c
+++ b/tools/lib/api/fs/fs.c
@@ -272,8 +272,8 @@ static const char *mount_overload(struct fs *fs)
/* "PERF_" + name + "_ENVIRONMENT" + '\0' */
char upper_name[5 + name_len + 12 + 1];
- snprintf(upper_name, name_len, "PERF_%s_ENVIRONMENT", fs->name);
- mem_toupper(upper_name, name_len);
+ snprintf(upper_name, sizeof(upper_name), "PERF_%s_ENVIRONMENT", fs->name);
+ mem_toupper(upper_name, strlen(upper_name));
return getenv(upper_name) ?: *fs->mounts;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 320/699] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 319/699] tools lib api: Fix mount_overload() snprintf truncation and toupper range Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 321/699] perf symbols: Add bounds checks to elf_read_build_id() note iteration Greg Kroah-Hartman
` (382 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Song Liu,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 903b0526dcf86d030c5970b4b0a67f9c227368e2 ]
synthesize_bpf_prog_name() calls btf__type_by_id() and immediately
dereferences the result via t->name_off without checking for NULL.
btf__type_by_id() returns NULL when the type_id is invalid or out
of range. When processing perf.data files, finfo->type_id comes from
untrusted input, so an invalid ID causes a NULL pointer dereference.
Fix by checking t for NULL before dereferencing.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: fc462ac75b36daaa ("perf bpf: Extract logic to create program names from perf_event__synthesize_one_bpf_prog()")
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-event.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 67295ca1d14b86..386afcefbc30dd 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -136,7 +136,8 @@ static int synthesize_bpf_prog_name(char *buf, int size,
if (btf) {
finfo = func_infos + sub_id * info->func_info_rec_size;
t = btf__type_by_id(btf, finfo->type_id);
- short_name = btf__name_by_offset(btf, t->name_off);
+ if (t)
+ short_name = btf__name_by_offset(btf, t->name_off);
} else if (sub_id == 0 && sub_prog_cnt == 1) {
/* no subprog */
if (info->name[0])
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 321/699] perf symbols: Add bounds checks to elf_read_build_id() note iteration
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 320/699] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 322/699] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build Greg Kroah-Hartman
` (381 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit acc56d3941fc2997a5a21ea9233a8ac3d87c4f2f ]
elf_read_build_id() iterates ELF notes using pointer arithmetic
driven by n_namesz and n_descsz from the note headers. Neither
the note header read nor the subsequent name/desc advances are
checked against the section boundary. A malformed ELF file with
oversized note sizes causes out-of-bounds reads past the section
data buffer.
Add two bounds checks: verify the note header fits within the
remaining section data, and verify that namesz + descsz (after
alignment) fits before advancing the pointer.
Fixes: fd7a346ea292074e ("perf symbols: Filename__read_build_id should look at .notes section too")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index bf11448eb4177d..627a6206f48221 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -535,10 +535,24 @@ static int elf_read_build_id(Elf *elf, void *bf, size_t size)
ptr = data->d_buf;
while (ptr < (data->d_buf + data->d_size)) {
GElf_Nhdr *nhdr = ptr;
- size_t namesz = NOTE_ALIGN(nhdr->n_namesz),
- descsz = NOTE_ALIGN(nhdr->n_descsz);
+ size_t namesz, descsz, remaining;
const char *name;
+ /* ensure the note header fits within the section */
+ if (ptr + sizeof(*nhdr) > data->d_buf + data->d_size)
+ break;
+
+ namesz = NOTE_ALIGN(nhdr->n_namesz);
+ descsz = NOTE_ALIGN(nhdr->n_descsz);
+
+ /* validate individually to avoid size_t overflow on 32-bit */
+ remaining = data->d_buf + data->d_size - ptr - sizeof(*nhdr);
+ if (namesz > remaining || descsz > remaining - namesz) {
+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n",
+ __func__, nhdr->n_namesz, nhdr->n_descsz);
+ break;
+ }
+
ptr += sizeof(*nhdr);
name = ptr;
ptr += namesz;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 322/699] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 321/699] perf symbols: Add bounds checks to elf_read_build_id() note iteration Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 323/699] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() Greg Kroah-Hartman
` (380 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Namhyung Kim,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 52e582e316c48c53bb3082c29f7862ebc554087e ]
symbol-minimal.c's read_build_id() iterates ELF notes with the same
pattern as symbol-elf.c's elf_read_build_id(): pointer arithmetic
driven by n_namesz and n_descsz from 32-bit note header fields,
without validating that the name and desc fit within the note section
data. A malformed ELF file with oversized note sizes causes
out-of-bounds reads past the section data buffer.
Add the same bounds check as the libelf path: validate namesz and
descsz individually against remaining data before advancing the
pointer, avoiding size_t overflow on 32-bit.
Fixes: b691f64360ecec49 ("perf symbols: Implement poor man's ELF parser")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-minimal.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/symbol-minimal.c b/tools/perf/util/symbol-minimal.c
index f9eb0bee7f157a..cd3bef5644a0b6 100644
--- a/tools/perf/util/symbol-minimal.c
+++ b/tools/perf/util/symbol-minimal.c
@@ -1,3 +1,4 @@
+#include "debug.h"
#include "dso.h"
#include "symbol.h"
#include "symsrc.h"
@@ -45,7 +46,7 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid,
ptr = note_data;
while (ptr < (note_data + note_len)) {
const char *name;
- size_t namesz, descsz;
+ size_t namesz, descsz, remaining;
nhdr = ptr;
if (need_swap) {
@@ -57,6 +58,14 @@ static int read_build_id(void *note_data, size_t note_len, struct build_id *bid,
namesz = NOTE_ALIGN(nhdr->n_namesz);
descsz = NOTE_ALIGN(nhdr->n_descsz);
+ /* validate individually to avoid size_t overflow on 32-bit */
+ remaining = note_data + note_len - ptr - sizeof(*nhdr);
+ if (namesz > remaining || descsz > remaining - namesz) {
+ pr_warning("%s: oversized note: n_namesz=%u, n_descsz=%u\n",
+ __func__, nhdr->n_namesz, nhdr->n_descsz);
+ break;
+ }
+
ptr += sizeof(*nhdr);
name = ptr;
ptr += namesz;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 323/699] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 322/699] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 324/699] PCI: mediatek: Use actual physical address instead of virt_to_phys() Greg Kroah-Hartman
` (379 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryder Lee, Manivannan Sadhasivam,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryder Lee <ryder.lee@mediatek.com>
[ Upstream commit ab4a4043db1fcc4fd4c5745c5be8caf053502e29 ]
As reported by the W=1 warning below, content of the 'name' variable might
get truncated with the existing size of 10 bytes. Though it is not
practically possible to exceed the 10 bytes size, increase it to 20 to
silence the warning for a clean W=1 build:
$ make W=1 drivers/pci/controller/pcie-mediatek.o
CALL scripts/checksyscalls.sh
DESCEND objtool
INSTALL libsubcmd_headers
CC drivers/pci/controller/pcie-mediatek.o
drivers/pci/controller/pcie-mediatek.c: In function ‘mtk_pcie_parse_port’:
drivers/pci/controller/pcie-mediatek.c:963:43: error: ‘%d’ directive output may be truncated writing between 1 and 10 bytes into a region of size 6 [-Werror=format-truncation=]
963 | snprintf(name, sizeof(name), "port%d", slot);
| ^~
drivers/pci/controller/pcie-mediatek.c:963:38: note: directive argument in the range [0, 2147483647]
963 | snprintf(name, sizeof(name), "port%d", slot);
| ^~~~~~~~
drivers/pci/controller/pcie-mediatek.c:963:9: note: ‘snprintf’ output between 6 and 15 bytes into a destination of size 10
963 | snprintf(name, sizeof(name), "port%d", slot);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Ryder Lee <ryder.lee@mediatek.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/b835e360b42c5e0994f9301a34dbdf140a8d3ef5.1772493898.git.ryder.lee@mediatek.com
Stable-dep-of: ebc1d9906894 ("PCI: mediatek: Use actual physical address instead of virt_to_phys()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-mediatek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index c33335f3f8e249..3679bc7ab078af 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -914,7 +914,7 @@ static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
struct mtk_pcie_port *port;
struct device *dev = pcie->dev;
struct platform_device *pdev = to_platform_device(dev);
- char name[10];
+ char name[20];
int err;
port = devm_kzalloc(dev, sizeof(*port), GFP_KERNEL);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 324/699] PCI: mediatek: Use actual physical address instead of virt_to_phys()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 323/699] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 325/699] apparmor: check label build before no_new_privs test Greg Kroah-Hartman
` (378 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Manivannan Sadhasivam, Caleb James DeLisle, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit ebc1d9906894703286d12306a6f242d90cfb49e8 ]
The driver previously used virt_to_phys() on the ioremapped register base
(port->base) to compute the MSI message address. Using virt_to_phys() on an
IO mapped address is incorrect because it expects a kernel virtual address.
To fix it, store the physical start of the I/O register region in
mtk_pcie_port->phys_base and use it to build the MSI address. This replaces
the incorrect virt_to_phys() usage and ensures MSI addresses are generated
correctly.
Fixes: 43e6409db64d ("PCI: mediatek: Add MSI support for MT2712 and MT7622")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Tested-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://patch.msgid.link/20260521171951.1495781-2-cjd@cjdns.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/pcie-mediatek.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/controller/pcie-mediatek.c b/drivers/pci/controller/pcie-mediatek.c
index 3679bc7ab078af..3242e0ccb79593 100644
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -161,6 +161,7 @@ struct mtk_pcie_soc {
/**
* struct mtk_pcie_port - PCIe port information
* @base: IO mapped register base
+ * @phys_base: Physical address of the I/O register base region
* @list: port list
* @pcie: pointer to PCIe host info
* @reset: pointer to port reset control
@@ -183,6 +184,7 @@ struct mtk_pcie_soc {
*/
struct mtk_pcie_port {
void __iomem *base;
+ phys_addr_t phys_base;
struct list_head list;
struct mtk_pcie *pcie;
struct reset_control *reset;
@@ -399,7 +401,7 @@ static void mtk_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
phys_addr_t addr;
/* MT2712/MT7622 only support 32-bit MSI addresses */
- addr = virt_to_phys(port->base + PCIE_MSI_VECTOR);
+ addr = port->phys_base + PCIE_MSI_VECTOR;
msg->address_hi = 0;
msg->address_lo = lower_32_bits(addr);
@@ -522,7 +524,7 @@ static void mtk_pcie_enable_msi(struct mtk_pcie_port *port)
u32 val;
phys_addr_t msg_addr;
- msg_addr = virt_to_phys(port->base + PCIE_MSI_VECTOR);
+ msg_addr = port->phys_base + PCIE_MSI_VECTOR;
val = lower_32_bits(msg_addr);
writel(val, port->base + PCIE_IMSI_ADDR);
@@ -914,6 +916,7 @@ static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
struct mtk_pcie_port *port;
struct device *dev = pcie->dev;
struct platform_device *pdev = to_platform_device(dev);
+ struct resource *res;
char name[20];
int err;
@@ -922,7 +925,14 @@ static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
return -ENOMEM;
snprintf(name, sizeof(name), "port%d", slot);
- port->base = devm_platform_ioremap_resource_byname(pdev, name);
+ res = platform_get_resource_byname(pdev, IORESOURCE_MEM, name);
+ if (!res) {
+ dev_err(dev, "failed to get port%d base\n", slot);
+ return -EINVAL;
+ }
+
+ port->phys_base = res->start;
+ port->base = devm_ioremap_resource(&pdev->dev, res);
if (IS_ERR(port->base)) {
dev_err(dev, "failed to map port%d base\n", slot);
return PTR_ERR(port->base);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 325/699] apparmor: check label build before no_new_privs test
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 324/699] PCI: mediatek: Use actual physical address instead of virt_to_phys() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 326/699] apparmor: aa_label_alloc use aa_label_free on alloc failure Greg Kroah-Hartman
` (377 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, John Johansen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit a58cafd38b46fb1a2220e2fbbcfe291ea75fa147 ]
aa_change_profile() builds a replacement label with
fn_label_build_in_scope() before the no_new_privs subset check. The build
helper can fail and return NULL or an ERR_PTR, but the result was passed
to aa_label_is_unconfined_subset() before the existing IS_ERR_OR_NULL()
check.
Reuse the existing target-label build failure handling immediately after
the build. This preserves the current audit handling while preventing the
subset helper from dereferencing an invalid label.
Fixes: e00b02bb6ac2a ("apparmor: move change_profile mediation to using labels")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/domain.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 87a9e6fd7908d9..f7bf0ebc00cb8c 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -1404,6 +1404,8 @@ int aa_change_profile(const char *fqname, int flags)
new = fn_label_build_in_ns(label, profile, GFP_KERNEL,
aa_get_label(target),
aa_get_label(&profile->label));
+ if (IS_ERR_OR_NULL(new))
+ goto build_fail;
/*
* no new privs prevents domain transitions that would
* reduce restrictions.
@@ -1421,16 +1423,8 @@ int aa_change_profile(const char *fqname, int flags)
/* only transition profiles in the current ns */
if (stack)
new = aa_label_merge(label, target, GFP_KERNEL);
- if (IS_ERR_OR_NULL(new)) {
- info = "failed to build target label";
- if (!new)
- error = -ENOMEM;
- else
- error = PTR_ERR(new);
- new = NULL;
- perms.allow = 0;
- goto audit;
- }
+ if (IS_ERR_OR_NULL(new))
+ goto build_fail;
error = aa_replace_current_label(new);
} else {
if (new) {
@@ -1442,6 +1436,17 @@ int aa_change_profile(const char *fqname, int flags)
error = aa_set_current_onexec(target, stack);
}
+ goto audit;
+
+build_fail:
+ info = "failed to build target label";
+ if (!new)
+ error = -ENOMEM;
+ else
+ error = PTR_ERR(new);
+ new = NULL;
+ perms.allow = 0;
+
audit:
error = fn_for_each_in_ns(label, profile,
aa_audit_file(profile, &perms, op, request, auditname,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 326/699] apparmor: aa_label_alloc use aa_label_free on alloc failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 325/699] apparmor: check label build before no_new_privs test Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 327/699] apparmor: grab ns lock and refresh when looking up changehat child profiles Greg Kroah-Hartman
` (376 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zygmunt Krynicki, John Johansen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zygmunt Krynicki <me@zygoon.pl>
[ Upstream commit 654fe7505dc6889724d4094fa64f89991afabfc3 ]
aa_label_alloc() allocates a secid before allocating or taking the label
proxy. If the later proxy step fails, the error path only freed the label
memory, leaking any resources initialized by aa_label_init().
Use aa_label_free() on the failure path so partially initialized labels
release their secid and other label resources before the backing memory is
freed.
Fixes: f1bd904175e81 ("apparmor: add the base fns() for domain labels")
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/apparmor/label.c b/security/apparmor/label.c
index 7cae71daa0f92f..c675a11d8a5516 100644
--- a/security/apparmor/label.c
+++ b/security/apparmor/label.c
@@ -450,7 +450,7 @@ struct aa_label *aa_label_alloc(int size, struct aa_proxy *proxy, gfp_t gfp)
return new;
fail:
- kfree(new);
+ aa_label_free(new);
return NULL;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 327/699] apparmor: grab ns lock and refresh when looking up changehat child profiles
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 326/699] apparmor: aa_label_alloc use aa_label_free on alloc failure Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 328/699] apparmor: fix potential UAF in aa_replace_profiles Greg Kroah-Hartman
` (375 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, Ryan Lee,
John Johansen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryan Lee <ryan.lee@canonical.com>
[ Upstream commit 32e92764d6f8d251c1bca62be33793287b453a81 ]
There was a race condition involving change_hat and profile replacement in
which replacement of the parent profile during a changehat operation could
result in the list of children becoming empty and the changehat operation
failing. To prevent this:
- grab the namespace lock until we've built the hat transition, and
- use aa_get_newest_profile to avoid using stale profile objects.
Link: https://bugs.launchpad.net/bugs/2139664
Fixes: 89dbf1962aa63 ("apparmor: move change_hat mediation to using labels")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/domain.c | 33 +++++++++++++++++++++++++++++++--
1 file changed, 31 insertions(+), 2 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index f7bf0ebc00cb8c..4a7891ffe86b91 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -12,6 +12,7 @@
#include <linux/fdtable.h>
#include <linux/file.h>
#include <linux/mount.h>
+#include <linux/mutex.h>
#include <linux/syscalls.h>
#include <linux/tracehook.h>
#include <linux/personality.h>
@@ -1034,6 +1035,7 @@ static struct aa_label *change_hat(struct aa_label *label, const char *hats[],
int count, int flags)
{
struct aa_profile *profile, *root, *hat = NULL;
+ struct aa_ns *ns, *new_ns;
struct aa_label *new;
struct label_it it;
bool sibling = false;
@@ -1044,6 +1046,32 @@ static struct aa_label *change_hat(struct aa_label *label, const char *hats[],
AA_BUG(!hats);
AA_BUG(count < 1);
+ /*
+ * Acquire the newest label and then hold the lock until we choose a
+ * hat, so that profile replacement doesn't atomically truncate the
+ * list of potential hats. Because we are getting the namespaces from
+ * the profiles and label, we can rely on the namespaces being live
+ * and avoid incrementing their refcounts while grabbing the lock.
+ */
+ label = aa_get_label(label);
+ ns = labels_ns(label);
+
+retry:
+ mutex_lock_nested(&ns->lock, ns->level);
+ if (label_is_stale(label)) {
+ new = aa_get_newest_label(label);
+ new_ns = labels_ns(new);
+ if (new_ns != ns) {
+ aa_put_label(new);
+ mutex_unlock(&ns->lock);
+ ns = new_ns;
+ label = new;
+ goto retry;
+ }
+ aa_put_label(label);
+ label = new;
+ }
+
if (PROFILE_IS_HAT(labels_profile(label)))
sibling = true;
@@ -1052,7 +1080,7 @@ static struct aa_label *change_hat(struct aa_label *label, const char *hats[],
name = hats[i];
label_for_each_in_ns(it, labels_ns(label), label, profile) {
if (sibling && PROFILE_IS_HAT(profile)) {
- root = aa_get_profile_rcu(&profile->parent);
+ root = aa_get_profile(profile->parent);
} else if (!sibling && !PROFILE_IS_HAT(profile)) {
root = aa_get_profile(profile);
} else { /* conflicting change type */
@@ -1111,6 +1139,7 @@ static struct aa_label *change_hat(struct aa_label *label, const char *hats[],
GLOBAL_ROOT_UID, info, error);
}
}
+ mutex_unlock(&ns->lock);
return ERR_PTR(error);
build:
@@ -1122,7 +1151,7 @@ static struct aa_label *change_hat(struct aa_label *label, const char *hats[],
error = -ENOMEM;
goto fail;
} /* else if (IS_ERR) build_change_hat has logged error so return new */
-
+ mutex_unlock(&ns->lock);
return new;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 328/699] apparmor: fix potential UAF in aa_replace_profiles
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 327/699] apparmor: grab ns lock and refresh when looking up changehat child profiles Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 329/699] apparmor: aa_getprocattr free procattr leak on format failure Greg Kroah-Hartman
` (374 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgia Garcia, Maxime Bélair,
John Johansen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Bélair <maxime.belair@canonical.com>
[ Upstream commit 7b42f95813dc9ceb6bda35afcf914630909a19f9 ]
The function aa_replace_profiles was accessing udata->size after calling
aa_put_loaddata(udata), causing a potential UAF.
Fixed this by saving the size to a local variable before dropping the
reference.
Fixes: 5ac8c355ae001 ("apparmor: allow introspecting the loaded policy pre internal transform")
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -922,6 +922,7 @@ ssize_t aa_replace_profiles(struct aa_ns
struct aa_loaddata *rawdata_ent;
const char *op;
ssize_t count, error;
+ ssize_t udata_sz;
LIST_HEAD(lh);
op = mask & AA_MAY_REPLACE_POLICY ? OP_PROF_REPL : OP_PROF_LOAD;
@@ -1106,13 +1107,15 @@ ssize_t aa_replace_profiles(struct aa_ns
mutex_unlock(&ns->lock);
out:
+ udata_sz = udata->size;
+
aa_put_ns(ns);
aa_put_profile_loaddata(udata);
kfree(ns_name);
if (error)
return error;
- return udata->size;
+ return udata_sz;
fail_lock:
mutex_unlock(&ns->lock);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 329/699] apparmor: aa_getprocattr free procattr leak on format failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 328/699] apparmor: fix potential UAF in aa_replace_profiles Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 330/699] apparmor: put secmark label after secid lookup Greg Kroah-Hartman
` (373 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tyler Hicks, Ryan Lee,
Zygmunt Krynicki, John Johansen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zygmunt Krynicki <me@zygoon.pl>
[ Upstream commit fea23bf73f0cae8ccb1d0684e4a3003874771f41 ]
aa_getprocattr() allocates the output string before rendering the label
into it. If the second aa_label_snxprint() call fails, the function
returned without freeing that allocation.
Free and clear the output pointer on the uncommon formatting failure path
before dropping the namespace reference.
Fixes: 76a1d263aba3 ("apparmor: switch getprocattr to using label_print fns()")
Reviewed-by: Tyler Hicks <code@thicks.com>
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/procattr.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/apparmor/procattr.c b/security/apparmor/procattr.c
index c929bf4a3df1c0..3beb0915892a16 100644
--- a/security/apparmor/procattr.c
+++ b/security/apparmor/procattr.c
@@ -56,6 +56,8 @@ int aa_getprocattr(struct aa_label *label, char **string)
FLAG_SHOW_MODE | FLAG_VIEW_SUBNS |
FLAG_HIDDEN_UNCONFINED);
if (len < 0) {
+ kfree(*string);
+ *string = NULL;
aa_put_ns(current_ns);
return len;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 330/699] apparmor: put secmark label after secid lookup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 329/699] apparmor: aa_getprocattr free procattr leak on format failure Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 331/699] i3c: master: Prevent reuse of dynamic address on device add failure Greg Kroah-Hartman
` (372 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zygmunt Krynicki, John Johansen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zygmunt Krynicki <me@zygoon.pl>
[ Upstream commit 340372688bb87da45ff8d4e2f82ccfd1b64c65ff ]
apparmor_secmark_init() parses a configured secmark label to obtain its
secid. aa_label_strn_parse() returns a refcounted label, but the success
path kept that reference after copying the secid.
Fixes: ab9f2115081a ("apparmor: Allow filtering based on secmark policy")
Signed-off-by: Zygmunt Krynicki <me@zygoon.pl>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/net.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/apparmor/net.c b/security/apparmor/net.c
index fbbfedd253f69b..1ca5702d3facce 100644
--- a/security/apparmor/net.c
+++ b/security/apparmor/net.c
@@ -208,6 +208,7 @@ static int apparmor_secmark_init(struct aa_secmark *secmark)
return PTR_ERR(label);
secmark->secid = label->secid;
+ aa_put_label(label);
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 331/699] i3c: master: Prevent reuse of dynamic address on device add failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 330/699] apparmor: put secmark label after secid lookup Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 332/699] apparmor: fix label can not be immediately before a declaration Greg Kroah-Hartman
` (371 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Frank Li,
Alexandre Belloni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <adrian.hunter@intel.com>
[ Upstream commit b3ba8383da4d0cff15810e32ea785eceb0a80813 ]
i3c_master_add_i3c_dev_locked() is called after a device has already
been assigned a dynamic address. If the function fails, the address
remains marked as free and may be reallocated to another device,
leading to address conflicts on the bus.
Ensure the address is not marked as free on failure, by updating the
address slot state to prevent the address from being re-used.
Emit an error message to inform of the failure.
Opportunistically remove the !master check because it is impossible.
Note, directly resetting the device's dynamic address is no longer
an option, since Direct RSTDAA was deprecated from I3C starting from
version 1.1 and v1.1 (or later) target devices are meant to NACK it.
Fixes: 3a379bbcea0af ("i3c: Add core I3C infrastructure")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260612080107.11606-4-adrian.hunter@intel.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i3c/master.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c
index f3fc7fe3779fe9..22a95b30d5abad 100644
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1902,12 +1902,11 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
bool enable_ibi = false;
int ret;
- if (!master)
- return -EINVAL;
-
newdev = i3c_master_alloc_i3c_dev(master, &info);
- if (IS_ERR(newdev))
- return PTR_ERR(newdev);
+ if (IS_ERR(newdev)) {
+ ret = PTR_ERR(newdev);
+ goto err_prevent_addr_reuse;
+ }
ret = i3c_master_attach_i3c_dev(master, newdev);
if (ret)
@@ -2028,6 +2027,16 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master,
err_free_dev:
i3c_master_free_i3c_dev(newdev);
+err_prevent_addr_reuse:
+ /*
+ * Although the device has not been added, the address has been
+ * assigned. Prevent the address from being used again.
+ */
+ if (i3c_bus_get_addr_slot_status(&master->bus, addr) == I3C_ADDR_SLOT_FREE)
+ i3c_bus_set_addr_slot_status(&master->bus, addr, I3C_ADDR_SLOT_I3C_DEV);
+
+ dev_err(&master->dev, "Failed to add I3C device at address %u, error %d\n", addr, ret);
+
return ret;
}
EXPORT_SYMBOL_GPL(i3c_master_add_i3c_dev_locked);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 332/699] apparmor: fix label can not be immediately before a declaration
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 331/699] i3c: master: Prevent reuse of dynamic address on device add failure Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 333/699] sparc: led: avoid trimming a newline from empty writes Greg Kroah-Hartman
` (370 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, John Johansen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Johansen <john.johansen@canonical.com>
[ Upstream commit 1ed40bd525c00d22af666016af9aef7167f8085f ]
Fix error reported by kernel test robot
security/apparmor/policy.c:1381:2: error: a label can only be part of
a statement and a declaration is not a statement
All errors (new ones prefixed by >>):
security/apparmor/policy.c: In function 'aa_replace_profiles':
>> security/apparmor/policy.c:1381:2: error: a label can only be part
of a statement and a declaration is not a statement
ssize_t udata_sz = udata->size;
^~~~~
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606150525.npax8WiH-lkp@intel.com/
Fixes: 7b42f95813dc9 ("apparmor: fix potential UAF in aa_replace_profiles")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/security/apparmor/policy.c
+++ b/security/apparmor/policy.c
@@ -1107,9 +1107,10 @@ ssize_t aa_replace_profiles(struct aa_ns
mutex_unlock(&ns->lock);
out:
+ aa_put_ns(ns);
+
udata_sz = udata->size;
- aa_put_ns(ns);
aa_put_profile_loaddata(udata);
kfree(ns_name);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 333/699] sparc: led: avoid trimming a newline from empty writes
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 332/699] apparmor: fix label can not be immediately before a declaration Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 334/699] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() Greg Kroah-Hartman
` (369 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Larsson, Pengpeng Hou,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 7eb475e8a738ee6fd1260aa59ddccb610fdd4300 ]
led_proc_write() duplicates up to LED_MAX_LENGTH bytes with
memdup_user_nul() and then unconditionally inspects buf[count - 1] to
strip a trailing newline. A zero-length write therefore reads one byte
before the duplicated buffer.
The previous version rejected empty writes, but empty input already falls
through to the existing default case and turns the LED off like any other
unrecognized string. Preserve that behavior and only skip the newline
trim when there is no input byte to inspect.
Fixes: ee1858d3122d ("[SPARC]: Add sun4m LED driver.")
Suggested-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/kernel/led.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/kernel/led.c b/arch/sparc/kernel/led.c
index 3a66e62eb2a0e6..9d1e93d25f6cc0 100644
--- a/arch/sparc/kernel/led.c
+++ b/arch/sparc/kernel/led.c
@@ -78,7 +78,7 @@ static ssize_t led_proc_write(struct file *file, const char __user *buffer,
return PTR_ERR(buf);
/* work around \n when echo'ing into proc */
- if (buf[count - 1] == '\n')
+ if (count > 0 && buf[count - 1] == '\n')
buf[count - 1] = '\0';
/* before we change anything we want to stop any running timers,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 334/699] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 333/699] sparc: led: avoid trimming a newline from empty writes Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 335/699] perf tools: Use snprintf() for root_dir path construction Greg Kroah-Hartman
` (368 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Ian Rogers,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 063c647b24f640657d6d9e2e90d620ea3ee19ae6 ]
sysfs__read_build_id() iterates ELF note headers from sysfs files in a
while(1) loop. If the file contains a zero-filled note header (both
n_namesz and n_descsz are 0), the code computes n = namesz + descsz = 0
and calls read(fd, bf, 0). read() with count 0 returns 0, which
matches the expected (ssize_t)n value, so the error check passes and
the loop repeats — reading the same zero bytes and spinning forever.
This can happen with corrupted or zero-padded sysfs pseudo-files.
Add a check for n == 0 before the read, since no valid ELF note has
both name and description of zero length.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: f1617b40596cb341 ("perf symbols: Record the build_ids of kernel modules too")
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/symbol-elf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 627a6206f48221..8dd0f3a50a5b14 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -685,6 +685,9 @@ int sysfs__read_build_id(const char *filename, struct build_id *bid)
} else {
n = namesz + descsz;
}
+ /* no valid note has both namesz and descsz zero */
+ if (n == 0)
+ break;
if (read(fd, bf, n) != (ssize_t)n)
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 335/699] perf tools: Use snprintf() for root_dir path construction
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 334/699] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 336/699] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() Greg Kroah-Hartman
` (367 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang Yanmin,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 7b0df6f4d498b1608afccfd6dffb264e6da91693 ]
get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in
symbol.c use sprintf() to construct paths by prepending root_dir to
"/proc/version" and "/proc/kallsyms" respectively. Both write into
PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM
configuration and is not length-checked. A root_dir at or near
PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof(path) to prevent overflow.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host")
Cc: Zhang Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 2 +-
tools/perf/util/symbol.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index eec926c313b131..53adfad15be455 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -1309,7 +1309,7 @@ static char *get_kernel_version(const char *root_dir)
char *name, *tmp;
const char *prefix = "Linux version ";
- sprintf(version, "%s/proc/version", root_dir);
+ snprintf(version, sizeof(version), "%s/proc/version", root_dir);
file = fopen(version, "r");
if (!file)
return NULL;
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 40e2362096d8c6..bc59d217f79233 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -2287,7 +2287,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map)
if (!kallsyms_filename)
return -1;
} else {
- sprintf(path, "%s/proc/kallsyms", machine->root_dir);
+ snprintf(path, sizeof(path), "%s/proc/kallsyms", machine->root_dir);
kallsyms_filename = path;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 336/699] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 335/699] perf tools: Use snprintf() for root_dir path construction Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 337/699] xfrm: validate selector family and prefixlen during match Greg Kroah-Hartman
` (366 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Song Liu,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 10b3c3d63ecc17c6acb855bac5f40367f1115765 ]
synthesize_bpf_prog_name() computes a pointer into the func_info array
using sub_id * info->func_info_rec_size without validating either value.
Both come from perf.data and are untrusted:
- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means
the finfo pointer would reference a truncated entry, reading past it
into adjacent data.
- A sub_id >= nr_func_info computes an offset past the func_info buffer,
causing an out-of-bounds read.
Add bounds checks for both values before computing the pointer offset.
When validation fails, fall through to the non-BTF name path instead
of reading garbage.
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 7b612e291a5affb1 ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-event.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 386afcefbc30dd..f4d35213c90502 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -133,7 +133,9 @@ static int synthesize_bpf_prog_name(char *buf, int size,
name_len = scnprintf(buf, size, "bpf_prog_");
name_len += snprintf_hex(buf + name_len, size - name_len,
prog_tags[sub_id], BPF_TAG_SIZE);
- if (btf) {
+ if (btf &&
+ info->func_info_rec_size >= sizeof(*finfo) &&
+ sub_id < info->nr_func_info) {
finfo = func_infos + sub_id * info->func_info_rec_size;
t = btf__type_by_id(btf, finfo->type_id);
if (t)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 337/699] xfrm: validate selector family and prefixlen during match
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 336/699] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 338/699] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
` (365 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+9383b1ff0df4b29ca5e6,
Eric Dumazet, Steffen Klassert, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 40f0b1047918539f0b0f795ac65e35336b4c2c78 ]
syzbot reported a shift-out-of-bounds in xfrm_selector_match()
due to AF_UNSPEC selector with large prefixlen (e.g. 128) matched
against IPv4 flow (when XFRM_STATE_AF_UNSPEC is set).
Fix this by:
- Rejecting mismatched families in xfrm_selector_match.
- Returning false in addr4_match if prefixlen > 32.
- Returning false in addr_match if prefixlen > 128 (prevents overflow).
Fixes: 3f0ab59e6537 ("xfrm: validate new SA's prefixlen using SA family when sel.family is unset")
Reported-by: syzbot+9383b1ff0df4b29ca5e6@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6a2fbe35.be3f099c.2836ae.0018.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/xfrm.h | 7 +++++++
net/xfrm/xfrm_policy.c | 3 +++
2 files changed, 10 insertions(+)
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 22f66b689e82c5..695b73b355eed6 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -821,6 +821,9 @@ static inline bool addr_match(const void *token1, const void *token2,
unsigned int pdw;
unsigned int pbi;
+ if (prefixlen > 128)
+ return false;
+
pdw = prefixlen >> 5; /* num of whole u32 in prefix */
pbi = prefixlen & 0x1f; /* num of bits in incomplete u32 in prefix */
@@ -845,6 +848,10 @@ static inline bool addr4_match(__be32 a1, __be32 a2, u8 prefixlen)
/* C99 6.5.7 (3): u32 << 32 is undefined behaviour */
if (sizeof(long) == 4 && prefixlen == 0)
return true;
+
+ if (prefixlen > 32)
+ return false;
+
return !((a1 ^ a2) & htonl(~0UL << (32 - prefixlen)));
}
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index e17faf51f32553..37c4128e313cb2 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -223,6 +223,9 @@ __xfrm6_selector_match(const struct xfrm_selector *sel, const struct flowi *fl)
bool xfrm_selector_match(const struct xfrm_selector *sel, const struct flowi *fl,
unsigned short family)
{
+ if (family != sel->family && sel->family != AF_UNSPEC)
+ return false;
+
switch (family) {
case AF_INET:
return __xfrm4_selector_match(sel, fl);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 338/699] perf machine: Use snprintf() for guestmount path construction
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 337/699] xfrm: validate selector family and prefixlen during match Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 339/699] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown Greg Kroah-Hartman
` (364 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-bot, Zhang, Yanmin,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit fe63d3bca288c5bb983304efd5fc3a5ff3183403 ]
machines__findnew() and machines__create_guest_kernel_maps() use
sprintf() to build paths by prepending symbol_conf.guestmount.
Both write into PATH_MAX stack buffers, but guestmount comes from
user configuration and is not length-checked. A guestmount path
at or near PATH_MAX causes a stack buffer overflow.
Switch to snprintf() with sizeof() to prevent overflow. The
subsequent access()/fopen() calls will fail on a truncated path.
Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/machine.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 53adfad15be455..c0ba380023db67 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -347,7 +347,7 @@ struct machine *machines__findnew(struct machines *machines, pid_t pid)
if ((pid != HOST_KERNEL_ID) &&
(pid != DEFAULT_GUEST_KERNEL_ID) &&
(symbol_conf.guestmount)) {
- sprintf(path, "%s/%d", symbol_conf.guestmount, pid);
+ snprintf(path, sizeof(path), "%s/%d", symbol_conf.guestmount, pid);
if (access(path, R_OK)) {
static struct strlist *seen;
@@ -1231,9 +1231,9 @@ int machines__create_guest_kernel_maps(struct machines *machines)
namelist[i]->d_name);
continue;
}
- sprintf(path, "%s/%s/proc/kallsyms",
- symbol_conf.guestmount,
- namelist[i]->d_name);
+ snprintf(path, sizeof(path), "%s/%s/proc/kallsyms",
+ symbol_conf.guestmount,
+ namelist[i]->d_name);
ret = access(path, R_OK);
if (ret) {
pr_debug("Can't access file %s\n", path);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 339/699] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 338/699] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 340/699] net: psample: fix info leak in PSAMPLE_ATTR_DATA Greg Kroah-Hartman
` (363 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksey Makarov, Ratheesh Kannoth,
Simon Horman, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ratheesh Kannoth <rkannoth@marvell.com>
[ Upstream commit a056db30de92945ff8ee6033096678bfbae878e3 ]
The send-queue timestamp ring is allocated with qmem_alloc() when
timestamping is used, but otx2_free_sq_res() never freed sq->timestamps,
leaking that memory across ifdown and device removal. Add the missing
qmem_free() alongside the other SQ companion buffers.
Fixes: c9c12d339d93 ("octeontx2-pf: Add support for PTP clock")
Cc: Aleksey Makarov <amakarov@marvell.com>
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260615030704.504536-1-rkannoth@marvell.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
index 1516f248377549..50a36639e0ced6 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c
@@ -1282,6 +1282,7 @@ static void otx2_free_sq_res(struct otx2_nic *pf)
sq = &qset->sq[qidx];
qmem_free(pf->dev, sq->sqe);
qmem_free(pf->dev, sq->tso_hdrs);
+ qmem_free(pf->dev, sq->timestamps);
kfree(sq->sg);
kfree(sq->sqb_ptrs);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 340/699] net: psample: fix info leak in PSAMPLE_ATTR_DATA
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 339/699] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 341/699] sctp: hold socket lock when dumping endpoints in sctp_diag Greg Kroah-Hartman
` (362 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Jiri Pirko,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit aedd02af1f8b0bceb7f42f5a21c41634ca9ed390 ]
psample open codes nla_put() presumably to avoid wiping
the data with 0s just to override it with packet data.
This open coding is missing clearing the pad, however,
each netlink attr is padded to 4B and data_len may
not be divisible by 4B.
Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20260616003046.1099490-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/psample/psample.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/psample/psample.c b/net/psample/psample.c
index 5913da77c71d2e..ef5b437804731e 100644
--- a/net/psample/psample.c
+++ b/net/psample/psample.c
@@ -425,15 +425,17 @@ void psample_sample_packet(struct psample_group *group, struct sk_buff *skb,
goto error;
if (data_len) {
- int nla_len = nla_total_size(data_len);
+ int nla_len = nla_attr_size(data_len);
struct nlattr *nla;
nla = skb_put(nl_skb, nla_len);
nla->nla_type = PSAMPLE_ATTR_DATA;
- nla->nla_len = nla_attr_size(data_len);
+ nla->nla_len = nla_len;
if (skb_copy_bits(skb, 0, nla_data(nla), data_len))
goto error;
+
+ skb_put_zero(nl_skb, nla_padlen(data_len));
}
#ifdef CONFIG_INET
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 341/699] sctp: hold socket lock when dumping endpoints in sctp_diag
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 340/699] net: psample: fix info leak in PSAMPLE_ATTR_DATA Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 342/699] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS Greg Kroah-Hartman
` (361 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zero Day Initiative, Xin Long,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823 ]
SCTP_DIAG endpoint dumping was traversing endpoint address lists without
holding lock_sock(), while those lists could change concurrently via
socket operations (e.g., bindx changes). This creates a race where
nla_reserve() counts addresses under RCU protection, but the subsequent
copy may see fewer entries, potentially leaking uninitialized memory to
userspace.
Fix this by:
- Taking a reference on each endpoint during hash traversal
- Moving socket operations (lock_sock()) outside read_lock_bh()
- Serializing address list access during dump
- Reworking sctp_for_each_endpoint() to support restart-based traversal
with (net, pos) tracking
Also:
- Add WARN_ON_ONCE() for inconsistent address counts
- Fix idiag_states filtering for LISTEN vs association cases
- Skip dumping endpoints being freed (ep->base.dead)
- Move dump position tracking into iterator, removing cb->args[4] and
its comment for sctp_ep_dump().,
- Update the comment for cb->args[4] and remove the comment for unused
cb->args[5] for sctp_sock_dump().
Note: traversal is restart-based and may re-scan buckets multiple times,
but this is acceptable due to small bucket sizes and required to support
sleeping-safe callbacks.
This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero
Day Initiative.
Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/4c1b49ab87e0f7d552ebd8172b364b1994e913c9.1781552190.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sctp/sctp.h | 3 +-
net/sctp/diag.c | 67 ++++++++++++++++++++---------------------
net/sctp/socket.c | 29 +++++++++++++-----
3 files changed, 56 insertions(+), 43 deletions(-)
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 775fde82c65767..f517189b41c80c 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -115,7 +115,8 @@ int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net,
const union sctp_addr *paddr, void *p);
int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
struct net *net, int *pos, void *p);
-int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), void *p);
+int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
+ struct net *net, int *pos, void *p);
int sctp_get_sctp_info(struct sock *sk, struct sctp_association *asoc,
struct sctp_info *info);
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index dccf4509190c0e..dd7cd940d6bd6f 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -92,6 +92,7 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
if (!--addrcnt)
break;
}
+ WARN_ON_ONCE(addrcnt);
rcu_read_unlock();
return 0;
@@ -373,42 +374,39 @@ static int sctp_ep_dump(struct sctp_endpoint *ep, void *p)
struct sk_buff *skb = commp->skb;
struct netlink_callback *cb = commp->cb;
const struct inet_diag_req_v2 *r = commp->r;
- struct net *net = sock_net(skb->sk);
struct inet_sock *inet = inet_sk(sk);
int err = 0;
- if (!net_eq(sock_net(sk), net))
+ lock_sock(sk);
+ if (ep->base.dead)
goto out;
- if (cb->args[4] < cb->args[1])
- goto next;
-
- if (!(r->idiag_states & TCPF_LISTEN) && !list_empty(&ep->asocs))
- goto next;
+ /* Skip eps with assocs if non-LISTEN states were requested, since
+ * they'll be dumped by sctp_sock_dump() during assoc traversal.
+ */
+ if ((r->idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)) &&
+ !list_empty(&ep->asocs))
+ goto out;
if (r->sdiag_family != AF_UNSPEC &&
sk->sk_family != r->sdiag_family)
- goto next;
+ goto out;
if (r->id.idiag_sport != inet->inet_sport &&
r->id.idiag_sport)
- goto next;
+ goto out;
if (r->id.idiag_dport != inet->inet_dport &&
r->id.idiag_dport)
- goto next;
-
- if (inet_sctp_diag_fill(sk, NULL, skb, r,
- sk_user_ns(NETLINK_CB(cb->skb).sk),
- NETLINK_CB(cb->skb).portid,
- cb->nlh->nlmsg_seq, NLM_F_MULTI,
- cb->nlh, commp->net_admin) < 0) {
- err = 2;
goto out;
- }
-next:
- cb->args[4]++;
+
+ err = inet_sctp_diag_fill(sk, NULL, skb, r,
+ sk_user_ns(NETLINK_CB(cb->skb).sk),
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ cb->nlh, commp->net_admin);
out:
+ release_sock(sk);
return err;
}
@@ -478,41 +476,40 @@ static void sctp_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
.r = r,
.net_admin = netlink_net_capable(cb->skb, CAP_NET_ADMIN),
};
- int pos = cb->args[2];
+ int pos;
/* eps hashtable dumps
* args:
* 0 : if it will traversal listen sock
* 1 : to record the sock pos of this time's traversal
- * 4 : to work as a temporary variable to traversal list
*/
if (cb->args[0] == 0) {
- if (!(idiag_states & TCPF_LISTEN))
- goto skip;
- if (sctp_for_each_endpoint(sctp_ep_dump, &commp))
- goto done;
-skip:
+ if (idiag_states & TCPF_LISTEN) {
+ pos = cb->args[1];
+ if (sctp_for_each_endpoint(sctp_ep_dump, net, &pos,
+ &commp)) {
+ cb->args[1] = pos;
+ return;
+ }
+ }
cb->args[0] = 1;
cb->args[1] = 0;
- cb->args[4] = 0;
}
+ if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
+ return;
+
/* asocs by transport hashtable dump
* args:
* 1 : to record the assoc pos of this time's traversal
* 2 : to record the transport pos of this time's traversal
* 3 : to mark if we have dumped the ep info of the current asoc
- * 4 : to work as a temporary variable to traversal list
- * 5 : to save the sk we get from travelsing the tsp list.
+ * 4 : to track position within ep->asocs list in sctp_sock_dump()
*/
- if (!(idiag_states & ~(TCPF_LISTEN | TCPF_CLOSE)))
- goto done;
-
+ pos = cb->args[2];
sctp_transport_traverse_process(sctp_sock_filter, sctp_sock_dump,
net, &pos, &commp);
cb->args[2] = pos;
-
-done:
cb->args[1] = cb->args[4];
cb->args[4] = 0;
}
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 150235d861411d..b398aa79e17c86 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5200,24 +5200,39 @@ struct sctp_transport *sctp_transport_get_idx(struct net *net,
}
int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
- void *p) {
- int err = 0;
- int hash = 0;
- struct sctp_endpoint *ep;
+ struct net *net, int *pos, void *p) {
+ int err, hash = 0, idx = 0, start;
struct sctp_hashbucket *head;
+ struct sctp_endpoint *ep;
for (head = sctp_ep_hashtable; hash < sctp_ep_hashsize;
hash++, head++) {
+ start = idx;
+again:
read_lock_bh(&head->lock);
sctp_for_each_hentry(ep, &head->chain) {
- err = cb(ep, p);
- if (err)
+ if (sock_net(ep->base.sk) != net)
+ continue;
+ if (idx++ >= *pos) {
+ sctp_endpoint_hold(ep);
break;
+ }
}
read_unlock_bh(&head->lock);
+
+ if (ep) {
+ err = cb(ep, p);
+ sctp_endpoint_put(ep);
+ if (err)
+ return err;
+ (*pos)++;
+
+ idx = start;
+ goto again;
+ }
}
- return err;
+ return 0;
}
EXPORT_SYMBOL_GPL(sctp_for_each_endpoint);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 342/699] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 341/699] sctp: hold socket lock when dumping endpoints in sctp_diag Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 343/699] thermal: intel: Fix dangling resources on thermal_throttle_online() failure Greg Kroah-Hartman
` (360 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Breno Leitao, Will Deacon,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 4cc70f75853bebac022334b6a86b953348072f74 ]
hw_breakpoint_arch_parse() positions the BAS bit pattern in
hw->ctrl.len with
offset = hw->address & alignment_mask; /* 0..7 */
hw->ctrl.len <<= offset;
ctrl.len is an 8-bit bitfield (struct arch_hw_breakpoint_ctrl::len is
u32 :8), so the shift silently drops any bits past bit 7. For
non-compat AArch64 watchpoints the offset is unbounded relative to
ctrl.len: a perf_event_open(PERF_TYPE_BREAKPOINT) caller asking for
HW_BREAKPOINT_W with bp_addr=page+1 and bp_len=HW_BREAKPOINT_LEN_8
ends up with 0xff << 1 = 0x1fe, stored as 0xfe. The kernel programs
WCR.BAS=0xfe and the hardware watches bytes [1..7] instead of the
requested [1..8] -- the eighth byte is silently dropped. The
syscall still returns success, leaving userspace to discover the
gap by empirical probing.
The same class affects HW_BREAKPOINT_LEN_{2,4} when offset pushes the
high BAS bit past bit 7 (e.g. LEN_4 with offset=5 yields 0xe0
instead of 0x1e0). No memory-safety impact -- the value is masked
into 8 bits before encoding -- but debuggers and perf users observe
missed events on bytes they thought they were watching.
The AArch32 branch immediately above already rejects unrepresentable
(offset, len) combinations via an explicit switch. Mirror that for
the non-compat branch by checking that the shifted pattern fits in
the BAS field, returning -EINVAL when it does not.
GDB and similar debuggers are unaffected by the stricter check.
aarch64_linux_set_debug_regs() already treats EINVAL on
NT_ARM_HW_WATCH as a downgrade signal: it clears
kernel_supports_any_contiguous_range, calls aarch64_downgrade_regs()
to round the BAS up to a legacy 0x01/03/0f/ff mask with an aligned
base, and retries -- the same fallback path that PR-20207 introduced.
The new -EINVAL is therefore reachable only from a raw
perf_event_open() that pairs an unaligned base with an oversized
bp_len, which is precisely the bug.
Reproducer:
struct perf_event_attr a = {
.type = PERF_TYPE_BREAKPOINT, .size = sizeof(a),
.bp_type = HW_BREAKPOINT_W,
.bp_addr = (uintptr_t)(buf + 1),
.bp_len = HW_BREAKPOINT_LEN_8,
.exclude_kernel = 1, .exclude_hv = 1,
};
int fd = perf_event_open(&a, 0, -1, -1, 0);
/* before this fix: succeeds, watches 7 bytes (buf+1..buf+7) */
/* after this fix: fails with EINVAL */
Fixes: b08fb180bb88 ("arm64: Allow hw watchpoint at varied offset from base address")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/hw_breakpoint.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index e5a0c38f1b5ee9..059e9bc0625521 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -557,6 +557,15 @@ int hw_breakpoint_arch_parse(struct perf_event *bp,
else
alignment_mask = 0x7;
offset = hw->address & alignment_mask;
+
+ /*
+ * BAS is an 8-bit field in WCR/BCR; the shift below would
+ * silently drop the high bits of ctrl.len when offset + len
+ * exceeds 8, programming hardware to watch fewer bytes than
+ * the user requested.
+ */
+ if (((u32)hw->ctrl.len << offset) > ARM_BREAKPOINT_LEN_8)
+ return -EINVAL;
}
hw->address &= ~alignment_mask;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 343/699] thermal: intel: Fix dangling resources on thermal_throttle_online() failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 342/699] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 344/699] ACPI: resource: Amend kernel-doc style Greg Kroah-Hartman
` (359 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Neri, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
[ Upstream commit b91d287fa7a1ba0727eed5823c6ee4924ee5fa31 ]
The function thermal_throttle_add_dev() may fail and abort a CPU hotplug
online operation. Since the failure occurs within the online callback,
thermal_throttle_online(), the CPU hotplug framework does not invoke the
corresponding offline callback. As a result, the hardware and software
resources set up during the failed operation are not torn down.
Since only thermal_throttle_add_dev() can fail, call it before setting up
the rest of the resources.
Fixes: f6656208f04e ("x86/mce/therm_throt: Optimize notifications of thermal throttle")
Signed-off-by: Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
Link: https://patch.msgid.link/20260613-rneri-directed-therm-intr-v3-1-3a26d1e47fc8@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/mce/therm_throt.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/mce/therm_throt.c b/arch/x86/kernel/cpu/mce/therm_throt.c
index a7cd2d203ceda6..52c9269dd3a820 100644
--- a/arch/x86/kernel/cpu/mce/therm_throt.c
+++ b/arch/x86/kernel/cpu/mce/therm_throt.c
@@ -467,8 +467,13 @@ static int thermal_throttle_online(unsigned int cpu)
{
struct thermal_state *state = &per_cpu(thermal_state, cpu);
struct device *dev = get_cpu_device(cpu);
+ int err;
u32 l;
+ err = thermal_throttle_add_dev(dev, cpu);
+ if (err)
+ return err;
+
state->package_throttle.level = PACKAGE_LEVEL;
state->core_throttle.level = CORE_LEVEL;
@@ -479,7 +484,7 @@ static int thermal_throttle_online(unsigned int cpu)
l = apic_read(APIC_LVTTHMR);
apic_write(APIC_LVTTHMR, l & ~APIC_LVT_MASKED);
- return thermal_throttle_add_dev(dev, cpu);
+ return err;
}
static int thermal_throttle_offline(unsigned int cpu)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 344/699] ACPI: resource: Amend kernel-doc style
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 343/699] thermal: intel: Fix dangling resources on thermal_throttle_online() failure Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 345/699] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() Greg Kroah-Hartman
` (358 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 78ad5c7722b7bed9d35ffc5b45eb0f12e2c22fee ]
The functions are referred as func() in the kernel-doc. The % (percent)
character makes the rendering for constants as described in the respective
documentation. Amend all these.
Fixes: 8e345c991c8c ("ACPI: Centralized processing of ACPI device resources")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260617090555.2648709-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 14898b4fadf099..11ec469653a81b 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -688,7 +688,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
EXPORT_SYMBOL_GPL(acpi_dev_resource_interrupt);
/**
- * acpi_dev_free_resource_list - Free resource from %acpi_dev_get_resources().
+ * acpi_dev_free_resource_list - Free resource from acpi_dev_get_resources().
* @list: The head of the resource list to free.
*/
void acpi_dev_free_resource_list(struct list_head *list)
@@ -808,7 +808,7 @@ static int __acpi_dev_get_resources(struct acpi_device *adev,
*
* The resultant struct resource objects are put on the list pointed to by
* @list, that must be empty initially, as members of struct resource_entry
- * objects. Callers of this routine should use %acpi_dev_free_resource_list() to
+ * objects. Callers of this routine should use acpi_dev_free_resource_list() to
* free that list.
*
* The number of resources in the output list is returned on success, an error
@@ -846,7 +846,7 @@ static int is_memory(struct acpi_resource *ares, void *not_used)
* The resultant struct resource objects are put on the list pointed to
* by @list, that must be empty initially, as members of struct
* resource_entry objects. Callers of this routine should use
- * %acpi_dev_free_resource_list() to free that list.
+ * acpi_dev_free_resource_list() to free that list.
*
* The number of resources in the output list is returned on success,
* an error code reflecting the error condition is returned otherwise.
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 345/699] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 344/699] ACPI: resource: Amend kernel-doc style Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 346/699] ieee802154: fix kernel-infoleak in dgram_recvmsg() Greg Kroah-Hartman
` (357 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Ivan Abramov,
Stefan Schmidt, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Abramov <i.abramov@mt-integration.ru>
[ Upstream commit e69ed6fc9fb3b386b5fcdb9f51623f122cee2ebd ]
There's no need to call WARN_ON() in cfg802154_pernet_exit(), since
every point of failure in cfg802154_switch_netns() is covered with
WARN_ON(), so remove it.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 66e5c2672cd1 ("ieee802154: add netns support")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Ivan Abramov <i.abramov@mt-integration.ru>
Link: https://lore.kernel.org/20250403101935.991385-4-i.abramov@mt-integration.ru
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ieee802154/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ieee802154/core.c b/net/ieee802154/core.c
index de259b5170ab17..b3b89a1cd2a4c1 100644
--- a/net/ieee802154/core.c
+++ b/net/ieee802154/core.c
@@ -324,7 +324,7 @@ static void __net_exit cfg802154_pernet_exit(struct net *net)
rtnl_lock();
list_for_each_entry(rdev, &cfg802154_rdev_list, list) {
if (net_eq(wpan_phy_net(&rdev->wpan_phy), net))
- WARN_ON(cfg802154_switch_netns(rdev, &init_net));
+ cfg802154_switch_netns(rdev, &init_net);
}
rtnl_unlock();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 346/699] ieee802154: fix kernel-infoleak in dgram_recvmsg()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 345/699] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 347/699] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Greg Kroah-Hartman
` (356 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+346474e3bf0b26bd3090,
Aleksandr Nogikh, Miquel Raynal, Stefan Schmidt, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Nogikh <nogikh@google.com>
[ Upstream commit 4db86f8ab11b5a41bfc36680be837e6ac1375ec6 ]
KMSAN reported a kernel-infoleak in move_addr_to_user():
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user
include/linux/instrumented.h:131 [inline]
BUG: KMSAN: kernel-infoleak in _inline_copy_to_user
include/linux/uaccess.h:205 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120
lib/usercopy.c:26
instrument_copy_to_user include/linux/instrumented.h:131 [inline]
_inline_copy_to_user include/linux/uaccess.h:205 [inline]
_copy_to_user+0xcc/0x120 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:236 [inline]
move_addr_to_user+0x2e7/0x440 net/socket.c:302
____sys_recvmsg+0x232/0x610 net/socket.c:2925
...
Uninit was stored to memory at:
ieee802154_addr_to_sa include/net/ieee802154_netdev.h:369 [inline]
dgram_recvmsg+0xa09/0xbe0 net/ieee802154/socket.c:739
The issue occurs because the `pan_id` field of `struct ieee802154_addr`
is left uninitialized when the address mode is `IEEE802154_ADDR_NONE`.
The execution flow is as follows:
1. `__ieee802154_rx_handle_packet()` declares a local `struct
ieee802154_hdr hdr` on the stack.
2. `ieee802154_hdr_pull()` calls `ieee802154_hdr_get_addr()` to parse
the source and destination addresses into this structure.
3. If the address mode is `IEEE802154_ADDR_NONE`,
`ieee802154_hdr_get_addr()` previously only set the `mode` field,
leaving the `pan_id` field containing uninitialized stack memory.
4. This uninitialized `pan_id` is later copied into a `struct
sockaddr_ieee802154` in `dgram_recvmsg()` via `ieee802154_addr_to_sa()`.
5. Finally, `move_addr_to_user()` copies the socket address structure to
user space, leaking the uninitialized bytes.
Fix this by using `memset` to zero out the address structure in
`ieee802154_hdr_get_addr()` when the mode is `IEEE802154_ADDR_NONE`.
Fixes: 94b4f6c21cf5 ("ieee802154: add header structs with endiannes and operations")
Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot
Reported-by: syzbot+346474e3bf0b26bd3090@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=346474e3bf0b26bd3090
Link: https://syzkaller.appspot.com/ai_job?id=a507a109-d683-4a2c-bc03-93394f491b17
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/62795fd9-fc0c-48eb-bb82-05ffc5a57104@mail.kernel.org
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
| 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--git a/net/ieee802154/header_ops.c b/net/ieee802154/header_ops.c
index af337cf627643e..0687a4bded50c9 100644
--- a/net/ieee802154/header_ops.c
+++ b/net/ieee802154/header_ops.c
@@ -126,10 +126,13 @@ ieee802154_hdr_get_addr(const u8 *buf, int mode, bool omit_pan,
{
int pos = 0;
- addr->mode = mode;
-
- if (mode == IEEE802154_ADDR_NONE)
+ if (mode == IEEE802154_ADDR_NONE) {
+ memset(addr, 0, sizeof(*addr));
+ addr->mode = IEEE802154_ADDR_NONE;
return 0;
+ }
+
+ addr->mode = mode;
if (!omit_pan) {
memcpy(&addr->pan_id, buf + pos, 2);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 347/699] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 346/699] ieee802154: fix kernel-infoleak in dgram_recvmsg() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 348/699] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak Greg Kroah-Hartman
` (355 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jozsef Kadlecsik, Pablo Neira Ayuso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <kadlec@netfilter.org>
[ Upstream commit 3ca9982a8882470aa0ac4e8bb9a552b181d1efcd ]
Sashiko pointed out that kfree_rcu() was called before
rcu_assign_pointer() in handling the comment extension.
Fix the order so that rcu_assign_pointer() called first.
Fixes: b57b2d1fa53f ("netfilter: ipset: Prepare the ipset core to use RCU at set level")
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipset/ip_set_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index d66a6fb2e448b3..11e5536d8b2637 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -351,8 +351,8 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment,
if (unlikely(c)) {
set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
- kfree_rcu(c, rcu);
rcu_assign_pointer(comment->c, NULL);
+ kfree_rcu(c, rcu);
}
if (!len)
return;
@@ -393,8 +393,8 @@ ip_set_comment_free(struct ip_set *set, void *ptr)
if (unlikely(!c))
return;
set->ext_size -= sizeof(*c) + strlen(c->str) + 1;
- kfree_rcu(c, rcu);
rcu_assign_pointer(comment->c, NULL);
+ kfree_rcu(c, rcu);
}
typedef void (*destroyer)(struct ip_set *, void *);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 348/699] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 347/699] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 349/699] irqchip/crossbar: Fix parent domain resource leak Greg Kroah-Hartman
` (354 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 27dd2997746d54ebc079bb13161cc1bdd401d4a6 ]
This needs to test for nonzero retval.
Fixes: c54c7c685494 ("netfilter: nft_meta_bridge: add NFT_META_BRI_IIFPVID support")
Closes: https://sashiko.dev/#/patchset/20260618061631.21919-1-fw%40strlen.de
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/netfilter/nft_meta_bridge.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bridge/netfilter/nft_meta_bridge.c b/net/bridge/netfilter/nft_meta_bridge.c
index 97805ec424c199..5ebcf5001dfd28 100644
--- a/net/bridge/netfilter/nft_meta_bridge.c
+++ b/net/bridge/netfilter/nft_meta_bridge.c
@@ -41,7 +41,9 @@ static void nft_meta_bridge_get_eval(const struct nft_expr *expr,
if (!br_dev || !br_vlan_enabled(br_dev))
goto err;
- br_vlan_get_pvid_rcu(in, &p_pvid);
+ if (br_vlan_get_pvid_rcu(in, &p_pvid))
+ goto err;
+
nft_reg_store16(dest, p_pvid);
return;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 349/699] irqchip/crossbar: Fix parent domain resource leak
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 348/699] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 350/699] selftests/mm: clarify alternate unmapping in compaction_test Greg Kroah-Hartman
` (353 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bhargav Joshi, Thomas Gleixner,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhargav Joshi <j.bhargav.u@gmail.com>
[ Upstream commit a1074dd62faa6572921d387e8a21589ccea00efc ]
irq_domain_alloc_irqs_parent() is called in allocate_gic_irq() but
irq_domain_free_irqs_parent() is never called which causes a resource leak.
Fix this by calling irq_domain_free_irqs_parent() in
crossbar_domain_free().
Fixes: 783d31863fb82 ("irqchip: crossbar: Convert dra7 crossbar to stacked domains")
Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260620-irq-crossbar-fix-v2-2-b8e8499f468a@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-crossbar.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c
index a05a7501e10790..729492772ff46e 100644
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -163,6 +163,7 @@ static void crossbar_domain_free(struct irq_domain *domain, unsigned int virq,
cb->write(d->hwirq, cb->safe_map);
}
raw_spin_unlock(&cb->lock);
+ irq_domain_free_irqs_parent(domain, virq, nr_irqs);
}
static int crossbar_domain_translate(struct irq_domain *d,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 350/699] selftests/mm: clarify alternate unmapping in compaction_test
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 349/699] irqchip/crossbar: Fix parent domain resource leak Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 351/699] selftests/mm: allow PUD-level entries in compound testcase of hmm tests Greg Kroah-Hartman
` (352 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sayali Patil, Venkat Rao Bagalkote,
David Hildenbrand (Arm), Dev Jain, Liam Howlett, Miaohe Lin,
Michal Hocko, Oscar Salvador, Ritesh Harjani (IBM), Shuah Khan,
Zi Yan, Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sayali Patil <sayalip@linux.ibm.com>
[ Upstream commit 69ba1d76d93ab818245333cf400928477ba72053 ]
Add a comment explaining that every other entry in the list is unmapped to
intentionally create fragmentation with locked pages before invoking
check_compaction().
Link: https://lore.kernel.org/da5e0a8d5152e54152c0d2f456aac2fac35af291.1779296493.git.sayalip@linux.ibm.com
Fixes: bd67d5c15cc1 ("Test compaction of mlocked memory")
Signed-off-by: Sayali Patil <sayalip@linux.ibm.com>
Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/vm/compaction_test.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/testing/selftests/vm/compaction_test.c b/tools/testing/selftests/vm/compaction_test.c
index 00ebd9d508ffdf..442960f3381dbc 100644
--- a/tools/testing/selftests/vm/compaction_test.c
+++ b/tools/testing/selftests/vm/compaction_test.c
@@ -231,6 +231,9 @@ int main(int argc, char **argv)
mem_fragmentable_MB -= MAP_SIZE_MB;
}
+ /* Unmap every other entry in the list to create fragmentation with
+ * locked pages before invoking check_compaction().
+ */
for (entry = list; entry != NULL; entry = entry->next) {
munmap(entry->map, MAP_SIZE);
if (!entry->next)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 351/699] selftests/mm: allow PUD-level entries in compound testcase of hmm tests
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 350/699] selftests/mm: clarify alternate unmapping in compaction_test Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 352/699] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags Greg Kroah-Hartman
` (351 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sayali Patil, Aboorva Devarajan,
Alex Sierra, Alistair Popple, Balbir Singh, David Hildenbrand,
Jason Gunthorpe, Leon Romanovsky, Liam R. Howlett,
Lorenzo Stoakes, Matthew Brost, Matthew Wilcox (Oracle),
Michal Hocko, Mike Rapoport, Ralph Campbell, Shuah Khan,
Suren Baghdasaryan, Vlastimil Babka, Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sayali Patil <sayalip@linux.ibm.com>
[ Upstream commit 224ed0e019b122d08580362abe57574a78f2b5fa ]
Patch series "selftests/mm: assorted fixes for hmm-tests", v3.
This series fixes a few issues in hmm-tests that show up when page-size
and huge-page configuration differ from the hardcoded assumptions the
tests were written for (PMD/THP sizing, default hugepage size, and related
cases).
It also includes a fix to exclusive_cow: the test ignored the return value
of fork(), so both parent and child ran the same teardown path.
This patch (of 3):
The HMM compound testcase currently assumes only PMD-level mappings and
fails on systems where default_hugepagesz=1G is set, because the region is
then reported by the device at PUD level.
Determine the mapping level (PMD or PUD) the device reports for the first
page of the range and require every page to match that level exactly via
ASSERT_EQ(). This accepts PUD-level mappings while preserving the
expected/observed protection values printed on failure, and rejects a
fragmented mapping that mixes PMD- and PUD-level entries within the same
range (which a per-page OR check would have let pass).
Link: https://lore.kernel.org/20260611034102.1030738-1-aboorvad@linux.ibm.com
Link: https://lore.kernel.org/20260611034102.1030738-2-aboorvad@linux.ibm.com
Fixes: e478425bec93 ("mm/hmm: add tests for hmm_pfn_to_map_order()")
Signed-off-by: Sayali Patil <sayalip@linux.ibm.com>
Co-developed-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Signed-off-by: Aboorva Devarajan <aboorvad@linux.ibm.com>
Cc: Alex Sierra <alex.sierra@amd.com>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/vm/hmm-tests.c | 32 +++++++++++++++++++-------
1 file changed, 24 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/vm/hmm-tests.c b/tools/testing/selftests/vm/hmm-tests.c
index 738c34eb50afc6..bf3f71d421db35 100644
--- a/tools/testing/selftests/vm/hmm-tests.c
+++ b/tools/testing/selftests/vm/hmm-tests.c
@@ -1379,8 +1379,8 @@ TEST_F(hmm2, snapshot)
}
/*
- * Test the hmm_range_fault() HMM_PFN_PMD flag for large pages that
- * should be mapped by a large page table entry.
+ * Test the hmm_range_fault() handling of large pages (PMD or PUD)
+ * that should be mapped by a large page table entry.
*/
TEST_F(hmm, compound)
{
@@ -1389,6 +1389,7 @@ TEST_F(hmm, compound)
unsigned long size;
int *ptr;
unsigned char *m;
+ unsigned char prot;
int ret;
long pagesizes[4];
int n, idx;
@@ -1428,11 +1429,20 @@ TEST_F(hmm, compound)
ASSERT_EQ(ret, 0);
ASSERT_EQ(buffer->cpages, npages);
- /* Check what the device saw. */
+ /*
+ * Check what the device saw. The region is backed by a single huge
+ * page that the device reports either at PMD or at PUD level depending
+ * on the configured default hugepage size. Determine that level from
+ * the first page and require every page in the range to match it
+ * exactly, so that a fragmented mapping mixing levels (or a missing
+ * large-page bit) is still caught and reported with its actual value.
+ */
m = buffer->mirror;
+ prot = HMM_DMIRROR_PROT_WRITE |
+ ((m[0] & HMM_DMIRROR_PROT_PUD) ? HMM_DMIRROR_PROT_PUD :
+ HMM_DMIRROR_PROT_PMD);
for (i = 0; i < npages; ++i)
- ASSERT_EQ(m[i], HMM_DMIRROR_PROT_WRITE |
- HMM_DMIRROR_PROT_PMD);
+ ASSERT_EQ(m[i], prot);
/* Make the region read-only. */
ret = mprotect(buffer->ptr, size, PROT_READ);
@@ -1443,11 +1453,17 @@ TEST_F(hmm, compound)
ASSERT_EQ(ret, 0);
ASSERT_EQ(buffer->cpages, npages);
- /* Check what the device saw. */
+ /*
+ * Check what the device saw after mprotect(PROT_READ). Same
+ * approach as above: determine the mapping level from the first
+ * page and require every page to match it exactly.
+ */
m = buffer->mirror;
+ prot = HMM_DMIRROR_PROT_READ |
+ ((m[0] & HMM_DMIRROR_PROT_PUD) ? HMM_DMIRROR_PROT_PUD :
+ HMM_DMIRROR_PROT_PMD);
for (i = 0; i < npages; ++i)
- ASSERT_EQ(m[i], HMM_DMIRROR_PROT_READ |
- HMM_DMIRROR_PROT_PMD);
+ ASSERT_EQ(m[i], prot);
free_hugepage_region(buffer->ptr);
buffer->ptr = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 352/699] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 351/699] selftests/mm: allow PUD-level entries in compound testcase of hmm tests Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 353/699] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 Greg Kroah-Hartman
` (350 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antoni Pokusinski, Alexandre Belloni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antoni Pokusinski <apokusinski01@gmail.com>
[ Upstream commit 419719c514252a2dbb2e2976f564c83417dd6d0a ]
The RTC_VL_CLR ioctl intends to clear only the battery low flag (BLF),
however the current implementation writes 0 to the status register,
clearing all status bits.
Fix this by writing back the masked status value so that only BLF is
cleared, preserving other status flags.
Fixes: ffe1c5a2d427 ("rtc: abx80x: Implement RTC_VL_READ,CLR ioctls")
Signed-off-by: Antoni Pokusinski <apokusinski01@gmail.com>
Link: https://patch.msgid.link/20260415160610.127155-2-apokusinski01@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-abx80x.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-abx80x.c b/drivers/rtc/rtc-abx80x.c
index 8d15a68eedb814..280de9a9474dce 100644
--- a/drivers/rtc/rtc-abx80x.c
+++ b/drivers/rtc/rtc-abx80x.c
@@ -535,7 +535,8 @@ static int abx80x_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
status &= ~ABX8XX_STATUS_BLF;
- tmp = i2c_smbus_write_byte_data(client, ABX8XX_REG_STATUS, 0);
+ tmp = i2c_smbus_write_byte_data(client, ABX8XX_REG_STATUS,
+ status);
if (tmp < 0)
return tmp;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 353/699] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 352/699] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 354/699] bpf: Fix stack slot index in nospec checks Greg Kroah-Hartman
` (349 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ronan Dalton, linux-rtc,
linux-kernel, Alexandre Belloni, Tyler Hicks, Sasha Levin,
Meagan Lloyd, Rodolfo Giometti, Chris Packham
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronan Dalton <ronan.dalton@alliedtelesis.co.nz>
[ Upstream commit a091e1ba3b68cabc9caedafc6f81d9fe9b3b2200 ]
Prior to commit 48458654659c ("rtc: ds1307: remove clear of oscillator
stop flag (OSF) in probe"), the oscillator stop flag (OSF) bit was
checked during device probe for the ds1337, ds1339, ds1341, and ds3231
chips; if it was set, it would be cleared and a warning would be logged
saying "SET TIME!". Since that commit, the OSF bit is no longer cleared,
but the warning is still printed.
Directly following that commit, there was no way to get rid of this
warning because nothing cleared the OSF bit on these chips.
The commit associated with the previous commit, 523923cfd5d6 ("rtc:
ds1307: handle oscillator stop flag (OSF) for ds1341"), made proper use
of the OSF when getting and setting the time in the RTC. However, the
other RTC variants ds1337, ds1339 and ds3231 didn't have a corresponding
change made.
Given that the OSF bit is no longer cleared at probe time when it is
set, the remaining three chips should have the same handling as the
ds1341 chip has for the OSF bit.
Fix the issue on the ds1337, ds1339 and ds3231 chips by applying the
same logic as the ds1341 has to these chips.
Note that any devices brought up between the first referenced commit and
this one may begin mistrusting the time reported by the RTC until it is
set again, if the bit was never explicitly cleared.
Note that only the ds1339 was tested with this change, but the
datasheets for the other chips contain essentially identical
descriptions of the OSF bit so the same change should work.
Signed-off-by: Ronan Dalton <ronan.dalton@alliedtelesis.co.nz>
Cc: linux-rtc@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Cc: Tyler Hicks <code@tyhicks.com>
Cc: Sasha Levin <sashal@kernel.org>
Cc: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
Cc: Rodolfo Giometti <giometti@enneenne.com>
Cc: Chris Packham <chris.packham@alliedtelesis.co.nz>
Fixes: 48458654659c ("rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe")
Reviewed-by: Meagan Lloyd <meaganlloyd@linux.microsoft.com>
Reviewed-by: Tyler Hicks <code@tyhicks.com>
Link: https://patch.msgid.link/20260508032518.3696705-2-ronan.dalton@alliedtelesis.co.nz
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-ds1307.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index ecfd6c27ba542c..27073898c9c3d7 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -265,6 +265,16 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
if (tmp & DS1338_BIT_OSF)
return -EINVAL;
break;
+ case ds_1337:
+ case ds_1339:
+ case ds_1341:
+ case ds_3231:
+ ret = regmap_read(ds1307->regmap, DS1337_REG_STATUS, &tmp);
+ if (ret)
+ return ret;
+ if (tmp & DS1337_BIT_OSF)
+ return -EINVAL;
+ break;
case ds_1340:
if (tmp & DS1340_BIT_nEOSC)
return -EINVAL;
@@ -275,13 +285,6 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
if (tmp & DS1340_BIT_OSF)
return -EINVAL;
break;
- case ds_1341:
- ret = regmap_read(ds1307->regmap, DS1337_REG_STATUS, &tmp);
- if (ret)
- return ret;
- if (tmp & DS1337_BIT_OSF)
- return -EINVAL;
- break;
case ds_1388:
ret = regmap_read(ds1307->regmap, DS1388_REG_FLAG, &tmp);
if (ret)
@@ -376,14 +379,17 @@ static int ds1307_set_time(struct device *dev, struct rtc_time *t)
regmap_update_bits(ds1307->regmap, DS1307_REG_CONTROL,
DS1338_BIT_OSF, 0);
break;
- case ds_1340:
- regmap_update_bits(ds1307->regmap, DS1340_REG_FLAG,
- DS1340_BIT_OSF, 0);
- break;
+ case ds_1337:
+ case ds_1339:
case ds_1341:
+ case ds_3231:
regmap_update_bits(ds1307->regmap, DS1337_REG_STATUS,
DS1337_BIT_OSF, 0);
break;
+ case ds_1340:
+ regmap_update_bits(ds1307->regmap, DS1340_REG_FLAG,
+ DS1340_BIT_OSF, 0);
+ break;
case ds_1388:
regmap_update_bits(ds1307->regmap, DS1388_REG_FLAG,
DS1388_BIT_OSF, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 354/699] bpf: Fix stack slot index in nospec checks
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 353/699] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 355/699] drm/edid: fix OOB read in drm_parse_tiled_block() Greg Kroah-Hartman
` (348 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Gerhorst, Jiayuan Chen,
Emil Tsalapatis, Nuoqi Gui, Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
[ Upstream commit d1d53aa30ab3b5ae89161c9cc840b3f7489ad386 ]
check_stack_write_fixed_off() computes the byte slot for a fixed-offset
stack write as -off - 1, and records each written byte in slot_type[] with
(slot - i) % BPF_REG_SIZE.
The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a
4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the
pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates
bytes 7..4. That can leave the second half-slot write without nospec_result
even though the bytes being overwritten still require sanitization.
Use the same slot index in the sanitization pre-check that the write path uses
when updating slot_type[].
Fixes: 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation")
Acked-by: Luis Gerhorst <luis.gerhorst@fau.de>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/r/20260618-f01-11-stack-nospec-slot-index-v3-1-780297041721@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e6cf29b117e1a5..19e1f7fff07a9c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2523,7 +2523,8 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
bool sanitize = reg && is_spillable_regtype(reg->type);
for (i = 0; i < size; i++) {
- u8 type = state->stack[spi].slot_type[i];
+ u8 type = state->stack[spi].slot_type[(slot - i) %
+ BPF_REG_SIZE];
if (type != STACK_MISC && type != STACK_ZERO) {
sanitize = true;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 355/699] drm/edid: fix OOB read in drm_parse_tiled_block()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 354/699] bpf: Fix stack slot index in nospec checks Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 356/699] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() Greg Kroah-Hartman
` (347 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Jani Nikula,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ]
drm_parse_tiled_block() casts the DisplayID block to a
struct displayid_tiled_block and reads the full fixed layout up to
tile->topology_id[7] without checking block->num_bytes. The DisplayID
iterator only validates the declared payload length, so a crafted EDID
can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or
DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at
the end of a DisplayID extension. The read then runs past the end of the
exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read.
Reject blocks shorter than the spec's 22-byte tiled payload before
reading the fixed struct, as drm_parse_vesa_mso_data() already does.
BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update
Read of size 2 at addr ffff888010077700 by task exploit/147
dump_stack_lvl (lib/dump_stack.c:94 ...)
print_report (mm/kasan/report.c:378 ...)
kasan_report (mm/kasan/report.c:595)
drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581)
bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574)
drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426)
status_store (drivers/gpu/drm/drm_sysfs.c:219)
...
vfs_write (fs/read_write.c:595 fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_edid.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index c3b4a84a9f911d..268791a29828a1 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -5896,6 +5896,14 @@ static void drm_parse_tiled_block(struct drm_connector *connector,
u8 num_v_tile, num_h_tile;
struct drm_tile_group *tg;
+ /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */
+ if (block->num_bytes < 22) {
+ drm_dbg_kms(connector->dev,
+ "[CONNECTOR:%d:%s] Unexpected tiled block size %u\n",
+ connector->base.id, connector->name, block->num_bytes);
+ return;
+ }
+
w = tile->tile_size[0] | tile->tile_size[1] << 8;
h = tile->tile_size[2] | tile->tile_size[3] << 8;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 356/699] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change().
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 355/699] drm/edid: fix OOB read in drm_parse_tiled_block() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 357/699] ipv4: fib: Dont ignore error route in local/main tables Greg Kroah-Hartman
` (346 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 46c3b8191aad3d032776bf3bebf03efdf5f4b905 ]
fib6_nh_mtu_change() re-fetches idev via __in6_dev_get(arg->dev) and
dereferences idev->cnf.mtu6 without a NULL check. addrconf_ifdown()
clears dev->ip6_ptr with RCU_INIT_POINTER() after rt6_disable_ip() has
released tb6_lock, so the RA-driven MTU walk can observe a NULL idev and
oops. The caller rt6_mtu_change_route() guards its own __in6_dev_get(),
but this re-fetch is unguarded; nexthop-backed routes survive
addrconf_ifdown()'s flush, so the walk still reaches it after ip6_ptr is
nulled.
Return 0 when idev is NULL, matching rt6_mtu_change_route() and the
fib6_mtu() fix in commit 5ad509c1fdad ("ipv6: Fix null-ptr-deref in
fib6_mtu().").
Oops: general protection fault, ... KASAN: null-ptr-deref in range
[0x00000000000002a8-0x00000000000002af]
RIP: 0010:fib6_nh_mtu_change+0x203/0x990
rt6_mtu_change_route+0x141/0x1d0
__fib6_clean_all+0xd0/0x160
rt6_mtu_change+0xb4/0x100
ndisc_router_discovery+0x24b5/0x2cb0
icmpv6_rcv+0x12e9/0x1710
ipv6_rcv+0x39b/0x410
Fixes: c0b220cf7d80 ("ipv6: Refactor exception functions")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260619045334.2427073-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/route.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 039e1304b03136..b8bf919a940f34 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4829,6 +4829,9 @@ static int fib6_nh_mtu_change(struct fib6_nh *nh, void *_arg)
struct inet6_dev *idev = __in6_dev_get(arg->dev);
u32 mtu = f6i->fib6_pmtu;
+ if (!idev)
+ return 0;
+
if (mtu >= arg->mtu ||
(mtu < arg->mtu && mtu == idev->cnf.mtu6))
fib6_metric_set(f6i, RTAX_MTU, arg->mtu);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 357/699] ipv4: fib: Dont ignore error route in local/main tables.
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 356/699] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 358/699] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Greg Kroah-Hartman
` (345 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Ido Schimmel,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit b72f0db64205d9ce462038ba995d5d31eff32dc1 ]
When CONFIG_IP_MULTIPLE_TABLES is enabled but no rule is added,
fib_lookup() performs route lookup directly on two tables.
Since the first lookup does not properly bail out, the result
of an error route in the merged local/main table could be
overwritten by another route in the default table:
# unshare -n
# ip link set lo up
# ip route add 192.168.0.0/24 dev lo table 253
# ip route add unreachable 192.168.0.0/24
# ip route get 192.168.0.1
192.168.0.1 dev lo table default uid 0
cache <local>
Once a random rule is added, the error route is respected:
# ip rule add table 0
# ip rule del table 0
# ip route get 192.168.0.1
RTNETLINK answers: No route to host
Let's fix the inconsistent behaviour.
Fixes: f4530fa574df ("ipv4: Avoid overhead when no custom FIB rules are installed.")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260619212753.3367244-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip_fib.h | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 0d3cb34c7abc5d..d01aa665512e55 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -365,7 +365,7 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
struct fib_result *res, unsigned int flags)
{
struct fib_table *tb;
- int err = -ENETUNREACH;
+ int err = -EAGAIN;
flags |= FIB_LOOKUP_NOREF;
if (net->ipv4.fib_has_custom_rules)
@@ -379,17 +379,16 @@ static inline int fib_lookup(struct net *net, struct flowi4 *flp,
if (tb)
err = fib_table_lookup(tb, flp, res, flags);
- if (!err)
+ if (err != -EAGAIN)
goto out;
tb = rcu_dereference_rtnl(net->ipv4.fib_default);
if (tb)
err = fib_table_lookup(tb, flp, res, flags);
-out:
if (err == -EAGAIN)
err = -ENETUNREACH;
-
+out:
rcu_read_unlock();
return err;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 358/699] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 357/699] ipv4: fib: Dont ignore error route in local/main tables Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 359/699] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Greg Kroah-Hartman
` (344 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alejandro Olivan Alvarez,
Fernando Fernandez Mancera, Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit c8b6f36f766991e3ebebec6596daee4b04dcbc49 ]
Commit 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add
was skipped") introduced a regression where packets for valid
connections are dropped when using connlimit for soft-limiting
scenarios.
The issue occurs when a new connection reuses a socket currently in
the TIME_WAIT state. In this scenario, the connection tracking entry
is evaluated as already confirmed. Previously, __nf_conncount_add()
assumed that if a connection was confirmed and did not originate from
the loopback interface, it should skip the addition and return -EEXIST.
Skipping the addition triggers a garbage collection run that cleans up
the TIME_WAIT connection. Consequently, the active connection count
drops to 0, which xt_connlimit mishandles, leading to the false rejection
of the perfectly valid new connection.
Fix this by replacing the interface check with protocol-agnostic state
checks. We now skip the tree insertion and preserve the lockless garbage
collection optimization only if the connection is IPS_ASSURED. This
allows early-confirmed setup packets (such as reused TIME_WAIT sockets
or locally generated SYN-ACKs) to be properly evaluated and counted
without falsely dropping. The goto check_connections path is maintained
to ensure these setup packets are deduplicated correctly.
This has been tested with slowhttptest and HTTP server configured
locally to ensure we are not breaking soft-limiting scenarios for local
or external connections. In addition, it was tested with a OVS zone
limit too.
Fixes: 69894e5b4c5e ("netfilter: nft_connlimit: update the count if add was skipped")
Reported-by: Alejandro Olivan Alvarez <alejandro.olivan.alvarez@gmail.com>
Closes: https://lore.kernel.org/netfilter-devel/177349610461.3071718.4083978280323144323@eldamar.lan/
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conncount.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_conncount.c b/net/netfilter/nf_conncount.c
index b9265a8cdb2bc4..79b0d9c8de56d9 100644
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -179,17 +179,16 @@ static int __nf_conncount_add(struct net *net,
return -ENOENT;
if (ct && nf_ct_is_confirmed(ct)) {
- /* local connections are confirmed in postrouting so confirmation
- * might have happened before hitting connlimit
+ /* Connection is confirmed but might still be in the setup phase.
+ * Only skip the tracking if it is fully assured. This guarantees
+ * that setup packets or retransmissions are properly counted and
+ * deduplicated.
*/
- if (skb->skb_iif != LOOPBACK_IFINDEX) {
+ if (test_bit(IPS_ASSURED_BIT, &ct->status)) {
err = -EEXIST;
goto out_put;
}
- /* this is likely a local connection, skip optimization to avoid
- * adding duplicates from a 'packet train'
- */
goto check_connections;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 359/699] netfilter: nft_synproxy: stop bypassing the priv->info snapshot
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 358/699] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 360/699] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Greg Kroah-Hartman
` (343 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao,
Fernando Fernandez Mancera, Pablo Neira Ayuso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 11d4bc4e26fb66040a5b5d95e9abf37deac2b1fc ]
nft_synproxy_eval_v4() and nft_synproxy_eval_v6() already take a
whole-object READ_ONCE() snapshot of the shared priv->info state before
building the SYNACK reply, but nft_synproxy_tcp_options() still masks
opts->options with priv->info.options from the live shared object.
When a named synproxy object is updated concurrently with SYN traffic,
the eval path can then mix mss and timestamp handling from the local
snapshot with an options mask taken from a newer configuration, so one
SYNACK no longer reflects a coherent synproxy configuration.
Use info->options so nft_synproxy_tcp_options() stays on the same local
snapshot that the eval path already copied from priv->info.
Fixes: ee394f96ad75 ("netfilter: nft_synproxy: add synproxy stateful object support")
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_synproxy.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nft_synproxy.c b/net/netfilter/nft_synproxy.c
index 46d2eefb0b2182..aaba34ed0f7179 100644
--- a/net/netfilter/nft_synproxy.c
+++ b/net/netfilter/nft_synproxy.c
@@ -23,14 +23,13 @@ static const struct nla_policy nft_synproxy_policy[NFTA_SYNPROXY_MAX + 1] = {
static void nft_synproxy_tcp_options(struct synproxy_options *opts,
const struct tcphdr *tcp,
struct synproxy_net *snet,
- struct nf_synproxy_info *info,
- const struct nft_synproxy *priv)
+ struct nf_synproxy_info *info)
{
this_cpu_inc(snet->stats->syn_received);
if (tcp->ece && tcp->cwr)
opts->options |= NF_SYNPROXY_OPT_ECN;
- opts->options &= priv->info.options;
+ opts->options &= info->options;
opts->mss_encode = opts->mss_option;
opts->mss_option = info->mss;
if (opts->options & NF_SYNPROXY_OPT_TIMESTAMP)
@@ -55,7 +54,7 @@ static void nft_synproxy_eval_v4(const struct nft_synproxy *priv,
if (tcp->syn) {
/* Initial SYN from client */
- nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+ nft_synproxy_tcp_options(opts, tcp, snet, &info);
synproxy_send_client_synack(net, skb, tcp, opts);
consume_skb(skb);
regs->verdict.code = NF_STOLEN;
@@ -86,7 +85,7 @@ static void nft_synproxy_eval_v6(const struct nft_synproxy *priv,
if (tcp->syn) {
/* Initial SYN from client */
- nft_synproxy_tcp_options(opts, tcp, snet, &info, priv);
+ nft_synproxy_tcp_options(opts, tcp, snet, &info);
synproxy_send_client_synack_ipv6(net, skb, tcp, opts);
consume_skb(skb);
regs->verdict.code = NF_STOLEN;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 360/699] alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 359/699] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Greg Kroah-Hartman
@ 2026-07-21 15:21 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 361/699] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs Greg Kroah-Hartman
` (342 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:21 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Magnus Lindholm, Shivaprasad G Bhat,
Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
[ Upstream commit 78a228f0aa0e9eba31955950c8a40a9945e2c8bb ]
Currently, Alpha's pci_mmap_resource() does not check
security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to mmap
PCI BARs.
The generic version has had this check since commit eb627e17727e ("PCI:
Lock down BAR access when the kernel is locked down") to prevent DMA
attacks when the kernel is locked down.
Add the same check to Alpha's pci_mmap_resource().
Fixes: eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-12-kwilczynski@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/pci-sysfs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index 0021580d79adbd..f1fd9543067424 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -11,6 +11,7 @@
*/
#include <linux/sched.h>
+#include <linux/security.h>
#include <linux/stat.h>
#include <linux/slab.h>
#include <linux/pci.h>
@@ -69,7 +70,11 @@ static int pci_mmap_resource(struct kobject *kobj,
struct resource *res = attr->private;
enum pci_mmap_state mmap_type;
struct pci_bus_region bar;
- int i;
+ int i, ret;
+
+ ret = security_locked_down(LOCKDOWN_PCI_ACCESS);
+ if (ret)
+ return ret;
for (i = 0; i < PCI_STD_NUM_BARS; i++)
if (res == &pdev->resource[i])
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 361/699] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2026-07-21 15:21 ` [PATCH 5.10 360/699] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 362/699] net: dsa: sja1105: round up PTP perout pin duration Greg Kroah-Hartman
` (341 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Magnus Lindholm, Shivaprasad G Bhat,
Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
[ Upstream commit 802a3b3f470b9bc1148f26e01fc9cbfeb4dfcb57 ]
Currently, __pci_mmap_fits() computes the BAR size using
"pci_resource_len() - 1", which wraps to a large value when the BAR length
is zero, causing the bounds check to incorrectly succeed.
Add an early return for empty resources.
Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-15-kwilczynski@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/alpha/kernel/pci-sysfs.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
index f1fd9543067424..cc0b0d3c52f2f1 100644
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -37,12 +37,16 @@ static int hose_mmap_page_range(struct pci_controller *hose,
static int __pci_mmap_fits(struct pci_dev *pdev, int num,
struct vm_area_struct *vma, int sparse)
{
+ resource_size_t len = pci_resource_len(pdev, num);
unsigned long nr, start, size;
int shift = sparse ? 5 : 0;
+ if (!len)
+ return 0;
+
nr = vma_pages(vma);
start = vma->vm_pgoff;
- size = ((pci_resource_len(pdev, num) - 1) >> (PAGE_SHIFT - shift)) + 1;
+ size = ((len - 1) >> (PAGE_SHIFT - shift)) + 1;
if (start < size && size - start >= nr)
return 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 362/699] net: dsa: sja1105: round up PTP perout pin duration
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 361/699] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 363/699] ipv6: fix error handling in disable_ipv6 sysctl Greg Kroah-Hartman
` (340 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksandrova Alyona, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandrova Alyona <aga@itb.spb.ru>
[ Upstream commit aee5836273b07b439fb245fb43930664d8b78518 ]
pin_duration is converted from the user-provided period to SJA1105
clock ticks and is later passed as the cycle_time argument to
future_base_time().
Very small period values may become zero after the conversion,
which can lead to a division by zero in future_base_time().
Round zero pin_duration up to 1 tick so that the smallest unsupported
periods use the minimum non-zero hardware duration instead of passing
zero to future_base_time().
Fixes: 747e5eb31d59 ("net: dsa: sja1105: configure the PTP_CLK pin as EXT_TS or PER_OUT")
Signed-off-by: Aleksandrova Alyona <aga@itb.spb.ru>
Link: https://patch.msgid.link/20260618110508.53094-1-aga@itb.spb.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_ptp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_ptp.c b/drivers/net/dsa/sja1105/sja1105_ptp.c
index 1b90570b257b50..c8a0a805303a54 100644
--- a/drivers/net/dsa/sja1105/sja1105_ptp.c
+++ b/drivers/net/dsa/sja1105/sja1105_ptp.c
@@ -711,7 +711,7 @@ static int sja1105_per_out_enable(struct sja1105_private *priv,
* 2 edges on PTP_CLK. So check for truncation which happens
* at periods larger than around 68.7 seconds.
*/
- pin_duration = ns_to_sja1105_ticks(pin_duration / 2);
+ pin_duration = max_t(u64, ns_to_sja1105_ticks(pin_duration / 2), 1);
if (pin_duration > U32_MAX) {
rc = -ERANGE;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 363/699] ipv6: fix error handling in disable_ipv6 sysctl
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 362/699] net: dsa: sja1105: round up PTP perout pin duration Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 364/699] ipv6: fix error handling in ignore_routes_with_linkdown sysctl Greg Kroah-Hartman
` (339 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit c779441e5070e2268bdfe77f6e2e0de926c431e3 ]
When writing to the disable_ipv6 sysctl, if proc_dointvec() fails to
parse the input, it returns a negative error code. The current
implementation is overwriting that error for write operations.
This results in a silent failure, it returns a successful write although
the configuration was not modified at all. When modifying the "all"
variant it can also modify the configuration of existing interfaces to
the wrong value.
Fix this by checking the return value of proc_dointvec() and returning
early on failure.
Fixes: 56d417b12e57 ("IPv6: Add 'autoconf' and 'disable_ipv6' module parameters")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-2-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c0f84b2315528f..c888471bf5d355 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6291,6 +6291,8 @@ static int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write)
ret = addrconf_disable_ipv6(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 364/699] ipv6: fix error handling in ignore_routes_with_linkdown sysctl
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 363/699] ipv6: fix error handling in disable_ipv6 sysctl Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 365/699] ipv6: fix error handling in forwarding sysctl Greg Kroah-Hartman
` (338 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit cf4f2b14401f29ccac56393ca9e4b42a2505f540 ]
When writing to the ignore_routes_with_linkdown sysctl, if
proc_dointvec() fails to parse the input, it returns a negative error
code. The current implementation is overwriting that error for write
operations.
This results in a silent failure, it returns a successful write although
the configuration was not modified at all. When modifying the "all"
variant it can also modify the configuration of existing interfaces to
the wrong value.
Fix this by checking the return value of proc_dointvec() and returning
early on failure.
Fixes: 35103d11173b ("net: ipv6 sysctl option to ignore routes when nexthop link is down")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-3-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index c888471bf5d355..8c33e4cfa320e4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6489,6 +6489,8 @@ int addrconf_sysctl_ignore_routes_with_linkdown(struct ctl_table *ctl,
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write)
ret = addrconf_fixup_linkdown(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 365/699] ipv6: fix error handling in forwarding sysctl
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 364/699] ipv6: fix error handling in ignore_routes_with_linkdown sysctl Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 366/699] ipv6: fix error handling in disable_policy sysctl Greg Kroah-Hartman
` (337 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 058b9b19f9639fe1e1225a17c540f61b65bee6ad ]
When writing to the forwarding sysctl, if proc_dointvec() fails to parse
the input, it returns a negative error code. The current implementation
is overwriting that error for write operations.
This results in a silent failure, it returns a successful write although
the configuration was not modified at all. When modifying the "all"
variant it can also modify the configuration of existing interfaces to
the wrong value.
Fix this by checking the return value of proc_dointvec() and returning
early on failure. In addition, adjust return code of
addrconf_fixup_forwarding() for successful operation.
Fixes: b325fddb7f86 ("ipv6: Fix sysctl unregistration deadlock")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-4-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8c33e4cfa320e4..288178ee2c72ce 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -907,7 +907,7 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
if (newf)
rt6_purge_dflt_routers(net);
- return 1;
+ return 0;
}
static void addrconf_linkdown_change(struct net *net, __s32 newf)
@@ -6194,6 +6194,8 @@ static int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write)
ret = addrconf_fixup_forwarding(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 366/699] ipv6: fix error handling in disable_policy sysctl
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 365/699] ipv6: fix error handling in forwarding sysctl Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 367/699] smb/client: preserve errors from smb2_set_sparse() Greg Kroah-Hartman
` (336 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel,
Fernando Fernandez Mancera, Ido Schimmel, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fernando Fernandez Mancera <fmancera@suse.de>
[ Upstream commit 3e0e51c0ee1d08cc9d48dc17f3248d5b31cf8066 ]
When writing to the disable_policy sysctl, if proc_dointvec() fails to
parse the input, it returns a negative error code. The current
implementation is resetting the position argument even if an error
occurred during proc_dointvec() and not only during sysctl restart.
Fix this by checking the return value of proc_dointvec() and returning
early on failure.
Fixes: df789fe75206 ("ipv6: Provide ipv6 version of "disable_policy" sysctl")
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260622130857.5115-5-fmancera@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 288178ee2c72ce..199c14504444bd 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6588,6 +6588,8 @@ static int addrconf_sysctl_disable_policy(struct ctl_table *ctl, int write,
lctl = *ctl;
lctl.data = &val;
ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
+ if (ret)
+ return ret;
if (write && (*valp != val))
ret = addrconf_disable_policy(ctl, valp, val);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 367/699] smb/client: preserve errors from smb2_set_sparse()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 366/699] ipv6: fix error handling in disable_policy sysctl Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 368/699] rtc: ds1307: Fix off-by-one issue with wday for rx8130 Greg Kroah-Hartman
` (335 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Huiwen He, ChenXiaoSong,
Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huiwen He <hehuiwen@kylinos.cn>
[ Upstream commit 2a4b3d2db5c6fcdba889baf7b2ae5661b0beac89 ]
smb2_set_sparse() converts every FSCTL_SET_SPARSE failure to false and
marks sparse support as broken for the share. Callers therefore report
EOPNOTSUPP even for errors such as ENOSPC or EACCES, and later sparse
operations remain disabled until the share is unmounted.
Return the SMB2 ioctl error directly. Set broken_sparse_sup only for
EOPNOTSUPP, which indicates that the server does not support the request.
Update smb3_punch_hole() to propagate the error returned by
smb2_set_sparse().
Fixes: 3d1a3745d8ca ("Add sparse file support to SMB2/SMB3 mounts")
Signed-off-by: Huiwen He <hehuiwen@kylinos.cn>
Reviewed-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/smb2ops.c | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 62ec542871ec16..032799e25d9f03 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1941,8 +1941,9 @@ smb2_sync_write(const unsigned int xid, struct cifs_fid *pfid,
}
/* Set or clear the SPARSE_FILE attribute based on value passed in setsparse */
-static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
- struct cifsFileInfo *cfile, struct inode *inode, __u8 setsparse)
+static int smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
+ struct cifsFileInfo *cfile, struct inode *inode,
+ __u8 setsparse)
{
struct cifsInodeInfo *cifsi;
int rc;
@@ -1951,31 +1952,31 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
/* if file already sparse don't bother setting sparse again */
if ((cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE) && setsparse)
- return true; /* already sparse */
+ return 0; /* already sparse */
if (!(cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE) && !setsparse)
- return true; /* already not sparse */
+ return 0; /* already not sparse */
/*
* Can't check for sparse support on share the usual way via the
* FS attribute info (FILE_SUPPORTS_SPARSE_FILES) on the share
* since Samba server doesn't set the flag on the share, yet
* supports the set sparse FSCTL and returns sparse correctly
- * in the file attributes. If we fail setting sparse though we
- * mark that server does not support sparse files for this share
- * to avoid repeatedly sending the unsupported fsctl to server
- * if the file is repeatedly extended.
+ * in the file attributes. If the server returns EOPNOTSUPP, mark
+ * that sparse files are not supported on this share to avoid
+ * repeatedly sending the unsupported FSCTL.
*/
if (tcon->broken_sparse_sup)
- return false;
+ return -EOPNOTSUPP;
rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid,
cfile->fid.volatile_fid, FSCTL_SET_SPARSE,
&setsparse, 1, CIFSMaxBufSize, NULL, NULL);
if (rc) {
- tcon->broken_sparse_sup = true;
+ if (rc == -EOPNOTSUPP)
+ tcon->broken_sparse_sup = true;
cifs_dbg(FYI, "set sparse rc = %d\n", rc);
- return false;
+ return rc;
}
if (setsparse)
@@ -1983,7 +1984,7 @@ static bool smb2_set_sparse(const unsigned int xid, struct cifs_tcon *tcon,
else
cifsi->cifsAttrs &= (~FILE_ATTRIBUTE_SPARSE_FILE);
- return true;
+ return 0;
}
static int
@@ -3480,10 +3481,9 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon,
inode_lock(inode);
/* Need to make file sparse, if not already, before freeing range. */
/* Consider adding equivalent for compressed since it could also work */
- if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse)) {
- rc = -EOPNOTSUPP;
+ rc = smb2_set_sparse(xid, tcon, cfile, inode, set_sparse);
+ if (rc)
goto out;
- }
/*
* We implement the punch hole through ioctl, so we need remove the page
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 368/699] rtc: ds1307: Fix off-by-one issue with wday for rx8130
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 367/699] smb/client: preserve errors from smb2_set_sparse() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 369/699] rtc: cmos: unregister HPET IRQ handler on probe failure Greg Kroah-Hartman
` (334 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nobuhiro Iwamatsu, Fredrik M Olsson,
Alexandre Belloni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fredrik M Olsson <fredrik.m.olsson@axis.com>
[ Upstream commit 6882aab3c66112b33b251be95c09c8ead3e8d580 ]
The RTC represent each weekday with a individual bit set in the WDAY
register, where the 0th bit represent the first day of the week and the
6th bit represents the last day of the week. For each passed day the
chip performs a rotary-left-shift by one to advance the weekday by one.
The tm_wday field represent weekdays by a value in the range of 0-6.
The fls() function return the bit index of the last bit set. To handle
when there are no bits set it will return 0, and if the 0th bit is set
it will return 1, and if the 1st bit is set it will return 2, and so on.
In order to make the result of the fls() function fall into the expected
range of 0-6 (instead of 1-7) this patch subtracts one from the result
(which matches how the value is written in ds1307_set_time()).
Fixes: 204756f016726 ("rtc: ds1307: Fix wday settings for rx8130")
Reviewed-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
Signed-off-by: Fredrik M Olsson <fredrik.m.olsson@axis.com>
Link: https://patch.msgid.link/20260520-ds1307-rx8901-add-v2-2-e069ea32e1db@axis.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-ds1307.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index 27073898c9c3d7..50e6cc94962a0c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -307,7 +307,7 @@ static int ds1307_get_time(struct device *dev, struct rtc_time *t)
t->tm_hour = bcd2bin(tmp);
/* rx8130 is bit position, not BCD */
if (ds1307->type == rx_8130)
- t->tm_wday = fls(regs[DS1307_REG_WDAY] & 0x7f);
+ t->tm_wday = fls(regs[DS1307_REG_WDAY] & 0x7f) - 1;
else
t->tm_wday = bcd2bin(regs[DS1307_REG_WDAY] & 0x07) - 1;
t->tm_mday = bcd2bin(regs[DS1307_REG_MDAY] & 0x3f);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 369/699] rtc: cmos: unregister HPET IRQ handler on probe failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 368/699] rtc: ds1307: Fix off-by-one issue with wday for rx8130 Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 370/699] net: mvneta: re-enable percpu interrupt on resume Greg Kroah-Hartman
` (333 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Alexandre Belloni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
[ Upstream commit a5bb580df018b5d1c5668f05f7979044fb19e23a ]
cmos_do_probe() registers cmos_interrupt() as the HPET RTC IRQ
handler before requesting the RTC IRQ and registering the RTC
device. If either request_irq() or devm_rtc_register_device()
fails afterwards, the error path leaves the HPET RTC IRQ handler
installed. This leaves a stale handler behind and make a later
hpet_register_irq_handler() fail with -EBUSY.
Track whether the HPET handler was registered successfully and
undo the registration on the probe error path. Also mask the HPET
RTC IRQ bits to match the normal shutdown cleanup.
Fixes: 9d8af78b0797 ("rtc: add HPET RTC emulation to RTC_DRV_CMOS")
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Link: https://patch.msgid.link/20260623100848.2127281-1-haoxiang_li2024@163.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rtc/rtc-cmos.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index 97fa887f4f02c8..5c0df138ca2c13 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -929,6 +929,7 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
unsigned char rtc_control;
unsigned address_space;
u32 flags = 0;
+ bool hpet_registered = false;
struct nvmem_config nvmem_cfg = {
.name = "cmos_nvram",
.word_size = 1,
@@ -1079,6 +1080,7 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
" failed in rtc_init().");
goto cleanup1;
}
+ hpet_registered = true;
} else
rtc_cmos_int_handler = cmos_interrupt;
@@ -1127,6 +1129,10 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
if (is_valid_irq(rtc_irq))
free_irq(rtc_irq, cmos_rtc.rtc);
cleanup1:
+ if (hpet_registered) {
+ hpet_mask_rtc_irq_bit(RTC_IRQMASK);
+ hpet_unregister_irq_handler(cmos_interrupt);
+ }
cmos_rtc.dev = NULL;
cleanup0:
if (RTC_IOMAPPED)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 370/699] net: mvneta: re-enable percpu interrupt on resume
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 369/699] rtc: cmos: unregister HPET IRQ handler on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 371/699] net: sungem: fix probe error cleanup Greg Kroah-Hartman
` (332 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yun Zhou, Sebastian Andrzej Siewior,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
[ Upstream commit fd398d6480987e4c84fff0aaab6b9d6642a93343 ]
On Marvell MPIC platforms (Armada 370/XP/38x), mvneta uses a percpu
IRQ disable/enable scheme for NAPI: the ISR (mvneta_percpu_isr) calls
disable_percpu_irq() to mask the MPIC per-CPU interrupt and schedules
NAPI poll, which calls enable_percpu_irq() on completion to unmask.
If suspend occurs while NAPI poll is pending (between
disable_percpu_irq in the ISR and enable_percpu_irq in poll
completion), the interrupt is never re-enabled:
1. mvneta_percpu_isr: disable_percpu_irq() + napi_schedule()
=> MPIC masked, percpu_enabled cpumask bit cleared
2. NAPI poll does not complete before suspend proceeds
(on PREEMPT_RT this is highly likely since softirqs run in
ksoftirqd which gets frozen; on non-RT it can happen when
softirq processing is deferred to ksoftirqd)
3. mvneta_stop_dev => napi_disable(): cancels the pending poll
without executing the completion path
4. suspend_device_irqs => IRQCHIP_MASK_ON_SUSPEND: masks MPIC
(already masked, but records IRQS_SUSPENDED)
5. Resume: mpic_resume checks irq_percpu_is_enabled() => false
(bit was cleared in step 1) => skips unmask
6. mvneta_start_dev only restores device-level INTR_NEW_MASK,
does not touch the MPIC per-CPU mask
Result: MPIC per-CPU interrupt stays masked permanently. The NIC
generates interrupts (INTR_NEW_CAUSE != 0) but the CPU never
receives them, causing complete loss of network connectivity.
Fix by calling on_each_cpu(mvneta_percpu_enable) in the resume path
to unconditionally unmask the MPIC per-CPU interrupt regardless of
pre-suspend state.
Fixes: 12bb03b436da ("net: mvneta: Handle per-cpu interrupts")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260622074350.1666290-1-yun.zhou@windriver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/mvneta.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
index 3656a3937eca6a..6394b52216b520 100644
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -5434,6 +5434,9 @@ static int mvneta_resume(struct device *device)
rtnl_unlock();
mvneta_set_rx_mode(dev);
+ if (!pp->neta_armada3700)
+ on_each_cpu(mvneta_percpu_enable, pp, true);
+
return 0;
}
#endif
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 371/699] net: sungem: fix probe error cleanup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 370/699] net: mvneta: re-enable percpu interrupt on resume Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 372/699] tracing: probes: fix typo in a log message Greg Kroah-Hartman
` (331 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Simon Horman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
[ Upstream commit 36dea2f639249460d13f6ca66b2a9064187cd34d ]
gem_init_one() calls gem_remove_one() when register_netdev() fails.
gem_remove_one() unregisters and frees resources owned by the net_device,
including the DMA block, MMIO mapping, PCI regions, and the net_device
itself. gem_init_one() then falls through to its own cleanup labels and
frees the same resources again.
Keep the register_netdev() error path in gem_init_one(): clear drvdata so
PM/remove paths do not see a half-registered device, remove the NAPI
instance added during probe, and let the existing cleanup labels release
the resources once.
The issue was found by a local static-analysis checker for probe error
paths. The reported path was manually inspected before sending this fix.
Compile-tested with CONFIG_SUNGEM=y. Runtime testing was not performed
because no sungem hardware is available.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260623025759.3468566-1-ruoyuw560@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sun/sungem.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index 4d6a9f02c7388d..0cd80b27d8598c 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -2983,10 +2983,10 @@ static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
dev->max_mtu = GEM_MAX_MTU;
/* Register with kernel */
- if (register_netdev(dev)) {
+ err = register_netdev(dev);
+ if (err) {
pr_err("Cannot register net device, aborting\n");
- err = -ENOMEM;
- goto err_out_free_consistent;
+ goto err_out_clear_drvdata;
}
/* Undo the get_cell with appropriate locking (we could use
@@ -3000,8 +3000,13 @@ static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
dev->dev_addr);
return 0;
+err_out_clear_drvdata:
+ pci_set_drvdata(pdev, NULL);
+ netif_napi_del(&gp->napi);
+
err_out_free_consistent:
- gem_remove_one(pdev);
+ dma_free_coherent(&pdev->dev, sizeof(struct gem_init_block),
+ gp->init_block, gp->gblock_dvma);
err_out_iounmap:
gem_put_cell(gp);
iounmap(gp->regs);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 372/699] tracing: probes: fix typo in a log message
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 371/699] net: sungem: fix probe error cleanup Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 373/699] spi: sh-msiof: abort transfers when reset times out Greg Kroah-Hartman
` (330 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kaiser,
Masami Hiramatsu (Google), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <martin@kaiser.cx>
[ Upstream commit 72c8646956ffc8050bb8be5988a0f28fc37e1ac4 ]
Fix a typo ("Invalid $-variable") in a log message.
Link: https://lore.kernel.org/all/20260507081041.885781-4-martin@kaiser.cx/
Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_probe.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h
index 5d4dc7ac3d198b..0f7a584ac21bfc 100644
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -409,7 +409,7 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call,
C(RETVAL_ON_PROBE, "$retval is not available on probe"), \
C(BAD_STACK_NUM, "Invalid stack number"), \
C(BAD_ARG_NUM, "Invalid argument number"), \
- C(BAD_VAR, "Invalid $-valiable specified"), \
+ C(BAD_VAR, "Invalid $-variable specified"), \
C(BAD_REG_NAME, "Invalid register name"), \
C(BAD_MEM_ADDR, "Invalid memory address"), \
C(BAD_IMM, "Invalid immediate value"), \
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 373/699] spi: sh-msiof: abort transfers when reset times out
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 372/699] tracing: probes: fix typo in a log message Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 374/699] gpio: mvebu: fail probe if gpiochip registration fails Greg Kroah-Hartman
` (329 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 6dbaa4d288432c697cea47028480481b8b29bd6a ]
sh_msiof_spi_reset_regs() asserts TX/RX reset and polls until the reset
bits clear, but the poll result is ignored. sh_msiof_transfer_one() can
therefore continue programming a transfer after the controller did not
leave reset.
Return the reset poll result from the helper and abort the transfer on
timeout, matching the existing transfer path's error-return style.
Fixes: fedd6940682a ("spi: sh-msiof: Add reset of registers before starting transfer")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260623135834.55442-1-pengpeng@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sh-msiof.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index f1ca8b5356bcfd..6c026b193548a6 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -243,7 +243,7 @@ static irqreturn_t sh_msiof_spi_irq(int irq, void *data)
return IRQ_HANDLED;
}
-static void sh_msiof_spi_reset_regs(struct sh_msiof_spi_priv *p)
+static int sh_msiof_spi_reset_regs(struct sh_msiof_spi_priv *p)
{
u32 mask = SICTR_TXRST | SICTR_RXRST;
u32 data;
@@ -252,8 +252,8 @@ static void sh_msiof_spi_reset_regs(struct sh_msiof_spi_priv *p)
data |= mask;
sh_msiof_write(p, SICTR, data);
- readl_poll_timeout_atomic(p->mapbase + SICTR, data, !(data & mask), 1,
- 100);
+ return readl_poll_timeout_atomic(p->mapbase + SICTR, data,
+ !(data & mask), 1, 100);
}
static const u32 sh_msiof_spi_div_array[] = {
@@ -923,7 +923,9 @@ static int sh_msiof_transfer_one(struct spi_controller *ctlr,
int ret;
/* reset registers */
- sh_msiof_spi_reset_regs(p);
+ ret = sh_msiof_spi_reset_regs(p);
+ if (ret)
+ return ret;
/* setup clocks (clock already enabled in chipselect()) */
if (!spi_controller_is_slave(p->ctlr))
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 374/699] gpio: mvebu: fail probe if gpiochip registration fails
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 373/699] spi: sh-msiof: abort transfers when reset times out Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 375/699] gpio: htc-egpio: use managed gpiochip registration Greg Kroah-Hartman
` (328 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Bartosz Golaszewski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 479e91fc92416a4d54d2b3150aa1e4550d9cc759 ]
mvebu_gpio_probe() registers the GPIO chip with
devm_gpiochip_add_data() but ignores the return value. If registration
fails, probe continues and leaves later code operating on a GPIO chip
that was never published to gpiolib.
Return the registration error so the device fails probe cleanly.
Fixes: fefe7b092345 ("gpio: introduce gpio-mvebu driver for Marvell SoCs")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131645.86884-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-mvebu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 2ab34a8e6273df..0f8b042d5369f2 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -1193,7 +1193,10 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
BUG();
}
- devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
+ err = devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip);
+ if (err)
+ return dev_err_probe(&pdev->dev, err,
+ "failed to register gpiochip\n");
/* Some MVEBU SoCs have simple PWM support for GPIO lines */
if (IS_ENABLED(CONFIG_PWM)) {
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 375/699] gpio: htc-egpio: use managed gpiochip registration
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 374/699] gpio: mvebu: fail probe if gpiochip registration fails Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 376/699] seg6: validate SRH length before reading fixed fields Greg Kroah-Hartman
` (327 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Bartosz Golaszewski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
[ Upstream commit 17326db5f0ab4ec1901e75d052b5ebef486b467f ]
egpio_probe() registers each nested gpio_chip with gpiochip_add_data()
but ignores the return value. If one registration fails, probe still
returns success even though one of the chips was not published to
gpiolib.
Use devm_gpiochip_add_data() and fail probe if any chip registration
fails. This lets devres unwind already registered chips and prevents
the driver from publishing a partially initialized device.
Fixes: a1635b8fe59d ("[ARM] 4947/1: htc-egpio, a driver for GPIO/IRQ expanders with fixed input/output pins")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260624131828.94139-1-pengpeng@iscas.ac.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-htc-egpio.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-htc-egpio.c b/drivers/gpio/gpio-htc-egpio.c
index a40bd56673fe36..5f12ce9ac28caf 100644
--- a/drivers/gpio/gpio-htc-egpio.c
+++ b/drivers/gpio/gpio-htc-egpio.c
@@ -268,6 +268,7 @@ static int __init egpio_probe(struct platform_device *pdev)
struct gpio_chip *chip;
unsigned int irq, irq_end;
int i;
+ int ret;
/* Initialize ei data structure. */
ei = devm_kzalloc(&pdev->dev, sizeof(*ei), GFP_KERNEL);
@@ -331,7 +332,10 @@ static int __init egpio_probe(struct platform_device *pdev)
chip->base = pdata->chip[i].gpio_base;
chip->ngpio = pdata->chip[i].num_gpios;
- gpiochip_add_data(chip, &ei->chip[i]);
+ ret = devm_gpiochip_add_data(&pdev->dev, chip, &ei->chip[i]);
+ if (ret)
+ return dev_err_probe(&pdev->dev, ret,
+ "failed to register gpiochip %d\n", i);
}
/* Set initial pin values */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 376/699] seg6: validate SRH length before reading fixed fields
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 375/699] gpio: htc-egpio: use managed gpiochip registration Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 377/699] hwmon: adm1275: Prevent reading uninitialized stack Greg Kroah-Hartman
` (326 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuoqi Gui, Andrea Mayer,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
[ Upstream commit a75d99f46bf21b45965ce39c5cfb3b8bb5ffb1aa ]
seg6_validate_srh() reads fixed SRH fields such as srh->type and
srh->hdrlen before checking that the supplied length covers the fixed
struct ipv6_sr_hdr fields.
The BPF SEG6 encap path reaches this with a BPF program-supplied pointer
and length: bpf_lwt_push_encap() and the SEG6 local BPF END_B6 and
END_B6_ENCAP actions call bpf_push_seg6_encap(), which forwards the
length to seg6_validate_srh() with no minimum-size guard. A 2-byte SEG6
encap header can therefore make the validator read srh->type at offset 2
beyond the caller-supplied buffer.
Reject lengths shorter than the fixed SRH at the top of
seg6_validate_srh(), before any field is read. This fixes the BPF helper
path and keeps the common validator robust.
Fixes: fe94cc290f53 ("bpf: Add IPv6 Segment Routing helpers")
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Reviewed-by: Andrea Mayer <andrea.mayer@uniroma2.it>
Link: https://patch.msgid.link/20260623-f01-17-seg6-srh-len-v2-1-2edc40e9e3e1@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/seg6.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 77221f27262aaa..cb494c67c94445 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -31,6 +31,9 @@ bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced)
int max_last_entry;
int trailing;
+ if (len < sizeof(*srh))
+ return false;
+
if (srh->type != IPV6_SRCRT_TYPE_4)
return false;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 377/699] hwmon: adm1275: Prevent reading uninitialized stack
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 376/699] seg6: validate SRH length before reading fixed fields Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 378/699] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() Greg Kroah-Hartman
` (325 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matti Vaittinen, Guenter Roeck,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <mazziesaccount@gmail.com>
[ Upstream commit 553f9517813912a5ab661af5504485d96824a61c ]
While adding support for the ROHM BD127X0 hot-swap controllers, sashiko
reported an error in device-name comparison, which can lead to reading
uninitialized stack memory.
Quoting Sashiko:
This is a pre-existing issue, but I noticed that just before this block in
adm1275_probe(), there might be an out-of-bounds stack read:
ret = i2c_smbus_read_block_data(client, PMBUS_MFR_MODEL, block_buffer);
if (ret < 0) { ... }
for (mid = adm1275_id; mid->name[0]; mid++) {
if (!strncasecmp(mid->name, block_buffer, strlen(mid->name)))
break;
}
Since i2c_smbus_read_block_data() reads up to 32 bytes into the
uninitialized stack array block_buffer without appending a null
terminator, strncasecmp() could read past the valid bytes returned in ret.
For example, if the device returns a shorter string like "adm12", checking
it against "adm1275" up to the length of "adm1275" will continue reading
into uninitialized stack bounds.
Prevent reading uninitialized memory by zeroing the stack array.
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Fixes: 87102808d039 ("hwmon: (pmbus/adm1275) Validate device ID")
Link: https://lore.kernel.org/r/c8ad38e0cdb347261c6245de2b7965e747f28d22.1782458224.git.mazziesaccount@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/pmbus/adm1275.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c
index c0618205758e93..71233e04b3fcb0 100644
--- a/drivers/hwmon/pmbus/adm1275.c
+++ b/drivers/hwmon/pmbus/adm1275.c
@@ -484,7 +484,7 @@ static int adm1275_enable_vout_temp(struct i2c_client *client, int config)
static int adm1275_probe(struct i2c_client *client)
{
s32 (*config_read_fn)(const struct i2c_client *client, u8 reg);
- u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1];
+ u8 block_buffer[I2C_SMBUS_BLOCK_MAX + 1] = {0};
int config, device_config;
int ret;
struct pmbus_driver_info *info;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 378/699] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 377/699] hwmon: adm1275: Prevent reading uninitialized stack Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 379/699] tracing/events: Fix to check the simple_tsk_fn creation Greg Kroah-Hartman
` (324 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 8ff7f2a6da4fccaa5cc9be7251a24e71e29fbd1a ]
genelink_rx_fixup() splits an aggregated RX frame into its individual
packets, using a per-packet length taken from device-supplied data. That
length is only bounded by GL_MAX_PACKET_LEN (1514); it is never compared
against how many bytes were actually received.
A malicious GeneLink (GL620A) device can therefore send a short URB whose
header claims packet_count > 1 and a first packet of up to 1514 bytes.
skb_put_data(gl_skb, packet->packet_data, size);
then copies past the end of the receive buffer and hands the adjacent slab
contents up the network stack, an out-of-bounds read that leaks kernel heap.
No privilege is required: the path runs in the usbnet RX softirq as soon as
the interface is up.
BUG: KASAN: slab-out-of-bounds in genelink_rx_fixup (drivers/net/usb/gl620a.c:112)
Read of size 1514 at addr ffff888011309708 by task ksoftirqd/0/14
Call Trace:
...
__asan_memcpy (mm/kasan/shadow.c:105)
genelink_rx_fixup (include/linux/skbuff.h:2814 drivers/net/usb/gl620a.c:112)
usbnet_bh (drivers/net/usb/usbnet.c:572 drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3405)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
run_ksoftirqd (kernel/softirq.c:1076)
...
skb_pull() already verifies that the requested length fits the buffer and
returns NULL otherwise. Move it ahead of the copy and check its result, so
a packet that overruns the received data is rejected before it is read.
Well-formed frames, whose packets are fully present, are unaffected.
Fixes: 47ee3051c856 ("[PATCH] USB: usbnet (5/9) module for genesys gl620a cables")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260627205353.4000788-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/gl620a.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/gl620a.c b/drivers/net/usb/gl620a.c
index 8c2838cba77bc1..d00d364fb8acc3 100644
--- a/drivers/net/usb/gl620a.c
+++ b/drivers/net/usb/gl620a.c
@@ -104,6 +104,9 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
return 0;
}
+ if (!skb_pull(skb, size + 4))
+ return 0;
+
// allocate the skb for the individual packet
gl_skb = alloc_skb(size, GFP_ATOMIC);
if (gl_skb) {
@@ -116,9 +119,6 @@ static int genelink_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
// advance to the next packet
packet = (struct gl_packet *)&packet->packet_data[size];
count--;
-
- // shift the data pointer to the next gl_packet
- skb_pull(skb, size + 4);
}
// skip the packet length field 4 bytes
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 379/699] tracing/events: Fix to check the simple_tsk_fn creation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 378/699] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 380/699] virtio_net: disable cb when NAPI is busy-polled Greg Kroah-Hartman
` (323 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
[ Upstream commit cda1fbfc5313bb90daa271d45eea4a8d317a8544 ]
Sashiko pointed that this sample code does not correctly handle the
failure of thread creation because kthread_run() can return -errno.
Check the simple_tsk_fn is correctly initialized (created) or not.
Link: https://lore.kernel.org/all/178165817322.269421.3992299509400184196.stgit@devnote2/
Link: https://sashiko.dev/#/patchset/178092865666.163648.10457567771536160909.stgit%40devnote2
Fixes: 9cfe06f8cd5c ("tracing/events: add trace-events-sample")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/trace_events/trace-events-sample.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/samples/trace_events/trace-events-sample.c b/samples/trace_events/trace-events-sample.c
index 1a72b7d95cdc74..2bcae90d85e51f 100644
--- a/samples/trace_events/trace-events-sample.c
+++ b/samples/trace_events/trace-events-sample.c
@@ -94,6 +94,10 @@ int foo_bar_reg(void)
* for consistency sake, we still take the thread_mutex.
*/
simple_tsk_fn = kthread_run(simple_thread_fn, NULL, "event-sample-fn");
+ if (IS_ERR_OR_NULL(simple_tsk_fn)) {
+ pr_err("Failed to create simple_thread_fn\n");
+ simple_tsk_fn = NULL;
+ }
out:
mutex_unlock(&thread_mutex);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 380/699] virtio_net: disable cb when NAPI is busy-polled
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 379/699] tracing/events: Fix to check the simple_tsk_fn creation Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 381/699] cxgb4: Fix decode strings dump for T6 adapters Greg Kroah-Hartman
` (322 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael S. Tsirkin, Longjun Tang,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longjun Tang <tanglongjun@kylinos.cn>
[ Upstream commit 1eb8fc67ca41db71c90866ff76c990d85247daef ]
When busy-poll is active, napi_schedule_prep() returns false in
virtqueue_napi_schedule(), so virtqueue_disable_cb() is skipped.
The device may keep firing irqs until reaches virtqueue_napi_complete().
Under load (received == budget), it will lead to a large number
of spurious interrupts.
Fix it by disabling the callback at the virtnet_poll() entry.
This keeps the callback off while we poll and it is re-enabled by
virtqueue_napi_complete() when going idle.
Fixes: ceef438d613f ("virtio_net: remove custom busy_poll")
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Longjun Tang <tanglongjun@kylinos.cn>
Link: https://patch.msgid.link/20260629024230.37325-1-lange_tang@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/virtio_net.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index fe7b28a595f163..aa61bf852e2e0e 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1555,6 +1555,9 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
unsigned int received;
unsigned int xdp_xmit = 0;
+ if (budget)
+ virtqueue_disable_cb(rq->vq);
+
virtnet_poll_cleantx(rq, budget);
received = virtnet_receive(rq, budget, &xdp_xmit);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 381/699] cxgb4: Fix decode strings dump for T6 adapters
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 380/699] virtio_net: disable cb when NAPI is busy-polled Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 382/699] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
` (321 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gleb Markov, Potnuri Bharat Teja,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gleb Markov <markov.gi@npc-ksb.ru>
[ Upstream commit 5d6dc22d62682d93f5f55f145ad792f2891de911 ]
Depending on the value of chip_version, the correct decode set is selected.
However, the subsequent matching with the t4 encoding type in the if-else
block results in a reassignment, which leads to the loss of support for
t6_decode as well as reinitializing of values t4_decode and t5_decode.
The component history shows that the if-else block previously used for
this purpose, as well as the execution order, was not affected by the
change.
Furthermore, it is suggested by the execution order that the scenario with
overwriting and loss of support will be implemented.
Delete the if-else block.
Fixes: 6df397539cb0 ("cxgb4: Update correct encoding of SGE Ingress DMA States for T6 adapter")
Signed-off-by: Gleb Markov <markov.gi@npc-ksb.ru>
Reviewed-by: Potnuri Bharat Teja <bharat@chelsio.com>
Link: https://patch.msgid.link/20260629130856.1168-1-markov.gi@npc-ksb.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 51ea81638b31b9..465b3591cbdbe2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -6767,14 +6767,6 @@ void t4_sge_decode_idma_state(struct adapter *adapter, int state)
return;
}
- if (is_t4(adapter->params.chip)) {
- sge_idma_decode = (const char **)t4_decode;
- sge_idma_decode_nstates = ARRAY_SIZE(t4_decode);
- } else {
- sge_idma_decode = (const char **)t5_decode;
- sge_idma_decode_nstates = ARRAY_SIZE(t5_decode);
- }
-
if (state < sge_idma_decode_nstates)
CH_WARN(adapter, "idma state %s\n", sge_idma_decode[state]);
else
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 382/699] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 381/699] cxgb4: Fix decode strings dump for T6 adapters Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 383/699] net/sched: hhf: clear heavy-hitter state on reset Greg Kroah-Hartman
` (320 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy,
Bartosz Golaszewski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vz@kernel.org>
[ Upstream commit 8d7e62d5e9b2d2ff146f472a9215d7e29c7e2307 ]
Out of memory situation on driver's probe is expected to be reported to
the driver's framework with a proper -ENOMEM error code.
Fixes: 35570ac6039e ("gpio: add GPIO driver for the Timberdale FPGA")
Signed-off-by: Vladimir Zapolskiy <vz@kernel.org>
Link: https://patch.msgid.link/20260630145148.4081967-1-vz@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-timberdale.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-timberdale.c b/drivers/gpio/gpio-timberdale.c
index 92c1f2baa4bff2..3a9cb305c13777 100644
--- a/drivers/gpio/gpio-timberdale.c
+++ b/drivers/gpio/gpio-timberdale.c
@@ -228,7 +228,7 @@ static int timbgpio_probe(struct platform_device *pdev)
tgpio = devm_kzalloc(dev, sizeof(*tgpio), GFP_KERNEL);
if (!tgpio)
- return -EINVAL;
+ return -ENOMEM;
tgpio->irq_base = pdata->irq_base;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 383/699] net/sched: hhf: clear heavy-hitter state on reset
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 382/699] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 384/699] afs: Fix error code in afs_extract_vl_addrs() Greg Kroah-Hartman
` (319 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit a225f8c20712713406ae47024b8df42deacddd4a ]
HHF reset does not clear the classifier state used to identify heavy
hitters. Packets after reset can therefore be scheduled using flow
history from before the reset.
The reset operation should return the qdisc to an empty state.
Clear the heavy-hitter classifier tables when HHF is reset.
Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hhf.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
index 73cabb4451ce7a..1fb9294a27f252 100644
--- a/net/sched/sch_hhf.c
+++ b/net/sched/sch_hhf.c
@@ -461,12 +461,39 @@ static struct sk_buff *hhf_dequeue(struct Qdisc *sch)
return skb;
}
+static void hhf_reset_classifier(struct hhf_sched_data *q)
+{
+ int i;
+
+ if (!q->hh_flows)
+ return;
+
+ for (i = 0; i < HH_FLOWS_CNT; i++) {
+ struct hh_flow_state *flow, *next;
+ struct list_head *head = &q->hh_flows[i];
+
+ list_for_each_entry_safe(flow, next, head, flowchain) {
+ list_del(&flow->flowchain);
+ kfree(flow);
+ }
+ }
+ WRITE_ONCE(q->hh_flows_current_cnt, 0);
+
+ for (i = 0; i < HHF_ARRAYS_CNT; i++) {
+ if (q->hhf_valid_bits[i])
+ bitmap_zero(q->hhf_valid_bits[i], HHF_ARRAYS_LEN);
+ }
+ q->hhf_arrays_reset_timestamp = hhf_time_stamp();
+}
+
static void hhf_reset(struct Qdisc *sch)
{
+ struct hhf_sched_data *q = qdisc_priv(sch);
struct sk_buff *skb;
while ((skb = hhf_dequeue(sch)) != NULL)
rtnl_kfree_skbs(skb, skb);
+ hhf_reset_classifier(q);
}
static void hhf_destroy(struct Qdisc *sch)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 384/699] afs: Fix error code in afs_extract_vl_addrs()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 383/699] net/sched: hhf: clear heavy-hitter state on reset Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 385/699] afs: Fix callback service message parsers to pass through -EAGAIN Greg Kroah-Hartman
` (318 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, David Howells,
Marc Dionne, linux-afs, Christian Brauner (Amutable), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 4897cb71d4ab1f7e1a214adb1e4b80176702368d ]
The error codes on these paths are only set on the first iteration
through the loop. Set the correct error code on every iteration.
Fixes: 0a5143f2f89c ("afs: Implement VL server rotation")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-3-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/vl_list.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/afs/vl_list.c b/fs/afs/vl_list.c
index 38b2ba1d9ec0df..8508d225509bb0 100644
--- a/fs/afs/vl_list.c
+++ b/fs/afs/vl_list.c
@@ -95,7 +95,7 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end,
{
struct afs_addr_list *alist;
const u8 *b = *_b;
- int ret = -EINVAL;
+ int ret;
alist = afs_alloc_addrlist(nr_addrs, VL_SERVICE, port);
if (!alist)
@@ -113,6 +113,7 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end,
case DNS_ADDRESS_IS_IPV4:
if (end - b < 4) {
_leave(" = -EINVAL [short inet]");
+ ret = -EINVAL;
goto error;
}
memcpy(x, b, 4);
@@ -123,6 +124,7 @@ static struct afs_addr_list *afs_extract_vl_addrs(const u8 **_b, const u8 *end,
case DNS_ADDRESS_IS_IPV6:
if (end - b < 16) {
_leave(" = -EINVAL [short inet6]");
+ ret = -EINVAL;
goto error;
}
memcpy(x, b, 16);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 385/699] afs: Fix callback service message parsers to pass through -EAGAIN
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 384/699] afs: Fix error code in afs_extract_vl_addrs() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 386/699] afs: Fix vllist leak Greg Kroah-Hartman
` (317 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
linux-afs, Christian Brauner (Amutable), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 0f36469d7ce98b362934113c550d08bb0c784231 ]
The AFS filesystem client uses an rxrpc server to listen for callback
notifications. Each callback call type handler has a delivery function
that parses the incoming request stream, and this should return -EAGAIN the
last packet hasn't yet been seen, but all currently queued received data is
consumed. afs_extract_data() does this, but the -EAGAIN return is switched
to 0 inadvertantly
Fix callback service message parsers to pass through -EAGAIN
Fixes: d001648ec7cf ("rxrpc: Don't expose skbs to in-kernel users [ver #2]")
Closes: https://sashiko.dev/#/patchset/20260609081738.770127-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-14-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/cmservice.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index 6761a0b5f3986f..c7de60bade8d22 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -386,7 +386,6 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call)
ret = afs_extract_data(call, false);
switch (ret) {
case 0: break;
- case -EAGAIN: return 0;
default: return ret;
}
@@ -498,7 +497,6 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call)
ret = afs_extract_data(call, false);
switch (ret) {
case 0: break;
- case -EAGAIN: return 0;
default: return ret;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 386/699] afs: Fix vllist leak
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 385/699] afs: Fix callback service message parsers to pass through -EAGAIN Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 387/699] afs: Fix unchecked-length string display in debug statement Greg Kroah-Hartman
` (316 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
linux-afs, Christian Brauner (Amutable), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit fc10c0ecf06f2981af5d04357612b00051e03e9e ]
Fix a leak of the new vllist in afs_update_cell() in the event that it is an
empty list (nr_servers == 0), in which case the old list isn't displaced
unless the old list is also empty.
Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup")
Closes: https://sashiko.dev/#/patchset/20260609081738.770127-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-18-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/cell.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index cfd3c4dabdb2c0..7f8a13d6967b17 100644
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -471,6 +471,8 @@ static int afs_update_cell(struct afs_cell *cell)
rcu_assign_pointer(cell->vl_servers, vllist);
cell->dns_source = vllist->source;
old = p;
+ } else {
+ old = vllist;
}
write_unlock(&cell->vl_servers_lock);
afs_put_vlserverlist(cell->net, old);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 387/699] afs: Fix unchecked-length string display in debug statement
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 386/699] afs: Fix vllist leak Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 388/699] ata: sata_gemini: unwind clocks on IDE pinctrl errors Greg Kroah-Hartman
` (315 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Marc Dionne,
linux-afs, Christian Brauner (Amutable), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 903d37c97228258da71e092f8b4ab260ce81497d ]
Fix afs_extract_vlserver_list() to limit the length of the displayed
string in a debug statement().
Fixes: 0a5143f2f89c ("afs: Implement VL server rotation")
Closes: https://sashiko.dev/#/patchset/20260618074903.2374756-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-22-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/vl_list.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/afs/vl_list.c b/fs/afs/vl_list.c
index 8508d225509bb0..d7199ed4838be9 100644
--- a/fs/afs/vl_list.c
+++ b/fs/afs/vl_list.c
@@ -199,6 +199,8 @@ struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *cell,
b += sizeof(*hdr);
while (end - b >= sizeof(bs)) {
+ int nlen;
+
bs.name_len = afs_extract_le16(&b);
bs.priority = afs_extract_le16(&b);
bs.weight = afs_extract_le16(&b);
@@ -208,10 +210,12 @@ struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *cell,
bs.protocol = *b++;
bs.nr_addrs = *b++;
+ nlen = min3(bs.name_len, end - b, 255);
+
_debug("extract %u %u %u %u %u %u %*.*s",
bs.name_len, bs.priority, bs.weight,
bs.port, bs.protocol, bs.nr_addrs,
- bs.name_len, bs.name_len, b);
+ bs.name_len, nlen, b);
if (end - b < bs.name_len)
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 388/699] ata: sata_gemini: unwind clocks on IDE pinctrl errors
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 387/699] afs: Fix unchecked-length string display in debug statement Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 389/699] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() Greg Kroah-Hartman
` (314 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Niklas Cassel, Linus Walleij, Damien Le Moal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
[ Upstream commit c0ace4130e813acbabdfaa28d4e94a849c2ffdd7 ]
gemini_sata_bridge_init() prepares and enables both SATA PCLKs, then
disables them again while keeping the clocks prepared for later bridge
start and stop operations. If gemini_setup_ide_pins() fails after that,
gemini_sata_probe() returns directly and skips the existing
out_unprep_clk unwind path.
Route the IDE pinctrl failure through out_unprep_clk so the clocks
prepared by gemini_sata_bridge_init() are unprepared before probe
fails.
Fixes: d872ced29d5f ("ata: sata_gemini: Introduce explicit IDE pin control")
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/sata_gemini.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/sata_gemini.c b/drivers/ata/sata_gemini.c
index 1564472fd5d509..5b7ffbc2e174c6 100644
--- a/drivers/ata/sata_gemini.c
+++ b/drivers/ata/sata_gemini.c
@@ -391,7 +391,7 @@ static int gemini_sata_probe(struct platform_device *pdev)
if (sg->ide_pins) {
ret = gemini_setup_ide_pins(dev);
if (ret)
- return ret;
+ goto out_unprep_clk;
}
dev_info(dev, "set up the Gemini IDE/SATA nexus\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 389/699] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 388/699] ata: sata_gemini: unwind clocks on IDE pinctrl errors Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 390/699] HID: core: Fix OOB read in hid_get_report for numbered reports Greg Kroah-Hartman
` (313 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Georgiy Osokin, Jiri Kosina,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georgiy Osokin <g.osokin@auroraos.dev>
[ Upstream commit 0021eb09041f021c079be1022934a280f7f176c0 ]
In picolcd_send_and_wait(), an integer overflow of the signed loop counter
'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.
If the loop executes more than INT_MAX times, 'k' becomes negative,
making the condition 'k < size' true even when 'size' is 0.
Change the type of 'k' to 'unsigned int' to prevent the overflow and
eliminate the out-of-bounds access.
Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.
[jkosina@suse.com: extended hash length]
Fixes: fabdbf2fd22fa17 ("HID: picoLCD: split driver code")
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-picolcd_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
index 1b5c63241af058..34a9068a258041 100644
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -72,7 +72,8 @@ struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
struct picolcd_pending *work;
struct hid_report *report = picolcd_out_report(report_id, hdev);
unsigned long flags;
- int i, j, k;
+ int i, j;
+ unsigned int k;
if (!report || !data)
return NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 390/699] HID: core: Fix OOB read in hid_get_report for numbered reports
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 389/699] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 391/699] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup Greg Kroah-Hartman
` (312 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Jiri Kosina, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <lee@kernel.org>
[ Upstream commit af1a9b65ebe8a948eda805c14b78d4d0767cb1b5 ]
When a caller passes a size of 0 to hid_report_raw_event() for a
numbered report, the function originally called hid_get_report() before
performing any size validation.
Inside hid_get_report(), if the report is numbered (report_enum->numbered
is true), it unconditionally dereferences data[0] to extract the report ID.
With a size of 0, this results in an out-of-bounds read or kernel panic.
Fix this by moving the numbered report size validation check before the
call to hid_get_report(), ensuring that size is at least 1 before
dereferencing the data pointer.
Fixes: 2c85c61d1332 ("HID: pass the buffer size to hid_report_raw_event")
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-core.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 918c66d5bc93f6..5acb893ecff683 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1788,6 +1788,13 @@ int hid_report_raw_event(struct hid_device *hid, int type, u8 *data,
u8 *cdata = data;
int ret = 0;
+ if (report_enum->numbered && (size < 1 || bufsize < 1)) {
+ hid_warn_ratelimited(hid,
+ "Event data for numbered report is too short (%d vs %zu)\n",
+ size, bufsize);
+ return -EINVAL;
+ }
+
report = hid_get_report(report_enum, data);
if (!report)
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 391/699] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 390/699] HID: core: Fix OOB read in hid_get_report for numbered reports Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 392/699] gue: validate REMCSUM private option length Greg Kroah-Hartman
` (311 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 03f384bc0cb8d4a1301d4f5b0baef2d980258383 ]
For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:
BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...
Reject the frame when packet_len >= skb->len before reading.
Fixes: 904813cd8a0b ("[PATCH] USB: usbnet (4/9) module for net1080 cables")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260630045121.1565324-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/net1080.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index b0c0c9dd6a028d..8a66549cefa7df 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -381,7 +381,7 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
skb_trim(skb, skb->len - sizeof *trailer);
if ((packet_len & 0x01) == 0) {
- if (skb->data [packet_len] != PAD_BYTE) {
+ if (packet_len >= skb->len || skb->data[packet_len] != PAD_BYTE) {
dev->net->stats.rx_frame_errors++;
netdev_dbg(dev->net, "bad pad\n");
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 392/699] gue: validate REMCSUM private option length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 391/699] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 393/699] netfilter: xt_u32: reject invalid shift counts Greg Kroah-Hartman
` (310 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qihang, Eric Dumazet,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qihang <q.h.hack.winter@gmail.com>
[ Upstream commit d335dcc6f521571d57117b8deeebc940836e5450 ]
GUE private flags can indicate that remote checksum offload metadata is
present. The private flags field itself is accounted for by
guehdr_flags_len(), but guehdr_priv_flags_len() currently returns 0 even
when GUE_PFLAG_REMCSUM is set.
This lets a packet with only the private flags field pass
validate_gue_flags(), after which gue_remcsum() and gue_gro_remcsum()
read the missing REMCSUM start/offset fields from the following bytes.
Account for GUE_PLEN_REMCSUM when GUE_PFLAG_REMCSUM is present so that
malformed packets are rejected during option validation.
Fixes: c1aa8347e73e ("gue: Protocol constants for remote checksum offload")
Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/gue.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/gue.h b/include/net/gue.h
index e42402f180b75a..e5246d5d3e87d1 100644
--- a/include/net/gue.h
+++ b/include/net/gue.h
@@ -77,7 +77,7 @@ static inline size_t guehdr_flags_len(__be16 flags)
static inline size_t guehdr_priv_flags_len(__be32 flags)
{
- return 0;
+ return (flags & GUE_PFLAG_REMCSUM) ? GUE_PLEN_REMCSUM : 0;
}
/* Validate standard and private flags. Returns non-zero (meaning invalid)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 393/699] netfilter: xt_u32: reject invalid shift counts
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 392/699] gue: validate REMCSUM private option length Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 394/699] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() Greg Kroah-Hartman
` (309 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Wyatt Feng, Ren Wei, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
[ Upstream commit 64cdf7d30ac18e43df6c48004435febb965809a8 ]
u32_match_it() executes rule-supplied shift operands on a 32-bit
value. A malformed u32 rule can provide a shift count of 32 or more,
triggering an undefined shift out-of-bounds during packet evaluation.
Validate XT_U32_LEFTSH and XT_U32_RIGHTSH operands in
u32_mt_checkentry() and reject malformed rules before they reach the
packet path.
Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_u32.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 117d4615d6684c..ec1a21e3b6e2c3 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -100,7 +100,7 @@ static int u32_mt_checkentry(const struct xt_mtchk_param *par)
{
const struct xt_u32 *data = par->matchinfo;
const struct xt_u32_test *ct;
- unsigned int i;
+ unsigned int i, j;
if (data->ntests > ARRAY_SIZE(data->tests))
return -EINVAL;
@@ -111,6 +111,16 @@ static int u32_mt_checkentry(const struct xt_mtchk_param *par)
if (ct->nnums > ARRAY_SIZE(ct->location) ||
ct->nvalues > ARRAY_SIZE(ct->value))
return -EINVAL;
+
+ for (j = 1; j < ct->nnums; ++j) {
+ switch (ct->location[j].nextop) {
+ case XT_U32_LEFTSH:
+ case XT_U32_RIGHTSH:
+ if (ct->location[j].number >= 32)
+ return -EINVAL;
+ break;
+ }
+ }
}
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 394/699] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 393/699] netfilter: xt_u32: reject invalid shift counts Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 395/699] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop Greg Kroah-Hartman
` (308 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Feng Wu, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Wu <wufengwufengwufeng@gmail.com>
[ Upstream commit 444853cd438201007da5359821adcc2995655ab1 ]
On links faster than ~34 Gbps, where byte rate may exceed 2^32-1
(~ 4.3 GBps), the comparison result becomes incorrect because the
truncated value no longer reflects the actual estimator rate.
Fix by changing the local variables to u64.
Fixes: 1c0d32fde5bd ("net_sched: gen_estimator: complete rewrite of rate estimators")
Signed-off-by: Feng Wu <wufengwufengwufeng@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/xt_rateest.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/xt_rateest.c b/net/netfilter/xt_rateest.c
index b1d736c15fcbe5..7c05b63425784e 100644
--- a/net/netfilter/xt_rateest.c
+++ b/net/netfilter/xt_rateest.c
@@ -16,7 +16,7 @@ xt_rateest_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_rateest_match_info *info = par->matchinfo;
struct gnet_stats_rate_est64 sample = {0};
- u_int32_t bps1, bps2, pps1, pps2;
+ u64 bps1, bps2, pps1, pps2;
bool ret = true;
gen_estimator_read(&info->est1->rate_est, &sample);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 395/699] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 394/699] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 396/699] qede: fix off-by-one in BD ring consumption on build_skb failure Greg Kroah-Hartman
` (307 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhixing Chen, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhixing Chen <running910@gmail.com>
[ Upstream commit 43ccc20b5a733226417832cf16ef45322e594990 ]
The ah, hbh and rt matches check that the fixed extension header is
present, then use the header length field to derive the advertised
extension header length for matching.
For the ah match, add the missing advertised-length check. For hbh
and rt, update the existing advertised-length checks. In all three
cases, set hotdrop to true before returning false when the advertised
extension header length exceeds the available skb data.
Returning false treats the packet as a rule mismatch. Set hotdrop to
true and drop malformed packets so they cannot bypass rules intended
to drop packets with these IPv6 extension headers.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Zhixing Chen <running910@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/netfilter/ip6t_ah.c | 5 +++++
net/ipv6/netfilter/ip6t_hbh.c | 1 +
net/ipv6/netfilter/ip6t_rt.c | 3 ++-
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 70da2f2ce064ca..1258783ed87629 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -56,6 +56,11 @@ static bool ah_mt6(const struct sk_buff *skb, struct xt_action_param *par)
}
hdrlen = ipv6_authlen(ah);
+ if (skb->len - ptr < hdrlen) {
+ /* Packet smaller than its length field */
+ par->hotdrop = true;
+ return false;
+ }
pr_debug("IPv6 AH LEN %u %u ", hdrlen, ah->hdrlen);
pr_debug("RES %04X ", ah->reserved);
diff --git a/net/ipv6/netfilter/ip6t_hbh.c b/net/ipv6/netfilter/ip6t_hbh.c
index 450dd53846a2f7..6d1a5d2026a678 100644
--- a/net/ipv6/netfilter/ip6t_hbh.c
+++ b/net/ipv6/netfilter/ip6t_hbh.c
@@ -75,6 +75,7 @@ hbh_mt6(const struct sk_buff *skb, struct xt_action_param *par)
hdrlen = ipv6_optlen(oh);
if (skb->len - ptr < hdrlen) {
/* Packet smaller than it's length field */
+ par->hotdrop = true;
return false;
}
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 5561bd9cea8185..278b52752f3645 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -56,7 +56,8 @@ static bool rt_mt6(const struct sk_buff *skb, struct xt_action_param *par)
hdrlen = ipv6_optlen(rh);
if (skb->len - ptr < hdrlen) {
- /* Pcket smaller than its length field */
+ /* Packet smaller than its length field */
+ par->hotdrop = true;
return false;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 396/699] qede: fix off-by-one in BD ring consumption on build_skb failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 395/699] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 397/699] net: qualcomm: rmnet: simplify some byte order logic Greg Kroah-Hartman
` (306 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shigeru Yoshida, Jamie Bainbridge,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <syoshida@redhat.com>
[ Upstream commit a0a558ca7e75b49e71f8c545c30e8c005e6e4e2f ]
qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
NULL return from qede_build_skb(). When it returns NULL under memory
pressure, the functions still consume a BD from the ring before
returning NULL. The callers then recycle additional BDs, resulting in
one extra BD being consumed (off-by-one). This desynchronizes the BD
ring, which can corrupt DMA page reference counts and lead to SLUB
freelist corruption.
Commit 4e910dbe3650 ("qede: confirm skb is allocated before using")
added a NULL check inside qede_build_skb() to prevent a NULL pointer
dereference, but did not address the missing NULL checks in the
callers, making this off-by-one reachable.
Fix this by adding NULL checks for the return value of
qede_build_skb() in both qede_rx_build_skb() and
qede_tpa_rx_build_skb(), returning NULL immediately before any BD ring
manipulation.
Fixes: 8a8633978b84 ("qede: Add build_skb() support.")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
Link: https://patch.msgid.link/20260630164623.3152625-1-syoshida@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qlogic/qede/qede_fp.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c
index a632de208a7dc6..02b866a49633c0 100644
--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
@@ -770,6 +770,9 @@ qede_tpa_rx_build_skb(struct qede_dev *edev,
struct sk_buff *skb;
skb = qede_build_skb(rxq, bd, len, pad);
+ if (unlikely(!skb))
+ return NULL;
+
bd->page_offset += rxq->rx_buf_seg_size;
if (bd->page_offset == PAGE_SIZE) {
@@ -817,6 +820,8 @@ qede_rx_build_skb(struct qede_dev *edev,
}
skb = qede_build_skb(rxq, bd, len, pad);
+ if (unlikely(!skb))
+ return NULL;
if (unlikely(qede_realloc_rx_buffer(rxq, bd))) {
/* Incr page ref count to reuse on allocation failure so
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 397/699] net: qualcomm: rmnet: simplify some byte order logic
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 396/699] qede: fix off-by-one in BD ring consumption on build_skb failure Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 398/699] net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros Greg Kroah-Hartman
` (305 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Elder, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <elder@linaro.org>
[ Upstream commit 50c62a111c4855510b0d8a2d8e50214172166b61 ]
In rmnet_map_ipv4_ul_csum_header() and rmnet_map_ipv6_ul_csum_header()
the offset within a packet at which checksumming should commence is
calculated. This calculation involves byte swapping and a forced type
conversion that makes it hard to understand.
Simplify this by computing the offset in host byte order, then
converting the result when assigning it into the header field.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f0f1887a9e30 ("net: qualcomm: rmnet: validate MAP frame length before ingress parsing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 21d38167f96180..0bfe69698b278f 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -197,12 +197,10 @@ rmnet_map_ipv4_ul_csum_header(void *iphdr,
struct rmnet_map_ul_csum_header *ul_header,
struct sk_buff *skb)
{
- struct iphdr *ip4h = (struct iphdr *)iphdr;
- __be16 *hdr = (__be16 *)ul_header, offset;
+ __be16 *hdr = (__be16 *)ul_header;
+ struct iphdr *ip4h = iphdr;
- offset = htons((__force u16)(skb_transport_header(skb) -
- (unsigned char *)iphdr));
- ul_header->csum_start_offset = offset;
+ ul_header->csum_start_offset = htons(skb_network_header_len(skb));
ul_header->csum_insert_offset = skb->csum_offset;
ul_header->csum_enabled = 1;
if (ip4h->protocol == IPPROTO_UDP)
@@ -239,12 +237,10 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
struct rmnet_map_ul_csum_header *ul_header,
struct sk_buff *skb)
{
- struct ipv6hdr *ip6h = (struct ipv6hdr *)ip6hdr;
- __be16 *hdr = (__be16 *)ul_header, offset;
+ __be16 *hdr = (__be16 *)ul_header;
+ struct ipv6hdr *ip6h = ip6hdr;
- offset = htons((__force u16)(skb_transport_header(skb) -
- (unsigned char *)ip6hdr));
- ul_header->csum_start_offset = offset;
+ ul_header->csum_start_offset = htons(skb_network_header_len(skb));
ul_header->csum_insert_offset = skb->csum_offset;
ul_header->csum_enabled = 1;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 398/699] net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 397/699] net: qualcomm: rmnet: simplify some byte order logic Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 399/699] net: qualcomm: rmnet: use masks instead of C bit-fields Greg Kroah-Hartman
` (304 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Elder, Bjorn Andersson,
Alexander Duyck, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <elder@linaro.org>
[ Upstream commit 9d131d044f89a808f947d49f1a1865815c610158 ]
The following macros, defined in "rmnet_map.h", assume a socket
buffer is provided as an argument without any real indication this
is the case.
RMNET_MAP_GET_MUX_ID()
RMNET_MAP_GET_CD_BIT()
RMNET_MAP_GET_PAD()
RMNET_MAP_GET_CMD_START()
RMNET_MAP_GET_LENGTH()
What they hide is pretty trivial accessing of fields in a structure,
and it's much clearer to see this if we do these accesses directly.
So rather than using these accessor macros, assign a local
variable of the map header pointer type to the socket buffer data
pointer, and derereference that pointer variable.
In "rmnet_map_data.c", use sizeof(object) rather than sizeof(type)
in one spot. Also, there's no need to byte swap 0; it's all zeros
irrespective of endianness.
Signed-off-by: Alex Elder <elder@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f0f1887a9e30 ("net: qualcomm: rmnet: validate MAP frame length before ingress parsing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 10 ++++++----
drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h | 12 ------------
.../net/ethernet/qualcomm/rmnet/rmnet_map_command.c | 11 ++++++++---
drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 4 ++--
4 files changed, 16 insertions(+), 21 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index 3d7d3ab383f85a..df924f7a1f4c72 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -56,20 +56,22 @@ static void
__rmnet_map_ingress_handler(struct sk_buff *skb,
struct rmnet_port *port)
{
+ struct rmnet_map_header *map_header = (void *)skb->data;
struct rmnet_endpoint *ep;
u16 len, pad;
u8 mux_id;
- if (RMNET_MAP_GET_CD_BIT(skb)) {
+ if (map_header->cd_bit) {
+ /* Packet contains a MAP command (not data) */
if (port->data_format & RMNET_FLAGS_INGRESS_MAP_COMMANDS)
return rmnet_map_command(skb, port);
goto free_skb;
}
- mux_id = RMNET_MAP_GET_MUX_ID(skb);
- pad = RMNET_MAP_GET_PAD(skb);
- len = RMNET_MAP_GET_LENGTH(skb) - pad;
+ mux_id = map_header->mux_id;
+ pad = map_header->pad_len;
+ len = ntohs(map_header->pkt_len) - pad;
if (mux_id >= RMNET_MAX_LOGICAL_EP)
goto free_skb;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
index 576501db2a0bcb..2aea153f42473a 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
@@ -32,18 +32,6 @@ enum rmnet_map_commands {
RMNET_MAP_COMMAND_ENUM_LENGTH
};
-#define RMNET_MAP_GET_MUX_ID(Y) (((struct rmnet_map_header *) \
- (Y)->data)->mux_id)
-#define RMNET_MAP_GET_CD_BIT(Y) (((struct rmnet_map_header *) \
- (Y)->data)->cd_bit)
-#define RMNET_MAP_GET_PAD(Y) (((struct rmnet_map_header *) \
- (Y)->data)->pad_len)
-#define RMNET_MAP_GET_CMD_START(Y) ((struct rmnet_map_control_command *) \
- ((Y)->data + \
- sizeof(struct rmnet_map_header)))
-#define RMNET_MAP_GET_LENGTH(Y) (ntohs(((struct rmnet_map_header *) \
- (Y)->data)->pkt_len))
-
#define RMNET_MAP_COMMAND_REQUEST 0
#define RMNET_MAP_COMMAND_ACK 1
#define RMNET_MAP_COMMAND_UNSUPPORTED 2
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
index beaee496212875..add0f5ade2e617 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
@@ -12,12 +12,13 @@ static u8 rmnet_map_do_flow_control(struct sk_buff *skb,
struct rmnet_port *port,
int enable)
{
+ struct rmnet_map_header *map_header = (void *)skb->data;
struct rmnet_endpoint *ep;
struct net_device *vnd;
u8 mux_id;
int r;
- mux_id = RMNET_MAP_GET_MUX_ID(skb);
+ mux_id = map_header->mux_id;
if (mux_id >= RMNET_MAX_LOGICAL_EP) {
kfree_skb(skb);
@@ -49,6 +50,7 @@ static void rmnet_map_send_ack(struct sk_buff *skb,
unsigned char type,
struct rmnet_port *port)
{
+ struct rmnet_map_header *map_header = (void *)skb->data;
struct rmnet_map_control_command *cmd;
struct net_device *dev = skb->dev;
@@ -58,7 +60,8 @@ static void rmnet_map_send_ack(struct sk_buff *skb,
skb->protocol = htons(ETH_P_MAP);
- cmd = RMNET_MAP_GET_CMD_START(skb);
+ /* Command data immediately follows the MAP header */
+ cmd = (struct rmnet_map_control_command *)(map_header + 1);
cmd->cmd_type = type & 0x03;
netif_tx_lock(dev);
@@ -71,11 +74,13 @@ static void rmnet_map_send_ack(struct sk_buff *skb,
*/
void rmnet_map_command(struct sk_buff *skb, struct rmnet_port *port)
{
+ struct rmnet_map_header *map_header = (void *)skb->data;
struct rmnet_map_control_command *cmd;
unsigned char command_name;
unsigned char rc = 0;
- cmd = RMNET_MAP_GET_CMD_START(skb);
+ /* Command data immediately follows the MAP header */
+ cmd = (struct rmnet_map_control_command *)(map_header + 1);
command_name = cmd->command_name;
switch (command_name) {
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 0bfe69698b278f..3af68368fc3155 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -315,7 +315,7 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
return NULL;
maph = (struct rmnet_map_header *)skb->data;
- packet_len = ntohs(maph->pkt_len) + sizeof(struct rmnet_map_header);
+ packet_len = ntohs(maph->pkt_len) + sizeof(*maph);
if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4)
packet_len += sizeof(struct rmnet_map_dl_csum_trailer);
@@ -324,7 +324,7 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
return NULL;
/* Some hardware can send us empty frames. Catch them */
- if (ntohs(maph->pkt_len) == 0)
+ if (!maph->pkt_len)
return NULL;
skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 399/699] net: qualcomm: rmnet: use masks instead of C bit-fields
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 398/699] net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 400/699] net: qualcomm: rmnet: dont use C bit-fields in rmnet checksum header Greg Kroah-Hartman
` (303 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Elder, Bjorn Andersson,
Alexander Duyck, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <elder@linaro.org>
[ Upstream commit 16653c16d282e768763b2e8cc78f75df8fd53992 ]
The actual layout of bits defined in C bit-fields (e.g. int foo : 3)
is implementation-defined. Structures defined in <linux/if_rmnet.h>
address this by specifying all bit-fields twice, to cover two
possible layouts.
I think this pattern is repetitive and noisy, and I find the whole
notion of compiler "bitfield endianness" to be non-intuitive.
Stop using C bit-fields for the command/data flag and the pad length
fields in the rmnet_map structure, and define a single-byte flags
field instead. Define a mask for the single-bit "command" flag,
and another mask for the encoded pad length. The content of both
fields can be accessed using a simple bitwise AND operation.
Signed-off-by: Alex Elder <elder@linaro.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f0f1887a9e30 ("net: qualcomm: rmnet: validate MAP frame length before ingress parsing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/qualcomm/rmnet/rmnet_handlers.c | 4 ++--
.../ethernet/qualcomm/rmnet/rmnet_map_data.c | 4 +++-
include/linux/if_rmnet.h | 23 ++++++++-----------
3 files changed, 15 insertions(+), 16 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index df924f7a1f4c72..1103f9e873b7d8 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -61,7 +61,7 @@ __rmnet_map_ingress_handler(struct sk_buff *skb,
u16 len, pad;
u8 mux_id;
- if (map_header->cd_bit) {
+ if (map_header->flags & MAP_CMD_FLAG) {
/* Packet contains a MAP command (not data) */
if (port->data_format & RMNET_FLAGS_INGRESS_MAP_COMMANDS)
return rmnet_map_command(skb, port);
@@ -70,7 +70,7 @@ __rmnet_map_ingress_handler(struct sk_buff *skb,
}
mux_id = map_header->mux_id;
- pad = map_header->pad_len;
+ pad = map_header->flags & MAP_PAD_LEN_MASK;
len = ntohs(map_header->pkt_len) - pad;
if (mux_id >= RMNET_MAX_LOGICAL_EP)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 3af68368fc3155..e7d0394cb29791 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -280,6 +280,7 @@ struct rmnet_map_header *rmnet_map_add_map_header(struct sk_buff *skb,
return map_header;
}
+ BUILD_BUG_ON(MAP_PAD_LEN_MASK < 3);
padding = ALIGN(map_datalen, 4) - map_datalen;
if (padding == 0)
@@ -293,7 +294,8 @@ struct rmnet_map_header *rmnet_map_add_map_header(struct sk_buff *skb,
done:
map_header->pkt_len = htons(map_datalen + padding);
- map_header->pad_len = padding & 0x3F;
+ /* This is a data packet, so the CMD bit is 0 */
+ map_header->flags = padding & MAP_PAD_LEN_MASK;
return map_header;
}
diff --git a/include/linux/if_rmnet.h b/include/linux/if_rmnet.h
index 9661416a9bb473..eb4099eae84b26 100644
--- a/include/linux/if_rmnet.h
+++ b/include/linux/if_rmnet.h
@@ -6,21 +6,18 @@
#define _LINUX_IF_RMNET_H_
struct rmnet_map_header {
-#if defined(__LITTLE_ENDIAN_BITFIELD)
- u8 pad_len:6;
- u8 reserved_bit:1;
- u8 cd_bit:1;
-#elif defined (__BIG_ENDIAN_BITFIELD)
- u8 cd_bit:1;
- u8 reserved_bit:1;
- u8 pad_len:6;
-#else
-#error "Please fix <asm/byteorder.h>"
-#endif
- u8 mux_id;
- __be16 pkt_len;
+ u8 flags; /* MAP_CMD_FLAG, MAP_PAD_LEN_MASK */
+ u8 mux_id;
+ __be16 pkt_len; /* Length of packet, including pad */
} __aligned(1);
+/* rmnet_map_header flags field:
+ * PAD_LEN: number of pad bytes following packet data
+ * CMD: 1 = packet contains a MAP command; 0 = packet contains data
+ */
+#define MAP_PAD_LEN_MASK GENMASK(5, 0)
+#define MAP_CMD_FLAG BIT(7)
+
struct rmnet_map_dl_csum_trailer {
u8 reserved1;
#if defined(__LITTLE_ENDIAN_BITFIELD)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 400/699] net: qualcomm: rmnet: dont use C bit-fields in rmnet checksum header
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 399/699] net: qualcomm: rmnet: use masks instead of C bit-fields Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 401/699] net: ethernet: rmnet: Support for ingress MAPv5 checksum offload Greg Kroah-Hartman
` (302 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Elder, Alexander Duyck,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Elder <elder@linaro.org>
[ Upstream commit 86ca860e12ec0feab7d721d3b05e60fb86613540 ]
Replace the use of C bit-fields in the rmnet_map_ul_csum_header
structure with a single two-byte (big endian) structure member,
and use masks to encode or get values within it. The content of
these fields can be accessed using simple bitwise AND and OR
operations on the (host byte order) value of the new structure
member.
Previously rmnet_map_ipv4_ul_csum_header() would update C bit-field
values in host byte order, then forcibly fix their byte order using
a combination of byte swap operations and types.
Instead, just compute the value that needs to go into the new
structure member and save it with a simple byte-order conversion.
Make similar simplifications in rmnet_map_ipv6_ul_csum_header().
Finally, in rmnet_map_checksum_uplink_packet() a set of assignments
zeroes every field in the upload checksum header. Replace that with
a single memset() operation.
Signed-off-by: Alex Elder <elder@linaro.org>
Reviewed-by: Alexander Duyck <alexanderduyck@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f0f1887a9e30 ("net: qualcomm: rmnet: validate MAP frame length before ingress parsing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/qualcomm/rmnet/rmnet_map_data.c | 38 +++++++------------
include/linux/if_rmnet.h | 21 +++++-----
2 files changed, 23 insertions(+), 36 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index e7d0394cb29791..4ee59034f8fb2b 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -197,20 +197,16 @@ rmnet_map_ipv4_ul_csum_header(void *iphdr,
struct rmnet_map_ul_csum_header *ul_header,
struct sk_buff *skb)
{
- __be16 *hdr = (__be16 *)ul_header;
struct iphdr *ip4h = iphdr;
+ u16 val;
- ul_header->csum_start_offset = htons(skb_network_header_len(skb));
- ul_header->csum_insert_offset = skb->csum_offset;
- ul_header->csum_enabled = 1;
+ val = MAP_CSUM_UL_ENABLED_FLAG;
if (ip4h->protocol == IPPROTO_UDP)
- ul_header->udp_ind = 1;
- else
- ul_header->udp_ind = 0;
+ val |= MAP_CSUM_UL_UDP_FLAG;
+ val |= skb->csum_offset & MAP_CSUM_UL_OFFSET_MASK;
- /* Changing remaining fields to network order */
- hdr++;
- *hdr = htons((__force u16)*hdr);
+ ul_header->csum_start_offset = htons(skb_network_header_len(skb));
+ ul_header->csum_info = htons(val);
skb->ip_summed = CHECKSUM_NONE;
@@ -237,21 +233,16 @@ rmnet_map_ipv6_ul_csum_header(void *ip6hdr,
struct rmnet_map_ul_csum_header *ul_header,
struct sk_buff *skb)
{
- __be16 *hdr = (__be16 *)ul_header;
struct ipv6hdr *ip6h = ip6hdr;
+ u16 val;
- ul_header->csum_start_offset = htons(skb_network_header_len(skb));
- ul_header->csum_insert_offset = skb->csum_offset;
- ul_header->csum_enabled = 1;
-
+ val = MAP_CSUM_UL_ENABLED_FLAG;
if (ip6h->nexthdr == IPPROTO_UDP)
- ul_header->udp_ind = 1;
- else
- ul_header->udp_ind = 0;
+ val |= MAP_CSUM_UL_UDP_FLAG;
+ val |= skb->csum_offset & MAP_CSUM_UL_OFFSET_MASK;
- /* Changing remaining fields to network order */
- hdr++;
- *hdr = htons((__force u16)*hdr);
+ ul_header->csum_start_offset = htons(skb_network_header_len(skb));
+ ul_header->csum_info = htons(val);
skb->ip_summed = CHECKSUM_NONE;
@@ -419,10 +410,7 @@ void rmnet_map_checksum_uplink_packet(struct sk_buff *skb,
}
sw_csum:
- ul_header->csum_start_offset = 0;
- ul_header->csum_insert_offset = 0;
- ul_header->csum_enabled = 0;
- ul_header->udp_ind = 0;
+ memset(ul_header, 0, sizeof(*ul_header));
priv->stats.csum_sw++;
}
diff --git a/include/linux/if_rmnet.h b/include/linux/if_rmnet.h
index eb4099eae84b26..484c1ccfd87d5f 100644
--- a/include/linux/if_rmnet.h
+++ b/include/linux/if_rmnet.h
@@ -36,17 +36,16 @@ struct rmnet_map_dl_csum_trailer {
struct rmnet_map_ul_csum_header {
__be16 csum_start_offset;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
- u16 csum_insert_offset:14;
- u16 udp_ind:1;
- u16 csum_enabled:1;
-#elif defined (__BIG_ENDIAN_BITFIELD)
- u16 csum_enabled:1;
- u16 udp_ind:1;
- u16 csum_insert_offset:14;
-#else
-#error "Please fix <asm/byteorder.h>"
-#endif
+ __be16 csum_info; /* MAP_CSUM_UL_* */
} __aligned(1);
+/* csum_info field:
+ * OFFSET: where (offset in bytes) to insert computed checksum
+ * UDP: 1 = UDP checksum (zero checkum means no checksum)
+ * ENABLED: 1 = checksum computation requested
+ */
+#define MAP_CSUM_UL_OFFSET_MASK GENMASK(13, 0)
+#define MAP_CSUM_UL_UDP_FLAG BIT(14)
+#define MAP_CSUM_UL_ENABLED_FLAG BIT(15)
+
#endif /* !(_LINUX_IF_RMNET_H_) */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 401/699] net: ethernet: rmnet: Support for ingress MAPv5 checksum offload
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 400/699] net: qualcomm: rmnet: dont use C bit-fields in rmnet checksum header Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 402/699] net: qualcomm: rmnet: add tx packets aggregation Greg Kroah-Hartman
` (301 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sharath Chandra Vurukala,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sharath Chandra Vurukala <sharathv@codeaurora.org>
[ Upstream commit e1d9a90a9bfdb0735062d3adb16b07314b4b7b01 ]
Adding support for processing of MAPv5 downlink packets.
It involves parsing the Mapv5 packet and checking the csum header
to know whether the hardware has validated the checksum and is
valid or not.
Based on the checksum valid bit the corresponding stats are
incremented and skb->ip_summed is marked either CHECKSUM_UNNECESSARY
or left as CHEKSUM_NONE to let network stack revalidate the checksum
and update the respective snmp stats.
Current MAPV1 header has been modified, the reserved field in the
Mapv1 header is now used for next header indication.
Signed-off-by: Sharath Chandra Vurukala <sharathv@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f0f1887a9e30 ("net: qualcomm: rmnet: validate MAP frame length before ingress parsing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/qualcomm/rmnet/rmnet_handlers.c | 17 ++++--
.../net/ethernet/qualcomm/rmnet/rmnet_map.h | 3 +-
.../ethernet/qualcomm/rmnet/rmnet_map_data.c | 57 ++++++++++++++++++-
include/linux/if_rmnet.h | 30 +++++++++-
include/uapi/linux/if_link.h | 1 +
5 files changed, 96 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index 1103f9e873b7d8..f50112f75d5077 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -1,5 +1,5 @@
// SPDX-License-Identifier: GPL-2.0-only
-/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2018, 2021, The Linux Foundation. All rights reserved.
*
* RMNET Data ingress/egress handler
*/
@@ -82,11 +82,16 @@ __rmnet_map_ingress_handler(struct sk_buff *skb,
skb->dev = ep->egress_dev;
- /* Subtract MAP header */
- skb_pull(skb, sizeof(struct rmnet_map_header));
- rmnet_set_skb_proto(skb);
-
- if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) {
+ if ((port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV5) &&
+ (map_header->flags & MAP_NEXT_HEADER_FLAG)) {
+ if (rmnet_map_process_next_hdr_packet(skb, len))
+ goto free_skb;
+ skb_pull(skb, sizeof(*map_header));
+ rmnet_set_skb_proto(skb);
+ } else if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) {
+ /* Subtract MAP header */
+ skb_pull(skb, sizeof(*map_header));
+ rmnet_set_skb_proto(skb);
if (!rmnet_map_checksum_downlink_packet(skb, len + pad))
skb->ip_summed = CHECKSUM_UNNECESSARY;
}
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
index 2aea153f42473a..1a399bfa07d254 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0-only */
-/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2018, 2021, The Linux Foundation. All rights reserved.
*/
#ifndef _RMNET_MAP_H_
@@ -48,5 +48,6 @@ void rmnet_map_command(struct sk_buff *skb, struct rmnet_port *port);
int rmnet_map_checksum_downlink_packet(struct sk_buff *skb, u16 len);
void rmnet_map_checksum_uplink_packet(struct sk_buff *skb,
struct net_device *orig_dev);
+int rmnet_map_process_next_hdr_packet(struct sk_buff *skb, u16 len);
#endif /* _RMNET_MAP_H_ */
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index 4ee59034f8fb2b..a8326f23736c2b 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -1,5 +1,5 @@
// SPDX-License-Identifier: GPL-2.0-only
-/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2018, 2021, The Linux Foundation. All rights reserved.
*
* RMNET Data MAP protocol
*/
@@ -8,6 +8,7 @@
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/ip6_checksum.h>
+#include <linux/bitfield.h>
#include "rmnet_config.h"
#include "rmnet_map.h"
#include "rmnet_private.h"
@@ -300,8 +301,11 @@ struct rmnet_map_header *rmnet_map_add_map_header(struct sk_buff *skb,
struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
struct rmnet_port *port)
{
+ struct rmnet_map_v5_csum_header *next_hdr = NULL;
struct rmnet_map_header *maph;
+ void *data = skb->data;
struct sk_buff *skbn;
+ u8 nexthdr_type;
u32 packet_len;
if (skb->len == 0)
@@ -310,8 +314,18 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
maph = (struct rmnet_map_header *)skb->data;
packet_len = ntohs(maph->pkt_len) + sizeof(*maph);
- if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4)
+ if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) {
packet_len += sizeof(struct rmnet_map_dl_csum_trailer);
+ } else if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV5) {
+ if (!(maph->flags & MAP_CMD_FLAG)) {
+ packet_len += sizeof(*next_hdr);
+ if (maph->flags & MAP_NEXT_HEADER_FLAG)
+ next_hdr = data + sizeof(*maph);
+ else
+ /* Mapv5 data pkt without csum hdr is invalid */
+ return NULL;
+ }
+ }
if (((int)skb->len - (int)packet_len) < 0)
return NULL;
@@ -320,6 +334,13 @@ struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
if (!maph->pkt_len)
return NULL;
+ if (next_hdr) {
+ nexthdr_type = u8_get_bits(next_hdr->header_info,
+ MAPV5_HDRINFO_HDR_TYPE_FMASK);
+ if (nexthdr_type != RMNET_MAP_HEADER_TYPE_CSUM_OFFLOAD)
+ return NULL;
+ }
+
skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);
if (!skbn)
return NULL;
@@ -414,3 +435,35 @@ void rmnet_map_checksum_uplink_packet(struct sk_buff *skb,
priv->stats.csum_sw++;
}
+
+/* Process a MAPv5 packet header */
+int rmnet_map_process_next_hdr_packet(struct sk_buff *skb,
+ u16 len)
+{
+ struct rmnet_priv *priv = netdev_priv(skb->dev);
+ struct rmnet_map_v5_csum_header *next_hdr;
+ u8 nexthdr_type;
+
+ next_hdr = (struct rmnet_map_v5_csum_header *)(skb->data +
+ sizeof(struct rmnet_map_header));
+
+ nexthdr_type = u8_get_bits(next_hdr->header_info,
+ MAPV5_HDRINFO_HDR_TYPE_FMASK);
+
+ if (nexthdr_type != RMNET_MAP_HEADER_TYPE_CSUM_OFFLOAD)
+ return -EINVAL;
+
+ if (unlikely(!(skb->dev->features & NETIF_F_RXCSUM))) {
+ priv->stats.csum_sw++;
+ } else if (next_hdr->csum_info & MAPV5_CSUMINFO_VALID_FLAG) {
+ priv->stats.csum_ok++;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ } else {
+ priv->stats.csum_valid_unset++;
+ }
+
+ /* Pull csum v5 header */
+ skb_pull(skb, sizeof(*next_hdr));
+
+ return 0;
+}
diff --git a/include/linux/if_rmnet.h b/include/linux/if_rmnet.h
index 484c1ccfd87d5f..b5ce32bda82613 100644
--- a/include/linux/if_rmnet.h
+++ b/include/linux/if_rmnet.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0-only
- * Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2019, 2021 The Linux Foundation. All rights reserved.
*/
#ifndef _LINUX_IF_RMNET_H_
@@ -12,10 +12,12 @@ struct rmnet_map_header {
} __aligned(1);
/* rmnet_map_header flags field:
- * PAD_LEN: number of pad bytes following packet data
- * CMD: 1 = packet contains a MAP command; 0 = packet contains data
+ * PAD_LEN: number of pad bytes following packet data
+ * CMD: 1 = packet contains a MAP command; 0 = packet contains data
+ * NEXT_HEADER: 1 = packet contains V5 CSUM header 0 = no V5 CSUM header
*/
#define MAP_PAD_LEN_MASK GENMASK(5, 0)
+#define MAP_NEXT_HEADER_FLAG BIT(6)
#define MAP_CMD_FLAG BIT(7)
struct rmnet_map_dl_csum_trailer {
@@ -48,4 +50,26 @@ struct rmnet_map_ul_csum_header {
#define MAP_CSUM_UL_UDP_FLAG BIT(14)
#define MAP_CSUM_UL_ENABLED_FLAG BIT(15)
+/* MAP CSUM headers */
+struct rmnet_map_v5_csum_header {
+ u8 header_info;
+ u8 csum_info;
+ __be16 reserved;
+} __aligned(1);
+
+/* v5 header_info field
+ * NEXT_HEADER: represents whether there is any next header
+ * HEADER_TYPE: represents the type of this header
+ *
+ * csum_info field
+ * CSUM_VALID_OR_REQ:
+ * 1 = for UL, checksum computation is requested.
+ * 1 = for DL, validated the checksum and has found it valid
+ */
+
+#define MAPV5_HDRINFO_NXT_HDR_FLAG BIT(0)
+#define MAPV5_HDRINFO_HDR_TYPE_FMASK GENMASK(7, 1)
+#define MAPV5_CSUMINFO_VALID_FLAG BIT(7)
+
+#define RMNET_MAP_HEADER_TYPE_CSUM_OFFLOAD 2
#endif /* !(_LINUX_IF_RMNET_H_) */
diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
index 33c3b684f6de46..c0190ac8a37093 100644
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -1232,6 +1232,7 @@ enum {
#define RMNET_FLAGS_INGRESS_MAP_COMMANDS (1U << 1)
#define RMNET_FLAGS_INGRESS_MAP_CKSUMV4 (1U << 2)
#define RMNET_FLAGS_EGRESS_MAP_CKSUMV4 (1U << 3)
+#define RMNET_FLAGS_INGRESS_MAP_CKSUMV5 (1U << 4)
enum {
IFLA_RMNET_UNSPEC,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 402/699] net: qualcomm: rmnet: add tx packets aggregation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 401/699] net: ethernet: rmnet: Support for ingress MAPv5 checksum offload Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 403/699] net: qualcomm: rmnet: validate MAP frame length before ingress parsing Greg Kroah-Hartman
` (300 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniele Palmas,
Subash Abhinov Kasiviswanathan, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <dnlplm@gmail.com>
[ Upstream commit 64b5d1f8f2d1b3f039cfb0dd8035892015543e58 ]
Add tx packets aggregation.
Bidirectional TCP throughput tests through iperf with low-cat
Thread-x based modems revelead performance issues both in tx
and rx.
The Windows driver does not show this issue: inspecting USB
packets revealed that the only notable change is the driver
enabling tx packets aggregation.
Tx packets aggregation is by default disabled and can be enabled
by increasing the value of ETHTOOL_A_COALESCE_TX_MAX_AGGR_FRAMES.
The maximum aggregated size is by default set to a reasonably low
value in order to support the majority of modems.
This implementation is based on patches available in Code Aurora
repositories (msm kernel) whose main authors are
Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Reviewed-by: Subash Abhinov Kasiviswanathan <quic_subashab@quicinc.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f0f1887a9e30 ("net: qualcomm: rmnet: validate MAP frame length before ingress parsing")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/qualcomm/rmnet/rmnet_config.c | 5 +
.../ethernet/qualcomm/rmnet/rmnet_config.h | 20 ++
.../ethernet/qualcomm/rmnet/rmnet_handlers.c | 18 +-
.../net/ethernet/qualcomm/rmnet/rmnet_map.h | 6 +
.../ethernet/qualcomm/rmnet/rmnet_map_data.c | 191 ++++++++++++++++++
.../net/ethernet/qualcomm/rmnet/rmnet_vnd.c | 9 +-
.../net/ethernet/qualcomm/rmnet/rmnet_vnd.h | 1 +
7 files changed, 246 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index c1b96bb3456333..0dc9c9ac9b0a9c 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -12,6 +12,7 @@
#include "rmnet_handlers.h"
#include "rmnet_vnd.h"
#include "rmnet_private.h"
+#include "rmnet_map.h"
/* Local Definitions and Declarations */
@@ -39,6 +40,8 @@ static int rmnet_unregister_real_device(struct net_device *real_dev)
if (port->nr_rmnet_devs)
return -EINVAL;
+ rmnet_map_tx_aggregate_exit(port);
+
netdev_rx_handler_unregister(real_dev);
kfree(port);
@@ -79,6 +82,8 @@ static int rmnet_register_real_device(struct net_device *real_dev,
for (entry = 0; entry < RMNET_MAX_LOGICAL_EP; entry++)
INIT_HLIST_HEAD(&port->muxed_ep[entry]);
+ rmnet_map_tx_aggregate_init(port);
+
netdev_dbg(real_dev, "registered with rmnet\n");
return 0;
}
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
index 0fd2c23e7ee09e..1bde80ea226393 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.h
@@ -5,6 +5,7 @@
*/
#include <linux/skbuff.h>
+#include <linux/time.h>
#include <net/gro_cells.h>
#ifndef _RMNET_CONFIG_H_
@@ -19,6 +20,12 @@ struct rmnet_endpoint {
struct rcu_head rcu;
};
+struct rmnet_egress_agg_params {
+ u32 bytes;
+ u32 count;
+ u64 time_nsec;
+};
+
/* One instance of this structure is instantiated for each real_dev associated
* with rmnet.
*/
@@ -30,6 +37,19 @@ struct rmnet_port {
struct hlist_head muxed_ep[RMNET_MAX_LOGICAL_EP];
struct net_device *bridge_ep;
struct net_device *rmnet_dev;
+
+ /* Egress aggregation information */
+ struct rmnet_egress_agg_params egress_agg_params;
+ /* Protect aggregation related elements */
+ spinlock_t agg_lock;
+ struct sk_buff *skbagg_head;
+ struct sk_buff *skbagg_tail;
+ int agg_state;
+ u8 agg_count;
+ struct timespec64 agg_time;
+ struct timespec64 agg_last;
+ struct hrtimer hrtimer;
+ struct work_struct agg_wq;
};
extern struct rtnl_link_ops rmnet_link_ops;
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index f50112f75d5077..9fec50a1969f14 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -158,8 +158,18 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
map_header->mux_id = mux_id;
- skb->protocol = htons(ETH_P_MAP);
+ if (READ_ONCE(port->egress_agg_params.count) > 1) {
+ unsigned int len;
+
+ len = rmnet_map_tx_aggregate(skb, port, orig_dev);
+ if (likely(len)) {
+ rmnet_vnd_tx_fixup_len(len, orig_dev);
+ return -EINPROGRESS;
+ }
+ return -ENOMEM;
+ }
+ skb->protocol = htons(ETH_P_MAP);
return 0;
}
@@ -224,6 +234,7 @@ void rmnet_egress_handler(struct sk_buff *skb)
struct rmnet_port *port;
struct rmnet_priv *priv;
u8 mux_id;
+ int err;
sk_pacing_shift_update(skb->sk, 8);
@@ -236,8 +247,11 @@ void rmnet_egress_handler(struct sk_buff *skb)
if (!port)
goto drop;
- if (rmnet_map_egress_handler(skb, port, mux_id, orig_dev))
+ err = rmnet_map_egress_handler(skb, port, mux_id, orig_dev);
+ if (err == -ENOMEM)
goto drop;
+ else if (err == -EINPROGRESS)
+ return;
rmnet_vnd_tx_fixup(skb, orig_dev);
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
index 1a399bfa07d254..7a2718b7e359db 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
@@ -49,5 +49,11 @@ int rmnet_map_checksum_downlink_packet(struct sk_buff *skb, u16 len);
void rmnet_map_checksum_uplink_packet(struct sk_buff *skb,
struct net_device *orig_dev);
int rmnet_map_process_next_hdr_packet(struct sk_buff *skb, u16 len);
+unsigned int rmnet_map_tx_aggregate(struct sk_buff *skb, struct rmnet_port *port,
+ struct net_device *orig_dev);
+void rmnet_map_tx_aggregate_init(struct rmnet_port *port);
+void rmnet_map_tx_aggregate_exit(struct rmnet_port *port);
+void rmnet_map_update_ul_agg_config(struct rmnet_port *port, u32 size,
+ u32 count, u32 time);
#endif /* _RMNET_MAP_H_ */
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index a8326f23736c2b..d82af25f51cc2e 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -12,6 +12,7 @@
#include "rmnet_config.h"
#include "rmnet_map.h"
#include "rmnet_private.h"
+#include "rmnet_vnd.h"
#define RMNET_MAP_DEAGGR_SPACING 64
#define RMNET_MAP_DEAGGR_HEADROOM (RMNET_MAP_DEAGGR_SPACING / 2)
@@ -467,3 +468,193 @@ int rmnet_map_process_next_hdr_packet(struct sk_buff *skb,
return 0;
}
+
+#define RMNET_AGG_BYPASS_TIME_NSEC 10000000L
+
+static void reset_aggr_params(struct rmnet_port *port)
+{
+ port->skbagg_head = NULL;
+ port->agg_count = 0;
+ port->agg_state = 0;
+ memset(&port->agg_time, 0, sizeof(struct timespec64));
+}
+
+static void rmnet_send_skb(struct rmnet_port *port, struct sk_buff *skb)
+{
+ if (skb_needs_linearize(skb, port->dev->features)) {
+ if (unlikely(__skb_linearize(skb))) {
+ struct rmnet_priv *priv;
+
+ priv = netdev_priv(port->rmnet_dev);
+ this_cpu_inc(priv->pcpu_stats->stats.tx_drops);
+ dev_kfree_skb_any(skb);
+ return;
+ }
+ }
+
+ dev_queue_xmit(skb);
+}
+
+static void rmnet_map_flush_tx_packet_work(struct work_struct *work)
+{
+ struct sk_buff *skb = NULL;
+ struct rmnet_port *port;
+
+ port = container_of(work, struct rmnet_port, agg_wq);
+
+ spin_lock_bh(&port->agg_lock);
+ if (likely(port->agg_state == -EINPROGRESS)) {
+ /* Buffer may have already been shipped out */
+ if (likely(port->skbagg_head)) {
+ skb = port->skbagg_head;
+ reset_aggr_params(port);
+ }
+ port->agg_state = 0;
+ }
+
+ spin_unlock_bh(&port->agg_lock);
+ if (skb)
+ rmnet_send_skb(port, skb);
+}
+
+static enum hrtimer_restart rmnet_map_flush_tx_packet_queue(struct hrtimer *t)
+{
+ struct rmnet_port *port;
+
+ port = container_of(t, struct rmnet_port, hrtimer);
+
+ schedule_work(&port->agg_wq);
+
+ return HRTIMER_NORESTART;
+}
+
+unsigned int rmnet_map_tx_aggregate(struct sk_buff *skb, struct rmnet_port *port,
+ struct net_device *orig_dev)
+{
+ struct timespec64 diff, last;
+ unsigned int len = skb->len;
+ struct sk_buff *agg_skb;
+ int size;
+
+ spin_lock_bh(&port->agg_lock);
+ memcpy(&last, &port->agg_last, sizeof(struct timespec64));
+ ktime_get_real_ts64(&port->agg_last);
+
+ if (!port->skbagg_head) {
+ /* Check to see if we should agg first. If the traffic is very
+ * sparse, don't aggregate.
+ */
+new_packet:
+ diff = timespec64_sub(port->agg_last, last);
+ size = port->egress_agg_params.bytes - skb->len;
+
+ if (size < 0) {
+ /* dropped */
+ spin_unlock_bh(&port->agg_lock);
+ return 0;
+ }
+
+ if (diff.tv_sec > 0 || diff.tv_nsec > RMNET_AGG_BYPASS_TIME_NSEC ||
+ size == 0)
+ goto no_aggr;
+
+ port->skbagg_head = skb_copy_expand(skb, 0, size, GFP_ATOMIC);
+ if (!port->skbagg_head)
+ goto no_aggr;
+
+ dev_kfree_skb_any(skb);
+ port->skbagg_head->protocol = htons(ETH_P_MAP);
+ port->agg_count = 1;
+ ktime_get_real_ts64(&port->agg_time);
+ skb_frag_list_init(port->skbagg_head);
+ goto schedule;
+ }
+ diff = timespec64_sub(port->agg_last, port->agg_time);
+ size = port->egress_agg_params.bytes - port->skbagg_head->len;
+
+ if (skb->len > size) {
+ agg_skb = port->skbagg_head;
+ reset_aggr_params(port);
+ spin_unlock_bh(&port->agg_lock);
+ hrtimer_cancel(&port->hrtimer);
+ rmnet_send_skb(port, agg_skb);
+ spin_lock_bh(&port->agg_lock);
+ goto new_packet;
+ }
+
+ if (skb_has_frag_list(port->skbagg_head))
+ port->skbagg_tail->next = skb;
+ else
+ skb_shinfo(port->skbagg_head)->frag_list = skb;
+
+ port->skbagg_head->len += skb->len;
+ port->skbagg_head->data_len += skb->len;
+ port->skbagg_head->truesize += skb->truesize;
+ port->skbagg_tail = skb;
+ port->agg_count++;
+
+ if (diff.tv_sec > 0 || diff.tv_nsec > port->egress_agg_params.time_nsec ||
+ port->agg_count >= port->egress_agg_params.count ||
+ port->skbagg_head->len == port->egress_agg_params.bytes) {
+ agg_skb = port->skbagg_head;
+ reset_aggr_params(port);
+ spin_unlock_bh(&port->agg_lock);
+ hrtimer_cancel(&port->hrtimer);
+ rmnet_send_skb(port, agg_skb);
+ return len;
+ }
+
+schedule:
+ if (!hrtimer_active(&port->hrtimer) && port->agg_state != -EINPROGRESS) {
+ port->agg_state = -EINPROGRESS;
+ hrtimer_start(&port->hrtimer,
+ ns_to_ktime(port->egress_agg_params.time_nsec),
+ HRTIMER_MODE_REL);
+ }
+ spin_unlock_bh(&port->agg_lock);
+
+ return len;
+
+no_aggr:
+ spin_unlock_bh(&port->agg_lock);
+ skb->protocol = htons(ETH_P_MAP);
+ dev_queue_xmit(skb);
+
+ return len;
+}
+
+void rmnet_map_update_ul_agg_config(struct rmnet_port *port, u32 size,
+ u32 count, u32 time)
+{
+ spin_lock_bh(&port->agg_lock);
+ port->egress_agg_params.bytes = size;
+ WRITE_ONCE(port->egress_agg_params.count, count);
+ port->egress_agg_params.time_nsec = time * NSEC_PER_USEC;
+ spin_unlock_bh(&port->agg_lock);
+}
+
+void rmnet_map_tx_aggregate_init(struct rmnet_port *port)
+{
+ hrtimer_init(&port->hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ port->hrtimer.function = rmnet_map_flush_tx_packet_queue;
+ spin_lock_init(&port->agg_lock);
+ rmnet_map_update_ul_agg_config(port, 4096, 1, 800);
+ INIT_WORK(&port->agg_wq, rmnet_map_flush_tx_packet_work);
+}
+
+void rmnet_map_tx_aggregate_exit(struct rmnet_port *port)
+{
+ hrtimer_cancel(&port->hrtimer);
+ cancel_work_sync(&port->agg_wq);
+
+ spin_lock_bh(&port->agg_lock);
+ if (port->agg_state == -EINPROGRESS) {
+ if (port->skbagg_head) {
+ dev_kfree_skb_any(port->skbagg_head);
+ reset_aggr_params(port);
+ }
+
+ port->agg_state = 0;
+ }
+ spin_unlock_bh(&port->agg_lock);
+}
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
index 2adcf24848a452..0b35dfe1e58e33 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.c
@@ -28,7 +28,7 @@ void rmnet_vnd_rx_fixup(struct sk_buff *skb, struct net_device *dev)
u64_stats_update_end(&pcpu_ptr->syncp);
}
-void rmnet_vnd_tx_fixup(struct sk_buff *skb, struct net_device *dev)
+void rmnet_vnd_tx_fixup_len(unsigned int len, struct net_device *dev)
{
struct rmnet_priv *priv = netdev_priv(dev);
struct rmnet_pcpu_stats *pcpu_ptr;
@@ -37,10 +37,15 @@ void rmnet_vnd_tx_fixup(struct sk_buff *skb, struct net_device *dev)
u64_stats_update_begin(&pcpu_ptr->syncp);
pcpu_ptr->stats.tx_pkts++;
- pcpu_ptr->stats.tx_bytes += skb->len;
+ pcpu_ptr->stats.tx_bytes += len;
u64_stats_update_end(&pcpu_ptr->syncp);
}
+void rmnet_vnd_tx_fixup(struct sk_buff *skb, struct net_device *dev)
+{
+ rmnet_vnd_tx_fixup_len(skb->len, dev);
+}
+
/* Network Device Operations */
static netdev_tx_t rmnet_vnd_start_xmit(struct sk_buff *skb,
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h
index dc3a4443ef0af1..c2b2baf86894e7 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_vnd.h
@@ -16,6 +16,7 @@ int rmnet_vnd_newlink(u8 id, struct net_device *rmnet_dev,
int rmnet_vnd_dellink(u8 id, struct rmnet_port *port,
struct rmnet_endpoint *ep);
void rmnet_vnd_rx_fixup(struct sk_buff *skb, struct net_device *dev);
+void rmnet_vnd_tx_fixup_len(unsigned int len, struct net_device *dev);
void rmnet_vnd_tx_fixup(struct sk_buff *skb, struct net_device *dev);
void rmnet_vnd_setup(struct net_device *dev);
int rmnet_vnd_validate_real_dev_mtu(struct net_device *real_dev);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 403/699] net: qualcomm: rmnet: validate MAP frame length before ingress parsing
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 402/699] net: qualcomm: rmnet: add tx packets aggregation Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 404/699] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket Greg Kroah-Hartman
` (299 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi,
Subash Abhinov Kasiviswanathan, Xiang Mei, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit f0f1887a9e30712a1df03e152dce6fb91344b1f3 ]
When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:
BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet
Read of size 1 at addr ffff88801118ed00 by task exploit/147
Call Trace:
...
rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)
__rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)
rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)
netif_receive_skb (net/core/dev.c:6460)
tun_get_user (drivers/net/tun.c:1955)
tun_chr_write_iter (drivers/net/tun.c:2001)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...
Factor that validation out of rmnet_map_deaggregate() into
rmnet_map_validate_packet_len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.
Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Suggested-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@oss.qualcomm.com>
Link: https://patch.msgid.link/20260630174110.2003121-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +-
.../net/ethernet/qualcomm/rmnet/rmnet_map.h | 1 +
.../ethernet/qualcomm/rmnet/rmnet_map_data.c | 72 ++++++++++---------
3 files changed, 45 insertions(+), 33 deletions(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
index 9fec50a1969f14..8e5be431acaeb4 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -125,7 +125,10 @@ rmnet_map_ingress_handler(struct sk_buff *skb,
consume_skb(skb);
} else {
- __rmnet_map_ingress_handler(skb, port);
+ if (rmnet_map_validate_packet_len(skb, port))
+ __rmnet_map_ingress_handler(skb, port);
+ else
+ kfree_skb(skb);
}
}
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
index 7a2718b7e359db..dbbec14dff5cf7 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
@@ -55,5 +55,6 @@ void rmnet_map_tx_aggregate_init(struct rmnet_port *port);
void rmnet_map_tx_aggregate_exit(struct rmnet_port *port);
void rmnet_map_update_ul_agg_config(struct rmnet_port *port, u32 size,
u32 count, u32 time);
+u32 rmnet_map_validate_packet_len(struct sk_buff *skb, struct rmnet_port *port);
#endif /* _RMNET_MAP_H_ */
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
index d82af25f51cc2e..a655bb8d5c57bc 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c
@@ -293,54 +293,62 @@ struct rmnet_map_header *rmnet_map_add_map_header(struct sk_buff *skb,
return map_header;
}
-/* Deaggregates a single packet
- * A whole new buffer is allocated for each portion of an aggregated frame.
- * Caller should keep calling deaggregate() on the source skb until 0 is
- * returned, indicating that there are no more packets to deaggregate. Caller
- * is responsible for freeing the original skb.
- */
-struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
- struct rmnet_port *port)
+u32 rmnet_map_validate_packet_len(struct sk_buff *skb, struct rmnet_port *port)
{
struct rmnet_map_v5_csum_header *next_hdr = NULL;
struct rmnet_map_header *maph;
void *data = skb->data;
- struct sk_buff *skbn;
- u8 nexthdr_type;
u32 packet_len;
- if (skb->len == 0)
- return NULL;
+ if (skb->len < sizeof(*maph))
+ return 0;
maph = (struct rmnet_map_header *)skb->data;
+
+ /* Some hardware can send us empty frames. Catch them */
+ if (!maph->pkt_len)
+ return 0;
+
packet_len = ntohs(maph->pkt_len) + sizeof(*maph);
if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) {
packet_len += sizeof(struct rmnet_map_dl_csum_trailer);
- } else if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV5) {
- if (!(maph->flags & MAP_CMD_FLAG)) {
- packet_len += sizeof(*next_hdr);
- if (maph->flags & MAP_NEXT_HEADER_FLAG)
- next_hdr = data + sizeof(*maph);
- else
- /* Mapv5 data pkt without csum hdr is invalid */
- return NULL;
- }
+ } else if ((port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV5) &&
+ !(maph->flags & MAP_CMD_FLAG)) {
+ /* Mapv5 data pkt without csum hdr is invalid */
+ if (!(maph->flags & MAP_NEXT_HEADER_FLAG))
+ return 0;
+
+ packet_len += sizeof(*next_hdr);
+ next_hdr = data + sizeof(*maph);
}
- if (((int)skb->len - (int)packet_len) < 0)
- return NULL;
+ if (skb->len < packet_len)
+ return 0;
- /* Some hardware can send us empty frames. Catch them */
- if (!maph->pkt_len)
- return NULL;
+ if (next_hdr &&
+ u8_get_bits(next_hdr->header_info, MAPV5_HDRINFO_HDR_TYPE_FMASK) !=
+ RMNET_MAP_HEADER_TYPE_CSUM_OFFLOAD)
+ return 0;
- if (next_hdr) {
- nexthdr_type = u8_get_bits(next_hdr->header_info,
- MAPV5_HDRINFO_HDR_TYPE_FMASK);
- if (nexthdr_type != RMNET_MAP_HEADER_TYPE_CSUM_OFFLOAD)
- return NULL;
- }
+ return packet_len;
+}
+
+/* Deaggregates a single packet
+ * A whole new buffer is allocated for each portion of an aggregated frame.
+ * Caller should keep calling deaggregate() on the source skb until 0 is
+ * returned, indicating that there are no more packets to deaggregate. Caller
+ * is responsible for freeing the original skb.
+ */
+struct sk_buff *rmnet_map_deaggregate(struct sk_buff *skb,
+ struct rmnet_port *port)
+{
+ struct sk_buff *skbn;
+ u32 packet_len;
+
+ packet_len = rmnet_map_validate_packet_len(skb, port);
+ if (!packet_len)
+ return NULL;
skbn = alloc_skb(packet_len + RMNET_MAP_DEAGGR_SPACING, GFP_ATOMIC);
if (!skbn)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 404/699] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 403/699] net: qualcomm: rmnet: validate MAP frame length before ingress parsing Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 405/699] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length Greg Kroah-Hartman
` (298 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
[ Upstream commit 9d160b35cc34a2ba8229d07651468a7848325135 ]
smc_cdc_rx_handler() looks up the connection by token under the link
group's conns_lock, drops the lock, and then dereferences conn and the
smc_sock derived from it, ending in sock_hold(&smc->sk) inside
smc_cdc_msg_recv(). No reference is held across the lock release.
The only reference pinning the socket while the connection is
discoverable in the link group is taken in smc_lgr_register_conn()
(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both
under conns_lock. Once the handler drops conns_lock, a concurrent
close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()
can drop that reference and free the smc_sock, so the handler's later
sock_hold() runs on freed memory:
WARNING: lib/refcount.c:25 at refcount_warn_saturate
Workqueue: rxe_wq do_work
refcount_warn_saturate (lib/refcount.c:25)
smc_cdc_msg_recv (net/smc/smc_cdc.c:430)
smc_cdc_rx_handler (net/smc/smc_cdc.c:502)
smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)
tasklet_action_common (kernel/softirq.c:938)
handle_softirqs (kernel/softirq.c:622)
Kernel panic - not syncing: panic_on_warn set
Only SMC-R is affected. The SMC-D receive tasklet is stopped by
tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection
is unregistered, so it cannot run concurrently with the free.
Take the socket reference while still holding conns_lock, so the
registration reference can no longer be the last one, and drop it once
the handler is done.
Fixes: d7b0e37c1ac1 ("net/smc: restructure CDC message reception")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Link: https://patch.msgid.link/20260630183227.2044998-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_cdc.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
diff --git a/net/smc/smc_cdc.c b/net/smc/smc_cdc.c
index b92b2cee2079c1..d96dfbd946233d 100644
--- a/net/smc/smc_cdc.c
+++ b/net/smc/smc_cdc.c
@@ -423,9 +423,9 @@ static void smc_cdc_rx_handler(struct ib_wc *wc, void *buf)
{
struct smc_link *link = (struct smc_link *)wc->qp->qp_context;
struct smc_cdc_msg *cdc = buf;
+ struct smc_sock *smc = NULL;
struct smc_connection *conn;
struct smc_link_group *lgr;
- struct smc_sock *smc;
if (wc->byte_len < offsetof(struct smc_cdc_msg, reserved))
return; /* short message */
@@ -436,21 +436,26 @@ static void smc_cdc_rx_handler(struct ib_wc *wc, void *buf)
lgr = smc_get_lgr(link);
read_lock_bh(&lgr->conns_lock);
conn = smc_lgr_find_conn(ntohl(cdc->token), lgr);
- read_unlock_bh(&lgr->conns_lock);
- if (!conn || conn->out_of_sync)
+ if (!conn || conn->out_of_sync) {
+ read_unlock_bh(&lgr->conns_lock);
return;
+ }
smc = container_of(conn, struct smc_sock, conn);
+ sock_hold(&smc->sk);
+ read_unlock_bh(&lgr->conns_lock);
if (cdc->prod_flags.failover_validation) {
smc_cdc_msg_validate(smc, cdc, link);
- return;
+ goto out;
}
if (smc_cdc_before(ntohs(cdc->seqno),
conn->local_rx_ctrl.seqno))
/* received seqno is old */
- return;
+ goto out;
smc_cdc_msg_recv(smc, cdc);
+out:
+ sock_put(&smc->sk);
}
static struct smc_wr_rx_handler smc_cdc_rx_handlers[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 405/699] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 404/699] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 406/699] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() Greg Kroah-Hartman
` (297 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit fd076d8deeab6f9f18ef13400f89e1f550df665b ]
slen contains ISO_SDU_Length (12 bits), RFU (2 bits),
Packet_Status_Flags (2 bits).
Exclude the RFU bits from hci_iso_data_len. Also add masks to the pack
macro.
Fixes: 4de0fc599eb9 ("Bluetooth: Add definitions for CIS connections")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index ede7a153c69a5f..02a27fb4a634a1 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -2538,8 +2538,9 @@ static inline struct hci_sco_hdr *hci_sco_hdr(const struct sk_buff *skb)
#define hci_iso_flags_pack(pb, ts) ((pb & 0x03) | ((ts & 0x01) << 2))
/* ISO data length and flags pack/unpack */
-#define hci_iso_data_len_pack(h, f) ((__u16) ((h) | ((f) << 14)))
-#define hci_iso_data_len(h) ((h) & 0x3fff)
+#define hci_iso_data_len_pack(h, f) ((__u16) (((h) & 0x0fff) | \
+ (((f) & 0x3) << 14)))
+#define hci_iso_data_len(h) ((h) & 0x0fff)
#define hci_iso_data_flags(h) ((h) >> 14)
/* le24 support */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 406/699] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 405/699] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 407/699] ring-buffer: Fix event length with forced 8-byte alignment Greg Kroah-Hartman
` (296 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
[ Upstream commit dd068ef044128db655f48323a4acfd5907e04903 ]
bpa10x_setup() sends the vendor command 0xfc0e and passes the response
to bt_dev_info() and hci_set_fw_info() as a "%s" string starting at
skb->data + 1, without checking the length:
bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
hci_set_fw_info(hdev, "%s", skb->data + 1);
A device that returns a one-byte response (status only) leaves
skb->data + 1 past the end of the data, and the %s walk reads adjacent
slab memory until it meets a NUL. The same happens when the payload is
not NUL-terminated within skb->len. The out-of-bounds bytes end up in
the kernel log and the firmware-info debugfs file.
Print the revision string with a bounded "%.*s" limited to skb->len - 1
instead. This keeps the string readable for well-behaved devices while
never reading past the received data, and does not fail setup, so a
device returning a short or unterminated response keeps working.
Fixes: ddd68ec8f484 ("Bluetooth: bpa10x: Read revision information in setup stage")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/bpa10x.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 1fa58c059cbf5c..8942ebd0d0b9f6 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -254,9 +254,13 @@ static int bpa10x_setup(struct hci_dev *hdev)
if (IS_ERR(skb))
return PTR_ERR(skb);
- bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
+ /* Bounded print: the device controls skb->len. */
+ if (skb->len > 1) {
+ int len = skb->len - 1;
- hci_set_fw_info(hdev, "%s", skb->data + 1);
+ bt_dev_info(hdev, "%.*s", len, (char *)(skb->data + 1));
+ hci_set_fw_info(hdev, "%.*s", len, skb->data + 1);
+ }
kfree_skb(skb);
return 0;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 407/699] ring-buffer: Fix event length with forced 8-byte alignment
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 406/699] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 408/699] net: usb: lan78xx: disable VLAN filter in promiscuous mode Greg Kroah-Hartman
` (295 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Wang, Masami Hiramatsu (Google),
Steven Rostedt, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
[ Upstream commit c37e0a4b79a6bbb96ce5ffe279d7c001e20529e0 ]
When RB_FORCE_8BYTE_ALIGNMENT is true, rb_calculate_event_length()
reserves the space of event->array[0] for placing the data length and
rb_update_event() stores the data length in event->array[0]
accordingly. As a result the whole event length will add extra 4 bytes
for sizeof(event.array[0]) unconditionally.
But ring_buffer_event_length() only subtracts the
sizeof(event->array[0]) for events larger than RB_MAX_SMALL_DATA +
sizeof(event->array[0]). As a result, small events on architectures
with RB_FORCE_8BYTE_ALIGNMENT=true report a data length that is 4
bytes larger than expected.
To fix it, add the RB_FORCE_8BYTE_ALIGNMENT as a condition to subtract
the size of that length field whenever RB_FORCE_8BYTE_ALIGNMENT is
true.
This issue is observed in a riscv64 kernel with
CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, when we run ftrace selftest
trace_marker_raw.tc, we get the weird log: for cases where the id is
1..100, the number of data field is 8*N, but once id exceeds 100, the
number of data field becomes 8*N+4:
# 1 buf: 58 00 00 00 80 5e d1 63 (number of data field is 8*1)
...
# a buf: 58 ... (number of data field is 8*2)
...
# 64 buf: 58 ... (number of data field is 8*13)
# 65 buf: 58 ... (number of data field is 8*13+4)
After applying this change, the number of data field keeps being 8*N+4
consistently.
Link: https://patch.msgid.link/20260607072431.125633-2-hui.wang@canonical.com
Fixes: 2271048d1b3b ("ring-buffer: Do 8 byte alignment for 64 bit that can not handle 4 byte align")
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 1089daa17b09e2..40b3332e0c12ab 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -246,7 +246,8 @@ unsigned ring_buffer_event_length(struct ring_buffer_event *event)
if (event->type_len > RINGBUF_TYPE_DATA_TYPE_LEN_MAX)
return length;
length -= RB_EVNT_HDR_SIZE;
- if (length > RB_MAX_SMALL_DATA + sizeof(event->array[0]))
+ if (length > RB_MAX_SMALL_DATA + sizeof(event->array[0]) ||
+ RB_FORCE_8BYTE_ALIGNMENT)
length -= sizeof(event->array[0]);
return length;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 408/699] net: usb: lan78xx: disable VLAN filter in promiscuous mode
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 407/699] ring-buffer: Fix event length with forced 8-byte alignment Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 409/699] net/sched: cake: reject overhead values that underflow length Greg Kroah-Hartman
` (294 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Enrico Pozzobon, Nicolai Buchwitz,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enrico Pozzobon <enrico.pozzobon@dissecto.com>
[ Upstream commit 60444706aa17616efc03190d099ac347e28b3d0a ]
The hardware VLAN filter (RFE_CTL_VLAN_FILTER_) drops VLAN-tagged frames
whose VID has not been registered via lan78xx_vlan_rx_add_vid(). It is
left enabled in promiscuous mode, so packet capture (e.g. tcpdump or
Wireshark) does not see tagged frames for unregistered VIDs.
Clear the filter while the interface is promiscuous and restore it from
NETIF_F_HW_VLAN_CTAG_FILTER otherwise. Enforce the same condition in
lan78xx_set_features() so netdev_update_features() cannot re-enable the
filter while promiscuous.
Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Signed-off-by: Enrico Pozzobon <enrico.pozzobon@dissecto.com>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Link: https://patch.msgid.link/20260701-lan78xx-vlan-promisc-v3-1-232266d32743@dissecto.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/lan78xx.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index af0622e9425849..1a76fccee9a8d7 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1092,6 +1092,17 @@ static void lan78xx_deferred_multicast_write(struct work_struct *param)
lan78xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl);
}
+static void lan78xx_update_vlan_filter(struct lan78xx_priv *pdata,
+ struct net_device *netdev,
+ netdev_features_t features)
+{
+ if ((features & NETIF_F_HW_VLAN_CTAG_FILTER) &&
+ !(netdev->flags & IFF_PROMISC))
+ pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
+ else
+ pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
+}
+
static void lan78xx_set_multicast(struct net_device *netdev)
{
struct lan78xx_net *dev = netdev_priv(netdev);
@@ -1126,6 +1137,8 @@ static void lan78xx_set_multicast(struct net_device *netdev)
}
}
+ lan78xx_update_vlan_filter(pdata, dev->net, dev->net->features);
+
if (netdev_mc_count(dev->net)) {
struct netdev_hw_addr *ha;
int i;
@@ -2397,10 +2410,7 @@ static int lan78xx_set_features(struct net_device *netdev,
else
pdata->rfe_ctl &= ~RFE_CTL_VLAN_STRIP_;
- if (features & NETIF_F_HW_VLAN_CTAG_FILTER)
- pdata->rfe_ctl |= RFE_CTL_VLAN_FILTER_;
- else
- pdata->rfe_ctl &= ~RFE_CTL_VLAN_FILTER_;
+ lan78xx_update_vlan_filter(pdata, netdev, features);
spin_unlock_irqrestore(&pdata->rfe_ctl_lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 409/699] net/sched: cake: reject overhead values that underflow length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 408/699] net: usb: lan78xx: disable VLAN filter in promiscuous mode Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 410/699] mld: convert from timer to delayed work Greg Kroah-Hartman
` (293 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius,
Toke Høiland-Jørgensen, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
[ Upstream commit b7f97cae7ec1b6c3c32843c42be218690d310467 ]
CAKE accepts signed overhead values and stores them in an s16, but the
adjusted packet length calculation uses unsigned arithmetic. A negative
effective length can therefore wrap to a large value.
Such configurations make rate accounting depend on integer wraparound
rather than on the packet size userspace intended to model. A static
netlink lower bound is not enough because packets reaching CAKE can be
smaller than any reasonable manual-overhead allowance.
Fold the signed overhead adjustment into the existing datapath MPU clamp
so negative adjusted lengths are clamped before link-layer framing
adjustments.
Fixes: a729b7f0bd5b ("sch_cake: Add overhead compensation support to the rate shaper")
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260702000758.297407.e5c888d9d99d.cake-overhead-underflow@trailofbits.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_cake.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c
index 2be03c8d13cb01..45b175e53aac03 100644
--- a/net/sched/sch_cake.c
+++ b/net/sched/sch_cake.c
@@ -1381,10 +1381,7 @@ static u32 cake_calc_overhead(struct cake_sched_data *q, u32 len, u32 off)
if (q->min_netlen > len)
q->min_netlen = len;
- len += q->rate_overhead;
-
- if (len < q->rate_mpu)
- len = q->rate_mpu;
+ len = max((s32)len + q->rate_overhead, (s32)q->rate_mpu);
if (q->atm_mode == CAKE_ATM_ATM) {
len += 47;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 410/699] mld: convert from timer to delayed work
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 409/699] net/sched: cake: reject overhead values that underflow length Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 411/699] mld: get rid of inet6_dev->mc_lock Greg Kroah-Hartman
` (292 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Taehee Yoo,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 2d9a93b4902be6a5504b5941dd15e9cd776aadca ]
mcast.c has several timers for delaying works.
Timer's expire handler is working under atomic context so it can't use
sleepable things such as GFP_KERNEL, mutex, etc.
In order to use sleepable APIs, it converts from timers to delayed work.
But there are some critical sections, which is used by both process
and BH context. So that it still uses spin_lock_bh() and rwlock.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/if_inet6.h | 8 +--
net/ipv6/mcast.c | 140 +++++++++++++++++++++++------------------
2 files changed, 83 insertions(+), 65 deletions(-)
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index d4d7f4d52b1524..0d2788bc65d28a 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -124,7 +124,7 @@ struct ifmcaddr6 {
unsigned int mca_sfmode;
unsigned char mca_crcount;
unsigned long mca_sfcount[2];
- struct timer_list mca_timer;
+ struct delayed_work mca_work;
unsigned int mca_flags;
int mca_users;
refcount_t mca_refcnt;
@@ -183,9 +183,9 @@ struct inet6_dev {
unsigned long mc_qri; /* Query Response Interval */
unsigned long mc_maxdelay;
- struct timer_list mc_gq_timer; /* general query timer */
- struct timer_list mc_ifc_timer; /* interface change timer */
- struct timer_list mc_dad_timer; /* dad complete mc timer */
+ struct delayed_work mc_gq_work; /* general query work */
+ struct delayed_work mc_ifc_work; /* interface change work */
+ struct delayed_work mc_dad_work; /* dad complete mc work */
struct ifacaddr6 *ac_list;
rwlock_t lock;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 9fb5077f8e9a7e..023ff680ee6044 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -29,7 +29,6 @@
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/jiffies.h>
-#include <linux/times.h>
#include <linux/net.h>
#include <linux/in.h>
#include <linux/in6.h>
@@ -42,6 +41,7 @@
#include <linux/slab.h>
#include <linux/pkt_sched.h>
#include <net/mld.h>
+#include <linux/workqueue.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
@@ -67,14 +67,13 @@ static int __mld2_query_bugs[] __attribute__((__unused__)) = {
BUILD_BUG_ON_ZERO(offsetof(struct mld2_grec, grec_mca) % 4)
};
+static struct workqueue_struct *mld_wq;
static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
static void igmp6_join_group(struct ifmcaddr6 *ma);
static void igmp6_leave_group(struct ifmcaddr6 *ma);
-static void igmp6_timer_handler(struct timer_list *t);
+static void mld_mca_work(struct work_struct *work);
-static void mld_gq_timer_expire(struct timer_list *t);
-static void mld_ifc_timer_expire(struct timer_list *t);
static void mld_ifc_event(struct inet6_dev *idev);
static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *pmc);
@@ -713,7 +712,7 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
igmp6_leave_group(mc);
spin_lock_bh(&mc->mca_lock);
- if (del_timer(&mc->mca_timer))
+ if (cancel_delayed_work(&mc->mca_work))
refcount_dec(&mc->mca_refcnt);
spin_unlock_bh(&mc->mca_lock);
}
@@ -854,7 +853,7 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
if (!mc)
return NULL;
- timer_setup(&mc->mca_timer, igmp6_timer_handler, 0);
+ INIT_DELAYED_WORK(&mc->mca_work, mld_mca_work);
mc->mca_addr = *addr;
mc->idev = idev; /* reference taken by caller */
@@ -1027,48 +1026,48 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
return rv;
}
-static void mld_gq_start_timer(struct inet6_dev *idev)
+static void mld_gq_start_work(struct inet6_dev *idev)
{
unsigned long tv = prandom_u32() % idev->mc_maxdelay;
idev->mc_gq_running = 1;
- if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2))
+ if (!mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
in6_dev_hold(idev);
}
-static void mld_gq_stop_timer(struct inet6_dev *idev)
+static void mld_gq_stop_work(struct inet6_dev *idev)
{
idev->mc_gq_running = 0;
- if (del_timer(&idev->mc_gq_timer))
+ if (cancel_delayed_work(&idev->mc_gq_work))
__in6_dev_put(idev);
}
-static void mld_ifc_start_timer(struct inet6_dev *idev, unsigned long delay)
+static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = prandom_u32() % delay;
- if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2))
+ if (!mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
in6_dev_hold(idev);
}
-static void mld_ifc_stop_timer(struct inet6_dev *idev)
+static void mld_ifc_stop_work(struct inet6_dev *idev)
{
idev->mc_ifc_count = 0;
- if (del_timer(&idev->mc_ifc_timer))
+ if (cancel_delayed_work(&idev->mc_ifc_work))
__in6_dev_put(idev);
}
-static void mld_dad_start_timer(struct inet6_dev *idev, unsigned long delay)
+static void mld_dad_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = prandom_u32() % delay;
- if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2))
+ if (!mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
in6_dev_hold(idev);
}
-static void mld_dad_stop_timer(struct inet6_dev *idev)
+static void mld_dad_stop_work(struct inet6_dev *idev)
{
- if (del_timer(&idev->mc_dad_timer))
+ if (cancel_delayed_work(&idev->mc_dad_work))
__in6_dev_put(idev);
}
@@ -1080,21 +1079,20 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
{
unsigned long delay = resptime;
- /* Do not start timer for these addresses */
+ /* Do not start work for these addresses */
if (ipv6_addr_is_ll_all_nodes(&ma->mca_addr) ||
IPV6_ADDR_MC_SCOPE(&ma->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
return;
- if (del_timer(&ma->mca_timer)) {
+ if (cancel_delayed_work(&ma->mca_work)) {
refcount_dec(&ma->mca_refcnt);
- delay = ma->mca_timer.expires - jiffies;
+ delay = ma->mca_work.timer.expires - jiffies;
}
if (delay >= resptime)
delay = prandom_u32() % resptime;
- ma->mca_timer.expires = jiffies + delay;
- if (!mod_timer(&ma->mca_timer, jiffies + delay))
+ if (!mod_delayed_work(mld_wq, &ma->mca_work, delay))
refcount_inc(&ma->mca_refcnt);
ma->mca_flags |= MAF_TIMER_RUNNING;
}
@@ -1305,10 +1303,10 @@ static int mld_process_v1(struct inet6_dev *idev, struct mld_msg *mld,
if (v1_query)
mld_set_v1_mode(idev);
- /* cancel MLDv2 report timer */
- mld_gq_stop_timer(idev);
- /* cancel the interface change timer */
- mld_ifc_stop_timer(idev);
+ /* cancel MLDv2 report work */
+ mld_gq_stop_work(idev);
+ /* cancel the interface change work */
+ mld_ifc_stop_work(idev);
/* clear deleted report items */
mld_clear_delrec(idev);
@@ -1398,7 +1396,7 @@ int igmp6_event_query(struct sk_buff *skb)
if (mlh2->mld2q_nsrcs)
return -EINVAL; /* no sources allowed */
- mld_gq_start_timer(idev);
+ mld_gq_start_work(idev);
return 0;
}
/* mark sources to include, if group & source-specific */
@@ -1482,14 +1480,14 @@ int igmp6_event_report(struct sk_buff *skb)
return -ENODEV;
/*
- * Cancel the timer for this group
+ * Cancel the work for this group
*/
read_lock_bh(&idev->lock);
for (ma = idev->mc_list; ma; ma = ma->next) {
if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
spin_lock(&ma->mca_lock);
- if (del_timer(&ma->mca_timer))
+ if (cancel_delayed_work(&ma->mca_work))
refcount_dec(&ma->mca_refcnt);
ma->mca_flags &= ~(MAF_LAST_REPORTER|MAF_TIMER_RUNNING);
spin_unlock(&ma->mca_lock);
@@ -2100,21 +2098,23 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev)
mld_send_initial_cr(idev);
idev->mc_dad_count--;
if (idev->mc_dad_count)
- mld_dad_start_timer(idev,
- unsolicited_report_interval(idev));
+ mld_dad_start_work(idev,
+ unsolicited_report_interval(idev));
}
}
-static void mld_dad_timer_expire(struct timer_list *t)
+static void mld_dad_work(struct work_struct *work)
{
- struct inet6_dev *idev = from_timer(idev, t, mc_dad_timer);
+ struct inet6_dev *idev = container_of(to_delayed_work(work),
+ struct inet6_dev,
+ mc_dad_work);
mld_send_initial_cr(idev);
if (idev->mc_dad_count) {
idev->mc_dad_count--;
if (idev->mc_dad_count)
- mld_dad_start_timer(idev,
- unsolicited_report_interval(idev));
+ mld_dad_start_work(idev,
+ unsolicited_report_interval(idev));
}
in6_dev_put(idev);
}
@@ -2413,12 +2413,12 @@ static void igmp6_join_group(struct ifmcaddr6 *ma)
delay = prandom_u32() % unsolicited_report_interval(ma->idev);
spin_lock_bh(&ma->mca_lock);
- if (del_timer(&ma->mca_timer)) {
+ if (cancel_delayed_work(&ma->mca_work)) {
refcount_dec(&ma->mca_refcnt);
- delay = ma->mca_timer.expires - jiffies;
+ delay = ma->mca_work.timer.expires - jiffies;
}
- if (!mod_timer(&ma->mca_timer, jiffies + delay))
+ if (!mod_delayed_work(mld_wq, &ma->mca_work, delay))
refcount_inc(&ma->mca_refcnt);
ma->mca_flags |= MAF_TIMER_RUNNING | MAF_LAST_REPORTER;
spin_unlock_bh(&ma->mca_lock);
@@ -2455,25 +2455,29 @@ static void igmp6_leave_group(struct ifmcaddr6 *ma)
}
}
-static void mld_gq_timer_expire(struct timer_list *t)
+static void mld_gq_work(struct work_struct *work)
{
- struct inet6_dev *idev = from_timer(idev, t, mc_gq_timer);
+ struct inet6_dev *idev = container_of(to_delayed_work(work),
+ struct inet6_dev,
+ mc_gq_work);
idev->mc_gq_running = 0;
mld_send_report(idev, NULL);
in6_dev_put(idev);
}
-static void mld_ifc_timer_expire(struct timer_list *t)
+static void mld_ifc_work(struct work_struct *work)
{
- struct inet6_dev *idev = from_timer(idev, t, mc_ifc_timer);
+ struct inet6_dev *idev = container_of(to_delayed_work(work),
+ struct inet6_dev,
+ mc_ifc_work);
mld_send_cr(idev);
if (idev->mc_ifc_count) {
idev->mc_ifc_count--;
if (idev->mc_ifc_count)
- mld_ifc_start_timer(idev,
- unsolicited_report_interval(idev));
+ mld_ifc_start_work(idev,
+ unsolicited_report_interval(idev));
}
in6_dev_put(idev);
}
@@ -2483,22 +2487,23 @@ static void mld_ifc_event(struct inet6_dev *idev)
if (mld_in_v1_mode(idev))
return;
idev->mc_ifc_count = idev->mc_qrv;
- mld_ifc_start_timer(idev, 1);
+ mld_ifc_start_work(idev, 1);
}
-static void igmp6_timer_handler(struct timer_list *t)
+static void mld_mca_work(struct work_struct *work)
{
- struct ifmcaddr6 *ma = from_timer(ma, t, mca_timer);
+ struct ifmcaddr6 *ma = container_of(to_delayed_work(work),
+ struct ifmcaddr6, mca_work);
if (mld_in_v1_mode(ma->idev))
igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
else
mld_send_report(ma->idev, ma);
- spin_lock(&ma->mca_lock);
+ spin_lock_bh(&ma->mca_lock);
ma->mca_flags |= MAF_LAST_REPORTER;
ma->mca_flags &= ~MAF_TIMER_RUNNING;
- spin_unlock(&ma->mca_lock);
+ spin_unlock_bh(&ma->mca_lock);
ma_put(ma);
}
@@ -2534,12 +2539,12 @@ void ipv6_mc_down(struct inet6_dev *idev)
for (i = idev->mc_list; i; i = i->next)
igmp6_group_dropped(i);
- /* Should stop timer after group drop. or we will
- * start timer again in mld_ifc_event()
+ /* Should stop work after group drop. or we will
+ * start work again in mld_ifc_event()
*/
- mld_ifc_stop_timer(idev);
- mld_gq_stop_timer(idev);
- mld_dad_stop_timer(idev);
+ mld_ifc_stop_work(idev);
+ mld_gq_stop_work(idev);
+ mld_dad_stop_work(idev);
read_unlock_bh(&idev->lock);
}
@@ -2576,11 +2581,11 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
write_lock_bh(&idev->lock);
spin_lock_init(&idev->mc_lock);
idev->mc_gq_running = 0;
- timer_setup(&idev->mc_gq_timer, mld_gq_timer_expire, 0);
+ INIT_DELAYED_WORK(&idev->mc_gq_work, mld_gq_work);
idev->mc_tomb = NULL;
idev->mc_ifc_count = 0;
- timer_setup(&idev->mc_ifc_timer, mld_ifc_timer_expire, 0);
- timer_setup(&idev->mc_dad_timer, mld_dad_timer_expire, 0);
+ INIT_DELAYED_WORK(&idev->mc_ifc_work, mld_ifc_work);
+ INIT_DELAYED_WORK(&idev->mc_dad_work, mld_dad_work);
ipv6_mc_reset(idev);
write_unlock_bh(&idev->lock);
}
@@ -2593,7 +2598,7 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
{
struct ifmcaddr6 *i;
- /* Deactivate timers */
+ /* Deactivate works */
ipv6_mc_down(idev);
mld_clear_delrec(idev);
@@ -2760,7 +2765,7 @@ static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
&im->mca_addr,
im->mca_users, im->mca_flags,
(im->mca_flags&MAF_TIMER_RUNNING) ?
- jiffies_to_clock_t(im->mca_timer.expires-jiffies) : 0);
+ jiffies_to_clock_t(im->mca_work.timer.expires - jiffies) : 0);
return 0;
}
@@ -2999,7 +3004,19 @@ static struct pernet_operations igmp6_net_ops = {
int __init igmp6_init(void)
{
- return register_pernet_subsys(&igmp6_net_ops);
+ int err;
+
+ err = register_pernet_subsys(&igmp6_net_ops);
+ if (err)
+ return err;
+
+ mld_wq = create_workqueue("mld");
+ if (!mld_wq) {
+ unregister_pernet_subsys(&igmp6_net_ops);
+ return -ENOMEM;
+ }
+
+ return err;
}
int __init igmp6_late_init(void)
@@ -3010,6 +3027,7 @@ int __init igmp6_late_init(void)
void igmp6_cleanup(void)
{
unregister_pernet_subsys(&igmp6_net_ops);
+ destroy_workqueue(mld_wq);
}
void igmp6_late_cleanup(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 411/699] mld: get rid of inet6_dev->mc_lock
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 410/699] mld: convert from timer to delayed work Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 412/699] mld: convert ipv6_mc_socklist->sflist to RCU Greg Kroah-Hartman
` (291 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Taehee Yoo,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit cf2ce339b401bc53ee131f0ce38bae32a949925e ]
The purpose of mc_lock is to protect inet6_dev->mc_tomb.
But mc_tomb is already protected by RTNL and all functions,
which manipulate mc_tomb are called under RTNL.
So, mc_lock is not needed.
Furthermore, it is spinlock so the critical section is atomic.
In order to reduce atomic context, it should be removed.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/if_inet6.h | 1 -
net/ipv6/mcast.c | 9 ---------
2 files changed, 10 deletions(-)
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 0d2788bc65d28a..6ae15539d09d9b 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -171,7 +171,6 @@ struct inet6_dev {
struct ifmcaddr6 *mc_list;
struct ifmcaddr6 *mc_tomb;
- spinlock_t mc_lock;
unsigned char mc_qrv; /* Query Robustness Variable */
unsigned char mc_gq_running;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 023ff680ee6044..f5e01bfdfc46a9 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -752,10 +752,8 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
}
spin_unlock_bh(&im->mca_lock);
- spin_lock_bh(&idev->mc_lock);
pmc->next = idev->mc_tomb;
idev->mc_tomb = pmc;
- spin_unlock_bh(&idev->mc_lock);
}
static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
@@ -764,7 +762,6 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
struct ip6_sf_list *psf;
struct in6_addr *pmca = &im->mca_addr;
- spin_lock_bh(&idev->mc_lock);
pmc_prev = NULL;
for (pmc = idev->mc_tomb; pmc; pmc = pmc->next) {
if (ipv6_addr_equal(&pmc->mca_addr, pmca))
@@ -777,7 +774,6 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
else
idev->mc_tomb = pmc->next;
}
- spin_unlock_bh(&idev->mc_lock);
spin_lock_bh(&im->mca_lock);
if (pmc) {
@@ -801,10 +797,8 @@ static void mld_clear_delrec(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *nextpmc;
- spin_lock_bh(&idev->mc_lock);
pmc = idev->mc_tomb;
idev->mc_tomb = NULL;
- spin_unlock_bh(&idev->mc_lock);
for (; pmc; pmc = nextpmc) {
nextpmc = pmc->next;
@@ -1904,7 +1898,6 @@ static void mld_send_cr(struct inet6_dev *idev)
int type, dtype;
read_lock_bh(&idev->lock);
- spin_lock(&idev->mc_lock);
/* deleted MCA's */
pmc_prev = NULL;
@@ -1938,7 +1931,6 @@ static void mld_send_cr(struct inet6_dev *idev)
} else
pmc_prev = pmc;
}
- spin_unlock(&idev->mc_lock);
/* change recs */
for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
@@ -2579,7 +2571,6 @@ void ipv6_mc_up(struct inet6_dev *idev)
void ipv6_mc_init_dev(struct inet6_dev *idev)
{
write_lock_bh(&idev->lock);
- spin_lock_init(&idev->mc_lock);
idev->mc_gq_running = 0;
INIT_DELAYED_WORK(&idev->mc_gq_work, mld_gq_work);
idev->mc_tomb = NULL;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 412/699] mld: convert ipv6_mc_socklist->sflist to RCU
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 411/699] mld: get rid of inet6_dev->mc_lock Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 413/699] mld: convert ip6_sf_list " Greg Kroah-Hartman
` (290 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Taehee Yoo,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 882ba1f73c06831f2a21044ebd8864c485ac04f2 ]
The sflist has been protected by rwlock so that the critical section
is atomic context.
In order to switch this context, changing locking is needed.
The sflist actually already protected by RTNL So if it's converted
to use RCU, its control path context can be switched to sleepable.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/if_inet6.h | 4 ++--
net/ipv6/mcast.c | 52 ++++++++++++++++++------------------------
2 files changed, 24 insertions(+), 32 deletions(-)
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 6ae15539d09d9b..f91e62cf126661 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -82,6 +82,7 @@ struct inet6_ifaddr {
struct ip6_sf_socklist {
unsigned int sl_max;
unsigned int sl_count;
+ struct rcu_head rcu;
struct in6_addr sl_addr[];
};
@@ -95,8 +96,7 @@ struct ipv6_mc_socklist {
int ifindex;
unsigned int sfmode; /* MCAST_{INCLUDE,EXCLUDE} */
struct ipv6_mc_socklist __rcu *next;
- rwlock_t sflock;
- struct ip6_sf_socklist *sflist;
+ struct ip6_sf_socklist __rcu *sflist;
struct rcu_head rcu;
};
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f5e01bfdfc46a9..2a08c1e1ebc5f6 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -178,8 +178,7 @@ static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
mc_lst->ifindex = dev->ifindex;
mc_lst->sfmode = mode;
- rwlock_init(&mc_lst->sflock);
- mc_lst->sflist = NULL;
+ RCU_INIT_POINTER(mc_lst->sflist, NULL);
/*
* now add/increase the group membership on the device
@@ -335,7 +334,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
struct net *net = sock_net(sk);
int i, j, rv;
int leavegroup = 0;
- int pmclocked = 0;
int err;
source = &((struct sockaddr_in6 *)&pgsr->gsr_source)->sin6_addr;
@@ -364,7 +362,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
goto done;
}
/* if a source filter was set, must be the same mode as before */
- if (pmc->sflist) {
+ if (rcu_access_pointer(pmc->sflist)) {
if (pmc->sfmode != omode) {
err = -EINVAL;
goto done;
@@ -376,10 +374,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
pmc->sfmode = omode;
}
- write_lock(&pmc->sflock);
- pmclocked = 1;
-
- psl = pmc->sflist;
+ psl = rtnl_dereference(pmc->sflist);
if (!add) {
if (!psl)
goto done; /* err = -EADDRNOTAVAIL */
@@ -429,9 +424,11 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
if (psl) {
for (i = 0; i < psl->sl_count; i++)
newpsl->sl_addr[i] = psl->sl_addr[i];
- sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
+ atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+ kfree_rcu(psl, rcu);
}
- pmc->sflist = psl = newpsl;
+ psl = newpsl;
+ rcu_assign_pointer(pmc->sflist, psl);
}
rv = 1; /* > 0 for insert logic below if sl_count is 0 */
for (i = 0; i < psl->sl_count; i++) {
@@ -447,8 +444,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
/* update the interface list */
ip6_mc_add_src(idev, group, omode, 1, source, 1);
done:
- if (pmclocked)
- write_unlock(&pmc->sflock);
read_unlock_bh(&idev->lock);
rcu_read_unlock();
if (leavegroup)
@@ -526,17 +521,16 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
(void) ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
}
- write_lock(&pmc->sflock);
- psl = pmc->sflist;
+ psl = rtnl_dereference(pmc->sflist);
if (psl) {
(void) ip6_mc_del_src(idev, group, pmc->sfmode,
psl->sl_count, psl->sl_addr, 0);
- sock_kfree_s(sk, psl, IP6_SFLSIZE(psl->sl_max));
+ atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+ kfree_rcu(psl, rcu);
} else
(void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
- pmc->sflist = newpsl;
+ rcu_assign_pointer(pmc->sflist, newpsl);
pmc->sfmode = gsf->gf_fmode;
- write_unlock(&pmc->sflock);
err = 0;
done:
read_unlock_bh(&idev->lock);
@@ -585,16 +579,14 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
if (!pmc) /* must have a prior join */
goto done;
gsf->gf_fmode = pmc->sfmode;
- psl = pmc->sflist;
+ psl = rtnl_dereference(pmc->sflist);
count = psl ? psl->sl_count : 0;
read_unlock_bh(&idev->lock);
rcu_read_unlock();
copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
gsf->gf_numsrc = count;
- /* changes to psl require the socket lock, and a write lock
- * on pmc->sflock. We have the socket lock so reading here is safe.
- */
+
for (i = 0; i < copycount; i++, p++) {
struct sockaddr_in6 *psin6;
struct sockaddr_storage ss;
@@ -630,8 +622,7 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
rcu_read_unlock();
return np->mc_all;
}
- read_lock(&mc->sflock);
- psl = mc->sflist;
+ psl = rcu_dereference(mc->sflist);
if (!psl) {
rv = mc->sfmode == MCAST_EXCLUDE;
} else {
@@ -646,7 +637,6 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
if (mc->sfmode == MCAST_EXCLUDE && i < psl->sl_count)
rv = false;
}
- read_unlock(&mc->sflock);
rcu_read_unlock();
return rv;
@@ -2419,19 +2409,21 @@ static void igmp6_join_group(struct ifmcaddr6 *ma)
static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
struct inet6_dev *idev)
{
+ struct ip6_sf_socklist *psl;
int err;
- write_lock_bh(&iml->sflock);
- if (!iml->sflist) {
+ psl = rtnl_dereference(iml->sflist);
+
+ if (!psl) {
/* any-source empty exclude case */
err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
} else {
err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
- iml->sflist->sl_count, iml->sflist->sl_addr, 0);
- sock_kfree_s(sk, iml->sflist, IP6_SFLSIZE(iml->sflist->sl_max));
- iml->sflist = NULL;
+ psl->sl_count, psl->sl_addr, 0);
+ RCU_INIT_POINTER(iml->sflist, NULL);
+ atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
+ kfree_rcu(psl, rcu);
}
- write_unlock_bh(&iml->sflock);
return err;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 413/699] mld: convert ip6_sf_list to RCU
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 412/699] mld: convert ipv6_mc_socklist->sflist to RCU Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 414/699] mld: convert ifmcaddr6 " Greg Kroah-Hartman
` (289 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Taehee Yoo,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 4b200e398953c237c86d32bf26d4cb2a96556a6f ]
The ip6_sf_list has been protected by mca_lock(spin_lock) so that the
critical section is atomic context. In order to switch this context,
changing locking is needed. The ip6_sf_list actually already protected
by RTNL So if it's converted to use RCU, its control path context can
be switched to sleepable.
But It doesn't remove mca_lock yet because ifmcaddr6 isn't converted
to RCU yet. So, It's not fully converted to the sleepable context.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/if_inet6.h | 7 +-
net/ipv6/mcast.c | 200 ++++++++++++++++++++++++++---------------
2 files changed, 130 insertions(+), 77 deletions(-)
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index f91e62cf126661..7da80ee6c20738 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -101,12 +101,13 @@ struct ipv6_mc_socklist {
};
struct ip6_sf_list {
- struct ip6_sf_list *sf_next;
+ struct ip6_sf_list __rcu *sf_next;
struct in6_addr sf_addr;
unsigned long sf_count[2]; /* include/exclude counts */
unsigned char sf_gsresp; /* include in g & s response? */
unsigned char sf_oldin; /* change state */
unsigned char sf_crcount; /* retrans. left to send */
+ struct rcu_head rcu;
};
#define MAF_TIMER_RUNNING 0x01
@@ -119,8 +120,8 @@ struct ifmcaddr6 {
struct in6_addr mca_addr;
struct inet6_dev *idev;
struct ifmcaddr6 *next;
- struct ip6_sf_list *mca_sources;
- struct ip6_sf_list *mca_tomb;
+ struct ip6_sf_list __rcu *mca_sources;
+ struct ip6_sf_list __rcu *mca_tomb;
unsigned int mca_sfmode;
unsigned char mca_crcount;
unsigned long mca_sfcount[2];
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 2a08c1e1ebc5f6..563020749d10d0 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -113,10 +113,25 @@ int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
*/
#define for_each_pmc_rcu(np, pmc) \
- for (pmc = rcu_dereference(np->ipv6_mc_list); \
- pmc != NULL; \
+ for (pmc = rcu_dereference((np)->ipv6_mc_list); \
+ pmc; \
pmc = rcu_dereference(pmc->next))
+#define for_each_psf_rtnl(mc, psf) \
+ for (psf = rtnl_dereference((mc)->mca_sources); \
+ psf; \
+ psf = rtnl_dereference(psf->sf_next))
+
+#define for_each_psf_rcu(mc, psf) \
+ for (psf = rcu_dereference((mc)->mca_sources); \
+ psf; \
+ psf = rcu_dereference(psf->sf_next))
+
+#define for_each_psf_tomb(mc, psf) \
+ for (psf = rtnl_dereference((mc)->mca_tomb); \
+ psf; \
+ psf = rtnl_dereference(psf->sf_next))
+
static int unsolicited_report_interval(struct inet6_dev *idev)
{
int iv;
@@ -734,10 +749,14 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
if (pmc->mca_sfmode == MCAST_INCLUDE) {
struct ip6_sf_list *psf;
- pmc->mca_tomb = im->mca_tomb;
- pmc->mca_sources = im->mca_sources;
- im->mca_tomb = im->mca_sources = NULL;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
+ rcu_assign_pointer(pmc->mca_tomb,
+ rtnl_dereference(im->mca_tomb));
+ rcu_assign_pointer(pmc->mca_sources,
+ rtnl_dereference(im->mca_sources));
+ RCU_INIT_POINTER(im->mca_tomb, NULL);
+ RCU_INIT_POINTER(im->mca_sources, NULL);
+
+ for_each_psf_rtnl(pmc, psf)
psf->sf_crcount = pmc->mca_crcount;
}
spin_unlock_bh(&im->mca_lock);
@@ -748,9 +767,9 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
{
- struct ifmcaddr6 *pmc, *pmc_prev;
- struct ip6_sf_list *psf;
+ struct ip6_sf_list *psf, *sources, *tomb;
struct in6_addr *pmca = &im->mca_addr;
+ struct ifmcaddr6 *pmc, *pmc_prev;
pmc_prev = NULL;
for (pmc = idev->mc_tomb; pmc; pmc = pmc->next) {
@@ -769,9 +788,16 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
if (pmc) {
im->idev = pmc->idev;
if (im->mca_sfmode == MCAST_INCLUDE) {
- swap(im->mca_tomb, pmc->mca_tomb);
- swap(im->mca_sources, pmc->mca_sources);
- for (psf = im->mca_sources; psf; psf = psf->sf_next)
+ tomb = rcu_replace_pointer(im->mca_tomb,
+ rtnl_dereference(pmc->mca_tomb),
+ lockdep_rtnl_is_held());
+ rcu_assign_pointer(pmc->mca_tomb, tomb);
+
+ sources = rcu_replace_pointer(im->mca_sources,
+ rtnl_dereference(pmc->mca_sources),
+ lockdep_rtnl_is_held());
+ rcu_assign_pointer(pmc->mca_sources, sources);
+ for_each_psf_rtnl(im, psf)
psf->sf_crcount = idev->mc_qrv;
} else {
im->mca_crcount = idev->mc_qrv;
@@ -803,12 +829,12 @@ static void mld_clear_delrec(struct inet6_dev *idev)
struct ip6_sf_list *psf, *psf_next;
spin_lock_bh(&pmc->mca_lock);
- psf = pmc->mca_tomb;
- pmc->mca_tomb = NULL;
+ psf = rtnl_dereference(pmc->mca_tomb);
+ RCU_INIT_POINTER(pmc->mca_tomb, NULL);
spin_unlock_bh(&pmc->mca_lock);
for (; psf; psf = psf_next) {
- psf_next = psf->sf_next;
- kfree(psf);
+ psf_next = rtnl_dereference(psf->sf_next);
+ kfree_rcu(psf, rcu);
}
}
read_unlock_bh(&idev->lock);
@@ -990,7 +1016,7 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
struct ip6_sf_list *psf;
spin_lock_bh(&mc->mca_lock);
- for (psf = mc->mca_sources; psf; psf = psf->sf_next) {
+ for_each_psf_rcu(mc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, src_addr))
break;
}
@@ -1089,7 +1115,7 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
int i, scount;
scount = 0;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
+ for_each_psf_rcu(pmc, psf) {
if (scount == nsrcs)
break;
for (i = 0; i < nsrcs; i++) {
@@ -1122,7 +1148,7 @@ static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
/* mark INCLUDE-mode sources */
scount = 0;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
+ for_each_psf_rcu(pmc, psf) {
if (scount == nsrcs)
break;
for (i = 0; i < nsrcs; i++) {
@@ -1532,7 +1558,7 @@ mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
struct ip6_sf_list *psf;
int scount = 0;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
+ for_each_psf_rtnl(pmc, psf) {
if (!is_in(pmc, psf, type, gdeleted, sdeleted))
continue;
scount++;
@@ -1704,14 +1730,16 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
#define AVAILABLE(skb) ((skb) ? skb_availroom(skb) : 0)
static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
- int type, int gdeleted, int sdeleted, int crsend)
+ int type, int gdeleted, int sdeleted,
+ int crsend)
{
+ struct ip6_sf_list *psf, *psf_prev, *psf_next;
+ int scount, stotal, first, isquery, truncate;
+ struct ip6_sf_list __rcu **psf_list;
struct inet6_dev *idev = pmc->idev;
struct net_device *dev = idev->dev;
- struct mld2_report *pmr;
struct mld2_grec *pgr = NULL;
- struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
- int scount, stotal, first, isquery, truncate;
+ struct mld2_report *pmr;
unsigned int mtu;
if (pmc->mca_flags & MAF_NOREPORT)
@@ -1730,7 +1758,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
psf_list = sdeleted ? &pmc->mca_tomb : &pmc->mca_sources;
- if (!*psf_list)
+ if (!rcu_access_pointer(*psf_list))
goto empty_source;
pmr = skb ? (struct mld2_report *)skb_transport_header(skb) : NULL;
@@ -1746,10 +1774,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
}
first = 1;
psf_prev = NULL;
- for (psf = *psf_list; psf; psf = psf_next) {
+ for (psf = rtnl_dereference(*psf_list);
+ psf;
+ psf = psf_next) {
struct in6_addr *psrc;
- psf_next = psf->sf_next;
+ psf_next = rtnl_dereference(psf->sf_next);
if (!is_in(pmc, psf, type, gdeleted, sdeleted) && !crsend) {
psf_prev = psf;
@@ -1796,10 +1826,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
psf->sf_crcount--;
if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
if (psf_prev)
- psf_prev->sf_next = psf->sf_next;
+ rcu_assign_pointer(psf_prev->sf_next,
+ rtnl_dereference(psf->sf_next));
else
- *psf_list = psf->sf_next;
- kfree(psf);
+ rcu_assign_pointer(*psf_list,
+ rtnl_dereference(psf->sf_next));
+ kfree_rcu(psf, rcu);
continue;
}
}
@@ -1863,21 +1895,26 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
/*
* remove zero-count source records from a source filter list
*/
-static void mld_clear_zeros(struct ip6_sf_list **ppsf)
+static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf)
{
struct ip6_sf_list *psf_prev, *psf_next, *psf;
psf_prev = NULL;
- for (psf = *ppsf; psf; psf = psf_next) {
- psf_next = psf->sf_next;
+ for (psf = rtnl_dereference(*ppsf);
+ psf;
+ psf = psf_next) {
+ psf_next = rtnl_dereference(psf->sf_next);
if (psf->sf_crcount == 0) {
if (psf_prev)
- psf_prev->sf_next = psf->sf_next;
+ rcu_assign_pointer(psf_prev->sf_next,
+ rtnl_dereference(psf->sf_next));
else
- *ppsf = psf->sf_next;
- kfree(psf);
- } else
+ rcu_assign_pointer(*ppsf,
+ rtnl_dereference(psf->sf_next));
+ kfree_rcu(psf, rcu);
+ } else {
psf_prev = psf;
+ }
}
}
@@ -1910,8 +1947,9 @@ static void mld_send_cr(struct inet6_dev *idev)
mld_clear_zeros(&pmc->mca_sources);
}
}
- if (pmc->mca_crcount == 0 && !pmc->mca_tomb &&
- !pmc->mca_sources) {
+ if (pmc->mca_crcount == 0 &&
+ !rcu_access_pointer(pmc->mca_tomb) &&
+ !rcu_access_pointer(pmc->mca_sources)) {
if (pmc_prev)
pmc_prev->next = pmc_next;
else
@@ -2108,7 +2146,7 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
int rv = 0;
psf_prev = NULL;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
+ for_each_psf_rtnl(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
break;
psf_prev = psf;
@@ -2123,17 +2161,22 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
/* no more filters for this source */
if (psf_prev)
- psf_prev->sf_next = psf->sf_next;
+ rcu_assign_pointer(psf_prev->sf_next,
+ rtnl_dereference(psf->sf_next));
else
- pmc->mca_sources = psf->sf_next;
+ rcu_assign_pointer(pmc->mca_sources,
+ rtnl_dereference(psf->sf_next));
+
if (psf->sf_oldin && !(pmc->mca_flags & MAF_NOREPORT) &&
!mld_in_v1_mode(idev)) {
psf->sf_crcount = idev->mc_qrv;
- psf->sf_next = pmc->mca_tomb;
- pmc->mca_tomb = psf;
+ rcu_assign_pointer(psf->sf_next,
+ rtnl_dereference(pmc->mca_tomb));
+ rcu_assign_pointer(pmc->mca_tomb, psf);
rv = 1;
- } else
- kfree(psf);
+ } else {
+ kfree_rcu(psf, rcu);
+ }
}
return rv;
}
@@ -2185,7 +2228,7 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
pmc->mca_sfmode = MCAST_INCLUDE;
pmc->mca_crcount = idev->mc_qrv;
idev->mc_ifc_count = pmc->mca_crcount;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
+ for_each_psf_rtnl(pmc, psf)
psf->sf_crcount = 0;
mld_ifc_event(pmc->idev);
} else if (sf_setstate(pmc) || changerec)
@@ -2204,7 +2247,7 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
struct ip6_sf_list *psf, *psf_prev;
psf_prev = NULL;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
+ for_each_psf_rtnl(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
break;
psf_prev = psf;
@@ -2216,9 +2259,10 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
psf->sf_addr = *psfsrc;
if (psf_prev) {
- psf_prev->sf_next = psf;
- } else
- pmc->mca_sources = psf;
+ rcu_assign_pointer(psf_prev->sf_next, psf);
+ } else {
+ rcu_assign_pointer(pmc->mca_sources, psf);
+ }
}
psf->sf_count[sfmode]++;
return 0;
@@ -2229,13 +2273,15 @@ static void sf_markstate(struct ifmcaddr6 *pmc)
struct ip6_sf_list *psf;
int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
+ for_each_psf_rtnl(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
psf->sf_oldin = mca_xcount ==
psf->sf_count[MCAST_EXCLUDE] &&
!psf->sf_count[MCAST_INCLUDE];
- } else
+ } else {
psf->sf_oldin = psf->sf_count[MCAST_INCLUDE] != 0;
+ }
+ }
}
static int sf_setstate(struct ifmcaddr6 *pmc)
@@ -2246,7 +2292,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
int new_in, rv;
rv = 0;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next) {
+ for_each_psf_rtnl(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
!psf->sf_count[MCAST_INCLUDE];
@@ -2256,8 +2302,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
if (!psf->sf_oldin) {
struct ip6_sf_list *prev = NULL;
- for (dpsf = pmc->mca_tomb; dpsf;
- dpsf = dpsf->sf_next) {
+ for_each_psf_tomb(pmc, dpsf) {
if (ipv6_addr_equal(&dpsf->sf_addr,
&psf->sf_addr))
break;
@@ -2265,10 +2310,12 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
}
if (dpsf) {
if (prev)
- prev->sf_next = dpsf->sf_next;
+ rcu_assign_pointer(prev->sf_next,
+ rtnl_dereference(dpsf->sf_next));
else
- pmc->mca_tomb = dpsf->sf_next;
- kfree(dpsf);
+ rcu_assign_pointer(pmc->mca_tomb,
+ rtnl_dereference(dpsf->sf_next));
+ kfree_rcu(dpsf, rcu);
}
psf->sf_crcount = qrv;
rv++;
@@ -2279,7 +2326,8 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
* add or update "delete" records if an active filter
* is now inactive
*/
- for (dpsf = pmc->mca_tomb; dpsf; dpsf = dpsf->sf_next)
+
+ for_each_psf_tomb(pmc, dpsf)
if (ipv6_addr_equal(&dpsf->sf_addr,
&psf->sf_addr))
break;
@@ -2288,9 +2336,9 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
if (!dpsf)
continue;
*dpsf = *psf;
- /* pmc->mca_lock held by callers */
- dpsf->sf_next = pmc->mca_tomb;
- pmc->mca_tomb = dpsf;
+ rcu_assign_pointer(dpsf->sf_next,
+ rtnl_dereference(pmc->mca_tomb));
+ rcu_assign_pointer(pmc->mca_tomb, dpsf);
}
dpsf->sf_crcount = qrv;
rv++;
@@ -2353,7 +2401,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
pmc->mca_crcount = idev->mc_qrv;
idev->mc_ifc_count = pmc->mca_crcount;
- for (psf = pmc->mca_sources; psf; psf = psf->sf_next)
+ for_each_psf_rtnl(pmc, psf)
psf->sf_crcount = 0;
mld_ifc_event(idev);
} else if (sf_setstate(pmc))
@@ -2367,16 +2415,20 @@ static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
{
struct ip6_sf_list *psf, *nextpsf;
- for (psf = pmc->mca_tomb; psf; psf = nextpsf) {
- nextpsf = psf->sf_next;
- kfree(psf);
+ for (psf = rtnl_dereference(pmc->mca_tomb);
+ psf;
+ psf = nextpsf) {
+ nextpsf = rtnl_dereference(psf->sf_next);
+ kfree_rcu(psf, rcu);
}
- pmc->mca_tomb = NULL;
- for (psf = pmc->mca_sources; psf; psf = nextpsf) {
- nextpsf = psf->sf_next;
- kfree(psf);
+ RCU_INIT_POINTER(pmc->mca_tomb, NULL);
+ for (psf = rtnl_dereference(pmc->mca_sources);
+ psf;
+ psf = nextpsf) {
+ nextpsf = rtnl_dereference(psf->sf_next);
+ kfree_rcu(psf, rcu);
}
- pmc->mca_sources = NULL;
+ RCU_INIT_POINTER(pmc->mca_sources, NULL);
pmc->mca_sfmode = MCAST_EXCLUDE;
pmc->mca_sfcount[MCAST_INCLUDE] = 0;
pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
@@ -2786,7 +2838,7 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
im = idev->mc_list;
if (likely(im)) {
spin_lock_bh(&im->mca_lock);
- psf = im->mca_sources;
+ psf = rcu_dereference(im->mca_sources);
if (likely(psf)) {
state->im = im;
state->idev = idev;
@@ -2803,7 +2855,7 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
{
struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
- psf = psf->sf_next;
+ psf = rcu_dereference(psf->sf_next);
while (!psf) {
spin_unlock_bh(&state->im->mca_lock);
state->im = state->im->next;
@@ -2825,7 +2877,7 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
if (!state->im)
break;
spin_lock_bh(&state->im->mca_lock);
- psf = state->im->mca_sources;
+ psf = rcu_dereference(state->im->mca_sources);
}
out:
return psf;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 414/699] mld: convert ifmcaddr6 to RCU
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 413/699] mld: convert ip6_sf_list " Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 415/699] mld: add new workqueues for process mld events Greg Kroah-Hartman
` (288 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Taehee Yoo,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 88e2ca3080947fe22eb520c1f8231e79a105d011 ]
The ifmcaddr6 has been protected by inet6_dev->lock(rwlock) so that
the critical section is atomic context. In order to switch this context,
changing locking is needed. The ifmcaddr6 actually already protected by
RTNL So if it's converted to use RCU, its control path context can be
switched to sleepable.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/net/qeth_l3_main.c | 6 +-
include/net/if_inet6.h | 7 +-
net/batman-adv/multicast.c | 6 +-
net/ipv6/addrconf.c | 9 +-
net/ipv6/addrconf_core.c | 2 +-
net/ipv6/af_inet6.c | 2 +-
net/ipv6/mcast.c | 296 +++++++++++++-------------------
7 files changed, 140 insertions(+), 188 deletions(-)
diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
index fee7b09ebc2267..8876aff82fb9df 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -1104,8 +1104,9 @@ static int qeth_l3_add_mcast_rtnl(struct net_device *dev, int vid, void *arg)
tmp.disp_flag = QETH_DISP_ADDR_ADD;
tmp.is_multicast = 1;
- read_lock_bh(&in6_dev->lock);
- for (im6 = in6_dev->mc_list; im6 != NULL; im6 = im6->next) {
+ for (im6 = rtnl_dereference(in6_dev->mc_list);
+ im6;
+ im6 = rtnl_dereference(im6->next)) {
tmp.u.a6.addr = im6->mca_addr;
ipm = qeth_l3_find_addr_by_ip(card, &tmp);
@@ -1123,7 +1124,6 @@ static int qeth_l3_add_mcast_rtnl(struct net_device *dev, int vid, void *arg)
qeth_l3_ipaddr_hash(ipm));
}
- read_unlock_bh(&in6_dev->lock);
out:
return 0;
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 7da80ee6c20738..67760d69e99812 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -119,7 +119,7 @@ struct ip6_sf_list {
struct ifmcaddr6 {
struct in6_addr mca_addr;
struct inet6_dev *idev;
- struct ifmcaddr6 *next;
+ struct ifmcaddr6 __rcu *next;
struct ip6_sf_list __rcu *mca_sources;
struct ip6_sf_list __rcu *mca_tomb;
unsigned int mca_sfmode;
@@ -132,6 +132,7 @@ struct ifmcaddr6 {
spinlock_t mca_lock;
unsigned long mca_cstamp;
unsigned long mca_tstamp;
+ struct rcu_head rcu;
};
/* Anycast stuff */
@@ -170,8 +171,8 @@ struct inet6_dev {
struct list_head addr_list;
- struct ifmcaddr6 *mc_list;
- struct ifmcaddr6 *mc_tomb;
+ struct ifmcaddr6 __rcu *mc_list;
+ struct ifmcaddr6 __rcu *mc_tomb;
unsigned char mc_qrv; /* Query Robustness Variable */
unsigned char mc_gq_running;
diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 36f2e84817095d..7da0d7aa0f798a 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -454,8 +454,9 @@ batadv_mcast_mla_softif_get_ipv6(struct net_device *dev,
return 0;
}
- read_lock_bh(&in6_dev->lock);
- for (pmc6 = in6_dev->mc_list; pmc6; pmc6 = pmc6->next) {
+ for (pmc6 = rcu_dereference(in6_dev->mc_list);
+ pmc6;
+ pmc6 = rcu_dereference(pmc6->next)) {
if (IPV6_ADDR_MC_SCOPE(&pmc6->mca_addr) <
IPV6_ADDR_SCOPE_LINKLOCAL)
continue;
@@ -484,7 +485,6 @@ batadv_mcast_mla_softif_get_ipv6(struct net_device *dev,
hlist_add_head(&new->list, mcast_list);
ret++;
}
- read_unlock_bh(&in6_dev->lock);
rcu_read_unlock();
return ret;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 199c14504444bd..8d5b49b4ac5758 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5174,17 +5174,20 @@ static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
break;
}
case MULTICAST_ADDR:
+ read_unlock_bh(&idev->lock);
fillargs->event = RTM_GETMULTICAST;
/* multicast address */
- for (ifmca = idev->mc_list; ifmca;
- ifmca = ifmca->next, ip_idx++) {
+ for (ifmca = rcu_dereference(idev->mc_list);
+ ifmca;
+ ifmca = rcu_dereference(ifmca->next), ip_idx++) {
if (ip_idx < s_ip_idx)
continue;
err = inet6_fill_ifmcaddr(skb, ifmca, fillargs);
if (err < 0)
break;
}
+ read_lock_bh(&idev->lock);
break;
case ANYCAST_ADDR:
fillargs->event = RTM_GETANYCAST;
@@ -6169,10 +6172,8 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
{
- rcu_read_lock_bh();
if (likely(ifp->idev->dead == 0))
__ipv6_ifa_notify(event, ifp);
- rcu_read_unlock_bh();
}
#ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 5e0e2b5ba34e42..797b43b1298ffe 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -257,7 +257,7 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
struct net_device *dev = idev->dev;
WARN_ON(!list_empty(&idev->addr_list));
- WARN_ON(idev->mc_list);
+ WARN_ON(rcu_access_pointer(idev->mc_list));
WARN_ON(timer_pending(&idev->rs_timer));
#ifdef NET_REFCNT_DEBUG
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 5fd203ddc0757e..ace50b41b28a28 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -232,7 +232,7 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
inet->mc_loop = 1;
inet->mc_ttl = 1;
inet->mc_index = 0;
- inet->mc_list = NULL;
+ RCU_INIT_POINTER(inet->mc_list, NULL);
inet->rcv_tos = 0;
if (READ_ONCE(net->ipv4.sysctl_ip_no_pmtu_disc))
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 563020749d10d0..2379266e5c5963 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -112,6 +112,11 @@ int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
* socket join on multicast group
*/
+#define for_each_pmc_rtnl(np, pmc) \
+ for (pmc = rtnl_dereference((np)->ipv6_mc_list); \
+ pmc; \
+ pmc = rtnl_dereference(pmc->next))
+
#define for_each_pmc_rcu(np, pmc) \
for (pmc = rcu_dereference((np)->ipv6_mc_list); \
pmc; \
@@ -132,6 +137,21 @@ int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
psf; \
psf = rtnl_dereference(psf->sf_next))
+#define for_each_mc_rtnl(idev, mc) \
+ for (mc = rtnl_dereference((idev)->mc_list); \
+ mc; \
+ mc = rtnl_dereference(mc->next))
+
+#define for_each_mc_rcu(idev, mc) \
+ for (mc = rcu_dereference((idev)->mc_list); \
+ mc; \
+ mc = rcu_dereference(mc->next))
+
+#define for_each_mc_tomb(idev, mc) \
+ for (mc = rtnl_dereference((idev)->mc_tomb); \
+ mc; \
+ mc = rtnl_dereference(mc->next))
+
static int unsolicited_report_interval(struct inet6_dev *idev)
{
int iv;
@@ -158,15 +178,11 @@ static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
if (!ipv6_addr_is_multicast(addr))
return -EINVAL;
- rcu_read_lock();
- for_each_pmc_rcu(np, mc_lst) {
+ for_each_pmc_rtnl(np, mc_lst) {
if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
- ipv6_addr_equal(&mc_lst->addr, addr)) {
- rcu_read_unlock();
+ ipv6_addr_equal(&mc_lst->addr, addr))
return -EADDRINUSE;
- }
}
- rcu_read_unlock();
mc_lst = sock_kmalloc(sk, sizeof(struct ipv6_mc_socklist), GFP_KERNEL);
@@ -268,10 +284,9 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
}
EXPORT_SYMBOL(ipv6_sock_mc_drop);
-/* called with rcu_read_lock() */
-static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
- const struct in6_addr *group,
- int ifindex)
+static struct inet6_dev *ip6_mc_find_dev_rtnl(struct net *net,
+ const struct in6_addr *group,
+ int ifindex)
{
struct net_device *dev = NULL;
struct inet6_dev *idev = NULL;
@@ -283,19 +298,17 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
dev = rt->dst.dev;
ip6_rt_put(rt);
}
- } else
- dev = dev_get_by_index_rcu(net, ifindex);
+ } else {
+ dev = __dev_get_by_index(net, ifindex);
+ }
if (!dev)
return NULL;
idev = __in6_dev_get(dev);
if (!idev)
return NULL;
- read_lock_bh(&idev->lock);
- if (idev->dead) {
- read_unlock_bh(&idev->lock);
+ if (idev->dead)
return NULL;
- }
return idev;
}
@@ -357,16 +370,13 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
if (!ipv6_addr_is_multicast(group))
return -EINVAL;
- rcu_read_lock();
- idev = ip6_mc_find_dev_rcu(net, group, pgsr->gsr_interface);
- if (!idev) {
- rcu_read_unlock();
+ idev = ip6_mc_find_dev_rtnl(net, group, pgsr->gsr_interface);
+ if (!idev)
return -ENODEV;
- }
err = -EADDRNOTAVAIL;
- for_each_pmc_rcu(inet6, pmc) {
+ for_each_pmc_rtnl(inet6, pmc) {
if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
continue;
if (ipv6_addr_equal(&pmc->addr, group))
@@ -459,8 +469,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
/* update the interface list */
ip6_mc_add_src(idev, group, omode, 1, source, 1);
done:
- read_unlock_bh(&idev->lock);
- rcu_read_unlock();
if (leavegroup)
err = ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group);
return err;
@@ -486,13 +494,9 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
gsf->gf_fmode != MCAST_EXCLUDE)
return -EINVAL;
- rcu_read_lock();
- idev = ip6_mc_find_dev_rcu(net, group, gsf->gf_interface);
-
- if (!idev) {
- rcu_read_unlock();
+ idev = ip6_mc_find_dev_rtnl(net, group, gsf->gf_interface);
+ if (!idev)
return -ENODEV;
- }
err = 0;
@@ -501,7 +505,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
goto done;
}
- for_each_pmc_rcu(inet6, pmc) {
+ for_each_pmc_rtnl(inet6, pmc) {
if (pmc->ifindex != gsf->gf_interface)
continue;
if (ipv6_addr_equal(&pmc->addr, group))
@@ -548,8 +552,6 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
pmc->sfmode = gsf->gf_fmode;
err = 0;
done:
- read_unlock_bh(&idev->lock);
- rcu_read_unlock();
if (leavegroup)
err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group);
return err;
@@ -571,13 +573,9 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
if (!ipv6_addr_is_multicast(group))
return -EINVAL;
- rcu_read_lock();
- idev = ip6_mc_find_dev_rcu(net, group, gsf->gf_interface);
-
- if (!idev) {
- rcu_read_unlock();
+ idev = ip6_mc_find_dev_rtnl(net, group, gsf->gf_interface);
+ if (!idev)
return -ENODEV;
- }
err = -EADDRNOTAVAIL;
/* changes to the ipv6_mc_list require the socket lock and
@@ -585,19 +583,18 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
* so reading the list is safe.
*/
- for_each_pmc_rcu(inet6, pmc) {
+ for_each_pmc_rtnl(inet6, pmc) {
if (pmc->ifindex != gsf->gf_interface)
continue;
if (ipv6_addr_equal(group, &pmc->addr))
break;
}
if (!pmc) /* must have a prior join */
- goto done;
+ return err;
+
gsf->gf_fmode = pmc->sfmode;
psl = rtnl_dereference(pmc->sflist);
count = psl ? psl->sl_count : 0;
- read_unlock_bh(&idev->lock);
- rcu_read_unlock();
copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
gsf->gf_numsrc = count;
@@ -614,10 +611,6 @@ int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
return -EFAULT;
}
return 0;
-done:
- read_unlock_bh(&idev->lock);
- rcu_read_unlock();
- return err;
}
bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
@@ -761,8 +754,8 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
}
spin_unlock_bh(&im->mca_lock);
- pmc->next = idev->mc_tomb;
- idev->mc_tomb = pmc;
+ rcu_assign_pointer(pmc->next, idev->mc_tomb);
+ rcu_assign_pointer(idev->mc_tomb, pmc);
}
static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
@@ -772,16 +765,16 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
struct ifmcaddr6 *pmc, *pmc_prev;
pmc_prev = NULL;
- for (pmc = idev->mc_tomb; pmc; pmc = pmc->next) {
+ for_each_mc_tomb(idev, pmc) {
if (ipv6_addr_equal(&pmc->mca_addr, pmca))
break;
pmc_prev = pmc;
}
if (pmc) {
if (pmc_prev)
- pmc_prev->next = pmc->next;
+ rcu_assign_pointer(pmc_prev->next, pmc->next);
else
- idev->mc_tomb = pmc->next;
+ rcu_assign_pointer(idev->mc_tomb, pmc->next);
}
spin_lock_bh(&im->mca_lock);
@@ -804,7 +797,7 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
}
in6_dev_put(pmc->idev);
ip6_mc_clear_src(pmc);
- kfree(pmc);
+ kfree_rcu(pmc, rcu);
}
spin_unlock_bh(&im->mca_lock);
}
@@ -813,19 +806,18 @@ static void mld_clear_delrec(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *nextpmc;
- pmc = idev->mc_tomb;
- idev->mc_tomb = NULL;
+ pmc = rtnl_dereference(idev->mc_tomb);
+ RCU_INIT_POINTER(idev->mc_tomb, NULL);
for (; pmc; pmc = nextpmc) {
- nextpmc = pmc->next;
+ nextpmc = rtnl_dereference(pmc->next);
ip6_mc_clear_src(pmc);
in6_dev_put(pmc->idev);
- kfree(pmc);
+ kfree_rcu(pmc, rcu);
}
/* clear dead sources, too */
- read_lock_bh(&idev->lock);
- for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
+ for_each_mc_rtnl(idev, pmc) {
struct ip6_sf_list *psf, *psf_next;
spin_lock_bh(&pmc->mca_lock);
@@ -837,7 +829,6 @@ static void mld_clear_delrec(struct inet6_dev *idev)
kfree_rcu(psf, rcu);
}
}
- read_unlock_bh(&idev->lock);
}
static void mca_get(struct ifmcaddr6 *mc)
@@ -849,7 +840,7 @@ static void ma_put(struct ifmcaddr6 *mc)
{
if (refcount_dec_and_test(&mc->mca_refcnt)) {
in6_dev_put(mc->idev);
- kfree(mc);
+ kfree_rcu(mc, rcu);
}
}
@@ -900,17 +891,14 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
if (!idev)
return -EINVAL;
- write_lock_bh(&idev->lock);
if (idev->dead) {
- write_unlock_bh(&idev->lock);
in6_dev_put(idev);
return -ENODEV;
}
- for (mc = idev->mc_list; mc; mc = mc->next) {
+ for_each_mc_rtnl(idev, mc) {
if (ipv6_addr_equal(&mc->mca_addr, addr)) {
mc->mca_users++;
- write_unlock_bh(&idev->lock);
ip6_mc_add_src(idev, &mc->mca_addr, mode, 0, NULL, 0);
in6_dev_put(idev);
return 0;
@@ -919,19 +907,14 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
mc = mca_alloc(idev, addr, mode);
if (!mc) {
- write_unlock_bh(&idev->lock);
in6_dev_put(idev);
return -ENOMEM;
}
- mc->next = idev->mc_list;
- idev->mc_list = mc;
+ rcu_assign_pointer(mc->next, idev->mc_list);
+ rcu_assign_pointer(idev->mc_list, mc);
- /* Hold this for the code below before we unlock,
- * it is already exposed via idev->mc_list.
- */
mca_get(mc);
- write_unlock_bh(&idev->lock);
mld_del_delrec(idev, mc);
igmp6_group_added(mc);
@@ -950,16 +933,16 @@ EXPORT_SYMBOL(ipv6_dev_mc_inc);
*/
int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
{
- struct ifmcaddr6 *ma, **map;
+ struct ifmcaddr6 *ma, __rcu **map;
ASSERT_RTNL();
- write_lock_bh(&idev->lock);
- for (map = &idev->mc_list; (ma = *map) != NULL; map = &ma->next) {
+ for (map = &idev->mc_list;
+ (ma = rtnl_dereference(*map));
+ map = &ma->next) {
if (ipv6_addr_equal(&ma->mca_addr, addr)) {
if (--ma->mca_users == 0) {
*map = ma->next;
- write_unlock_bh(&idev->lock);
igmp6_group_dropped(ma);
ip6_mc_clear_src(ma);
@@ -967,11 +950,9 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
ma_put(ma);
return 0;
}
- write_unlock_bh(&idev->lock);
return 0;
}
}
- write_unlock_bh(&idev->lock);
return -ENOENT;
}
@@ -1006,8 +987,7 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
rcu_read_lock();
idev = __in6_dev_get(dev);
if (idev) {
- read_lock_bh(&idev->lock);
- for (mc = idev->mc_list; mc; mc = mc->next) {
+ for_each_mc_rcu(idev, mc) {
if (ipv6_addr_equal(&mc->mca_addr, group))
break;
}
@@ -1030,7 +1010,6 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
} else
rv = true; /* don't filter unspecified source */
}
- read_unlock_bh(&idev->lock);
}
rcu_read_unlock();
return rv;
@@ -1082,9 +1061,8 @@ static void mld_dad_stop_work(struct inet6_dev *idev)
}
/*
- * IGMP handling (alias multicast ICMPv6 messages)
+ * IGMP handling (alias multicast ICMPv6 messages)
*/
-
static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
{
unsigned long delay = resptime;
@@ -1422,15 +1400,14 @@ int igmp6_event_query(struct sk_buff *skb)
return -EINVAL;
}
- read_lock_bh(&idev->lock);
if (group_type == IPV6_ADDR_ANY) {
- for (ma = idev->mc_list; ma; ma = ma->next) {
+ for_each_mc_rcu(idev, ma) {
spin_lock_bh(&ma->mca_lock);
igmp6_group_queried(ma, max_delay);
spin_unlock_bh(&ma->mca_lock);
}
} else {
- for (ma = idev->mc_list; ma; ma = ma->next) {
+ for_each_mc_rcu(idev, ma) {
if (!ipv6_addr_equal(group, &ma->mca_addr))
continue;
spin_lock_bh(&ma->mca_lock);
@@ -1452,7 +1429,6 @@ int igmp6_event_query(struct sk_buff *skb)
break;
}
}
- read_unlock_bh(&idev->lock);
return 0;
}
@@ -1493,18 +1469,17 @@ int igmp6_event_report(struct sk_buff *skb)
* Cancel the work for this group
*/
- read_lock_bh(&idev->lock);
- for (ma = idev->mc_list; ma; ma = ma->next) {
+ for_each_mc_rcu(idev, ma) {
if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
spin_lock(&ma->mca_lock);
if (cancel_delayed_work(&ma->mca_work))
refcount_dec(&ma->mca_refcnt);
- ma->mca_flags &= ~(MAF_LAST_REPORTER|MAF_TIMER_RUNNING);
+ ma->mca_flags &= ~(MAF_LAST_REPORTER |
+ MAF_TIMER_RUNNING);
spin_unlock(&ma->mca_lock);
break;
}
}
- read_unlock_bh(&idev->lock);
return 0;
}
@@ -1865,9 +1840,8 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
struct sk_buff *skb = NULL;
int type;
- read_lock_bh(&idev->lock);
if (!pmc) {
- for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
+ for_each_mc_rtnl(idev, pmc) {
if (pmc->mca_flags & MAF_NOREPORT)
continue;
spin_lock_bh(&pmc->mca_lock);
@@ -1887,7 +1861,6 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
skb = add_grec(skb, pmc, type, 0, 0, 0);
spin_unlock_bh(&pmc->mca_lock);
}
- read_unlock_bh(&idev->lock);
if (skb)
mld_sendpack(skb);
}
@@ -1924,12 +1897,12 @@ static void mld_send_cr(struct inet6_dev *idev)
struct sk_buff *skb = NULL;
int type, dtype;
- read_lock_bh(&idev->lock);
-
/* deleted MCA's */
pmc_prev = NULL;
- for (pmc = idev->mc_tomb; pmc; pmc = pmc_next) {
- pmc_next = pmc->next;
+ for (pmc = rtnl_dereference(idev->mc_tomb);
+ pmc;
+ pmc = pmc_next) {
+ pmc_next = rtnl_dereference(pmc->next);
if (pmc->mca_sfmode == MCAST_INCLUDE) {
type = MLD2_BLOCK_OLD_SOURCES;
dtype = MLD2_BLOCK_OLD_SOURCES;
@@ -1951,17 +1924,17 @@ static void mld_send_cr(struct inet6_dev *idev)
!rcu_access_pointer(pmc->mca_tomb) &&
!rcu_access_pointer(pmc->mca_sources)) {
if (pmc_prev)
- pmc_prev->next = pmc_next;
+ rcu_assign_pointer(pmc_prev->next, pmc_next);
else
- idev->mc_tomb = pmc_next;
+ rcu_assign_pointer(idev->mc_tomb, pmc_next);
in6_dev_put(pmc->idev);
- kfree(pmc);
+ kfree_rcu(pmc, rcu);
} else
pmc_prev = pmc;
}
/* change recs */
- for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
+ for_each_mc_rtnl(idev, pmc) {
spin_lock_bh(&pmc->mca_lock);
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
type = MLD2_BLOCK_OLD_SOURCES;
@@ -1984,7 +1957,6 @@ static void mld_send_cr(struct inet6_dev *idev)
}
spin_unlock_bh(&pmc->mca_lock);
}
- read_unlock_bh(&idev->lock);
if (!skb)
return;
(void) mld_sendpack(skb);
@@ -2096,8 +2068,7 @@ static void mld_send_initial_cr(struct inet6_dev *idev)
return;
skb = NULL;
- read_lock_bh(&idev->lock);
- for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
+ for_each_mc_rtnl(idev, pmc) {
spin_lock_bh(&pmc->mca_lock);
if (pmc->mca_sfcount[MCAST_EXCLUDE])
type = MLD2_CHANGE_TO_EXCLUDE;
@@ -2106,7 +2077,6 @@ static void mld_send_initial_cr(struct inet6_dev *idev)
skb = add_grec(skb, pmc, type, 0, 0, 1);
spin_unlock_bh(&pmc->mca_lock);
}
- read_unlock_bh(&idev->lock);
if (skb)
mld_sendpack(skb);
}
@@ -2129,7 +2099,9 @@ static void mld_dad_work(struct work_struct *work)
struct inet6_dev,
mc_dad_work);
+ rtnl_lock();
mld_send_initial_cr(idev);
+ rtnl_unlock();
if (idev->mc_dad_count) {
idev->mc_dad_count--;
if (idev->mc_dad_count)
@@ -2191,24 +2163,22 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
- read_lock_bh(&idev->lock);
- for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
+
+ for_each_mc_rtnl(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
}
- if (!pmc) {
- /* MCA not found?? bug */
- read_unlock_bh(&idev->lock);
+ if (!pmc)
return -ESRCH;
- }
spin_lock_bh(&pmc->mca_lock);
+
sf_markstate(pmc);
if (!delta) {
if (!pmc->mca_sfcount[sfmode]) {
spin_unlock_bh(&pmc->mca_lock);
- read_unlock_bh(&idev->lock);
return -EINVAL;
}
+
pmc->mca_sfcount[sfmode]--;
}
err = 0;
@@ -2234,7 +2204,6 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
} else if (sf_setstate(pmc) || changerec)
mld_ifc_event(pmc->idev);
spin_unlock_bh(&pmc->mca_lock);
- read_unlock_bh(&idev->lock);
return err;
}
@@ -2360,16 +2329,13 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
- read_lock_bh(&idev->lock);
- for (pmc = idev->mc_list; pmc; pmc = pmc->next) {
+
+ for_each_mc_rtnl(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
}
- if (!pmc) {
- /* MCA not found?? bug */
- read_unlock_bh(&idev->lock);
+ if (!pmc)
return -ESRCH;
- }
spin_lock_bh(&pmc->mca_lock);
sf_markstate(pmc);
@@ -2404,10 +2370,10 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
for_each_psf_rtnl(pmc, psf)
psf->sf_crcount = 0;
mld_ifc_event(idev);
- } else if (sf_setstate(pmc))
+ } else if (sf_setstate(pmc)) {
mld_ifc_event(idev);
+ }
spin_unlock_bh(&pmc->mca_lock);
- read_unlock_bh(&idev->lock);
return err;
}
@@ -2482,9 +2448,10 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
static void igmp6_leave_group(struct ifmcaddr6 *ma)
{
if (mld_in_v1_mode(ma->idev)) {
- if (ma->mca_flags & MAF_LAST_REPORTER)
+ if (ma->mca_flags & MAF_LAST_REPORTER) {
igmp6_send(&ma->mca_addr, ma->idev->dev,
ICMPV6_MGM_REDUCTION);
+ }
} else {
mld_add_delrec(ma->idev, ma);
mld_ifc_event(ma->idev);
@@ -2497,8 +2464,12 @@ static void mld_gq_work(struct work_struct *work)
struct inet6_dev,
mc_gq_work);
- idev->mc_gq_running = 0;
+ rtnl_lock();
mld_send_report(idev, NULL);
+ rtnl_unlock();
+
+ idev->mc_gq_running = 0;
+
in6_dev_put(idev);
}
@@ -2508,7 +2479,10 @@ static void mld_ifc_work(struct work_struct *work)
struct inet6_dev,
mc_ifc_work);
+ rtnl_lock();
mld_send_cr(idev);
+ rtnl_unlock();
+
if (idev->mc_ifc_count) {
idev->mc_ifc_count--;
if (idev->mc_ifc_count)
@@ -2522,6 +2496,7 @@ static void mld_ifc_event(struct inet6_dev *idev)
{
if (mld_in_v1_mode(idev))
return;
+
idev->mc_ifc_count = idev->mc_qrv;
mld_ifc_start_work(idev, 1);
}
@@ -2531,10 +2506,12 @@ static void mld_mca_work(struct work_struct *work)
struct ifmcaddr6 *ma = container_of(to_delayed_work(work),
struct ifmcaddr6, mca_work);
+ rtnl_lock();
if (mld_in_v1_mode(ma->idev))
igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
else
mld_send_report(ma->idev, ma);
+ rtnl_unlock();
spin_lock_bh(&ma->mca_lock);
ma->mca_flags |= MAF_LAST_REPORTER;
@@ -2551,10 +2528,8 @@ void ipv6_mc_unmap(struct inet6_dev *idev)
/* Install multicast list, except for all-nodes (already installed) */
- read_lock_bh(&idev->lock);
- for (i = idev->mc_list; i; i = i->next)
+ for_each_mc_rtnl(idev, i)
igmp6_group_dropped(i);
- read_unlock_bh(&idev->lock);
}
void ipv6_mc_remap(struct inet6_dev *idev)
@@ -2569,10 +2544,7 @@ void ipv6_mc_down(struct inet6_dev *idev)
struct ifmcaddr6 *i;
/* Withdraw multicast list */
-
- read_lock_bh(&idev->lock);
-
- for (i = idev->mc_list; i; i = i->next)
+ for_each_mc_rtnl(idev, i)
igmp6_group_dropped(i);
/* Should stop work after group drop. or we will
@@ -2581,7 +2553,6 @@ void ipv6_mc_down(struct inet6_dev *idev)
mld_ifc_stop_work(idev);
mld_gq_stop_work(idev);
mld_dad_stop_work(idev);
- read_unlock_bh(&idev->lock);
}
static void ipv6_mc_reset(struct inet6_dev *idev)
@@ -2601,28 +2572,24 @@ void ipv6_mc_up(struct inet6_dev *idev)
/* Install multicast list, except for all-nodes (already installed) */
- read_lock_bh(&idev->lock);
ipv6_mc_reset(idev);
- for (i = idev->mc_list; i; i = i->next) {
+ for_each_mc_rtnl(idev, i) {
mld_del_delrec(idev, i);
igmp6_group_added(i);
}
- read_unlock_bh(&idev->lock);
}
/* IPv6 device initialization. */
void ipv6_mc_init_dev(struct inet6_dev *idev)
{
- write_lock_bh(&idev->lock);
idev->mc_gq_running = 0;
INIT_DELAYED_WORK(&idev->mc_gq_work, mld_gq_work);
- idev->mc_tomb = NULL;
+ RCU_INIT_POINTER(idev->mc_tomb, NULL);
idev->mc_ifc_count = 0;
INIT_DELAYED_WORK(&idev->mc_ifc_work, mld_ifc_work);
INIT_DELAYED_WORK(&idev->mc_dad_work, mld_dad_work);
ipv6_mc_reset(idev);
- write_unlock_bh(&idev->lock);
}
/*
@@ -2647,16 +2614,12 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
if (idev->cnf.forwarding)
__ipv6_dev_mc_dec(idev, &in6addr_linklocal_allrouters);
- write_lock_bh(&idev->lock);
- while ((i = idev->mc_list) != NULL) {
- idev->mc_list = i->next;
+ while ((i = rtnl_dereference(idev->mc_list))) {
+ rcu_assign_pointer(idev->mc_list, rtnl_dereference(i->next));
- write_unlock_bh(&idev->lock);
ip6_mc_clear_src(i);
ma_put(i);
- write_lock_bh(&idev->lock);
}
- write_unlock_bh(&idev->lock);
}
static void ipv6_mc_rejoin_groups(struct inet6_dev *idev)
@@ -2666,12 +2629,11 @@ static void ipv6_mc_rejoin_groups(struct inet6_dev *idev)
ASSERT_RTNL();
if (mld_in_v1_mode(idev)) {
- read_lock_bh(&idev->lock);
- for (pmc = idev->mc_list; pmc; pmc = pmc->next)
+ for_each_mc_rtnl(idev, pmc)
igmp6_join_group(pmc);
- read_unlock_bh(&idev->lock);
- } else
+ } else {
mld_send_report(idev, NULL);
+ }
}
static int ipv6_mc_netdev_event(struct notifier_block *this,
@@ -2718,13 +2680,12 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
idev = __in6_dev_get(state->dev);
if (!idev)
continue;
- read_lock_bh(&idev->lock);
- im = idev->mc_list;
+
+ im = rcu_dereference(idev->mc_list);
if (im) {
state->idev = idev;
break;
}
- read_unlock_bh(&idev->lock);
}
return im;
}
@@ -2733,11 +2694,8 @@ static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr
{
struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
- im = im->next;
+ im = rcu_dereference(im->next);
while (!im) {
- if (likely(state->idev))
- read_unlock_bh(&state->idev->lock);
-
state->dev = next_net_device_rcu(state->dev);
if (!state->dev) {
state->idev = NULL;
@@ -2746,8 +2704,7 @@ static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr
state->idev = __in6_dev_get(state->dev);
if (!state->idev)
continue;
- read_lock_bh(&state->idev->lock);
- im = state->idev->mc_list;
+ im = rcu_dereference(state->idev->mc_list);
}
return im;
}
@@ -2781,10 +2738,8 @@ static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
{
struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
- if (likely(state->idev)) {
- read_unlock_bh(&state->idev->lock);
+ if (likely(state->idev))
state->idev = NULL;
- }
state->dev = NULL;
rcu_read_unlock();
}
@@ -2799,7 +2754,7 @@ static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
state->dev->ifindex, state->dev->name,
&im->mca_addr,
im->mca_users, im->mca_flags,
- (im->mca_flags&MAF_TIMER_RUNNING) ?
+ (im->mca_flags & MAF_TIMER_RUNNING) ?
jiffies_to_clock_t(im->mca_work.timer.expires - jiffies) : 0);
return 0;
}
@@ -2834,8 +2789,8 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
idev = __in6_dev_get(state->dev);
if (unlikely(idev == NULL))
continue;
- read_lock_bh(&idev->lock);
- im = idev->mc_list;
+
+ im = rcu_dereference(idev->mc_list);
if (likely(im)) {
spin_lock_bh(&im->mca_lock);
psf = rcu_dereference(im->mca_sources);
@@ -2846,7 +2801,6 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
}
spin_unlock_bh(&im->mca_lock);
}
- read_unlock_bh(&idev->lock);
}
return psf;
}
@@ -2858,11 +2812,8 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
psf = rcu_dereference(psf->sf_next);
while (!psf) {
spin_unlock_bh(&state->im->mca_lock);
- state->im = state->im->next;
+ state->im = rcu_dereference(state->im->next);
while (!state->im) {
- if (likely(state->idev))
- read_unlock_bh(&state->idev->lock);
-
state->dev = next_net_device_rcu(state->dev);
if (!state->dev) {
state->idev = NULL;
@@ -2871,8 +2822,7 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
state->idev = __in6_dev_get(state->dev);
if (!state->idev)
continue;
- read_lock_bh(&state->idev->lock);
- state->im = state->idev->mc_list;
+ state->im = rcu_dereference(state->idev->mc_list);
}
if (!state->im)
break;
@@ -2914,14 +2864,14 @@ static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
__releases(RCU)
{
struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
+
if (likely(state->im)) {
spin_unlock_bh(&state->im->mca_lock);
state->im = NULL;
}
- if (likely(state->idev)) {
- read_unlock_bh(&state->idev->lock);
+ if (likely(state->idev))
state->idev = NULL;
- }
+
state->dev = NULL;
rcu_read_unlock();
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 415/699] mld: add new workqueues for process mld events
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 414/699] mld: convert ifmcaddr6 " Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 416/699] mld: add mc_lock for protecting per-interface mld data Greg Kroah-Hartman
` (287 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Taehee Yoo,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit f185de28d9ae6c978135993769352e523ee8df06 ]
When query/report packets are received, mld module processes them.
But they are processed under BH context so it couldn't use sleepable
functions. So, in order to switch context, the two workqueues are
added which processes query and report event.
In the struct inet6_dev, mc_{query | report}_queue are added so it
is per-interface queue.
And mc_{query | report}_work are workqueue structure.
When the query or report event is received, skb is queued to proper
queue and worker function is scheduled immediately.
Workqueues and queues are protected by spinlock, which is
mc_{query | report}_lock, and worker functions are protected by RTNL.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/if_inet6.h | 9 +-
include/net/mld.h | 3 +
net/ipv6/icmp.c | 4 +-
net/ipv6/mcast.c | 280 +++++++++++++++++++++++++++++------------
4 files changed, 210 insertions(+), 86 deletions(-)
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 67760d69e99812..592d517da80333 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -129,7 +129,6 @@ struct ifmcaddr6 {
unsigned int mca_flags;
int mca_users;
refcount_t mca_refcnt;
- spinlock_t mca_lock;
unsigned long mca_cstamp;
unsigned long mca_tstamp;
struct rcu_head rcu;
@@ -187,6 +186,14 @@ struct inet6_dev {
struct delayed_work mc_gq_work; /* general query work */
struct delayed_work mc_ifc_work; /* interface change work */
struct delayed_work mc_dad_work; /* dad complete mc work */
+ struct delayed_work mc_query_work; /* mld query work */
+ struct delayed_work mc_report_work; /* mld report work */
+
+ struct sk_buff_head mc_query_queue; /* mld query queue */
+ struct sk_buff_head mc_report_queue; /* mld report queue */
+
+ spinlock_t mc_query_lock; /* mld query queue lock */
+ spinlock_t mc_report_lock; /* mld query report lock */
struct ifacaddr6 *ac_list;
rwlock_t lock;
diff --git a/include/net/mld.h b/include/net/mld.h
index 496bddb599425a..c073598084934d 100644
--- a/include/net/mld.h
+++ b/include/net/mld.h
@@ -92,6 +92,9 @@ struct mld2_query {
#define MLD_EXP_MIN_LIMIT 32768UL
#define MLDV1_MRD_MAX_COMPAT (MLD_EXP_MIN_LIMIT - 1)
+#define MLD_MAX_QUEUE 8
+#define MLD_MAX_SKBS 32
+
static inline unsigned long mldv2_mrc(const struct mld2_query *mlh2)
{
/* RFC3810, 5.1.3. Maximum Response Code */
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 35e99974aa882a..e8325d9780e992 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -947,11 +947,11 @@ static int icmpv6_rcv(struct sk_buff *skb)
case ICMPV6_MGM_QUERY:
igmp6_event_query(skb);
- break;
+ return 0;
case ICMPV6_MGM_REPORT:
igmp6_event_report(skb);
- break;
+ return 0;
case ICMPV6_MGM_REDUCTION:
case ICMPV6_NI_QUERY:
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 2379266e5c5963..a989e952432853 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -439,7 +439,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
if (psl)
count += psl->sl_max;
- newpsl = sock_kmalloc(sk, IP6_SFLSIZE(count), GFP_ATOMIC);
+ newpsl = sock_kmalloc(sk, IP6_SFLSIZE(count), GFP_KERNEL);
if (!newpsl) {
err = -ENOBUFS;
goto done;
@@ -517,7 +517,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
}
if (gsf->gf_numsrc) {
newpsl = sock_kmalloc(sk, IP6_SFLSIZE(gsf->gf_numsrc),
- GFP_ATOMIC);
+ GFP_KERNEL);
if (!newpsl) {
err = -ENOBUFS;
goto done;
@@ -659,13 +659,11 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
IPV6_ADDR_SCOPE_LINKLOCAL)
return;
- spin_lock_bh(&mc->mca_lock);
if (!(mc->mca_flags&MAF_LOADED)) {
mc->mca_flags |= MAF_LOADED;
if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
dev_mc_add(dev, buf);
}
- spin_unlock_bh(&mc->mca_lock);
if (!(dev->flags & IFF_UP) || (mc->mca_flags & MAF_NOREPORT))
return;
@@ -695,24 +693,20 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
IPV6_ADDR_SCOPE_LINKLOCAL)
return;
- spin_lock_bh(&mc->mca_lock);
if (mc->mca_flags&MAF_LOADED) {
mc->mca_flags &= ~MAF_LOADED;
if (ndisc_mc_map(&mc->mca_addr, buf, dev, 0) == 0)
dev_mc_del(dev, buf);
}
- spin_unlock_bh(&mc->mca_lock);
if (mc->mca_flags & MAF_NOREPORT)
return;
if (!mc->idev->dead)
igmp6_leave_group(mc);
- spin_lock_bh(&mc->mca_lock);
if (cancel_delayed_work(&mc->mca_work))
refcount_dec(&mc->mca_refcnt);
- spin_unlock_bh(&mc->mca_lock);
}
/*
@@ -728,12 +722,10 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
* for deleted items allows change reports to use common code with
* non-deleted or query-response MCA's.
*/
- pmc = kzalloc(sizeof(*pmc), GFP_ATOMIC);
+ pmc = kzalloc(sizeof(*pmc), GFP_KERNEL);
if (!pmc)
return;
- spin_lock_bh(&im->mca_lock);
- spin_lock_init(&pmc->mca_lock);
pmc->idev = im->idev;
in6_dev_hold(idev);
pmc->mca_addr = im->mca_addr;
@@ -752,7 +744,6 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
for_each_psf_rtnl(pmc, psf)
psf->sf_crcount = pmc->mca_crcount;
}
- spin_unlock_bh(&im->mca_lock);
rcu_assign_pointer(pmc->next, idev->mc_tomb);
rcu_assign_pointer(idev->mc_tomb, pmc);
@@ -777,7 +768,6 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
rcu_assign_pointer(idev->mc_tomb, pmc->next);
}
- spin_lock_bh(&im->mca_lock);
if (pmc) {
im->idev = pmc->idev;
if (im->mca_sfmode == MCAST_INCLUDE) {
@@ -799,7 +789,6 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
ip6_mc_clear_src(pmc);
kfree_rcu(pmc, rcu);
}
- spin_unlock_bh(&im->mca_lock);
}
static void mld_clear_delrec(struct inet6_dev *idev)
@@ -820,10 +809,8 @@ static void mld_clear_delrec(struct inet6_dev *idev)
for_each_mc_rtnl(idev, pmc) {
struct ip6_sf_list *psf, *psf_next;
- spin_lock_bh(&pmc->mca_lock);
psf = rtnl_dereference(pmc->mca_tomb);
RCU_INIT_POINTER(pmc->mca_tomb, NULL);
- spin_unlock_bh(&pmc->mca_lock);
for (; psf; psf = psf_next) {
psf_next = rtnl_dereference(psf->sf_next);
kfree_rcu(psf, rcu);
@@ -831,6 +818,26 @@ static void mld_clear_delrec(struct inet6_dev *idev)
}
}
+static void mld_clear_query(struct inet6_dev *idev)
+{
+ struct sk_buff *skb;
+
+ spin_lock_bh(&idev->mc_query_lock);
+ while ((skb = __skb_dequeue(&idev->mc_query_queue)))
+ kfree_skb(skb);
+ spin_unlock_bh(&idev->mc_query_lock);
+}
+
+static void mld_clear_report(struct inet6_dev *idev)
+{
+ struct sk_buff *skb;
+
+ spin_lock_bh(&idev->mc_report_lock);
+ while ((skb = __skb_dequeue(&idev->mc_report_queue)))
+ kfree_skb(skb);
+ spin_unlock_bh(&idev->mc_report_lock);
+}
+
static void mca_get(struct ifmcaddr6 *mc)
{
refcount_inc(&mc->mca_refcnt);
@@ -850,7 +857,7 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
{
struct ifmcaddr6 *mc;
- mc = kzalloc(sizeof(*mc), GFP_ATOMIC);
+ mc = kzalloc(sizeof(*mc), GFP_KERNEL);
if (!mc)
return NULL;
@@ -862,7 +869,6 @@ static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
/* mca_stamp should be updated upon changes */
mc->mca_cstamp = mc->mca_tstamp = jiffies;
refcount_set(&mc->mca_refcnt, 1);
- spin_lock_init(&mc->mca_lock);
mc->mca_sfmode = mode;
mc->mca_sfcount[mode] = 1;
@@ -995,7 +1001,6 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
if (src_addr && !ipv6_addr_any(src_addr)) {
struct ip6_sf_list *psf;
- spin_lock_bh(&mc->mca_lock);
for_each_psf_rcu(mc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, src_addr))
break;
@@ -1006,7 +1011,6 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
mc->mca_sfcount[MCAST_EXCLUDE];
else
rv = mc->mca_sfcount[MCAST_EXCLUDE] != 0;
- spin_unlock_bh(&mc->mca_lock);
} else
rv = true; /* don't filter unspecified source */
}
@@ -1060,6 +1064,20 @@ static void mld_dad_stop_work(struct inet6_dev *idev)
__in6_dev_put(idev);
}
+static void mld_query_stop_work(struct inet6_dev *idev)
+{
+ spin_lock_bh(&idev->mc_query_lock);
+ if (cancel_delayed_work(&idev->mc_query_work))
+ __in6_dev_put(idev);
+ spin_unlock_bh(&idev->mc_query_lock);
+}
+
+static void mld_report_stop_work(struct inet6_dev *idev)
+{
+ if (cancel_delayed_work_sync(&idev->mc_report_work))
+ __in6_dev_put(idev);
+}
+
/*
* IGMP handling (alias multicast ICMPv6 messages)
*/
@@ -1093,7 +1111,7 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
int i, scount;
scount = 0;
- for_each_psf_rcu(pmc, psf) {
+ for_each_psf_rtnl(pmc, psf) {
if (scount == nsrcs)
break;
for (i = 0; i < nsrcs; i++) {
@@ -1126,7 +1144,7 @@ static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
/* mark INCLUDE-mode sources */
scount = 0;
- for_each_psf_rcu(pmc, psf) {
+ for_each_psf_rtnl(pmc, psf) {
if (scount == nsrcs)
break;
for (i = 0; i < nsrcs; i++) {
@@ -1317,19 +1335,42 @@ static int mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
/* called with rcu_read_lock() */
int igmp6_event_query(struct sk_buff *skb)
+{
+ struct inet6_dev *idev = __in6_dev_get(skb->dev);
+
+ if (!idev)
+ return -EINVAL;
+
+ if (idev->dead) {
+ kfree_skb(skb);
+ return -ENODEV;
+ }
+
+ spin_lock_bh(&idev->mc_query_lock);
+ if (skb_queue_len(&idev->mc_query_queue) < MLD_MAX_SKBS) {
+ __skb_queue_tail(&idev->mc_query_queue, skb);
+ if (!mod_delayed_work(mld_wq, &idev->mc_query_work, 0))
+ in6_dev_hold(idev);
+ }
+ spin_unlock_bh(&idev->mc_query_lock);
+
+ return 0;
+}
+
+static void __mld_query_work(struct sk_buff *skb)
{
struct mld2_query *mlh2 = NULL;
- struct ifmcaddr6 *ma;
const struct in6_addr *group;
unsigned long max_delay;
struct inet6_dev *idev;
+ struct ifmcaddr6 *ma;
struct mld_msg *mld;
int group_type;
int mark = 0;
int len, err;
if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
- return -EINVAL;
+ goto out;
/* compute payload length excluding extension headers */
len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr);
@@ -1346,11 +1387,11 @@ int igmp6_event_query(struct sk_buff *skb)
ipv6_hdr(skb)->hop_limit != 1 ||
!(IP6CB(skb)->flags & IP6SKB_ROUTERALERT) ||
IP6CB(skb)->ra != htons(IPV6_OPT_ROUTERALERT_MLD))
- return -EINVAL;
+ goto out;
idev = __in6_dev_get(skb->dev);
if (!idev)
- return 0;
+ goto out;
mld = (struct mld_msg *)icmp6_hdr(skb);
group = &mld->mld_mca;
@@ -1358,59 +1399,56 @@ int igmp6_event_query(struct sk_buff *skb)
if (group_type != IPV6_ADDR_ANY &&
!(group_type&IPV6_ADDR_MULTICAST))
- return -EINVAL;
+ goto out;
if (len < MLD_V1_QUERY_LEN) {
- return -EINVAL;
+ goto out;
} else if (len == MLD_V1_QUERY_LEN || mld_in_v1_mode(idev)) {
err = mld_process_v1(idev, mld, &max_delay,
len == MLD_V1_QUERY_LEN);
if (err < 0)
- return err;
+ goto out;
} else if (len >= MLD_V2_QUERY_LEN_MIN) {
int srcs_offset = sizeof(struct mld2_query) -
sizeof(struct icmp6hdr);
if (!pskb_may_pull(skb, srcs_offset))
- return -EINVAL;
+ goto out;
mlh2 = (struct mld2_query *)skb_transport_header(skb);
err = mld_process_v2(idev, mlh2, &max_delay);
if (err < 0)
- return err;
+ goto out;
if (group_type == IPV6_ADDR_ANY) { /* general query */
if (mlh2->mld2q_nsrcs)
- return -EINVAL; /* no sources allowed */
+ goto out; /* no sources allowed */
mld_gq_start_work(idev);
- return 0;
+ goto out;
}
/* mark sources to include, if group & source-specific */
if (mlh2->mld2q_nsrcs != 0) {
if (!pskb_may_pull(skb, srcs_offset +
ntohs(mlh2->mld2q_nsrcs) * sizeof(struct in6_addr)))
- return -EINVAL;
+ goto out;
mlh2 = (struct mld2_query *)skb_transport_header(skb);
mark = 1;
}
} else {
- return -EINVAL;
+ goto out;
}
if (group_type == IPV6_ADDR_ANY) {
- for_each_mc_rcu(idev, ma) {
- spin_lock_bh(&ma->mca_lock);
+ for_each_mc_rtnl(idev, ma) {
igmp6_group_queried(ma, max_delay);
- spin_unlock_bh(&ma->mca_lock);
}
} else {
- for_each_mc_rcu(idev, ma) {
+ for_each_mc_rtnl(idev, ma) {
if (!ipv6_addr_equal(group, &ma->mca_addr))
continue;
- spin_lock_bh(&ma->mca_lock);
if (ma->mca_flags & MAF_TIMER_RUNNING) {
/* gsquery <- gsquery && mark */
if (!mark)
@@ -1425,16 +1463,72 @@ int igmp6_event_query(struct sk_buff *skb)
if (!(ma->mca_flags & MAF_GSQUERY) ||
mld_marksources(ma, ntohs(mlh2->mld2q_nsrcs), mlh2->mld2q_srcs))
igmp6_group_queried(ma, max_delay);
- spin_unlock_bh(&ma->mca_lock);
break;
}
}
- return 0;
+out:
+ consume_skb(skb);
+}
+
+static void mld_query_work(struct work_struct *work)
+{
+ struct inet6_dev *idev = container_of(to_delayed_work(work),
+ struct inet6_dev,
+ mc_query_work);
+ struct sk_buff_head q;
+ struct sk_buff *skb;
+ bool rework = false;
+ int cnt = 0;
+
+ skb_queue_head_init(&q);
+
+ spin_lock_bh(&idev->mc_query_lock);
+ while ((skb = __skb_dequeue(&idev->mc_query_queue))) {
+ __skb_queue_tail(&q, skb);
+
+ if (++cnt >= MLD_MAX_QUEUE) {
+ rework = true;
+ schedule_delayed_work(&idev->mc_query_work, 0);
+ break;
+ }
+ }
+ spin_unlock_bh(&idev->mc_query_lock);
+
+ rtnl_lock();
+ while ((skb = __skb_dequeue(&q)))
+ __mld_query_work(skb);
+ rtnl_unlock();
+
+ if (!rework)
+ in6_dev_put(idev);
}
/* called with rcu_read_lock() */
int igmp6_event_report(struct sk_buff *skb)
+{
+ struct inet6_dev *idev = __in6_dev_get(skb->dev);
+
+ if (!idev)
+ return -EINVAL;
+
+ if (idev->dead) {
+ kfree_skb(skb);
+ return -ENODEV;
+ }
+
+ spin_lock_bh(&idev->mc_report_lock);
+ if (skb_queue_len(&idev->mc_report_queue) < MLD_MAX_SKBS) {
+ __skb_queue_tail(&idev->mc_report_queue, skb);
+ if (!mod_delayed_work(mld_wq, &idev->mc_report_work, 0))
+ in6_dev_hold(idev);
+ }
+ spin_unlock_bh(&idev->mc_report_lock);
+
+ return 0;
+}
+
+static void __mld_report_work(struct sk_buff *skb)
{
struct ifmcaddr6 *ma;
struct inet6_dev *idev;
@@ -1443,15 +1537,15 @@ int igmp6_event_report(struct sk_buff *skb)
/* Our own report looped back. Ignore it. */
if (skb->pkt_type == PACKET_LOOPBACK)
- return 0;
+ goto out;
/* send our report if the MC router may not have heard this report */
if (skb->pkt_type != PACKET_MULTICAST &&
skb->pkt_type != PACKET_BROADCAST)
- return 0;
+ goto out;
if (!pskb_may_pull(skb, sizeof(*mld) - sizeof(struct icmp6hdr)))
- return -EINVAL;
+ goto out;
mld = (struct mld_msg *)icmp6_hdr(skb);
@@ -1459,28 +1553,60 @@ int igmp6_event_report(struct sk_buff *skb)
addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
if (addr_type != IPV6_ADDR_ANY &&
!(addr_type&IPV6_ADDR_LINKLOCAL))
- return -EINVAL;
+ goto out;
idev = __in6_dev_get(skb->dev);
if (!idev)
- return -ENODEV;
+ goto out;
/*
* Cancel the work for this group
*/
- for_each_mc_rcu(idev, ma) {
+ for_each_mc_rtnl(idev, ma) {
if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
- spin_lock(&ma->mca_lock);
if (cancel_delayed_work(&ma->mca_work))
refcount_dec(&ma->mca_refcnt);
ma->mca_flags &= ~(MAF_LAST_REPORTER |
MAF_TIMER_RUNNING);
- spin_unlock(&ma->mca_lock);
break;
}
}
- return 0;
+
+out:
+ consume_skb(skb);
+}
+
+static void mld_report_work(struct work_struct *work)
+{
+ struct inet6_dev *idev = container_of(to_delayed_work(work),
+ struct inet6_dev,
+ mc_report_work);
+ struct sk_buff_head q;
+ struct sk_buff *skb;
+ bool rework = false;
+ int cnt = 0;
+
+ skb_queue_head_init(&q);
+ spin_lock_bh(&idev->mc_report_lock);
+ while ((skb = __skb_dequeue(&idev->mc_report_queue))) {
+ __skb_queue_tail(&q, skb);
+
+ if (++cnt >= MLD_MAX_QUEUE) {
+ rework = true;
+ schedule_delayed_work(&idev->mc_report_work, 0);
+ break;
+ }
+ }
+ spin_unlock_bh(&idev->mc_report_lock);
+
+ rtnl_lock();
+ while ((skb = __skb_dequeue(&q)))
+ __mld_report_work(skb);
+ rtnl_unlock();
+
+ if (!rework)
+ in6_dev_put(idev);
}
static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
@@ -1844,22 +1970,18 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
for_each_mc_rtnl(idev, pmc) {
if (pmc->mca_flags & MAF_NOREPORT)
continue;
- spin_lock_bh(&pmc->mca_lock);
if (pmc->mca_sfcount[MCAST_EXCLUDE])
type = MLD2_MODE_IS_EXCLUDE;
else
type = MLD2_MODE_IS_INCLUDE;
skb = add_grec(skb, pmc, type, 0, 0, 0);
- spin_unlock_bh(&pmc->mca_lock);
}
} else {
- spin_lock_bh(&pmc->mca_lock);
if (pmc->mca_sfcount[MCAST_EXCLUDE])
type = MLD2_MODE_IS_EXCLUDE;
else
type = MLD2_MODE_IS_INCLUDE;
skb = add_grec(skb, pmc, type, 0, 0, 0);
- spin_unlock_bh(&pmc->mca_lock);
}
if (skb)
mld_sendpack(skb);
@@ -1935,7 +2057,6 @@ static void mld_send_cr(struct inet6_dev *idev)
/* change recs */
for_each_mc_rtnl(idev, pmc) {
- spin_lock_bh(&pmc->mca_lock);
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
type = MLD2_BLOCK_OLD_SOURCES;
dtype = MLD2_ALLOW_NEW_SOURCES;
@@ -1955,7 +2076,6 @@ static void mld_send_cr(struct inet6_dev *idev)
skb = add_grec(skb, pmc, type, 0, 0, 0);
pmc->mca_crcount--;
}
- spin_unlock_bh(&pmc->mca_lock);
}
if (!skb)
return;
@@ -2069,13 +2189,11 @@ static void mld_send_initial_cr(struct inet6_dev *idev)
skb = NULL;
for_each_mc_rtnl(idev, pmc) {
- spin_lock_bh(&pmc->mca_lock);
if (pmc->mca_sfcount[MCAST_EXCLUDE])
type = MLD2_CHANGE_TO_EXCLUDE;
else
type = MLD2_ALLOW_NEW_SOURCES;
skb = add_grec(skb, pmc, type, 0, 0, 1);
- spin_unlock_bh(&pmc->mca_lock);
}
if (skb)
mld_sendpack(skb);
@@ -2101,13 +2219,13 @@ static void mld_dad_work(struct work_struct *work)
rtnl_lock();
mld_send_initial_cr(idev);
- rtnl_unlock();
if (idev->mc_dad_count) {
idev->mc_dad_count--;
if (idev->mc_dad_count)
mld_dad_start_work(idev,
unsolicited_report_interval(idev));
}
+ rtnl_unlock();
in6_dev_put(idev);
}
@@ -2170,12 +2288,10 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
}
if (!pmc)
return -ESRCH;
- spin_lock_bh(&pmc->mca_lock);
sf_markstate(pmc);
if (!delta) {
if (!pmc->mca_sfcount[sfmode]) {
- spin_unlock_bh(&pmc->mca_lock);
return -EINVAL;
}
@@ -2203,7 +2319,6 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
mld_ifc_event(pmc->idev);
} else if (sf_setstate(pmc) || changerec)
mld_ifc_event(pmc->idev);
- spin_unlock_bh(&pmc->mca_lock);
return err;
}
@@ -2222,7 +2337,7 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
psf_prev = psf;
}
if (!psf) {
- psf = kzalloc(sizeof(*psf), GFP_ATOMIC);
+ psf = kzalloc(sizeof(*psf), GFP_KERNEL);
if (!psf)
return -ENOBUFS;
@@ -2301,7 +2416,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
&psf->sf_addr))
break;
if (!dpsf) {
- dpsf = kmalloc(sizeof(*dpsf), GFP_ATOMIC);
+ dpsf = kmalloc(sizeof(*dpsf), GFP_KERNEL);
if (!dpsf)
continue;
*dpsf = *psf;
@@ -2336,7 +2451,6 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
}
if (!pmc)
return -ESRCH;
- spin_lock_bh(&pmc->mca_lock);
sf_markstate(pmc);
isexclude = pmc->mca_sfmode == MCAST_EXCLUDE;
@@ -2373,7 +2487,6 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
} else if (sf_setstate(pmc)) {
mld_ifc_event(idev);
}
- spin_unlock_bh(&pmc->mca_lock);
return err;
}
@@ -2412,7 +2525,6 @@ static void igmp6_join_group(struct ifmcaddr6 *ma)
delay = prandom_u32() % unsolicited_report_interval(ma->idev);
- spin_lock_bh(&ma->mca_lock);
if (cancel_delayed_work(&ma->mca_work)) {
refcount_dec(&ma->mca_refcnt);
delay = ma->mca_work.timer.expires - jiffies;
@@ -2421,7 +2533,6 @@ static void igmp6_join_group(struct ifmcaddr6 *ma)
if (!mod_delayed_work(mld_wq, &ma->mca_work, delay))
refcount_inc(&ma->mca_refcnt);
ma->mca_flags |= MAF_TIMER_RUNNING | MAF_LAST_REPORTER;
- spin_unlock_bh(&ma->mca_lock);
}
static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
@@ -2466,9 +2577,8 @@ static void mld_gq_work(struct work_struct *work)
rtnl_lock();
mld_send_report(idev, NULL);
- rtnl_unlock();
-
idev->mc_gq_running = 0;
+ rtnl_unlock();
in6_dev_put(idev);
}
@@ -2481,7 +2591,6 @@ static void mld_ifc_work(struct work_struct *work)
rtnl_lock();
mld_send_cr(idev);
- rtnl_unlock();
if (idev->mc_ifc_count) {
idev->mc_ifc_count--;
@@ -2489,6 +2598,7 @@ static void mld_ifc_work(struct work_struct *work)
mld_ifc_start_work(idev,
unsolicited_report_interval(idev));
}
+ rtnl_unlock();
in6_dev_put(idev);
}
@@ -2511,12 +2621,10 @@ static void mld_mca_work(struct work_struct *work)
igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
else
mld_send_report(ma->idev, ma);
- rtnl_unlock();
-
- spin_lock_bh(&ma->mca_lock);
ma->mca_flags |= MAF_LAST_REPORTER;
ma->mca_flags &= ~MAF_TIMER_RUNNING;
- spin_unlock_bh(&ma->mca_lock);
+ rtnl_unlock();
+
ma_put(ma);
}
@@ -2550,6 +2658,9 @@ void ipv6_mc_down(struct inet6_dev *idev)
/* Should stop work after group drop. or we will
* start work again in mld_ifc_event()
*/
+ synchronize_net();
+ mld_query_stop_work(idev);
+ mld_report_stop_work(idev);
mld_ifc_stop_work(idev);
mld_gq_stop_work(idev);
mld_dad_stop_work(idev);
@@ -2589,6 +2700,12 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
idev->mc_ifc_count = 0;
INIT_DELAYED_WORK(&idev->mc_ifc_work, mld_ifc_work);
INIT_DELAYED_WORK(&idev->mc_dad_work, mld_dad_work);
+ INIT_DELAYED_WORK(&idev->mc_query_work, mld_query_work);
+ INIT_DELAYED_WORK(&idev->mc_report_work, mld_report_work);
+ skb_queue_head_init(&idev->mc_query_queue);
+ skb_queue_head_init(&idev->mc_report_queue);
+ spin_lock_init(&idev->mc_query_lock);
+ spin_lock_init(&idev->mc_report_lock);
ipv6_mc_reset(idev);
}
@@ -2603,6 +2720,8 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
/* Deactivate works */
ipv6_mc_down(idev);
mld_clear_delrec(idev);
+ mld_clear_query(idev);
+ mld_clear_report(idev);
/* Delete all-nodes address. */
/* We cannot call ipv6_dev_mc_dec() directly, our caller in
@@ -2792,14 +2911,12 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
im = rcu_dereference(idev->mc_list);
if (likely(im)) {
- spin_lock_bh(&im->mca_lock);
psf = rcu_dereference(im->mca_sources);
if (likely(psf)) {
state->im = im;
state->idev = idev;
break;
}
- spin_unlock_bh(&im->mca_lock);
}
}
return psf;
@@ -2811,7 +2928,6 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
psf = rcu_dereference(psf->sf_next);
while (!psf) {
- spin_unlock_bh(&state->im->mca_lock);
state->im = rcu_dereference(state->im->next);
while (!state->im) {
state->dev = next_net_device_rcu(state->dev);
@@ -2826,7 +2942,6 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
}
if (!state->im)
break;
- spin_lock_bh(&state->im->mca_lock);
psf = rcu_dereference(state->im->mca_sources);
}
out:
@@ -2865,10 +2980,8 @@ static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
{
struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
- if (likely(state->im)) {
- spin_unlock_bh(&state->im->mca_lock);
+ if (likely(state->im))
state->im = NULL;
- }
if (likely(state->idev))
state->idev = NULL;
@@ -2952,6 +3065,7 @@ static int __net_init igmp6_net_init(struct net *net)
}
inet6_sk(net->ipv6.igmp_sk)->hop_limit = 1;
+ net->ipv6.igmp_sk->sk_allocation = GFP_KERNEL;
err = inet_ctl_sock_create(&net->ipv6.mc_autojoin_sk, PF_INET6,
SOCK_RAW, IPPROTO_ICMPV6, net);
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 416/699] mld: add mc_lock for protecting per-interface mld data
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (414 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 415/699] mld: add new workqueues for process mld events Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 417/699] ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report() Greg Kroah-Hartman
` (286 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cong Wang, Taehee Yoo,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
[ Upstream commit 63ed8de4be81b699ca727e9f8e3344bd487806d7 ]
The purpose of this lock is to avoid a bottleneck in the query/report
event handler logic.
By previous patches, almost all mld data is protected by RTNL.
So, the query and report event handler, which is data path logic
acquires RTNL too. Therefore if a lot of query and report events
are received, it uses RTNL for a long time.
So it makes the control-plane bottleneck because of using RTNL.
In order to avoid this bottleneck, mc_lock is added.
mc_lock protect only per-interface mld data and per-interface mld
data is used in the query/report event handler logic.
So, no longer rtnl_lock is needed in the query/report event handler logic.
Therefore bottleneck will be disappeared by mc_lock.
Suggested-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/if_inet6.h | 1 +
net/ipv6/mcast.c | 309 +++++++++++++++++++++++++----------------
2 files changed, 194 insertions(+), 116 deletions(-)
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 592d517da80333..12f7a4a9856eff 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -194,6 +194,7 @@ struct inet6_dev {
spinlock_t mc_query_lock; /* mld query queue lock */
spinlock_t mc_report_lock; /* mld query report lock */
+ struct mutex mc_lock; /* mld global lock */
struct ifacaddr6 *ac_list;
rwlock_t lock;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index a989e952432853..d7fe7ae17bb4c6 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -111,6 +111,8 @@ int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
/*
* socket join on multicast group
*/
+#define mc_dereference(e, idev) \
+ rcu_dereference_protected(e, lockdep_is_held(&(idev)->mc_lock))
#define for_each_pmc_rtnl(np, pmc) \
for (pmc = rtnl_dereference((np)->ipv6_mc_list); \
@@ -122,10 +124,10 @@ int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
pmc; \
pmc = rcu_dereference(pmc->next))
-#define for_each_psf_rtnl(mc, psf) \
- for (psf = rtnl_dereference((mc)->mca_sources); \
+#define for_each_psf_mclock(mc, psf) \
+ for (psf = mc_dereference((mc)->mca_sources, mc->idev); \
psf; \
- psf = rtnl_dereference(psf->sf_next))
+ psf = mc_dereference(psf->sf_next, mc->idev))
#define for_each_psf_rcu(mc, psf) \
for (psf = rcu_dereference((mc)->mca_sources); \
@@ -133,14 +135,14 @@ int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
psf = rcu_dereference(psf->sf_next))
#define for_each_psf_tomb(mc, psf) \
- for (psf = rtnl_dereference((mc)->mca_tomb); \
+ for (psf = mc_dereference((mc)->mca_tomb, mc->idev); \
psf; \
- psf = rtnl_dereference(psf->sf_next))
+ psf = mc_dereference(psf->sf_next, mc->idev))
-#define for_each_mc_rtnl(idev, mc) \
- for (mc = rtnl_dereference((idev)->mc_list); \
+#define for_each_mc_mclock(idev, mc) \
+ for (mc = mc_dereference((idev)->mc_list, idev); \
mc; \
- mc = rtnl_dereference(mc->next))
+ mc = mc_dereference(mc->next, idev))
#define for_each_mc_rcu(idev, mc) \
for (mc = rcu_dereference((idev)->mc_list); \
@@ -148,9 +150,9 @@ int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
mc = rcu_dereference(mc->next))
#define for_each_mc_tomb(idev, mc) \
- for (mc = rtnl_dereference((idev)->mc_tomb); \
+ for (mc = mc_dereference((idev)->mc_tomb, idev); \
mc; \
- mc = rtnl_dereference(mc->next))
+ mc = mc_dereference(mc->next, idev))
static int unsolicited_report_interval(struct inet6_dev *idev)
{
@@ -268,11 +270,12 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
if (dev) {
struct inet6_dev *idev = __in6_dev_get(dev);
- (void) ip6_mc_leave_src(sk, mc_lst, idev);
+ ip6_mc_leave_src(sk, mc_lst, idev);
if (idev)
__ipv6_dev_mc_dec(idev, &mc_lst->addr);
- } else
- (void) ip6_mc_leave_src(sk, mc_lst, NULL);
+ } else {
+ ip6_mc_leave_src(sk, mc_lst, NULL);
+ }
atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
kfree_rcu(mc_lst, rcu);
@@ -329,11 +332,12 @@ void __ipv6_sock_mc_close(struct sock *sk)
if (dev) {
struct inet6_dev *idev = __in6_dev_get(dev);
- (void) ip6_mc_leave_src(sk, mc_lst, idev);
+ ip6_mc_leave_src(sk, mc_lst, idev);
if (idev)
__ipv6_dev_mc_dec(idev, &mc_lst->addr);
- } else
- (void) ip6_mc_leave_src(sk, mc_lst, NULL);
+ } else {
+ ip6_mc_leave_src(sk, mc_lst, NULL);
+ }
atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);
kfree_rcu(mc_lst, rcu);
@@ -376,6 +380,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
err = -EADDRNOTAVAIL;
+ mutex_lock(&idev->mc_lock);
for_each_pmc_rtnl(inet6, pmc) {
if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
continue;
@@ -469,6 +474,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
/* update the interface list */
ip6_mc_add_src(idev, group, omode, 1, source, 1);
done:
+ mutex_unlock(&idev->mc_lock);
if (leavegroup)
err = ipv6_sock_mc_drop(sk, pgsr->gsr_interface, group);
return err;
@@ -529,25 +535,33 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf,
psin6 = (struct sockaddr_in6 *)list;
newpsl->sl_addr[i] = psin6->sin6_addr;
}
+ mutex_lock(&idev->mc_lock);
err = ip6_mc_add_src(idev, group, gsf->gf_fmode,
- newpsl->sl_count, newpsl->sl_addr, 0);
+ newpsl->sl_count, newpsl->sl_addr, 0);
if (err) {
+ mutex_unlock(&idev->mc_lock);
sock_kfree_s(sk, newpsl, IP6_SFLSIZE(newpsl->sl_max));
goto done;
}
+ mutex_unlock(&idev->mc_lock);
} else {
newpsl = NULL;
- (void) ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
+ mutex_lock(&idev->mc_lock);
+ ip6_mc_add_src(idev, group, gsf->gf_fmode, 0, NULL, 0);
+ mutex_unlock(&idev->mc_lock);
}
+ mutex_lock(&idev->mc_lock);
psl = rtnl_dereference(pmc->sflist);
if (psl) {
- (void) ip6_mc_del_src(idev, group, pmc->sfmode,
- psl->sl_count, psl->sl_addr, 0);
+ ip6_mc_del_src(idev, group, pmc->sfmode,
+ psl->sl_count, psl->sl_addr, 0);
atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
kfree_rcu(psl, rcu);
- } else
- (void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
+ } else {
+ ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
+ }
+ mutex_unlock(&idev->mc_lock);
rcu_assign_pointer(pmc->sflist, newpsl);
pmc->sfmode = gsf->gf_fmode;
err = 0;
@@ -650,6 +664,7 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
return rv;
}
+/* called with mc_lock */
static void igmp6_group_added(struct ifmcaddr6 *mc)
{
struct net_device *dev = mc->idev->dev;
@@ -684,6 +699,7 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
mld_ifc_event(mc->idev);
}
+/* called with mc_lock */
static void igmp6_group_dropped(struct ifmcaddr6 *mc)
{
struct net_device *dev = mc->idev->dev;
@@ -711,6 +727,7 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
/*
* deleted ifmcaddr6 manipulation
+ * called with mc_lock
*/
static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
{
@@ -735,13 +752,13 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
struct ip6_sf_list *psf;
rcu_assign_pointer(pmc->mca_tomb,
- rtnl_dereference(im->mca_tomb));
+ mc_dereference(im->mca_tomb, idev));
rcu_assign_pointer(pmc->mca_sources,
- rtnl_dereference(im->mca_sources));
+ mc_dereference(im->mca_sources, idev));
RCU_INIT_POINTER(im->mca_tomb, NULL);
RCU_INIT_POINTER(im->mca_sources, NULL);
- for_each_psf_rtnl(pmc, psf)
+ for_each_psf_mclock(pmc, psf)
psf->sf_crcount = pmc->mca_crcount;
}
@@ -749,6 +766,7 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
rcu_assign_pointer(idev->mc_tomb, pmc);
}
+/* called with mc_lock */
static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
{
struct ip6_sf_list *psf, *sources, *tomb;
@@ -772,15 +790,15 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
im->idev = pmc->idev;
if (im->mca_sfmode == MCAST_INCLUDE) {
tomb = rcu_replace_pointer(im->mca_tomb,
- rtnl_dereference(pmc->mca_tomb),
- lockdep_rtnl_is_held());
+ mc_dereference(pmc->mca_tomb, pmc->idev),
+ lockdep_is_held(&im->idev->mc_lock));
rcu_assign_pointer(pmc->mca_tomb, tomb);
sources = rcu_replace_pointer(im->mca_sources,
- rtnl_dereference(pmc->mca_sources),
- lockdep_rtnl_is_held());
+ mc_dereference(pmc->mca_sources, pmc->idev),
+ lockdep_is_held(&im->idev->mc_lock));
rcu_assign_pointer(pmc->mca_sources, sources);
- for_each_psf_rtnl(im, psf)
+ for_each_psf_mclock(im, psf)
psf->sf_crcount = idev->mc_qrv;
} else {
im->mca_crcount = idev->mc_qrv;
@@ -791,28 +809,29 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
}
}
+/* called with mc_lock */
static void mld_clear_delrec(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *nextpmc;
- pmc = rtnl_dereference(idev->mc_tomb);
+ pmc = mc_dereference(idev->mc_tomb, idev);
RCU_INIT_POINTER(idev->mc_tomb, NULL);
for (; pmc; pmc = nextpmc) {
- nextpmc = rtnl_dereference(pmc->next);
+ nextpmc = mc_dereference(pmc->next, idev);
ip6_mc_clear_src(pmc);
in6_dev_put(pmc->idev);
kfree_rcu(pmc, rcu);
}
/* clear dead sources, too */
- for_each_mc_rtnl(idev, pmc) {
+ for_each_mc_mclock(idev, pmc) {
struct ip6_sf_list *psf, *psf_next;
- psf = rtnl_dereference(pmc->mca_tomb);
+ psf = mc_dereference(pmc->mca_tomb, idev);
RCU_INIT_POINTER(pmc->mca_tomb, NULL);
for (; psf; psf = psf_next) {
- psf_next = rtnl_dereference(psf->sf_next);
+ psf_next = mc_dereference(psf->sf_next, idev);
kfree_rcu(psf, rcu);
}
}
@@ -851,6 +870,7 @@ static void ma_put(struct ifmcaddr6 *mc)
}
}
+/* called with mc_lock */
static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
const struct in6_addr *addr,
unsigned int mode)
@@ -902,10 +922,12 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
return -ENODEV;
}
- for_each_mc_rtnl(idev, mc) {
+ mutex_lock(&idev->mc_lock);
+ for_each_mc_mclock(idev, mc) {
if (ipv6_addr_equal(&mc->mca_addr, addr)) {
mc->mca_users++;
ip6_mc_add_src(idev, &mc->mca_addr, mode, 0, NULL, 0);
+ mutex_unlock(&idev->mc_lock);
in6_dev_put(idev);
return 0;
}
@@ -913,6 +935,7 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
mc = mca_alloc(idev, addr, mode);
if (!mc) {
+ mutex_unlock(&idev->mc_lock);
in6_dev_put(idev);
return -ENOMEM;
}
@@ -924,6 +947,7 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
mld_del_delrec(idev, mc);
igmp6_group_added(mc);
+ mutex_unlock(&idev->mc_lock);
ma_put(mc);
return 0;
}
@@ -935,7 +959,7 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr)
EXPORT_SYMBOL(ipv6_dev_mc_inc);
/*
- * device multicast group del
+ * device multicast group del
*/
int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
{
@@ -943,8 +967,9 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
ASSERT_RTNL();
+ mutex_lock(&idev->mc_lock);
for (map = &idev->mc_list;
- (ma = rtnl_dereference(*map));
+ (ma = mc_dereference(*map, idev));
map = &ma->next) {
if (ipv6_addr_equal(&ma->mca_addr, addr)) {
if (--ma->mca_users == 0) {
@@ -952,14 +977,17 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr)
igmp6_group_dropped(ma);
ip6_mc_clear_src(ma);
+ mutex_unlock(&idev->mc_lock);
ma_put(ma);
return 0;
}
+ mutex_unlock(&idev->mc_lock);
return 0;
}
}
+ mutex_unlock(&idev->mc_lock);
return -ENOENT;
}
@@ -1019,6 +1047,7 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
return rv;
}
+/* called with mc_lock */
static void mld_gq_start_work(struct inet6_dev *idev)
{
unsigned long tv = prandom_u32() % idev->mc_maxdelay;
@@ -1028,6 +1057,7 @@ static void mld_gq_start_work(struct inet6_dev *idev)
in6_dev_hold(idev);
}
+/* called with mc_lock */
static void mld_gq_stop_work(struct inet6_dev *idev)
{
idev->mc_gq_running = 0;
@@ -1035,6 +1065,7 @@ static void mld_gq_stop_work(struct inet6_dev *idev)
__in6_dev_put(idev);
}
+/* called with mc_lock */
static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = prandom_u32() % delay;
@@ -1043,6 +1074,7 @@ static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
in6_dev_hold(idev);
}
+/* called with mc_lock */
static void mld_ifc_stop_work(struct inet6_dev *idev)
{
idev->mc_ifc_count = 0;
@@ -1050,6 +1082,7 @@ static void mld_ifc_stop_work(struct inet6_dev *idev)
__in6_dev_put(idev);
}
+/* called with mc_lock */
static void mld_dad_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = prandom_u32() % delay;
@@ -1080,6 +1113,7 @@ static void mld_report_stop_work(struct inet6_dev *idev)
/*
* IGMP handling (alias multicast ICMPv6 messages)
+ * called with mc_lock
*/
static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
{
@@ -1103,7 +1137,9 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
ma->mca_flags |= MAF_TIMER_RUNNING;
}
-/* mark EXCLUDE-mode sources */
+/* mark EXCLUDE-mode sources
+ * called with mc_lock
+ */
static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
const struct in6_addr *srcs)
{
@@ -1111,7 +1147,7 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
int i, scount;
scount = 0;
- for_each_psf_rtnl(pmc, psf) {
+ for_each_psf_mclock(pmc, psf) {
if (scount == nsrcs)
break;
for (i = 0; i < nsrcs; i++) {
@@ -1132,6 +1168,7 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
return true;
}
+/* called with mc_lock */
static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
const struct in6_addr *srcs)
{
@@ -1144,7 +1181,7 @@ static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
/* mark INCLUDE-mode sources */
scount = 0;
- for_each_psf_rtnl(pmc, psf) {
+ for_each_psf_mclock(pmc, psf) {
if (scount == nsrcs)
break;
for (i = 0; i < nsrcs; i++) {
@@ -1370,7 +1407,7 @@ static void __mld_query_work(struct sk_buff *skb)
int len, err;
if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
- goto out;
+ goto kfree_skb;
/* compute payload length excluding extension headers */
len = ntohs(ipv6_hdr(skb)->payload_len) + sizeof(struct ipv6hdr);
@@ -1387,11 +1424,11 @@ static void __mld_query_work(struct sk_buff *skb)
ipv6_hdr(skb)->hop_limit != 1 ||
!(IP6CB(skb)->flags & IP6SKB_ROUTERALERT) ||
IP6CB(skb)->ra != htons(IPV6_OPT_ROUTERALERT_MLD))
- goto out;
+ goto kfree_skb;
- idev = __in6_dev_get(skb->dev);
+ idev = in6_dev_get(skb->dev);
if (!idev)
- goto out;
+ goto kfree_skb;
mld = (struct mld_msg *)icmp6_hdr(skb);
group = &mld->mld_mca;
@@ -1442,11 +1479,11 @@ static void __mld_query_work(struct sk_buff *skb)
}
if (group_type == IPV6_ADDR_ANY) {
- for_each_mc_rtnl(idev, ma) {
+ for_each_mc_mclock(idev, ma) {
igmp6_group_queried(ma, max_delay);
}
} else {
- for_each_mc_rtnl(idev, ma) {
+ for_each_mc_mclock(idev, ma) {
if (!ipv6_addr_equal(group, &ma->mca_addr))
continue;
if (ma->mca_flags & MAF_TIMER_RUNNING) {
@@ -1468,6 +1505,8 @@ static void __mld_query_work(struct sk_buff *skb)
}
out:
+ in6_dev_put(idev);
+kfree_skb:
consume_skb(skb);
}
@@ -1495,10 +1534,10 @@ static void mld_query_work(struct work_struct *work)
}
spin_unlock_bh(&idev->mc_query_lock);
- rtnl_lock();
+ mutex_lock(&idev->mc_lock);
while ((skb = __skb_dequeue(&q)))
__mld_query_work(skb);
- rtnl_unlock();
+ mutex_unlock(&idev->mc_lock);
if (!rework)
in6_dev_put(idev);
@@ -1530,22 +1569,22 @@ int igmp6_event_report(struct sk_buff *skb)
static void __mld_report_work(struct sk_buff *skb)
{
- struct ifmcaddr6 *ma;
struct inet6_dev *idev;
+ struct ifmcaddr6 *ma;
struct mld_msg *mld;
int addr_type;
/* Our own report looped back. Ignore it. */
if (skb->pkt_type == PACKET_LOOPBACK)
- goto out;
+ goto kfree_skb;
/* send our report if the MC router may not have heard this report */
if (skb->pkt_type != PACKET_MULTICAST &&
skb->pkt_type != PACKET_BROADCAST)
- goto out;
+ goto kfree_skb;
if (!pskb_may_pull(skb, sizeof(*mld) - sizeof(struct icmp6hdr)))
- goto out;
+ goto kfree_skb;
mld = (struct mld_msg *)icmp6_hdr(skb);
@@ -1553,17 +1592,17 @@ static void __mld_report_work(struct sk_buff *skb)
addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
if (addr_type != IPV6_ADDR_ANY &&
!(addr_type&IPV6_ADDR_LINKLOCAL))
- goto out;
+ goto kfree_skb;
- idev = __in6_dev_get(skb->dev);
+ idev = in6_dev_get(skb->dev);
if (!idev)
- goto out;
+ goto kfree_skb;
/*
* Cancel the work for this group
*/
- for_each_mc_rtnl(idev, ma) {
+ for_each_mc_mclock(idev, ma) {
if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
if (cancel_delayed_work(&ma->mca_work))
refcount_dec(&ma->mca_refcnt);
@@ -1573,7 +1612,8 @@ static void __mld_report_work(struct sk_buff *skb)
}
}
-out:
+ in6_dev_put(idev);
+kfree_skb:
consume_skb(skb);
}
@@ -1600,10 +1640,10 @@ static void mld_report_work(struct work_struct *work)
}
spin_unlock_bh(&idev->mc_report_lock);
- rtnl_lock();
+ mutex_lock(&idev->mc_lock);
while ((skb = __skb_dequeue(&q)))
__mld_report_work(skb);
- rtnl_unlock();
+ mutex_unlock(&idev->mc_lock);
if (!rework)
in6_dev_put(idev);
@@ -1659,7 +1699,7 @@ mld_scount(struct ifmcaddr6 *pmc, int type, int gdeleted, int sdeleted)
struct ip6_sf_list *psf;
int scount = 0;
- for_each_psf_rtnl(pmc, psf) {
+ for_each_psf_mclock(pmc, psf) {
if (!is_in(pmc, psf, type, gdeleted, sdeleted))
continue;
scount++;
@@ -1830,6 +1870,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
#define AVAILABLE(skb) ((skb) ? skb_availroom(skb) : 0)
+/* called with mc_lock */
static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
int type, int gdeleted, int sdeleted,
int crsend)
@@ -1875,12 +1916,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
}
first = 1;
psf_prev = NULL;
- for (psf = rtnl_dereference(*psf_list);
+ for (psf = mc_dereference(*psf_list, idev);
psf;
psf = psf_next) {
struct in6_addr *psrc;
- psf_next = rtnl_dereference(psf->sf_next);
+ psf_next = mc_dereference(psf->sf_next, idev);
if (!is_in(pmc, psf, type, gdeleted, sdeleted) && !crsend) {
psf_prev = psf;
@@ -1928,10 +1969,10 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
if ((sdeleted || gdeleted) && psf->sf_crcount == 0) {
if (psf_prev)
rcu_assign_pointer(psf_prev->sf_next,
- rtnl_dereference(psf->sf_next));
+ mc_dereference(psf->sf_next, idev));
else
rcu_assign_pointer(*psf_list,
- rtnl_dereference(psf->sf_next));
+ mc_dereference(psf->sf_next, idev));
kfree_rcu(psf, rcu);
continue;
}
@@ -1961,13 +2002,14 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
return skb;
}
+/* called with mc_lock */
static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
{
struct sk_buff *skb = NULL;
int type;
if (!pmc) {
- for_each_mc_rtnl(idev, pmc) {
+ for_each_mc_mclock(idev, pmc) {
if (pmc->mca_flags & MAF_NOREPORT)
continue;
if (pmc->mca_sfcount[MCAST_EXCLUDE])
@@ -1989,23 +2031,24 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
/*
* remove zero-count source records from a source filter list
+ * called with mc_lock
*/
-static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf)
+static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf, struct inet6_dev *idev)
{
struct ip6_sf_list *psf_prev, *psf_next, *psf;
psf_prev = NULL;
- for (psf = rtnl_dereference(*ppsf);
+ for (psf = mc_dereference(*ppsf, idev);
psf;
psf = psf_next) {
- psf_next = rtnl_dereference(psf->sf_next);
+ psf_next = mc_dereference(psf->sf_next, idev);
if (psf->sf_crcount == 0) {
if (psf_prev)
rcu_assign_pointer(psf_prev->sf_next,
- rtnl_dereference(psf->sf_next));
+ mc_dereference(psf->sf_next, idev));
else
rcu_assign_pointer(*ppsf,
- rtnl_dereference(psf->sf_next));
+ mc_dereference(psf->sf_next, idev));
kfree_rcu(psf, rcu);
} else {
psf_prev = psf;
@@ -2013,6 +2056,7 @@ static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf)
}
}
+/* called with mc_lock */
static void mld_send_cr(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *pmc_prev, *pmc_next;
@@ -2021,10 +2065,10 @@ static void mld_send_cr(struct inet6_dev *idev)
/* deleted MCA's */
pmc_prev = NULL;
- for (pmc = rtnl_dereference(idev->mc_tomb);
+ for (pmc = mc_dereference(idev->mc_tomb, idev);
pmc;
pmc = pmc_next) {
- pmc_next = rtnl_dereference(pmc->next);
+ pmc_next = mc_dereference(pmc->next, idev);
if (pmc->mca_sfmode == MCAST_INCLUDE) {
type = MLD2_BLOCK_OLD_SOURCES;
dtype = MLD2_BLOCK_OLD_SOURCES;
@@ -2038,8 +2082,8 @@ static void mld_send_cr(struct inet6_dev *idev)
}
pmc->mca_crcount--;
if (pmc->mca_crcount == 0) {
- mld_clear_zeros(&pmc->mca_tomb);
- mld_clear_zeros(&pmc->mca_sources);
+ mld_clear_zeros(&pmc->mca_tomb, idev);
+ mld_clear_zeros(&pmc->mca_sources, idev);
}
}
if (pmc->mca_crcount == 0 &&
@@ -2056,7 +2100,7 @@ static void mld_send_cr(struct inet6_dev *idev)
}
/* change recs */
- for_each_mc_rtnl(idev, pmc) {
+ for_each_mc_mclock(idev, pmc) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
type = MLD2_BLOCK_OLD_SOURCES;
dtype = MLD2_ALLOW_NEW_SOURCES;
@@ -2178,6 +2222,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
goto out;
}
+/* called with mc_lock */
static void mld_send_initial_cr(struct inet6_dev *idev)
{
struct sk_buff *skb;
@@ -2188,7 +2233,7 @@ static void mld_send_initial_cr(struct inet6_dev *idev)
return;
skb = NULL;
- for_each_mc_rtnl(idev, pmc) {
+ for_each_mc_mclock(idev, pmc) {
if (pmc->mca_sfcount[MCAST_EXCLUDE])
type = MLD2_CHANGE_TO_EXCLUDE;
else
@@ -2201,6 +2246,7 @@ static void mld_send_initial_cr(struct inet6_dev *idev)
void ipv6_mc_dad_complete(struct inet6_dev *idev)
{
+ mutex_lock(&idev->mc_lock);
idev->mc_dad_count = idev->mc_qrv;
if (idev->mc_dad_count) {
mld_send_initial_cr(idev);
@@ -2209,6 +2255,7 @@ void ipv6_mc_dad_complete(struct inet6_dev *idev)
mld_dad_start_work(idev,
unsolicited_report_interval(idev));
}
+ mutex_unlock(&idev->mc_lock);
}
static void mld_dad_work(struct work_struct *work)
@@ -2216,8 +2263,7 @@ static void mld_dad_work(struct work_struct *work)
struct inet6_dev *idev = container_of(to_delayed_work(work),
struct inet6_dev,
mc_dad_work);
-
- rtnl_lock();
+ mutex_lock(&idev->mc_lock);
mld_send_initial_cr(idev);
if (idev->mc_dad_count) {
idev->mc_dad_count--;
@@ -2225,10 +2271,11 @@ static void mld_dad_work(struct work_struct *work)
mld_dad_start_work(idev,
unsolicited_report_interval(idev));
}
- rtnl_unlock();
+ mutex_unlock(&idev->mc_lock);
in6_dev_put(idev);
}
+/* called with mc_lock */
static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
const struct in6_addr *psfsrc)
{
@@ -2236,7 +2283,7 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
int rv = 0;
psf_prev = NULL;
- for_each_psf_rtnl(pmc, psf) {
+ for_each_psf_mclock(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
break;
psf_prev = psf;
@@ -2252,16 +2299,16 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
/* no more filters for this source */
if (psf_prev)
rcu_assign_pointer(psf_prev->sf_next,
- rtnl_dereference(psf->sf_next));
+ mc_dereference(psf->sf_next, idev));
else
rcu_assign_pointer(pmc->mca_sources,
- rtnl_dereference(psf->sf_next));
+ mc_dereference(psf->sf_next, idev));
if (psf->sf_oldin && !(pmc->mca_flags & MAF_NOREPORT) &&
!mld_in_v1_mode(idev)) {
psf->sf_crcount = idev->mc_qrv;
rcu_assign_pointer(psf->sf_next,
- rtnl_dereference(pmc->mca_tomb));
+ mc_dereference(pmc->mca_tomb, idev));
rcu_assign_pointer(pmc->mca_tomb, psf);
rv = 1;
} else {
@@ -2271,6 +2318,7 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
return rv;
}
+/* called with mc_lock */
static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
int sfmode, int sfcount, const struct in6_addr *psfsrc,
int delta)
@@ -2282,7 +2330,7 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
- for_each_mc_rtnl(idev, pmc) {
+ for_each_mc_mclock(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
}
@@ -2291,9 +2339,8 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
sf_markstate(pmc);
if (!delta) {
- if (!pmc->mca_sfcount[sfmode]) {
+ if (!pmc->mca_sfcount[sfmode])
return -EINVAL;
- }
pmc->mca_sfcount[sfmode]--;
}
@@ -2314,16 +2361,19 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
pmc->mca_sfmode = MCAST_INCLUDE;
pmc->mca_crcount = idev->mc_qrv;
idev->mc_ifc_count = pmc->mca_crcount;
- for_each_psf_rtnl(pmc, psf)
+ for_each_psf_mclock(pmc, psf)
psf->sf_crcount = 0;
mld_ifc_event(pmc->idev);
- } else if (sf_setstate(pmc) || changerec)
+ } else if (sf_setstate(pmc) || changerec) {
mld_ifc_event(pmc->idev);
+ }
+
return err;
}
/*
* Add multicast single-source filter to the interface list
+ * called with mc_lock
*/
static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
const struct in6_addr *psfsrc)
@@ -2331,7 +2381,7 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
struct ip6_sf_list *psf, *psf_prev;
psf_prev = NULL;
- for_each_psf_rtnl(pmc, psf) {
+ for_each_psf_mclock(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
break;
psf_prev = psf;
@@ -2352,12 +2402,13 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
return 0;
}
+/* called with mc_lock */
static void sf_markstate(struct ifmcaddr6 *pmc)
{
struct ip6_sf_list *psf;
int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
- for_each_psf_rtnl(pmc, psf) {
+ for_each_psf_mclock(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
psf->sf_oldin = mca_xcount ==
psf->sf_count[MCAST_EXCLUDE] &&
@@ -2368,6 +2419,7 @@ static void sf_markstate(struct ifmcaddr6 *pmc)
}
}
+/* called with mc_lock */
static int sf_setstate(struct ifmcaddr6 *pmc)
{
struct ip6_sf_list *psf, *dpsf;
@@ -2376,7 +2428,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
int new_in, rv;
rv = 0;
- for_each_psf_rtnl(pmc, psf) {
+ for_each_psf_mclock(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
new_in = mca_xcount == psf->sf_count[MCAST_EXCLUDE] &&
!psf->sf_count[MCAST_INCLUDE];
@@ -2395,10 +2447,12 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
if (dpsf) {
if (prev)
rcu_assign_pointer(prev->sf_next,
- rtnl_dereference(dpsf->sf_next));
+ mc_dereference(dpsf->sf_next,
+ pmc->idev));
else
rcu_assign_pointer(pmc->mca_tomb,
- rtnl_dereference(dpsf->sf_next));
+ mc_dereference(dpsf->sf_next,
+ pmc->idev));
kfree_rcu(dpsf, rcu);
}
psf->sf_crcount = qrv;
@@ -2421,7 +2475,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
continue;
*dpsf = *psf;
rcu_assign_pointer(dpsf->sf_next,
- rtnl_dereference(pmc->mca_tomb));
+ mc_dereference(pmc->mca_tomb, pmc->idev));
rcu_assign_pointer(pmc->mca_tomb, dpsf);
}
dpsf->sf_crcount = qrv;
@@ -2433,6 +2487,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
/*
* Add multicast source filter list to the interface list
+ * called with mc_lock
*/
static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
int sfmode, int sfcount, const struct in6_addr *psfsrc,
@@ -2445,7 +2500,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
- for_each_mc_rtnl(idev, pmc) {
+ for_each_mc_mclock(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
}
@@ -2481,7 +2536,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
pmc->mca_crcount = idev->mc_qrv;
idev->mc_ifc_count = pmc->mca_crcount;
- for_each_psf_rtnl(pmc, psf)
+ for_each_psf_mclock(pmc, psf)
psf->sf_crcount = 0;
mld_ifc_event(idev);
} else if (sf_setstate(pmc)) {
@@ -2490,21 +2545,22 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
return err;
}
+/* called with mc_lock */
static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
{
struct ip6_sf_list *psf, *nextpsf;
- for (psf = rtnl_dereference(pmc->mca_tomb);
+ for (psf = mc_dereference(pmc->mca_tomb, pmc->idev);
psf;
psf = nextpsf) {
- nextpsf = rtnl_dereference(psf->sf_next);
+ nextpsf = mc_dereference(psf->sf_next, pmc->idev);
kfree_rcu(psf, rcu);
}
RCU_INIT_POINTER(pmc->mca_tomb, NULL);
- for (psf = rtnl_dereference(pmc->mca_sources);
+ for (psf = mc_dereference(pmc->mca_sources, pmc->idev);
psf;
psf = nextpsf) {
- nextpsf = rtnl_dereference(psf->sf_next);
+ nextpsf = mc_dereference(psf->sf_next, pmc->idev);
kfree_rcu(psf, rcu);
}
RCU_INIT_POINTER(pmc->mca_sources, NULL);
@@ -2513,7 +2569,7 @@ static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
}
-
+/* called with mc_lock */
static void igmp6_join_group(struct ifmcaddr6 *ma)
{
unsigned long delay;
@@ -2543,19 +2599,27 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
psl = rtnl_dereference(iml->sflist);
+ if (idev)
+ mutex_lock(&idev->mc_lock);
+
if (!psl) {
/* any-source empty exclude case */
err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode, 0, NULL, 0);
} else {
err = ip6_mc_del_src(idev, &iml->addr, iml->sfmode,
- psl->sl_count, psl->sl_addr, 0);
+ psl->sl_count, psl->sl_addr, 0);
RCU_INIT_POINTER(iml->sflist, NULL);
atomic_sub(IP6_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
kfree_rcu(psl, rcu);
}
+
+ if (idev)
+ mutex_unlock(&idev->mc_lock);
+
return err;
}
+/* called with mc_lock */
static void igmp6_leave_group(struct ifmcaddr6 *ma)
{
if (mld_in_v1_mode(ma->idev)) {
@@ -2575,10 +2639,10 @@ static void mld_gq_work(struct work_struct *work)
struct inet6_dev,
mc_gq_work);
- rtnl_lock();
+ mutex_lock(&idev->mc_lock);
mld_send_report(idev, NULL);
idev->mc_gq_running = 0;
- rtnl_unlock();
+ mutex_unlock(&idev->mc_lock);
in6_dev_put(idev);
}
@@ -2589,7 +2653,7 @@ static void mld_ifc_work(struct work_struct *work)
struct inet6_dev,
mc_ifc_work);
- rtnl_lock();
+ mutex_lock(&idev->mc_lock);
mld_send_cr(idev);
if (idev->mc_ifc_count) {
@@ -2598,10 +2662,11 @@ static void mld_ifc_work(struct work_struct *work)
mld_ifc_start_work(idev,
unsolicited_report_interval(idev));
}
- rtnl_unlock();
+ mutex_unlock(&idev->mc_lock);
in6_dev_put(idev);
}
+/* called with mc_lock */
static void mld_ifc_event(struct inet6_dev *idev)
{
if (mld_in_v1_mode(idev))
@@ -2616,14 +2681,14 @@ static void mld_mca_work(struct work_struct *work)
struct ifmcaddr6 *ma = container_of(to_delayed_work(work),
struct ifmcaddr6, mca_work);
- rtnl_lock();
+ mutex_lock(&ma->idev->mc_lock);
if (mld_in_v1_mode(ma->idev))
igmp6_send(&ma->mca_addr, ma->idev->dev, ICMPV6_MGM_REPORT);
else
mld_send_report(ma->idev, ma);
ma->mca_flags |= MAF_LAST_REPORTER;
ma->mca_flags &= ~MAF_TIMER_RUNNING;
- rtnl_unlock();
+ mutex_unlock(&ma->idev->mc_lock);
ma_put(ma);
}
@@ -2636,8 +2701,10 @@ void ipv6_mc_unmap(struct inet6_dev *idev)
/* Install multicast list, except for all-nodes (already installed) */
- for_each_mc_rtnl(idev, i)
+ mutex_lock(&idev->mc_lock);
+ for_each_mc_mclock(idev, i)
igmp6_group_dropped(i);
+ mutex_unlock(&idev->mc_lock);
}
void ipv6_mc_remap(struct inet6_dev *idev)
@@ -2646,14 +2713,15 @@ void ipv6_mc_remap(struct inet6_dev *idev)
}
/* Device going down */
-
void ipv6_mc_down(struct inet6_dev *idev)
{
struct ifmcaddr6 *i;
+ mutex_lock(&idev->mc_lock);
/* Withdraw multicast list */
- for_each_mc_rtnl(idev, i)
+ for_each_mc_mclock(idev, i)
igmp6_group_dropped(i);
+ mutex_unlock(&idev->mc_lock);
/* Should stop work after group drop. or we will
* start work again in mld_ifc_event()
@@ -2684,10 +2752,12 @@ void ipv6_mc_up(struct inet6_dev *idev)
/* Install multicast list, except for all-nodes (already installed) */
ipv6_mc_reset(idev);
- for_each_mc_rtnl(idev, i) {
+ mutex_lock(&idev->mc_lock);
+ for_each_mc_mclock(idev, i) {
mld_del_delrec(idev, i);
igmp6_group_added(i);
}
+ mutex_unlock(&idev->mc_lock);
}
/* IPv6 device initialization. */
@@ -2706,6 +2776,7 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
skb_queue_head_init(&idev->mc_report_queue);
spin_lock_init(&idev->mc_query_lock);
spin_lock_init(&idev->mc_report_lock);
+ mutex_init(&idev->mc_lock);
ipv6_mc_reset(idev);
}
@@ -2719,7 +2790,9 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
/* Deactivate works */
ipv6_mc_down(idev);
+ mutex_lock(&idev->mc_lock);
mld_clear_delrec(idev);
+ mutex_unlock(&idev->mc_lock);
mld_clear_query(idev);
mld_clear_report(idev);
@@ -2733,12 +2806,14 @@ void ipv6_mc_destroy_dev(struct inet6_dev *idev)
if (idev->cnf.forwarding)
__ipv6_dev_mc_dec(idev, &in6addr_linklocal_allrouters);
- while ((i = rtnl_dereference(idev->mc_list))) {
- rcu_assign_pointer(idev->mc_list, rtnl_dereference(i->next));
+ mutex_lock(&idev->mc_lock);
+ while ((i = mc_dereference(idev->mc_list, idev))) {
+ rcu_assign_pointer(idev->mc_list, mc_dereference(i->next, idev));
ip6_mc_clear_src(i);
ma_put(i);
}
+ mutex_unlock(&idev->mc_lock);
}
static void ipv6_mc_rejoin_groups(struct inet6_dev *idev)
@@ -2747,12 +2822,14 @@ static void ipv6_mc_rejoin_groups(struct inet6_dev *idev)
ASSERT_RTNL();
+ mutex_lock(&idev->mc_lock);
if (mld_in_v1_mode(idev)) {
- for_each_mc_rtnl(idev, pmc)
+ for_each_mc_mclock(idev, pmc)
igmp6_join_group(pmc);
} else {
mld_send_report(idev, NULL);
}
+ mutex_unlock(&idev->mc_lock);
}
static int ipv6_mc_netdev_event(struct notifier_block *this,
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 417/699] ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (415 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 416/699] mld: add mc_lock for protecting per-interface mld data Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 418/699] ipv6: mcast: Replace locking comments with lockdep annotations Greg Kroah-Hartman
` (285 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Taehee Yoo, Cong Wang,
David Ahern, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 2d3916f3189172d5c69d33065c3c21119fe539fc ]
While investigating on why a synchronize_net() has been added recently
in ipv6_mc_down(), I found that igmp6_event_query() and igmp6_event_report()
might drop skbs in some cases.
Discussion about removing synchronize_net() from ipv6_mc_down()
will happen in a different thread.
Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Taehee Yoo <ap420073@gmail.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20220303173728.937869-1-eric.dumazet@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ndisc.h | 4 ++--
net/ipv6/mcast.c | 32 ++++++++++++--------------------
2 files changed, 14 insertions(+), 22 deletions(-)
diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 38e4094960cee8..e97ef508664f4c 100644
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -487,9 +487,9 @@ int igmp6_late_init(void);
void igmp6_cleanup(void);
void igmp6_late_cleanup(void);
-int igmp6_event_query(struct sk_buff *skb);
+void igmp6_event_query(struct sk_buff *skb);
-int igmp6_event_report(struct sk_buff *skb);
+void igmp6_event_report(struct sk_buff *skb);
#ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index d7fe7ae17bb4c6..e72058af646a84 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1371,27 +1371,23 @@ static int mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
}
/* called with rcu_read_lock() */
-int igmp6_event_query(struct sk_buff *skb)
+void igmp6_event_query(struct sk_buff *skb)
{
struct inet6_dev *idev = __in6_dev_get(skb->dev);
- if (!idev)
- return -EINVAL;
-
- if (idev->dead) {
- kfree_skb(skb);
- return -ENODEV;
- }
+ if (!idev || idev->dead)
+ goto out;
spin_lock_bh(&idev->mc_query_lock);
if (skb_queue_len(&idev->mc_query_queue) < MLD_MAX_SKBS) {
__skb_queue_tail(&idev->mc_query_queue, skb);
if (!mod_delayed_work(mld_wq, &idev->mc_query_work, 0))
in6_dev_hold(idev);
+ skb = NULL;
}
spin_unlock_bh(&idev->mc_query_lock);
-
- return 0;
+out:
+ kfree_skb(skb);
}
static void __mld_query_work(struct sk_buff *skb)
@@ -1544,27 +1540,23 @@ static void mld_query_work(struct work_struct *work)
}
/* called with rcu_read_lock() */
-int igmp6_event_report(struct sk_buff *skb)
+void igmp6_event_report(struct sk_buff *skb)
{
struct inet6_dev *idev = __in6_dev_get(skb->dev);
- if (!idev)
- return -EINVAL;
-
- if (idev->dead) {
- kfree_skb(skb);
- return -ENODEV;
- }
+ if (!idev || idev->dead)
+ goto out;
spin_lock_bh(&idev->mc_report_lock);
if (skb_queue_len(&idev->mc_report_queue) < MLD_MAX_SKBS) {
__skb_queue_tail(&idev->mc_report_queue, skb);
if (!mod_delayed_work(mld_wq, &idev->mc_report_work, 0))
in6_dev_hold(idev);
+ skb = NULL;
}
spin_unlock_bh(&idev->mc_report_lock);
-
- return 0;
+out:
+ kfree_skb(skb);
}
static void __mld_report_work(struct sk_buff *skb)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 418/699] ipv6: mcast: Replace locking comments with lockdep annotations.
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (416 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 417/699] ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report() Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 419/699] ipv6: mcast: Fix potential UAF in MLD delayed work Greg Kroah-Hartman
` (284 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 818ae1a5ecb41d82ad180a99c39111f051894d90 ]
Commit 63ed8de4be81 ("mld: add mc_lock for protecting per-interface
mld data") added the same comments regarding locking to many functions.
Let's replace the comments with lockdep annotation, which is more helpful.
Note that we just remove the comment for mld_clear_zeros() and
mld_send_cr(), where mc_dereference() is used in the entry of the
function.
While at it, a comment for __ipv6_sock_mc_join() is moved back to the
correct place.
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250702230210.3115355-3-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 9b26518b6896 ("ipv6: mcast: Fix potential UAF in MLD delayed work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/mcast.c | 125 +++++++++++++++++++++++++++--------------------
1 file changed, 71 insertions(+), 54 deletions(-)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index e72058af646a84..d4217bf93986cb 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -108,9 +108,9 @@ static int __ipv6_dev_mc_inc(struct net_device *dev,
int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
int sysctl_mld_qrv __read_mostly = MLD_QRV_DEFAULT;
-/*
- * socket join on multicast group
- */
+#define mc_assert_locked(idev) \
+ lockdep_assert_held(&(idev)->mc_lock)
+
#define mc_dereference(e, idev) \
rcu_dereference_protected(e, lockdep_is_held(&(idev)->mc_lock))
@@ -166,6 +166,9 @@ static int unsolicited_report_interval(struct inet6_dev *idev)
return iv > 0 ? iv : 1;
}
+/*
+ * socket join on multicast group
+ */
static int __ipv6_sock_mc_join(struct sock *sk, int ifindex,
const struct in6_addr *addr, unsigned int mode)
{
@@ -664,12 +667,13 @@ bool inet6_mc_check(struct sock *sk, const struct in6_addr *mc_addr,
return rv;
}
-/* called with mc_lock */
static void igmp6_group_added(struct ifmcaddr6 *mc)
{
struct net_device *dev = mc->idev->dev;
char buf[MAX_ADDR_LEN];
+ mc_assert_locked(mc->idev);
+
if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
IPV6_ADDR_SCOPE_LINKLOCAL)
return;
@@ -699,12 +703,13 @@ static void igmp6_group_added(struct ifmcaddr6 *mc)
mld_ifc_event(mc->idev);
}
-/* called with mc_lock */
static void igmp6_group_dropped(struct ifmcaddr6 *mc)
{
struct net_device *dev = mc->idev->dev;
char buf[MAX_ADDR_LEN];
+ mc_assert_locked(mc->idev);
+
if (IPV6_ADDR_MC_SCOPE(&mc->mca_addr) <
IPV6_ADDR_SCOPE_LINKLOCAL)
return;
@@ -725,14 +730,13 @@ static void igmp6_group_dropped(struct ifmcaddr6 *mc)
refcount_dec(&mc->mca_refcnt);
}
-/*
- * deleted ifmcaddr6 manipulation
- * called with mc_lock
- */
+/* deleted ifmcaddr6 manipulation */
static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
{
struct ifmcaddr6 *pmc;
+ mc_assert_locked(idev);
+
/* this is an "ifmcaddr6" for convenience; only the fields below
* are actually used. In particular, the refcnt and users are not
* used for management of the delete list. Using the same structure
@@ -766,13 +770,14 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
rcu_assign_pointer(idev->mc_tomb, pmc);
}
-/* called with mc_lock */
static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
{
struct ip6_sf_list *psf, *sources, *tomb;
struct in6_addr *pmca = &im->mca_addr;
struct ifmcaddr6 *pmc, *pmc_prev;
+ mc_assert_locked(idev);
+
pmc_prev = NULL;
for_each_mc_tomb(idev, pmc) {
if (ipv6_addr_equal(&pmc->mca_addr, pmca))
@@ -809,11 +814,12 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
}
}
-/* called with mc_lock */
static void mld_clear_delrec(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *nextpmc;
+ mc_assert_locked(idev);
+
pmc = mc_dereference(idev->mc_tomb, idev);
RCU_INIT_POINTER(idev->mc_tomb, NULL);
@@ -870,13 +876,14 @@ static void ma_put(struct ifmcaddr6 *mc)
}
}
-/* called with mc_lock */
static struct ifmcaddr6 *mca_alloc(struct inet6_dev *idev,
const struct in6_addr *addr,
unsigned int mode)
{
struct ifmcaddr6 *mc;
+ mc_assert_locked(idev);
+
mc = kzalloc(sizeof(*mc), GFP_KERNEL);
if (!mc)
return NULL;
@@ -1047,46 +1054,51 @@ bool ipv6_chk_mcast_addr(struct net_device *dev, const struct in6_addr *group,
return rv;
}
-/* called with mc_lock */
static void mld_gq_start_work(struct inet6_dev *idev)
{
unsigned long tv = prandom_u32() % idev->mc_maxdelay;
+ mc_assert_locked(idev);
+
idev->mc_gq_running = 1;
if (!mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
in6_dev_hold(idev);
}
-/* called with mc_lock */
static void mld_gq_stop_work(struct inet6_dev *idev)
{
+ mc_assert_locked(idev);
+
idev->mc_gq_running = 0;
if (cancel_delayed_work(&idev->mc_gq_work))
__in6_dev_put(idev);
}
-/* called with mc_lock */
static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = prandom_u32() % delay;
+ mc_assert_locked(idev);
+
if (!mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
in6_dev_hold(idev);
}
-/* called with mc_lock */
static void mld_ifc_stop_work(struct inet6_dev *idev)
{
+ mc_assert_locked(idev);
+
idev->mc_ifc_count = 0;
if (cancel_delayed_work(&idev->mc_ifc_work))
__in6_dev_put(idev);
}
-/* called with mc_lock */
static void mld_dad_start_work(struct inet6_dev *idev, unsigned long delay)
{
unsigned long tv = prandom_u32() % delay;
+ mc_assert_locked(idev);
+
if (!mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
in6_dev_hold(idev);
}
@@ -1111,14 +1123,13 @@ static void mld_report_stop_work(struct inet6_dev *idev)
__in6_dev_put(idev);
}
-/*
- * IGMP handling (alias multicast ICMPv6 messages)
- * called with mc_lock
- */
+/* IGMP handling (alias multicast ICMPv6 messages) */
static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
{
unsigned long delay = resptime;
+ mc_assert_locked(ma->idev);
+
/* Do not start work for these addresses */
if (ipv6_addr_is_ll_all_nodes(&ma->mca_addr) ||
IPV6_ADDR_MC_SCOPE(&ma->mca_addr) < IPV6_ADDR_SCOPE_LINKLOCAL)
@@ -1137,15 +1148,15 @@ static void igmp6_group_queried(struct ifmcaddr6 *ma, unsigned long resptime)
ma->mca_flags |= MAF_TIMER_RUNNING;
}
-/* mark EXCLUDE-mode sources
- * called with mc_lock
- */
+/* mark EXCLUDE-mode sources */
static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
const struct in6_addr *srcs)
{
struct ip6_sf_list *psf;
int i, scount;
+ mc_assert_locked(pmc->idev);
+
scount = 0;
for_each_psf_mclock(pmc, psf) {
if (scount == nsrcs)
@@ -1168,13 +1179,14 @@ static bool mld_xmarksources(struct ifmcaddr6 *pmc, int nsrcs,
return true;
}
-/* called with mc_lock */
static bool mld_marksources(struct ifmcaddr6 *pmc, int nsrcs,
const struct in6_addr *srcs)
{
struct ip6_sf_list *psf;
int i, scount;
+ mc_assert_locked(pmc->idev);
+
if (pmc->mca_sfmode == MCAST_EXCLUDE)
return mld_xmarksources(pmc, nsrcs, srcs);
@@ -1862,7 +1874,6 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
#define AVAILABLE(skb) ((skb) ? skb_availroom(skb) : 0)
-/* called with mc_lock */
static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
int type, int gdeleted, int sdeleted,
int crsend)
@@ -1876,6 +1887,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
struct mld2_report *pmr;
unsigned int mtu;
+ mc_assert_locked(idev);
+
if (pmc->mca_flags & MAF_NOREPORT)
return skb;
@@ -1994,12 +2007,13 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
return skb;
}
-/* called with mc_lock */
static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
{
struct sk_buff *skb = NULL;
int type;
+ mc_assert_locked(idev);
+
if (!pmc) {
for_each_mc_mclock(idev, pmc) {
if (pmc->mca_flags & MAF_NOREPORT)
@@ -2021,10 +2035,7 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
mld_sendpack(skb);
}
-/*
- * remove zero-count source records from a source filter list
- * called with mc_lock
- */
+/* remove zero-count source records from a source filter list */
static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf, struct inet6_dev *idev)
{
struct ip6_sf_list *psf_prev, *psf_next, *psf;
@@ -2048,7 +2059,6 @@ static void mld_clear_zeros(struct ip6_sf_list __rcu **ppsf, struct inet6_dev *i
}
}
-/* called with mc_lock */
static void mld_send_cr(struct inet6_dev *idev)
{
struct ifmcaddr6 *pmc, *pmc_prev, *pmc_next;
@@ -2214,13 +2224,14 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
goto out;
}
-/* called with mc_lock */
static void mld_send_initial_cr(struct inet6_dev *idev)
{
- struct sk_buff *skb;
struct ifmcaddr6 *pmc;
+ struct sk_buff *skb;
int type;
+ mc_assert_locked(idev);
+
if (mld_in_v1_mode(idev))
return;
@@ -2267,13 +2278,14 @@ static void mld_dad_work(struct work_struct *work)
in6_dev_put(idev);
}
-/* called with mc_lock */
static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
- const struct in6_addr *psfsrc)
+ const struct in6_addr *psfsrc)
{
struct ip6_sf_list *psf, *psf_prev;
int rv = 0;
+ mc_assert_locked(pmc->idev);
+
psf_prev = NULL;
for_each_psf_mclock(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
@@ -2310,7 +2322,6 @@ static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
return rv;
}
-/* called with mc_lock */
static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
int sfmode, int sfcount, const struct in6_addr *psfsrc,
int delta)
@@ -2322,6 +2333,8 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
+ mc_assert_locked(idev);
+
for_each_mc_mclock(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
@@ -2363,15 +2376,14 @@ static int ip6_mc_del_src(struct inet6_dev *idev, const struct in6_addr *pmca,
return err;
}
-/*
- * Add multicast single-source filter to the interface list
- * called with mc_lock
- */
+/* Add multicast single-source filter to the interface list */
static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
- const struct in6_addr *psfsrc)
+ const struct in6_addr *psfsrc)
{
struct ip6_sf_list *psf, *psf_prev;
+ mc_assert_locked(pmc->idev);
+
psf_prev = NULL;
for_each_psf_mclock(pmc, psf) {
if (ipv6_addr_equal(&psf->sf_addr, psfsrc))
@@ -2394,11 +2406,12 @@ static int ip6_mc_add1_src(struct ifmcaddr6 *pmc, int sfmode,
return 0;
}
-/* called with mc_lock */
static void sf_markstate(struct ifmcaddr6 *pmc)
{
- struct ip6_sf_list *psf;
int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
+ struct ip6_sf_list *psf;
+
+ mc_assert_locked(pmc->idev);
for_each_psf_mclock(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
@@ -2411,14 +2424,15 @@ static void sf_markstate(struct ifmcaddr6 *pmc)
}
}
-/* called with mc_lock */
static int sf_setstate(struct ifmcaddr6 *pmc)
{
- struct ip6_sf_list *psf, *dpsf;
int mca_xcount = pmc->mca_sfcount[MCAST_EXCLUDE];
+ struct ip6_sf_list *psf, *dpsf;
int qrv = pmc->idev->mc_qrv;
int new_in, rv;
+ mc_assert_locked(pmc->idev);
+
rv = 0;
for_each_psf_mclock(pmc, psf) {
if (pmc->mca_sfcount[MCAST_EXCLUDE]) {
@@ -2477,10 +2491,7 @@ static int sf_setstate(struct ifmcaddr6 *pmc)
return rv;
}
-/*
- * Add multicast source filter list to the interface list
- * called with mc_lock
- */
+/* Add multicast source filter list to the interface list */
static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
int sfmode, int sfcount, const struct in6_addr *psfsrc,
int delta)
@@ -2492,6 +2503,8 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
if (!idev)
return -ENODEV;
+ mc_assert_locked(idev);
+
for_each_mc_mclock(idev, pmc) {
if (ipv6_addr_equal(pmca, &pmc->mca_addr))
break;
@@ -2537,11 +2550,12 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
return err;
}
-/* called with mc_lock */
static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
{
struct ip6_sf_list *psf, *nextpsf;
+ mc_assert_locked(pmc->idev);
+
for (psf = mc_dereference(pmc->mca_tomb, pmc->idev);
psf;
psf = nextpsf) {
@@ -2561,11 +2575,12 @@ static void ip6_mc_clear_src(struct ifmcaddr6 *pmc)
pmc->mca_sfcount[MCAST_EXCLUDE] = 1;
}
-/* called with mc_lock */
static void igmp6_join_group(struct ifmcaddr6 *ma)
{
unsigned long delay;
+ mc_assert_locked(ma->idev);
+
if (ma->mca_flags & MAF_NOREPORT)
return;
@@ -2611,9 +2626,10 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
return err;
}
-/* called with mc_lock */
static void igmp6_leave_group(struct ifmcaddr6 *ma)
{
+ mc_assert_locked(ma->idev);
+
if (mld_in_v1_mode(ma->idev)) {
if (ma->mca_flags & MAF_LAST_REPORTER) {
igmp6_send(&ma->mca_addr, ma->idev->dev,
@@ -2658,9 +2674,10 @@ static void mld_ifc_work(struct work_struct *work)
in6_dev_put(idev);
}
-/* called with mc_lock */
static void mld_ifc_event(struct inet6_dev *idev)
{
+ mc_assert_locked(idev);
+
if (mld_in_v1_mode(idev))
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 419/699] ipv6: mcast: Fix potential UAF in MLD delayed work
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (417 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 418/699] ipv6: mcast: Replace locking comments with lockdep annotations Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 420/699] ipvs: pass parsed transport offset to state handlers Greg Kroah-Hartman
` (283 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Ido Schimmel,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9b26518b6896a16b809b1e42986f4ebac7bccc1e ]
A race condition exists between device teardown and incoming MLD query
processing, leading to a Use-After-Free in the MLD delayed work.
During device destruction, the primary reference to inet6_dev is dropped,
which can drop its refcount to 0. The actual freeing of inet6_dev memory
is deferred via RCU.
Concurrently, the packet receive path runs under RCU read lock and obtains
the inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can
safely dereference inet6_dev even if its refcount has hit 0.
However, if CPU-0 calls igmp6_event_query() and schedules delayed work, it
attempts to acquire a reference using in6_dev_hold(). This increments the
refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning.
Since the inet6_dev memory is still scheduled to be freed after the RCU
grace period, the device is freed while the work is still scheduled.
When the work runs, it accesses the freed memory, causing a kernel panic.
Fix this by using refcount_inc_not_zero() (via a new helper
in6_dev_hold_safe()) to prevent acquiring a reference if the device is
already being destroyed. If the refcount is 0, we do not schedule the work.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/addrconf.h | 5 +++++
net/ipv6/mcast.c | 40 ++++++++++++++++++++++++++++------------
2 files changed, 33 insertions(+), 12 deletions(-)
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 0d6a20841d3ac8..54979ebf9981c9 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -411,6 +411,11 @@ static inline void in6_dev_hold(struct inet6_dev *idev)
refcount_inc(&idev->refcnt);
}
+static inline bool in6_dev_hold_safe(struct inet6_dev *idev)
+{
+ return refcount_inc_not_zero(&idev->refcnt);
+}
+
/* called with rcu_read_lock held */
static inline bool ip6_ignore_linkdown(const struct net_device *dev)
{
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index d4217bf93986cb..13be720abcd16d 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1061,8 +1061,10 @@ static void mld_gq_start_work(struct inet6_dev *idev)
mc_assert_locked(idev);
idev->mc_gq_running = 1;
- if (!mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
- in6_dev_hold(idev);
+ if (in6_dev_hold_safe(idev)) {
+ if (mod_delayed_work(mld_wq, &idev->mc_gq_work, tv + 2))
+ in6_dev_put(idev);
+ }
}
static void mld_gq_stop_work(struct inet6_dev *idev)
@@ -1080,8 +1082,10 @@ static void mld_ifc_start_work(struct inet6_dev *idev, unsigned long delay)
mc_assert_locked(idev);
- if (!mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
- in6_dev_hold(idev);
+ if (in6_dev_hold_safe(idev)) {
+ if (mod_delayed_work(mld_wq, &idev->mc_ifc_work, tv + 2))
+ in6_dev_put(idev);
+ }
}
static void mld_ifc_stop_work(struct inet6_dev *idev)
@@ -1099,8 +1103,10 @@ static void mld_dad_start_work(struct inet6_dev *idev, unsigned long delay)
mc_assert_locked(idev);
- if (!mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
- in6_dev_hold(idev);
+ if (in6_dev_hold_safe(idev)) {
+ if (mod_delayed_work(mld_wq, &idev->mc_dad_work, tv + 2))
+ in6_dev_put(idev);
+ }
}
static void mld_dad_stop_work(struct inet6_dev *idev)
@@ -1386,18 +1392,23 @@ static int mld_process_v2(struct inet6_dev *idev, struct mld2_query *mld,
void igmp6_event_query(struct sk_buff *skb)
{
struct inet6_dev *idev = __in6_dev_get(skb->dev);
+ bool put = false;
if (!idev || idev->dead)
goto out;
spin_lock_bh(&idev->mc_query_lock);
- if (skb_queue_len(&idev->mc_query_queue) < MLD_MAX_SKBS) {
+ if (skb_queue_len(&idev->mc_query_queue) < MLD_MAX_SKBS &&
+ in6_dev_hold_safe(idev)) {
__skb_queue_tail(&idev->mc_query_queue, skb);
- if (!mod_delayed_work(mld_wq, &idev->mc_query_work, 0))
- in6_dev_hold(idev);
+ if (mod_delayed_work(mld_wq, &idev->mc_query_work, 0))
+ put = true;
skb = NULL;
}
spin_unlock_bh(&idev->mc_query_lock);
+
+ if (put)
+ in6_dev_put(idev);
out:
kfree_skb(skb);
}
@@ -1555,18 +1566,23 @@ static void mld_query_work(struct work_struct *work)
void igmp6_event_report(struct sk_buff *skb)
{
struct inet6_dev *idev = __in6_dev_get(skb->dev);
+ bool put = false;
if (!idev || idev->dead)
goto out;
spin_lock_bh(&idev->mc_report_lock);
- if (skb_queue_len(&idev->mc_report_queue) < MLD_MAX_SKBS) {
+ if (skb_queue_len(&idev->mc_report_queue) < MLD_MAX_SKBS &&
+ in6_dev_hold_safe(idev)) {
__skb_queue_tail(&idev->mc_report_queue, skb);
- if (!mod_delayed_work(mld_wq, &idev->mc_report_work, 0))
- in6_dev_hold(idev);
+ if (mod_delayed_work(mld_wq, &idev->mc_report_work, 0))
+ put = true;
skb = NULL;
}
spin_unlock_bh(&idev->mc_report_lock);
+
+ if (put)
+ in6_dev_put(idev);
out:
kfree_skb(skb);
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 420/699] ipvs: pass parsed transport offset to state handlers
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (418 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 419/699] ipv6: mcast: Fix potential UAF in MLD delayed work Greg Kroah-Hartman
@ 2026-07-21 15:22 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 421/699] ipvs: use parsed transport offset in TCP state lookup Greg Kroah-Hartman
` (282 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:22 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Julian Anastasov,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit bae7ce7bafb59e42dc0e0e2999fdd9d1cffe3866 ]
IPVS callers already parse the packet into struct ip_vs_iphdr before
updating connection state. For IPv6 this records the real
transport-header offset after extension headers in iph.len.
Pass this parsed transport offset through ip_vs_set_state() and the
protocol state_transition() callback so protocol handlers can use the
same packet context as scheduling and NAT handling. This patch only
changes the common callback plumbing and adapts the protocol callback
signatures; TCP and SCTP start using the value in follow-up patches.
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 2500fa3958b1 ("ipvs: use parsed transport offset in TCP state lookup")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip_vs.h | 3 ++-
net/netfilter/ipvs/ip_vs_core.c | 10 +++++-----
net/netfilter/ipvs/ip_vs_proto_sctp.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 ++-
5 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 7891c17ff8b688..0b8352a6310e98 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -455,7 +455,8 @@ struct ip_vs_protocol {
void (*state_transition)(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd);
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len);
int (*register_app)(struct netns_ipvs *ipvs, struct ip_vs_app *inc);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 3a76da58d88bb6..9d9af5a754a955 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -232,10 +232,10 @@ ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
static inline void
ip_vs_set_state(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd, unsigned int iph_len)
{
if (likely(pd->pp->state_transition))
- pd->pp->state_transition(cp, direction, skb, pd);
+ pd->pp->state_transition(cp, direction, skb, pd, iph_len);
}
static inline int
@@ -637,7 +637,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
ip_vs_in_stats(cp, skb);
/* set state */
- ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd, iph->len);
/* transmit the first SYN packet */
ret = cp->packet_xmit(skb, cp, pd->pp, iph);
@@ -1320,7 +1320,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
after_nat:
ip_vs_out_stats(cp, skb);
- ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd, iph->len);
skb->ipvs_property = 1;
if (!(cp->flags & IP_VS_CONN_F_NFCT))
ip_vs_notrack(skb);
@@ -2116,7 +2116,7 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
IP_VS_DBG_PKT(11, af, pp, skb, iph.off, "Incoming packet");
ip_vs_in_stats(cp, skb);
- ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd, iph.len);
if (cp->packet_xmit)
ret = cp->packet_xmit(skb, cp, pp, &iph);
/* do not touch skb anymore */
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 63c78a1f3918a7..394367b7b38879 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -468,7 +468,8 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
static void
sctp_state_transition(struct ip_vs_conn *cp, int direction,
- const struct sk_buff *skb, struct ip_vs_proto_data *pd)
+ const struct sk_buff *skb, struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
spin_lock_bh(&cp->lock);
set_sctp_state(pd, cp, direction, skb);
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index ede4fa3b63f52d..dc8394383c148e 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -580,7 +580,8 @@ set_tcp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
static void
tcp_state_transition(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
struct tcphdr _tcph, *th;
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index ffbebda547fc10..dbd4155bb07526 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -445,7 +445,8 @@ static const char * udp_state_name(int state)
static void
udp_state_transition(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
if (unlikely(!pd)) {
pr_err("UDP no ns data\n");
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 421/699] ipvs: use parsed transport offset in TCP state lookup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (419 preceding siblings ...)
2026-07-21 15:22 ` [PATCH 5.10 420/699] ipvs: pass parsed transport offset to state handlers Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 422/699] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors Greg Kroah-Hartman
` (281 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Julian Anastasov, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit 2500fa3958b1ba51c2b065e39db1b04dfa7e23a2 ]
TCP state handling reparses the skb to find the TCP header. For IPv6 it
uses sizeof(struct ipv6hdr), while the surrounding IPVS code already
parsed the packet with ip_vs_fill_iph_skb() and has the real
transport-header offset in iph.len.
This makes TCP state handling look at the wrong bytes when an IPv6
packet carries extension headers. Use the parsed transport offset passed
down from ip_vs_set_state() when reading the TCP header.
For IPv4 and for IPv6 packets without extension headers, the passed
offset matches the previous value.
Fixes: 0bbdd42b7efa6 ("IPVS: Extend protocol DNAT/SNAT and state handlers")
Link: https://lore.kernel.org/netdev/20260705125659.37744-1-zhaoyz24@mails.tsinghua.edu.cn/
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_proto_tcp.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index dc8394383c148e..b382810156b2c6 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -585,13 +585,7 @@ tcp_state_transition(struct ip_vs_conn *cp, int direction,
{
struct tcphdr _tcph, *th;
-#ifdef CONFIG_IP_VS_IPV6
- int ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
-#else
- int ihl = ip_hdrlen(skb);
-#endif
-
- th = skb_header_pointer(skb, ihl, sizeof(_tcph), &_tcph);
+ th = skb_header_pointer(skb, iph_len, sizeof(_tcph), &_tcph);
if (th == NULL)
return;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 422/699] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (420 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 421/699] ipvs: use parsed transport offset in TCP state lookup Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 423/699] ipvs: ensure inner headers in ICMP errors are in headroom Greg Kroah-Hartman
` (280 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Julian Anastasov, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
[ Upstream commit 6b335af0d0d1ff44ac579d106953bf19299e5233 ]
When an ICMP Fragmentation Needed error is received for a tunneled IPVS
connection, ip_vs_in_icmp() recomputes the MTU that the original packet
can use by subtracting the tunnel overhead from the reported next-hop
MTU.
The current code always subtracts sizeof(struct iphdr), which is only
the IPIP overhead. For GUE and GRE tunnels, ipvs_udp_decap() and
ipvs_gre_decap() already compute the additional tunnel header length,
but that value is scoped to the decapsulation block and is lost before
the ICMP_FRAG_NEEDED handling. As a result, the ICMP error sent back to
the client advertises an MTU that is too large, so PMTUD can fail to
converge for GUE/GRE-tunneled real servers.
With a reported next-hop MTU of 1400, a GUE tunnel currently returns
1380 to the client. The correct value is 1368:
1400 - sizeof(struct iphdr) - sizeof(struct udphdr) -
sizeof(struct guehdr)
Hoist the tunnel header length into the main ip_vs_in_icmp() scope and
subtract sizeof(struct iphdr) + ulen in the Fragmentation Needed path.
The IPIP path keeps ulen as 0, so its existing 1400 - 20 = 1380 result
is unchanged.
Fixes: 508f744c0de3 ("ipvs: strip udp tunnel headers from icmp errors")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: 3f7a535ff0fa ("ipvs: ensure inner headers in ICMP errors are in headroom")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 9d9af5a754a955..3a338f20fb6c07 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1653,6 +1653,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
bool tunnel, new_cp = false;
union nf_inet_addr *raddr;
char *outer_proto = "IPIP";
+ int ulen = 0;
*related = 1;
@@ -1717,7 +1718,6 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Error for our tunnel must arrive at LOCAL_IN */
(skb_rtable(skb)->rt_flags & RTCF_LOCAL)) {
__u8 iproto;
- int ulen;
/* Non-first fragment has no UDP/GRE header */
if (unlikely(cih->frag_off & htons(IP_OFFSET)))
@@ -1822,8 +1822,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
if (dest_dst)
mtu = dst_mtu(dest_dst->dst_cache);
}
- if (mtu > 68 + sizeof(struct iphdr))
- mtu -= sizeof(struct iphdr);
+ if (mtu > 68 + sizeof(struct iphdr) + ulen)
+ mtu -= sizeof(struct iphdr) + ulen;
info = htonl(mtu);
}
/* Strip outer IP, ICMP and IPIP/UDP/GRE, go to IP header of
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 423/699] ipvs: ensure inner headers in ICMP errors are in headroom
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (421 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 422/699] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 424/699] dm era: fix NULL pointer dereference in metadata_open() Greg Kroah-Hartman
` (279 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julian Anastasov, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
[ Upstream commit 3f7a535ff0fa627a0132803e4c2f903ceffcbc1c ]
Sashiko points out that after stripping the outer headers
with pskb_pull() we should ensure the inner IP headers
in ICMP errors from tunnels are present in the skb headroom
for functions like ipv4_update_pmtu(), icmp_send() and
IP_VS_DBG().
Also, add more checks for the length of the inner headers.
Fixes: f2edb9f7706d ("ipvs: implement passive PMTUD for IPIP packets")
Link: https://sashiko.dev/#/patchset/20260702073430.67680-1-zhaoyz24%40mails.tsinghua.edu.cn
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_core.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 3a338f20fb6c07..4ce5aa8be321e5 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1653,6 +1653,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
bool tunnel, new_cp = false;
union nf_inet_addr *raddr;
char *outer_proto = "IPIP";
+ unsigned int hlen_ipip;
int ulen = 0;
*related = 1;
@@ -1690,9 +1691,10 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Now find the contained IP header */
offset += sizeof(_icmph);
cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
- if (cih == NULL)
+ if (!(cih && cih->version == 4 && cih->ihl >= 5))
return NF_ACCEPT; /* The packet looks wrong, ignore */
raddr = (union nf_inet_addr *)&cih->daddr;
+ hlen_ipip = cih->ihl * 4;
/* Special case for errors for IPIP/UDP/GRE tunnel packets */
tunnel = false;
@@ -1708,9 +1710,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Only for known tunnel */
if (!dest || dest->tun_type != IP_VS_CONN_F_TUNNEL_TYPE_IPIP)
return NF_ACCEPT;
- offset += cih->ihl * 4;
+ offset += hlen_ipip;
cih = skb_header_pointer(skb, offset, sizeof(_ciph), &_ciph);
- if (cih == NULL)
+ if (!(cih && cih->version == 4 && cih->ihl >= 5))
return NF_ACCEPT; /* The packet looks wrong, ignore */
tunnel = true;
} else if ((cih->protocol == IPPROTO_UDP || /* Can be UDP encap */
@@ -1722,7 +1724,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
/* Non-first fragment has no UDP/GRE header */
if (unlikely(cih->frag_off & htons(IP_OFFSET)))
return NF_ACCEPT;
- offset2 = offset + cih->ihl * 4;
+ offset2 = offset + hlen_ipip;
if (cih->protocol == IPPROTO_UDP) {
ulen = ipvs_udp_decap(ipvs, skb, offset2, AF_INET,
raddr, &iproto);
@@ -1791,6 +1793,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
}
if (tunnel) {
+ unsigned int hlen_orig = cih->ihl * 4;
__be32 info = ic->un.gateway;
__u8 type = ic->type;
__u8 code = ic->code;
@@ -1807,6 +1810,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
goto ignore_tunnel;
offset2 -= ihl + sizeof(_icmph);
skb_reset_network_header(skb);
+ /* Ensure the IP header is present in headroom */
+ if (!pskb_may_pull(skb, hlen_ipip))
+ goto ignore_tunnel;
IP_VS_DBG(12, "ICMP for %s %pI4->%pI4: mtu=%u\n",
outer_proto, &ip_hdr(skb)->saddr,
&ip_hdr(skb)->daddr, mtu);
@@ -1822,8 +1828,8 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
if (dest_dst)
mtu = dst_mtu(dest_dst->dst_cache);
}
- if (mtu > 68 + sizeof(struct iphdr) + ulen)
- mtu -= sizeof(struct iphdr) + ulen;
+ if (mtu > 68 + hlen_ipip + ulen)
+ mtu -= hlen_ipip + ulen;
info = htonl(mtu);
}
/* Strip outer IP, ICMP and IPIP/UDP/GRE, go to IP header of
@@ -1832,6 +1838,9 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
if (pskb_pull(skb, offset2) == NULL)
goto ignore_tunnel;
skb_reset_network_header(skb);
+ /* Ensure the IP header is present in headroom */
+ if (!pskb_may_pull(skb, hlen_orig))
+ goto ignore_tunnel;
IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
&ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
type, code, ntohl(info));
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 424/699] dm era: fix NULL pointer dereference in metadata_open()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (422 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 423/699] ipvs: ensure inner headers in ICMP errors are in headroom Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 425/699] regulator: core: Make regulator_lock_two() logic easier to follow Greg Kroah-Hartman
` (278 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cao Guanghui, Su Yue, Ming-Hung Tsai,
Mikulas Patocka, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cao Guanghui <caoguanghui@kylinos.cn>
[ Upstream commit 9ae672606c17891d90b282e3490b817620549599 ]
metadata_open() returns NULL when kzalloc_obj() fails, but the
caller era_ctr() only checks IS_ERR(md). Since IS_ERR(NULL)
returns false, the NULL pointer is treated as a valid result
and later assigned to era->md, leading to a NULL pointer
dereference when the metadata is accessed.
Fix this by returning ERR_PTR(-ENOMEM) on allocation failure,
consistent with dm-cache-metadata.c, dm-thin-metadata.c, and
dm-clone-metadata.c which all use ERR_PTR(-ENOMEM) for the
same pattern.
Fixes: eec40579d848 ("dm: add era target")
Signed-off-by: Cao Guanghui <caoguanghui@kylinos.cn>
Reviewed-by: Su Yue <glass.su@suse.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-era-target.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index 96bad057bea2fc..28350c2337fad3 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -791,8 +791,10 @@ static struct era_metadata *metadata_open(struct block_device *bdev,
int r;
struct era_metadata *md = kzalloc(sizeof(*md), GFP_KERNEL);
- if (!md)
- return NULL;
+ if (!md) {
+ DMERR("could not allocate metadata struct");
+ return ERR_PTR(-ENOMEM);
+ }
md->bdev = bdev;
md->block_size = block_size;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 425/699] regulator: core: Make regulator_lock_two() logic easier to follow
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (423 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 424/699] dm era: fix NULL pointer dereference in metadata_open() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 426/699] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Greg Kroah-Hartman
` (277 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Boyd, Douglas Anderson,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 37473397b852f556d8b9428ccbfd51886037842d ]
The regulator_lock_two() function could be made clearer in the case of
lock contention by having a local variable for each of the held and
contended locks. Let's do that. At the same time, let's use the swap()
function instead of open coding it.
This change is expected to be a no-op and simply improves code
clarity.
Suggested-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/CAE-0n53Eb1BeDPmjBycXUaQAF4ppiAM6UDWje_jiB9GAmR8MMw@mail.gmail.com
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20230413173359.1.I1ae92b25689bd6579952e6d458b79f5f8054a0c9@changeid
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: d38f8bd771c4 ("regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 31 ++++++++++++-------------------
1 file changed, 12 insertions(+), 19 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 55f667a486a11a..61971705b96fb1 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -228,7 +228,7 @@ static void regulator_lock_two(struct regulator_dev *rdev1,
struct regulator_dev *rdev2,
struct ww_acquire_ctx *ww_ctx)
{
- struct regulator_dev *tmp;
+ struct regulator_dev *held, *contended;
int ret;
ww_acquire_init(ww_ctx, ®ulator_ww_class);
@@ -242,25 +242,18 @@ static void regulator_lock_two(struct regulator_dev *rdev1,
goto exit;
}
+ held = rdev1;
+ contended = rdev2;
while (true) {
- /*
- * Start of loop: rdev1 was locked and rdev2 was contended.
- * Need to unlock rdev1, slowly lock rdev2, then try rdev1
- * again.
- */
- regulator_unlock(rdev1);
-
- ww_mutex_lock_slow(&rdev2->mutex, ww_ctx);
- rdev2->ref_cnt++;
- rdev2->mutex_owner = current;
- ret = regulator_lock_nested(rdev1, ww_ctx);
-
- if (ret == -EDEADLOCK) {
- /* More contention; swap which needs to be slow */
- tmp = rdev1;
- rdev1 = rdev2;
- rdev2 = tmp;
- } else {
+ regulator_unlock(held);
+
+ ww_mutex_lock_slow(&contended->mutex, ww_ctx);
+ contended->ref_cnt++;
+ contended->mutex_owner = current;
+ swap(held, contended);
+ ret = regulator_lock_nested(contended, ww_ctx);
+
+ if (ret != -EDEADLOCK) {
WARN_ON(ret);
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 426/699] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (424 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 425/699] regulator: core: Make regulator_lock_two() logic easier to follow Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 427/699] net/mlx5: Fix L3 tunnel entropy refcount leak Greg Kroah-Hartman
` (276 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Timur Tabi, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <ttabi@nvidia.com>
[ Upstream commit d38f8bd771c4999b797d7074b348cf201414bd34 ]
Compare against -EDEADLK, which is what ww_mutex_lock() actually
returns and what every other deadlock check in this file already uses.
Function regulator_lock_two() acquires two regulators via
regulator_lock_nested() -> ww_mutex_lock(). On contention,
ww_mutex_lock() returns -EDEADLK, which is the caller's signal to drop
the lock it holds and retry the acquisition in the canonical order.
However, regulator_lock_two() tests the return value against -EDEADLOCK
rather than -EDEADLK. On most architectures, EDEADLK and EDEADLOCK are
the same value, so the comparison happens to be correct and the bug is
invisible. But on MIPS, SPARC, and PowerPC, those two errors have
different values. The test is wrong: a genuine -EDEADLK backoff no
longer matches -EDEADLOCK, so instead of unlocking and retrying, the
code falls into WARN_ON(ret) and returns with only one of the two
regulators locked.
In practice, this is a bug only on MIPS, because the regulator core is
not built or used on the other two platforms.
In general, EDEADLK is preferred over EDEADLOCK for new code.
Fixes: cba6cfdc7c3f ("regulator: core: Avoid lockdep reports when resolving supplies")
Signed-off-by: Timur Tabi <ttabi@nvidia.com>
Link: https://patch.msgid.link/20260708235722.2953579-1-ttabi@nvidia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 61971705b96fb1..335150e7775686 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -237,7 +237,7 @@ static void regulator_lock_two(struct regulator_dev *rdev1,
ret = regulator_lock_nested(rdev1, ww_ctx);
WARN_ON(ret);
ret = regulator_lock_nested(rdev2, ww_ctx);
- if (ret != -EDEADLOCK) {
+ if (ret != -EDEADLK) {
WARN_ON(ret);
goto exit;
}
@@ -253,7 +253,7 @@ static void regulator_lock_two(struct regulator_dev *rdev1,
swap(held, contended);
ret = regulator_lock_nested(contended, ww_ctx);
- if (ret != -EDEADLOCK) {
+ if (ret != -EDEADLK) {
WARN_ON(ret);
break;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 427/699] net/mlx5: Fix L3 tunnel entropy refcount leak
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (425 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 426/699] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 428/699] smb: client: fix overflow in passthrough ioctl bounds check Greg Kroah-Hartman
` (275 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Simon Horman,
Tariq Toukan, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit c914307e1d41c2cb7bcdcbfde4cd2f214f6aa027 ]
mlx5_tun_entropy_refcount_inc() counts both VXLAN and L2-to-L3
tunnel reformat entries as entropy-enabling users. The matching
decrement path only handled VXLAN, leaving L2-to-L3 tunnel entries
counted after release.
Handle MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL in
mlx5_tun_entropy_refcount_dec() as well so the enabling entry
refcount remains balanced.
Fixes: f828ca6a2fb6 ("net/mlx5e: Add support for hw encapsulation of MPLS over UDP")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260703141423.1723-1-lirongqing@baidu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c
index e042e092407939..1642ff7915ff84 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/port_tun.c
@@ -177,7 +177,8 @@ void mlx5_tun_entropy_refcount_dec(struct mlx5_tun_entropy *tun_entropy,
int reformat_type)
{
mutex_lock(&tun_entropy->lock);
- if (reformat_type == MLX5_REFORMAT_TYPE_L2_TO_VXLAN)
+ if (reformat_type == MLX5_REFORMAT_TYPE_L2_TO_VXLAN ||
+ reformat_type == MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL)
tun_entropy->num_enabling_entries--;
else if (reformat_type == MLX5_REFORMAT_TYPE_L2_TO_NVGRE &&
--tun_entropy->num_disabling_entries == 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 428/699] smb: client: fix overflow in passthrough ioctl bounds check
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (426 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 427/699] net/mlx5: Fix L3 tunnel entropy refcount leak Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 429/699] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() Greg Kroah-Hartman
` (274 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Steve French,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit a4f27ad055392fa164f5649e89a3637b033c5fcc ]
smb2_ioctl_query_info() validates the PASSTHRU_FSCTL response payload
before copying it to userspace.
The payload offset and length both come from 32-bit fields. The bounds
check currently adds OutputOffset and qi.input_buffer_length directly, so
the addition can wrap in 32-bit arithmetic before the result is compared
against the response buffer length.
A malicious server can use a large OutputOffset and a small OutputCount
to make the wrapped sum pass the bounds check. The later copy_to_user()
then reads from io_rsp + OutputOffset, outside the response buffer.
Use size_add() for the offset plus length check so overflow is treated as
out of bounds.
Fixes: 2b1116bbe898 ("CIFS: Use common error handling code in smb2_ioctl_query_info()")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/cifs/smb2ops.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 032799e25d9f03..8f320a9d59f665 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -1698,8 +1698,8 @@ smb2_ioctl_query_info(const unsigned int xid,
if (le32_to_cpu(io_rsp->OutputCount) < qi.input_buffer_length)
qi.input_buffer_length = le32_to_cpu(io_rsp->OutputCount);
if (qi.input_buffer_length > 0 &&
- le32_to_cpu(io_rsp->OutputOffset) + qi.input_buffer_length
- > rsp_iov[1].iov_len) {
+ size_add(le32_to_cpu(io_rsp->OutputOffset),
+ qi.input_buffer_length) > rsp_iov[1].iov_len) {
rc = -EFAULT;
goto out;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 429/699] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (427 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 428/699] smb: client: fix overflow in passthrough ioctl bounds check Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 430/699] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() Greg Kroah-Hartman
` (273 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Ido Schimmel,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 21cf8dc478a49e8de039c2739b1646a774cb1944 upstream.
When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs,
the error rollback loop does not correctly revert the preceding
replacements. The loop decrements the index but fails to update the
vr pointer, which still points to the VR that caused the failure. As
a result, the condition and the rollback call always operate on the
same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple
times on it while never rolling back the earlier VRs. Those VRs
continue to hold a reference to new_tree acquired via
mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree.
Fix by reinitializing vr inside the error loop with the updated index:
vr = &mlxsw_sp->router->vrs[i];
so that the loop correctly iterates over all VRs that were actually
replaced.
Cc: stable@vger.kernel.org
Fixes: fc922bb0dd94 ("mlxsw: spectrum_router: Use one LPM tree for all virtual routers")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260609084730.215732-1-vulab@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -910,6 +910,7 @@ static int mlxsw_sp_vrs_lpm_tree_replace
err_tree_replace:
for (i--; i >= 0; i--) {
+ vr = &mlxsw_sp->router->vrs[i];
if (!mlxsw_sp_vr_lpm_tree_should_replace(vr, proto, new_id))
continue;
mlxsw_sp_vr_lpm_tree_replace(mlxsw_sp,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 430/699] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (428 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 429/699] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 431/699] net: atm: reject out-of-range traffic classes in QoS validation Greg Kroah-Hartman
` (272 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Simon Horman,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 20054869770c7df060c5ecee3e8bbf9029c47191 upstream.
qrtr_endpoint_post() validates an incoming packet with
if (!size || len != ALIGN(size, 4) + hdrlen)
goto err;
where size comes from the wire. On 32-bit, size_t is 32 bits and
ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check
passes and skb_put_data(skb, data + hdrlen, size) writes past the
hdrlen-sized skb and oopses the kernel. 64-bit is unaffected.
This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB
Read in qrtr_endpoint_post"), which fixed only the 64-bit case.
Reject any size that cannot fit the buffer before the ALIGN.
Fixes: ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260611125455.2352279-1-michael.bommarito@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/qrtr/af_qrtr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -490,7 +490,7 @@ int qrtr_endpoint_post(struct qrtr_endpo
goto err;
}
- if (!size || len != ALIGN(size, 4) + hdrlen)
+ if (!size || size > len || len != ALIGN(size, 4) + hdrlen)
goto err;
if ((cb->type == QRTR_TYPE_NEW_SERVER ||
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 431/699] net: atm: reject out-of-range traffic classes in QoS validation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (429 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 430/699] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 432/699] net: ife: require ETH_HLEN to be pullable in ife_decode() Greg Kroah-Hartman
` (271 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Xin Liu, Zhengchuan Liang,
Ren Wei, Simon Horman, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchuan Liang <zcliangcn@gmail.com>
commit cdf19f380e46192e7084be559638aab1f6ed86a2 upstream.
Reject ATM traffic classes above ATM_ANYCLASS in check_tp().
SO_ATMQOS stores the supplied QoS after check_qos() succeeds, so
accepting larger values leaves invalid traffic_class values in
vcc->qos.
That bad state later reaches pvc_info(), which indexes class_name[]
with vcc->qos.{rx,tp}.traffic_class. Values above ATM_ANYCLASS cause
an out-of-bounds read when /proc/net/atm/pvc is read.
Tighten the existing QoS validation so invalid traffic_class values
are rejected at the point where user supplied QoS is accepted.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/58f02c6f73d9818fd5d2022e1116759fdde6116b.1780965530.git.zcliangcn@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/atm/common.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -720,6 +720,8 @@ static int atm_change_qos(struct atm_vcc
static int check_tp(const struct atm_trafprm *tp)
{
/* @@@ Should be merged with adjust_tp */
+ if (tp->traffic_class > ATM_ANYCLASS)
+ return -EINVAL;
if (!tp->traffic_class || tp->traffic_class == ATM_ANYCLASS)
return 0;
if (tp->traffic_class != ATM_UBR && !tp->min_pcr && !tp->pcr &&
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 432/699] net: ife: require ETH_HLEN to be pullable in ife_decode()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (430 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 431/699] net: atm: reject out-of-range traffic classes in QoS validation Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 433/699] arm64: dts: qcom: sdm630: describe adsp_mem region properly Greg Kroah-Hartman
` (270 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Xin Liu, Yong Wang,
Ren Wei, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong Wang <edragain@163.com>
commit 9406f6012b7343661efb516a11c62d4db2b62f75 upstream.
ife decode may return after making only the outer IFE header and
metadata pullable. The caller then passes the decapsulated packet to
eth_type_trans(), which expects the inner Ethernet header to be
accessible from the linear data area.
With a malformed IFE frame, the inner Ethernet header may still be
shorter than ETH_HLEN in the linear area, which can lead to a crash in
the original code.
Fix this by extending the pull check in ife_decode() so that the inner
Ethernet header is also guaranteed to be pullable before returning.
Fixes: ef6980b6becb ("introduce IFE action")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yong Wang <edragain@163.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/20260610183814.1648888-2-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ife/ife.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -79,7 +79,7 @@ void *ife_decode(struct sk_buff *skb, u1
if (unlikely(ifehdrln < 2))
return NULL;
- if (unlikely(!pskb_may_pull(skb, total_pull)))
+ if (unlikely(!pskb_may_pull(skb, total_pull + ETH_HLEN)))
return NULL;
ifehdr = (struct ifeheadr *)(skb->data + skb->dev->hard_header_len);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 433/699] arm64: dts: qcom: sdm630: describe adsp_mem region properly
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (431 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 432/699] net: ife: require ETH_HLEN to be pullable in ife_decode() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 434/699] KVM: arm64: vgic: Check the interrupt is still ours before migrating it Greg Kroah-Hartman
` (269 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ekansh Gupta, Dmitry Baryshkov,
Nickolay Goppen, Bjorn Andersson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nickolay Goppen <setotau@mainlining.org>
commit ce414263e9ebe5080381a50cbdf9065c29816202 upstream.
Downstream [1] this region is marked as shared, reusable and dynamic so
describe it that way.
[1]: https://github.com/xiaomi-sdm660/android_kernel_xiaomi_sdm660/blob/11-EAS/arch/arm/boot/dts/qcom/sdm660.dtsi#L448
Fixes: b190fb010664 ("arm64: dts: qcom: sdm630: Add sdm630 dts file")
Cc: stable@vger.kernel.org
Reviewed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Nickolay Goppen <setotau@mainlining.org>
Link: https://lore.kernel.org/r/20260429-qcom-sdm660-cdsp-adsp-fastrpc-dts-fix-v5-4-16bc82e622ad@mainlining.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/sdm630.dtsi | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/arch/arm64/boot/dts/qcom/sdm630.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm630.dtsi
@@ -391,9 +391,12 @@
no-map;
};
- adsp_mem: adsp-region@f6000000 {
- reg = <0x0 0xf6000000 0x0 0x800000>;
- no-map;
+ adsp_mem: adsp-region {
+ compatible = "shared-dma-pool";
+ alloc-ranges = <0x0 0x80000000 0x0 0x80000000>;
+ alignment = <0x0 0x400000>;
+ size = <0x0 0x800000>;
+ reusable;
};
qseecom_mem: qseecom-region@f6800000 {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 434/699] KVM: arm64: vgic: Check the interrupt is still ours before migrating it
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (432 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 433/699] arm64: dts: qcom: sdm630: describe adsp_mem region properly Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 435/699] fbdev: sm712: Fix operator precedence in big_swap macro Greg Kroah-Hartman
` (268 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Marc Zyngier
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
commit 0074b82cdfcb5fd13710a0ac308ade68ac6f6fbe upstream.
vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating
an interrupt to another vCPU. After reacquiring the locks it only checks
that the affinity is unchanged (target_vcpu == vgic_target_oracle(irq))
before moving the interrupt, which assumes that an interrupt whose affinity
is preserved is still queued on this vCPU's ap_list.
That assumption no longer holds if the interrupt is taken off the ap_list
while the locks are dropped. vgic_flush_pending_lpis() removes the
interrupt from the list and sets irq->vcpu to NULL, but leaves
enabled/pending/target_vcpu untouched. As the interrupt is still enabled
and pending, vgic_target_oracle() returns the same target_vcpu, so the
affinity check passes and list_del() is run a second time on an entry that
has already been removed.
Also check that the interrupt is still assigned to this vCPU
(irq->vcpu == vcpu) before moving it.
Fixes: 0919e84c0fc1 ("KVM: arm/arm64: vgic-new: Add IRQ sync/flush framework")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Link: https://patch.msgid.link/aiHnI1mu6SGQrgnz@v4bel
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -685,15 +685,16 @@ retry:
raw_spin_lock(&irq->irq_lock);
/*
- * If the affinity has been preserved, move the
- * interrupt around. Otherwise, it means things have
- * changed while the interrupt was unlocked, and we
- * need to replay this.
+ * If the interrupt is still ours and its affinity has
+ * been preserved, move it around. Otherwise, it means
+ * things have changed while the interrupt was unlocked
+ * (it may even have been taken off the list with its
+ * affinity left untouched), and we need to replay this.
*
* In all cases, we cannot trust the list not to have
* changed, so we restart from the beginning.
*/
- if (target_vcpu == vgic_target_oracle(irq)) {
+ if (irq->vcpu == vcpu && target_vcpu == vgic_target_oracle(irq)) {
struct vgic_cpu *new_cpu = &target_vcpu->arch.vgic_cpu;
list_del(&irq->ap_list);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 435/699] fbdev: sm712: Fix operator precedence in big_swap macro
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (433 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 434/699] KVM: arm64: vgic: Check the interrupt is still ours before migrating it Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 436/699] fbdev: radeon: fix potential memory leak in radeonfb_pci_register() Greg Kroah-Hartman
` (267 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li RongQing, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
commit 5dbe5b65df0b0c0ec77492427c274b7b5011890e upstream.
The big_swap(p) macro was intended to swap bytes within 16-bit halves
of a 32-bit value. However, because the bitwise shift operators (<<, >>)
have higher precedence than the bitwise AND operator (&), the original
code failed to perform any shifting on the masked bits.
For example, 'p & 0xff00ff00 >> 8' was evaluated as 'p &
(0xff00ff00 >> 8)', effectively neutralizing the intended swap.
Fix this by adding parentheses to ensure the bitwise AND is performed
before the shift, correctly implementing the byte swap logic.
Fixes: 1461d66728648 ("staging: sm7xxfb: merge sm712fb with fbdev")
Cc: stable@vger.kernel.org
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/sm712.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/fbdev/sm712.h
+++ b/drivers/video/fbdev/sm712.h
@@ -101,7 +101,7 @@ struct modeinit {
#define mmio_addr 0x00800000
#define seqw17() smtc_seqw(0x17, 0x30)
#define big_pixel_depth(p, d) {if (p == 24) {p = 32; d = 32; } }
-#define big_swap(p) ((p & 0xff00ff00 >> 8) | (p & 0x00ff00ff << 8))
+#define big_swap(p) (((p & 0xff00ff00) >> 8) | ((p & 0x00ff00ff) << 8))
#else
#define pal_rgb(r, g, b, val) val
#define big_addr 0
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 436/699] fbdev: radeon: fix potential memory leak in radeonfb_pci_register()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (434 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 435/699] fbdev: sm712: Fix operator precedence in big_swap macro Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 437/699] fbdev: i740fb: fix potential memory leak in i740fb_probe() Greg Kroah-Hartman
` (266 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit df8c1101c9a08859da612b5d0a08d55d475522c6 upstream.
The function radeonfb_pci_register() allocates memory for modelist
(by calling radeon_check_modes() which calls fb_add_videomode()).
The memory is appended to info->modelist, but is not freed in subsequent
error paths. Fix this by calling fb_destroy_modelist().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/aty/radeon_base.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/aty/radeon_base.c
+++ b/drivers/video/fbdev/aty/radeon_base.c
@@ -2492,6 +2492,7 @@ static int radeonfb_pci_register(struct
return 0;
err_unmap_fb:
iounmap(rinfo->fb_base);
+ fb_destroy_modelist(&info->modelist);
err_unmap_rom:
kfree(rinfo->mon1_EDID);
kfree(rinfo->mon2_EDID);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 437/699] fbdev: i740fb: fix potential memory leak in i740fb_probe()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (435 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 436/699] fbdev: radeon: fix potential memory leak in radeonfb_pci_register() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 438/699] fbdev: s3fb: fix potential memory leak in s3_pci_probe() Greg Kroah-Hartman
` (265 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 5936063409af230a2c88b8700c47b89a19fd70b5 upstream.
In i740fb_probe(), the memory allocated in fb_videomode_to_modelist()
for modelist is not freed in the error paths. Fix that by calling
fb_destroy_modelist().
Fixes: 5350c65f4f15 ("Resurrect Intel740 driver: i740fb")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/i740fb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/i740fb.c
+++ b/drivers/video/fbdev/i740fb.c
@@ -1150,6 +1150,7 @@ err_reg_framebuffer:
fb_dealloc_cmap(&info->cmap);
err_alloc_cmap:
err_find_mode:
+ fb_destroy_modelist(&info->modelist);
if (par->ddc_registered)
i2c_del_adapter(&par->ddc_adapter);
pci_iounmap(dev, par->regs);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 438/699] fbdev: s3fb: fix potential memory leak in s3_pci_probe()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (436 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 437/699] fbdev: i740fb: fix potential memory leak in i740fb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 439/699] fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Greg Kroah-Hartman
` (264 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 3b0ed04bc852887a9164e1bbf521652e8ef3eb92 upstream.
In s3_pci_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() is not freed in subsequent error paths.
Fix that by calling fb_destroy_modelist()
Fixes: 86c0f043a737 ("s3fb: add DDC support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/s3fb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/s3fb.c
+++ b/drivers/video/fbdev/s3fb.c
@@ -1366,6 +1366,7 @@ err_reg_fb:
err_alloc_cmap:
err_find_mode:
#ifdef CONFIG_FB_S3_DDC
+ fb_destroy_modelist(&info->modelist);
if (par->ddc_registered)
i2c_del_adapter(&par->ddc_adapter);
if (par->mmio)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 439/699] fbdev: uvesafb: fix potential memory leak in uvesafb_probe()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (437 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 438/699] fbdev: s3fb: fix potential memory leak in s3_pci_probe() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 440/699] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() Greg Kroah-Hartman
` (263 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 033e56fed09047ee63072e9f58789f40c1c7079d upstream.
Due to an incorrect goto label, memory allocated for modedb and modelist
in uvesafb_vbe_init() is not freed in some error paths. Fix this by
updating the goto label.
Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/uvesafb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -1698,14 +1698,14 @@ static int uvesafb_probe(struct platform
i = uvesafb_vbe_init_mode(info);
if (i < 0) {
err = -EINVAL;
- goto out;
+ goto out_mode;
} else {
mode = &par->vbe_modes[i];
}
if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
err = -ENXIO;
- goto out;
+ goto out_mode;
}
uvesafb_init_info(info, mode);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 440/699] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (438 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 439/699] fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 441/699] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() Greg Kroah-Hartman
` (262 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit bb019d755366cc3e777a12d4bf457ff289837370 upstream.
In tdfxfb_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() when CONFIG_FB_3DFX_I2C is defined, is not
freed in the subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 215059d2421f ("tdfxfb: make use of DDC information about connected monitor")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/tdfxfb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/tdfxfb.c
+++ b/drivers/video/fbdev/tdfxfb.c
@@ -1548,6 +1548,7 @@ static int tdfxfb_probe(struct pci_dev *
out_err_iobase:
#ifdef CONFIG_FB_3DFX_I2C
+ fb_destroy_modelist(&info->modelist);
tdfxfb_delete_i2c_busses(default_par);
#endif
arch_phys_wc_del(default_par->wc_cookie);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 441/699] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (439 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 440/699] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 442/699] fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Greg Kroah-Hartman
` (261 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 6fcca16a2b19c37f60693c56cbc0c923364ff3ef upstream.
The memory allocated for modelist in fb_videomode_to_modelist() is not
freed in the subsequent error path.
Fix that by calling fb_destroy_modelist()
Fixes: 2ece5f43b041 ("fbdev: add the carmine FB driver")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/carminefb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/carminefb.c
+++ b/drivers/video/fbdev/carminefb.c
@@ -592,6 +592,7 @@ static int alloc_carmine_fb(void __iomem
return 0;
err_dealloc_cmap:
+ fb_destroy_modelist(&info->modelist);
fb_dealloc_cmap(&info->cmap);
err_free_fb:
framebuffer_release(info);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 442/699] fbdev: nvidia: fix potential memory leak in nvidiafb_probe()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (440 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 441/699] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 443/699] fbdev: tridentfb: fix potential memory leak in trident_pci_probe() Greg Kroah-Hartman
` (260 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 85f5e38c162bdf9dbbe197275d416402712f3707 upstream.
In nvidiafb_probe(), the memory allocated for modelist in
nvidia_set_fbinfo() is not freed in the subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/nvidia/nvidia.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/nvidia/nvidia.c
+++ b/drivers/video/fbdev/nvidia/nvidia.c
@@ -1409,6 +1409,7 @@ static int nvidiafb_probe(struct pci_dev
err_out_iounmap_fb:
iounmap(info->screen_base);
+ fb_destroy_modelist(&info->modelist);
err_out_free_base1:
fb_destroy_modedb(info->monspecs.modedb);
nvidia_delete_i2c_busses(par);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 443/699] fbdev: tridentfb: fix potential memory leak in trident_pci_probe()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (441 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 442/699] fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 444/699] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read Greg Kroah-Hartman
` (259 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 7a35ec619d9af8ee128320975c1252b8ad65f1e8 upstream.
In trident_pci_probe(), the memory allocated for modelist using
fb_videomode_to_modelist() is not freed in subsequent error paths.
Fix that by calling fb_destroy_modelist().
Fixes: 6a5e3bd0c8bc ("tridentfb: Add DDC support")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/tridentfb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/fbdev/tridentfb.c
+++ b/drivers/video/fbdev/tridentfb.c
@@ -1702,6 +1702,7 @@ static int trident_pci_probe(struct pci_
return 0;
out_unmap2:
+ fb_destroy_modelist(&info->modelist);
if (default_par->ddc_registered)
i2c_del_adapter(&default_par->ddc_adapter);
kfree(info->pixmap.addr);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 444/699] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (442 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 443/699] fbdev: tridentfb: fix potential memory leak in trident_pci_probe() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 445/699] netfilter: nfnl_cthelper: apply per-class values when updating policies Greg Kroah-Hartman
` (258 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Muhammad Bilal, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Bilal <meatuni001@gmail.com>
commit ef6400ca25a13fd6dedbe8ef4a1d0979bbbfe88a upstream.
parse_dcc() treats data_end as an inclusive end pointer, but its only
caller passes data_limit = ib_ptr + datalen, which points one past the
last valid byte.
The newline search loop iterates while tmp <= data_end, so when no
newline is present, *tmp is read at tmp == data_end, one byte beyond
the region filled by skb_header_pointer().
irc_buffer is kmalloc'd as MAX_SEARCH_SIZE + 1 bytes and datalen is
capped at MAX_SEARCH_SIZE, so the stray read does not fault. The byte
is uninitialized or stale; if it contains an ASCII digit, simple_strtoul
will consume it and produce a wrong DCC IP or port in the conntrack
expectation. The extra allocation byte is also a fragile guard: if the
cap or allocation size changes, this becomes a real out-of-bounds read.
Change the loop and its post-loop check to use strict less-than,
consistent with the caller's exclusive-end convention. Update the
function comment accordingly.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Muhammad Bilal <meatuni001@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_irc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -63,7 +63,7 @@ static const char *const dccprotos[] = {
/* tries to get the ip_addr and port out of a dcc command
* return value: -1 on failure, 0 on success
* data pointer to first byte of DCC command data
- * data_end pointer to last byte of dcc command data
+ * data_end one past end of data
* ip returns parsed ip of dcc command
* port returns parsed port of dcc command
* ad_beg_p returns pointer to first byte of addr data
@@ -81,10 +81,10 @@ static int parse_dcc(char *data, const c
/* Make sure we have a newline character within the packet boundaries
* because simple_strtoul parses until the first invalid character. */
- for (tmp = data; tmp <= data_end; tmp++)
+ for (tmp = data; tmp < data_end; tmp++)
if (*tmp == '\n')
break;
- if (tmp > data_end || *tmp != '\n')
+ if (tmp >= data_end || *tmp != '\n')
return -1;
*ad_beg_p = data;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 445/699] netfilter: nfnl_cthelper: apply per-class values when updating policies
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (443 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 444/699] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 446/699] netfilter: xt_cluster: reject template conntracks in hash match Greg Kroah-Hartman
` (257 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Carlier, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
commit d738feccb98cb224ebabecb703e98f5008276bff upstream.
When a userspace conntrack helper with multiple expectation classes is
updated via nfnetlink, every class ends up with the first class's
max_expected and timeout values.
nfnl_cthelper_update_policy_all() validates each new policy into the
corresponding slot of the temporary new_policy array, but the second
loop that commits the values into the live helper dereferences
new_policy as a pointer instead of indexing it, so every iteration
reads new_policy[0] regardless of i. An update that changes per-class
values is silently collapsed onto class 0's values with no error
returned to userspace.
Index the temporary array by i in the commit loop so each class gets
its own validated values.
Fixes: 2c422257550f ("netfilter: nfnl_cthelper: fix runtime expectation policy updates")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nfnetlink_cthelper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -344,8 +344,8 @@ static int nfnl_cthelper_update_policy_a
for (i = 0; i < helper->expect_class_max + 1; i++) {
policy = (struct nf_conntrack_expect_policy *)
&helper->expect_policy[i];
- policy->max_expected = new_policy->max_expected;
- policy->timeout = new_policy->timeout;
+ policy->max_expected = new_policy[i].max_expected;
+ policy->timeout = new_policy[i].timeout;
}
err:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 446/699] netfilter: xt_cluster: reject template conntracks in hash match
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (444 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 445/699] netfilter: nfnl_cthelper: apply per-class values when updating policies Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 447/699] netfilter: nf_nat_sip: reload possible stale data pointer Greg Kroah-Hartman
` (256 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Wyatt Feng, Ren Wei, Pablo Neira Ayuso
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
commit 5feba91006ec92da57acc1cc2e34df623b98541e upstream.
xt_cluster_mt() treats any non-NULL nf_ct_get() result as a fully
initialized conntrack and passes it to xt_cluster_hash().
This causes a state confusion bug when the raw table CT target attaches
a template conntrack to skb->_nfct before normal conntrack processing.
Templates carry IPS_TEMPLATE status but do not have a valid tuple for
hashing yet, so xt_cluster_hash() can hit its WARN_ON() path on the
zeroed l3num field.
Reject template conntracks before hashing them. This matches existing
netfilter handling for template objects and avoids hashing incomplete
conntrack state.
Fixes: 0269ea493734 ("netfilter: xtables: add cluster match")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_cluster.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/xt_cluster.c
+++ b/net/netfilter/xt_cluster.c
@@ -107,7 +107,7 @@ xt_cluster_mt(const struct sk_buff *skb,
}
ct = nf_ct_get(skb, &ctinfo);
- if (ct == NULL)
+ if (!ct || nf_ct_is_template(ct))
return false;
if (ct->master)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 447/699] netfilter: nf_nat_sip: reload possible stale data pointer
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (445 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 446/699] netfilter: xt_cluster: reject template conntracks in hash match Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 448/699] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag Greg Kroah-Hartman
` (255 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 upstream.
quoting sashiko:
------------------------------------------------------------------------
[..] noticed a potential memory bug and header corruption involving the
SIP NAT helper.
In net/netfilter/nf_nat_sip.c:nf_nat_sip():
if (skb_ensure_writable(skb, skb->len)) {
nf_ct_helper_log(skb, ct, "cannot mangle packet");
return NF_DROP;
}
uh = (void *)skb->data + protoff;
uh->dest = ct_sip_info->forced_dport;
if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff,
0, 0, NULL, 0)) {
If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the
old data buffer is freed. However, nf_nat_sip() fails to update *dptr to
point to the new buffer.
It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP
packet, which would overwrite the sequence number with a checksum update.
------------------------------------------------------------------------
nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen.
But clones are possible, so rebuild dptr.
Disable nf_nat_mangle_udp_packet() branch for TCP streams.
It doesn't look like this can ever happen, else we should have received
bug reports about this, so just check the conntrack is UDP and drop
otherwise.
The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages,
so I don't think this is ever expected to be true for a TCP stream.
Fixes: 7266507d8999 ("netfilter: nf_ct_sip: support Cisco 7941/7945 IP phones")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_nat_sip.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -283,13 +283,22 @@ next:
/* Mangle destination port for Cisco phones, then fix up checksums */
if (dir == IP_CT_DIR_REPLY && ct_sip_info->forced_dport) {
+ int doff = *dptr - (const char *)skb->data;
struct udphdr *uh;
+ if (doff <= 0)
+ return NF_DROP;
+
+ /* ct_sip_info->forced_dport only expected with UDP */
+ if (nf_ct_protonum(ct) != IPPROTO_UDP)
+ return NF_DROP;
+
if (skb_ensure_writable(skb, skb->len)) {
nf_ct_helper_log(skb, ct, "cannot mangle packet");
return NF_DROP;
}
+ *dptr = skb->data + doff;
uh = (void *)skb->data + protoff;
uh->dest = ct_sip_info->forced_dport;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 448/699] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (446 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 447/699] netfilter: nf_nat_sip: reload possible stale data pointer Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 449/699] netfilter: nf_conncount: fix zone comparison in tuple dedup Greg Kroah-Hartman
` (254 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 3b08fed5b7e0d5e3a25d73ef3ba09cd33ade16c9 upstream.
nf_ct_frag6_reasm() slides the packet head forward to drop the IPv6
fragment header and then unconditionally advances skb->mac_header:
skb->mac_header += sizeof(struct frag_hdr);
On the NF_INET_LOCAL_OUT defrag path the skb has no link-layer header
yet, so skb->mac_header is still the "not set" sentinel (u16)~0U. Adding
sizeof(struct frag_hdr) wraps it to a small value (0xffff + 8 == 7),
after which skb_mac_header_was_set() wrongly reports a MAC header is
present and skb_mac_header() points into the headroom.
The reassembler has done this unconditional add since it was introduced;
it was harmless while mac_header was a bare pointer, but wrong once
mac_header became a u16 offset whose unset state is the ~0U sentinel
tested by skb_mac_header_was_set(). The sibling net/ipv6/reassembly.c
does the same relocation and does guard the adjustment; mirror the
guard here.
Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/netfilter/nf_conntrack_reasm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -344,7 +344,8 @@ static int nf_ct_frag6_reasm(struct frag
skb_network_header(skb)[fq->nhoffset] = skb_transport_header(skb)[0];
memmove(skb->head + sizeof(struct frag_hdr), skb->head,
(skb->data - skb->head) - sizeof(struct frag_hdr));
- skb->mac_header += sizeof(struct frag_hdr);
+ if (skb_mac_header_was_set(skb))
+ skb->mac_header += sizeof(struct frag_hdr);
skb->network_header += sizeof(struct frag_hdr);
skb_reset_transport_header(skb);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 449/699] netfilter: nf_conncount: fix zone comparison in tuple dedup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (447 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 448/699] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 450/699] netfilter: xt_nat: reject unsupported target families Greg Kroah-Hartman
` (253 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
commit f62c41b4910e65da396ec9a8c40c1fe7fe82e449 upstream.
The "already exists" dedup logic in __nf_conncount_add() decides
whether a connection has already been counted and can be skipped instead
of incrementing the connlimit count. It compares the conntrack zone of a
list entry with the zone of the connection being added using
nf_ct_zone_id() and nf_ct_zone_equal(), passing conn->zone.dir or
zone->dir as the direction argument.
Those helpers take enum ip_conntrack_dir values: IP_CT_DIR_ORIGINAL is 0
and IP_CT_DIR_REPLY is 1. However, zone->dir is a u8 bitmask:
NF_CT_ZONE_DIR_ORIG is 1, NF_CT_ZONE_DIR_REPL is 2 and
NF_CT_DEFAULT_ZONE_DIR is 3. Passing that bitmask as the enum direction
shifts the meaning of every non-zero value. An ORIG-only zone passes 1
and is tested as REPLY, while REPL-only and default zones pass 2 or 3 and
test bits beyond the valid direction range. In those cases
nf_ct_zone_id() can fall back to NF_CT_DEFAULT_ZONE_ID instead of using
the real zone id, so different zones can be treated as equal and dedup
collapses to tuple equality alone.
nf_conncount stores and compares the original-direction tuple for a
connection. If an skb already has an attached conntrack entry,
get_ct_or_tuple_from_skb() explicitly copies
ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple, regardless of the packet's
ctinfo. Therefore the zone comparison in the tuple dedup path must use
IP_CT_DIR_ORIGINAL as well; the zone direction bitmask describes where a
zone id applies, not which direction this conncount tuple represents.
Fix the two dedup comparisons by passing IP_CT_DIR_ORIGINAL directly.
Do not special-case NF_CT_DEFAULT_ZONE_DIR and do not compare raw zone
ids: using the existing helpers with IP_CT_DIR_ORIGINAL preserves the
direction-aware NF_CT_DEFAULT_ZONE_ID fallback. A default bidirectional
zone contains the ORIG bit, so it naturally returns the real zone id;
reply-only zones continue to fall back for original-direction tuple
comparisons.
Fixes: 21ba8847f857 ("netfilter: nf_conncount: Fix garbage collection with zones")
Fixes: b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conncount.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/netfilter/nf_conncount.c
+++ b/net/netfilter/nf_conncount.c
@@ -207,8 +207,8 @@ check_connections:
/* Not found, but might be about to be confirmed */
if (PTR_ERR(found) == -EAGAIN) {
if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
- nf_ct_zone_id(&conn->zone, conn->zone.dir) ==
- nf_ct_zone_id(zone, zone->dir))
+ nf_ct_zone_id(&conn->zone, IP_CT_DIR_ORIGINAL) ==
+ nf_ct_zone_id(zone, IP_CT_DIR_ORIGINAL))
goto out_put; /* already exists */
} else {
collect++;
@@ -219,7 +219,7 @@ check_connections:
found_ct = nf_ct_tuplehash_to_ctrack(found);
if (nf_ct_tuple_equal(&conn->tuple, &tuple) &&
- nf_ct_zone_equal(found_ct, zone, zone->dir)) {
+ nf_ct_zone_equal(found_ct, zone, IP_CT_DIR_ORIGINAL)) {
/*
* We should not see tuples twice unless someone hooks
* this into a table without "-p tcp --syn".
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 450/699] netfilter: xt_nat: reject unsupported target families
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (448 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 449/699] netfilter: nf_conncount: fix zone comparison in tuple dedup Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 451/699] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Greg Kroah-Hartman
` (252 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Zhengchuan Liang, Xin Liu, Wyatt Feng, Ren Wei, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wyatt Feng <bronzed_45_vested@icloud.com>
commit 5d1a2240935ea47e2673d0ea17fdb058e4dc91dd upstream.
xt_nat SNAT and DNAT target handlers assume IP-family conntrack state
is present and can dereference a NULL pointer when instantiated from an
unsupported family through nft_compat. A bridge-family compat rule can
therefore trigger a NULL-dereference in nf_nat_setup_info().
Reject non-IP families in xt_nat_checkentry() so unsupported targets
cannot be installed. Keep NFPROTO_INET allowed for valid inet NAT
compat users and leave the runtime fast path unchanged.
[ The crash was fixed via
9dbba7e694ec ("netfilter: nft_compat: ebtables emulation must reject non-bridge targets"),
so this patch is no longer critical.
Nevertheless, NAT is only relevant for ipv4/ipv6, so this extra
family check is a good idea in any case. ]
Fixes: c7232c9979cb ("netfilter: add protocol independent NAT core")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Signed-off-by: Wyatt Feng <bronzed_45_vested@icloud.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_nat.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/netfilter/xt_nat.c
+++ b/net/netfilter/xt_nat.c
@@ -26,6 +26,15 @@ static int xt_nat_checkentry_v0(const st
static int xt_nat_checkentry(const struct xt_tgchk_param *par)
{
+ switch (par->family) {
+ case NFPROTO_IPV4:
+ case NFPROTO_IPV6:
+ case NFPROTO_INET:
+ break;
+ default:
+ return -EINVAL;
+ }
+
return nf_ct_netns_get(par->net, par->family);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 451/699] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (449 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 450/699] netfilter: xt_nat: reject unsupported target families Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 452/699] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Greg Kroah-Hartman
` (251 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AutonomousCodeSecurity,
Xiang Mei (Microsoft), Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei (Microsoft) <xmei5@asu.edu>
commit 86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d upstream.
br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb
skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a
use-after-free write.
Save prevhdr's offset before skb_checksum_help() and recompute it after,
like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
fragment").
BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857)
Write of size 1 at addr ffff888013ff5016 by task exploit/141
Call Trace:
...
kasan_report (mm/kasan/report.c:595)
ip6_frag_next (net/ipv6/ip6_output.c:857)
br_ip6_fragment (net/ipv6/netfilter.c:212)
nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407)
nf_hook_slow (net/netfilter/core.c:619)
br_forward_finish (net/bridge/br_forward.c:66)
__br_forward (net/bridge/br_forward.c:115)
maybe_deliver (net/bridge/br_forward.c:191)
br_flood (net/bridge/br_forward.c:245)
br_handle_frame_finish (net/bridge/br_input.c:229)
br_handle_frame (net/bridge/br_input.c:442)
...
packet_sendmsg (net/packet/af_packet.c:3114)
...
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception in interrupt
Fixes: 764dd163ac92 ("netfilter: nf_conntrack_bridge: add support for IPv6")
Cc: stable@vger.kernel.org
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Xiang Mei (Microsoft) <xmei5@asu.edu>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/netfilter.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -122,7 +122,7 @@ int br_ip6_fragment(struct net *net, str
ktime_t tstamp = skb->tstamp;
struct ip6_frag_state state;
u8 *prevhdr, nexthdr = 0;
- unsigned int mtu, hlen;
+ unsigned int mtu, hlen, nexthdr_offset;
int hroom, err = 0;
__be32 frag_id;
@@ -131,6 +131,7 @@ int br_ip6_fragment(struct net *net, str
goto blackhole;
hlen = err;
nexthdr = *prevhdr;
+ nexthdr_offset = prevhdr - skb_network_header(skb);
mtu = skb->dev->mtu;
if (frag_max_size > mtu ||
@@ -149,6 +150,7 @@ int br_ip6_fragment(struct net *net, str
(err = skb_checksum_help(skb)))
goto blackhole;
+ prevhdr = skb_network_header(skb) + nexthdr_offset;
hroom = LL_RESERVED_SPACE(skb->dev);
if (skb_has_frag_list(skb)) {
unsigned int first_len = skb_pagelen(skb);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 452/699] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (450 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 451/699] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 453/699] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy Greg Kroah-Hartman
` (250 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Mikko Perttunen,
Thierry Reding
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit e75717f9aec04355777be41070890c6a815c76df upstream.
After device_initialize(), the embedded struct device in struct
host1x_device should be released through the device core with
put_device().
In host1x_device_add(), if host1x_device_parse_dt() fails, the current
error path frees the object directly with kfree(device). That bypasses
the normal device lifetime handling and leaks the reference held on the
embedded struct device.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fix this by using put_device() in the host1x_device_parse_dt() failure
path.
Fixes: f4c5cf88fbd50 ("gpu: host1x: Provide a proper struct bus_type")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20260413141526.2961841-1-lgs201920130244@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/host1x/bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/host1x/bus.c
+++ b/drivers/gpu/host1x/bus.c
@@ -441,7 +441,7 @@ static int host1x_device_add(struct host
err = host1x_device_parse_dt(device, driver);
if (err < 0) {
- kfree(device);
+ put_device(&device->dev);
return err;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 453/699] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (451 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 452/699] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 454/699] soc: fsl: qe: panic on ioremap() failure in qe_reset() Greg Kroah-Hartman
` (249 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Vadapalli,
Hari Prasath Gujulan Elango, Nishanth Menon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <s-vadapalli@ti.com>
commit b920352cfd2b0fcd1249ff006618c939b64fc8f7 upstream.
k3_ringacc_ring_pop_tail_io() and k3_ringacc_ring_pop_tail_proxy()
incorrectly use K3_RINGACC_ACCESS_MODE_POP_HEAD instead of
K3_RINGACC_ACCESS_MODE_POP_TAIL. This will result in ring elements being
popped in the reverse order of that which the caller expects. Fix this.
Fixes: 3277e8aa2504 ("soc: ti: k3: add navss ringacc driver")
Cc: stable@vger.kernel.org
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Reviewed-by: Hari Prasath Gujulan Elango <gehariprasath@ti.com>
Link: https://patch.msgid.link/20260501124129.362192-1-s-vadapalli@ti.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/ti/k3-ringacc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/soc/ti/k3-ringacc.c
+++ b/drivers/soc/ti/k3-ringacc.c
@@ -824,7 +824,7 @@ static int k3_ringacc_ring_pop_head_prox
static int k3_ringacc_ring_pop_tail_proxy(struct k3_ring *ring, void *elem)
{
return k3_ringacc_ring_access_proxy(ring, elem,
- K3_RINGACC_ACCESS_MODE_POP_HEAD);
+ K3_RINGACC_ACCESS_MODE_POP_TAIL);
}
static int k3_ringacc_ring_access_io(struct k3_ring *ring, void *elem,
@@ -895,7 +895,7 @@ static int k3_ringacc_ring_pop_io(struct
static int k3_ringacc_ring_pop_tail_io(struct k3_ring *ring, void *elem)
{
return k3_ringacc_ring_access_io(ring, elem,
- K3_RINGACC_ACCESS_MODE_POP_HEAD);
+ K3_RINGACC_ACCESS_MODE_POP_TAIL);
}
static int k3_ringacc_ring_push_mem(struct k3_ring *ring, void *elem)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 454/699] soc: fsl: qe: panic on ioremap() failure in qe_reset()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (452 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 453/699] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 455/699] leds: uleds: Fix potential buffer overread Greg Kroah-Hartman
` (248 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Jun,
Christophe Leroy (CS GROUP)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jun <1742789905@qq.com>
commit a0fe29d20e7822182e12324905af5115c1b3aed3 upstream.
When ioremap() fails in qe_reset(), the global pointer qe_immr remains
NULL, leading to a subsequent NULL pointer dereference when the pointer
is accessed. Since this happens early in the boot process, a failure to
map a few bytes of I/O memory indicates a fatal error from which the
system cannot recover.
Follow the same pattern as qe_sdma_init() and panic immediately when
ioremap() fails. This avoids a silent NULL pointer dereference later
and makes the error explicit.
Fixes: 986585385131 ("[POWERPC] Add QUICC Engine (QE) infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Jun <1742789905@qq.com>
Link: https://lore.kernel.org/r/tencent_FED49CF5331CC0C7910618883332A08E2606@qq.com
[chleroy: Rearranged change to reduce churn]
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/fsl/qe/qe.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/soc/fsl/qe/qe.c
+++ b/drivers/soc/fsl/qe/qe.c
@@ -88,6 +88,9 @@ void qe_reset(void)
if (qe_immr == NULL)
qe_immr = ioremap(get_qe_base(), QE_IMMAP_SIZE);
+ if (!qe_immr)
+ panic("QE:ioremap failed!");
+
qe_snums_init();
qe_issue_cmd(QE_RESET, QE_CR_SUBBLOCK_INVALID,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 455/699] leds: uleds: Fix potential buffer overread
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (453 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 454/699] soc: fsl: qe: panic on ioremap() failure in qe_reset() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 456/699] mfd: sm501: Fix reference leak on failed device registration Greg Kroah-Hartman
` (247 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Armin Wolf, Lee Jones
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
commit c19fe864f667afc49d1391d764e20b66555bcf7a upstream.
The name string supplied by userspace is not guaranteed to be
null-terminated, so using strchr() on it might result in a buffer
overread. The same thing will happen when said string is used by
the LED class device.
Fix this by using strnchr() instead and explicitly check that
the name string is properly null-terminated.
Cc: stable@vger.kernel.org
Fixes: e381322b0190 ("leds: Introduce userspace LED class driver")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://patch.msgid.link/20260524235553.189134-1-W_Armin@gmx.de
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/uleds.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/leds/uleds.c
+++ b/drivers/leds/uleds.c
@@ -102,7 +102,8 @@ static ssize_t uleds_write(struct file *
name = udev->user_dev.name;
if (!name[0] || !strcmp(name, ".") || !strcmp(name, "..") ||
- strchr(name, '/')) {
+ strnchr(name, sizeof(udev->user_dev.name), '/') ||
+ !strnchr(name, sizeof(udev->user_dev.name), '\0')) {
ret = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 456/699] mfd: sm501: Fix reference leak on failed device registration
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (454 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 455/699] leds: uleds: Fix potential buffer overread Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 457/699] x86/boot: Validate console=uart8250 baud rate to fix early boot hang Greg Kroah-Hartman
` (246 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Lee Jones
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 8c2f0b42fc252e1bf1c7746447091a468e784ca1 upstream.
When platform_device_register() fails in sm501_register_device(), the
embedded struct device in pdev has already been initialized by
device_initialize(), but the failure path only reports the error and
returns without dropping the device reference for the current platform
device:
sm501_register_device()
-> platform_device_register(pdev)
-> device_initialize(&pdev->dev)
-> setup_pdev_dma_masks(pdev)
-> platform_device_add(pdev)
This leads to a reference leak when platform_device_register() fails.
Fix this by calling platform_device_put() before returning the error.
The issue was identified by a static analysis tool I developed and
confirmed by manual review.
Fixes: b6d6454fdb66f ("[PATCH] mfd: SM501 core driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260415162627.3558789-1-lgs201920130244@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/sm501.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/mfd/sm501.c
+++ b/drivers/mfd/sm501.c
@@ -747,9 +747,11 @@ static int sm501_register_device(struct
if (ret >= 0) {
dev_dbg(sm->dev, "registered %s\n", pdev->name);
list_add_tail(&smdev->list, &sm->devices);
- } else
+ } else {
dev_err(sm->dev, "error registering %s (%d)\n",
pdev->name, ret);
+ platform_device_put(pdev);
+ }
return ret;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 457/699] x86/boot: Validate console=uart8250 baud rate to fix early boot hang
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (455 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 456/699] mfd: sm501: Fix reference leak on failed device registration Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 458/699] x86/boot: Reject too long acpi_rsdp= values Greg Kroah-Hartman
` (245 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Ingo Molnar,
H. Peter Anvin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit ffa0aa5b625fe0bed7463ac613f8b06676ff4542 upstream.
When the baud rate is empty, 0, invalid, or overflows to 0 when stored
as an int, the system will hang during early boot because of a division
by zero in early_serial_init().
Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent
an early system hang.
Fixes: ce0aa5dd20e4 ("x86, setup: Make the setup code also accept console=uart8250")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260713194924.126472-3-thorsten.blum@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/early_serial_console.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/arch/x86/boot/early_serial_console.c
+++ b/arch/x86/boot/early_serial_console.c
@@ -117,7 +117,7 @@ static unsigned int probe_baud(int port)
static void parse_console_uart8250(void)
{
char optstr[64], *options;
- int baud = DEFAULT_BAUD;
+ int baud;
int port = 0;
/*
@@ -136,10 +136,13 @@ static void parse_console_uart8250(void)
else
return;
- if (options && (options[0] == ','))
- baud = simple_strtoull(options + 1, &options, 0);
- else
+ if (options && (options[0] == ',')) {
+ baud = simple_strtoull(options + 1, NULL, 0);
+ if (!baud)
+ baud = DEFAULT_BAUD;
+ } else {
baud = probe_baud(port);
+ }
if (port)
early_serial_init(port, baud);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 458/699] x86/boot: Reject too long acpi_rsdp= values
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (456 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 457/699] x86/boot: Validate console=uart8250 baud rate to fix early boot hang Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 459/699] batman-adv: gw: acquire ethernet header only after skb realloc Greg Kroah-Hartman
` (244 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Borislav Petkov (AMD)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit d130041a7b96f79cd4c7079a6c2431a6db4c9619 upstream.
cmdline_find_option() returns the full length of the parsed acpi_rsdp=
value. get_cmdline_acpi_rsdp() then silently truncates values which do
not fit in the val[] buffer.
Prevent boot_kstrtoul() from parsing a truncated value and then the
kernel from silently using the wrong RSDP address, see discussion in
Link:.
Issue a warning so that the user is aware that s/he supplied a malformed
value and can get feedback instead of silent crashes.
[ bp: Make commit message more precise. ]
Fixes: 3c98e71b42a7 ("x86/boot: Add "acpi_rsdp=" early parsing")
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260617130417.36651-4-thorsten.blum@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/compressed/acpi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/x86/boot/compressed/acpi.c
+++ b/arch/x86/boot/compressed/acpi.c
@@ -288,10 +288,15 @@ static unsigned long get_cmdline_acpi_rs
char val[MAX_ADDR_LEN] = { };
int ret;
- ret = cmdline_find_option("acpi_rsdp", val, MAX_ADDR_LEN);
+ ret = cmdline_find_option("acpi_rsdp", val, sizeof(val));
if (ret < 0)
return 0;
+ if (ret >= sizeof(val)) {
+ warn("acpi_rsdp= value too long; ignoring");
+ return 0;
+ }
+
if (boot_kstrtoul(val, 16, &addr))
return 0;
#endif
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 459/699] batman-adv: gw: acquire ethernet header only after skb realloc
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (457 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 458/699] x86/boot: Reject too long acpi_rsdp= values Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 460/699] batman-adv: access unicast_ttvn skb->data " Greg Kroah-Hartman
` (243 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 77880a3be88d378d60cc1e8f8ec70430e2ed0518 upstream.
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/gateway_client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/batman-adv/gateway_client.c
+++ b/net/batman-adv/gateway_client.c
@@ -741,12 +741,13 @@ bool batadv_gw_out_of_range(struct batad
struct batadv_gw_node *gw_node = NULL;
struct batadv_gw_node *curr_gw = NULL;
struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo;
- struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
+ struct ethhdr *ethhdr;
bool out_of_range = false;
u8 curr_tq_avg;
unsigned short vid;
vid = batadv_get_vid(skb, 0);
+ ethhdr = (struct ethhdr *)skb->data;
if (is_multicast_ether_addr(ethhdr->h_dest))
goto out;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 460/699] batman-adv: access unicast_ttvn skb->data only after skb realloc
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (458 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 459/699] batman-adv: gw: acquire ethernet header only after skb realloc Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 461/699] batman-adv: dat: acquire ARP hw source " Greg Kroah-Hartman
` (242 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 7141990add3f75436f2933cb310654cad3b1e3e9 upstream.
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the ethernet header but missed for the
unicast_packet pointer.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c018ad3de61a ("batman-adv: add the VLAN ID attribute to the TT entry")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/routing.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -822,8 +822,8 @@ static bool batadv_check_unicast_ttvn(st
if (skb_cow(skb, sizeof(*unicast_packet)) < 0)
return false;
- unicast_packet = (struct batadv_unicast_packet *)skb->data;
vid = batadv_get_vid(skb, hdr_len);
+ unicast_packet = (struct batadv_unicast_packet *)skb->data;
ethhdr = (struct ethhdr *)(skb->data + hdr_len);
/* do not reroute multicast frames in a unicast header */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 461/699] batman-adv: dat: acquire ARP hw source only after skb realloc
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (459 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 460/699] batman-adv: access unicast_ttvn skb->data " Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 462/699] batman-adv: bla: reacquire gw address " Greg Kroah-Hartman
` (241 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 48067b2ae4504500a7093d9e1e16b42e70330480 upstream.
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: b61ec31c8575 ("batman-adv: Snoop DHCPACKs for DAT")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/distributed-arp-table.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1819,6 +1819,7 @@ void batadv_dat_snoop_incoming_dhcp_ack(
struct ethhdr *ethhdr;
__be32 ip_src, yiaddr;
unsigned short vid;
+ int hdr_size_tmp;
__be16 proto;
u8 *hw_src;
@@ -1835,8 +1836,10 @@ void batadv_dat_snoop_incoming_dhcp_ack(
if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
return;
+ hdr_size_tmp = hdr_size;
+ vid = batadv_dat_get_vid(skb, &hdr_size_tmp);
+ ethhdr = (struct ethhdr *)(skb->data + hdr_size);
hw_src = ethhdr->h_source;
- vid = batadv_dat_get_vid(skb, &hdr_size);
batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 462/699] batman-adv: bla: reacquire gw address after skb realloc
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (460 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 461/699] batman-adv: dat: acquire ARP hw source " Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 463/699] batman-adv: dat: ensure accessible eth_hdr proto field Greg Kroah-Hartman
` (240 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit cdf3b5af2bc4431e58629e8ad2086b1e9185c761 upstream.
The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
the buffer behind the skb. Variables which were pointing to the old buffer
need to be reassigned to avoid an use-after-free.
Cc: stable@vger.kernel.org
Fixes: 9e794b6bf4a2 ("batman-adv: drop unicast packets from other backbone gw")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/routing.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -1002,6 +1002,7 @@ int batadv_recv_unicast_packet(struct sk
hdr_size);
batadv_orig_node_put(orig_node_gw);
if (is_gw) {
+ orig_addr_gw = eth_hdr(skb)->h_source;
batadv_dbg(BATADV_DBG_BLA, bat_priv,
"%s(): Dropped unicast pkt received from another backbone gw %pM.\n",
__func__, orig_addr_gw);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 463/699] batman-adv: dat: ensure accessible eth_hdr proto field
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (461 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 462/699] batman-adv: bla: reacquire gw address " Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 464/699] batman-adv: dat: fix tie-break for candidate selection Greg Kroah-Hartman
` (239 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 26560c4a03dc4d607331600c187f59ab2df5f341 upstream.
When batadv_get_vid() accesses the proto field of the ethernet header, it
is not checking if the data itself is accessible. The caller is responsible
for it. But in contrast to other call sites, batadv_dat_get_vid() and its
caller didn't make sure this is true. This could have caused an
out-of-bounds access.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: be1db4f6615b ("batman-adv: make the Distributed ARP Table vlan aware")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/distributed-arp-table.c | 23 +++++++++++++++++++++++
net/batman-adv/main.c | 3 +++
2 files changed, 26 insertions(+)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -1135,6 +1135,9 @@ out:
* @skb: the buffer containing the packet to extract the VID from
* @hdr_size: the size of the batman-adv header encapsulating the packet
*
+ * The caller must ensure that at least @hdr_size + ETH_HLEN bytes are
+ * accessible after skb->data.
+ *
* Return: If the packet embedded in the skb is vlan tagged this function
* returns the VID with the BATADV_VLAN_HAS_TAG flag. Otherwise BATADV_NO_FLAGS
* is returned.
@@ -1217,6 +1220,10 @@ bool batadv_dat_snoop_outgoing_arp_reque
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1313,6 +1320,10 @@ bool batadv_dat_snoop_incoming_arp_reque
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1376,6 +1387,10 @@ void batadv_dat_snoop_outgoing_arp_reply
if (!atomic_read(&bat_priv->distributed_arp_table))
return;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ return;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1424,6 +1439,10 @@ bool batadv_dat_snoop_incoming_arp_reply
if (!atomic_read(&bat_priv->distributed_arp_table))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, skb, hdr_size);
@@ -1879,6 +1898,10 @@ bool batadv_dat_drop_broadcast_packet(st
if (batadv_forw_packet_is_rebroadcast(forw_packet))
goto out;
+ /* first, find out the vid. */
+ if (!pskb_may_pull(forw_packet->skb, hdr_size + ETH_HLEN))
+ goto out;
+
vid = batadv_dat_get_vid(forw_packet->skb, &hdr_size);
type = batadv_arp_get_type(bat_priv, forw_packet->skb, hdr_size);
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -663,6 +663,9 @@ __be32 batadv_skb_crc32(struct sk_buff *
* @skb: the buffer containing the packet
* @header_len: length of the batman header preceding the ethernet header
*
+ * The caller must ensure that at least @header_len + ETH_HLEN bytes are
+ * accessible after skb->data.
+ *
* Return: VID with the BATADV_VLAN_HAS_TAG flag when the packet embedded in the
* skb is vlan tagged. Otherwise BATADV_NO_FLAGS.
*/
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 464/699] batman-adv: dat: fix tie-break for candidate selection
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (462 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 463/699] batman-adv: dat: ensure accessible eth_hdr proto field Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 465/699] batman-adv: tt: avoid request storms during pending request Greg Kroah-Hartman
` (238 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 98052bdaf6ac1639a63ffc10244eeeab1f62ed2b upstream.
The original version of the candidate selection for DAT attempted to
compare both candidate and max_orig_node to identify which has the smaller
MAC address. This comparison is required as tie-break when a hash collision
happened.
But the used function returned 0 when the function was not equal and a
non-zero value when it was equal. As result, the actually selected
node was dependent on the order of entries in the orig_hash and not
actually on the mac addresses. The last originator in the hash collision
would always win.
To have a proper ordering, it must diff the actual MAC address bytes and
reject the candidate when the diff is not smaller than 0.
Cc: stable@vger.kernel.org
Fixes: 785ea1144182 ("batman-adv: Distributed ARP Table - create DHT helper functions")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/distributed-arp-table.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -548,7 +548,7 @@ static bool batadv_is_orig_node_eligible
* the one with the lowest address
*/
if (tmp_max == max && max_orig_node &&
- batadv_compare_eth(candidate->orig, max_orig_node->orig))
+ memcmp(candidate->orig, max_orig_node->orig, ETH_ALEN) >= 0)
goto out;
ret = true;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 465/699] batman-adv: tt: avoid request storms during pending request
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (463 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 464/699] batman-adv: dat: fix tie-break for candidate selection Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 466/699] batman-adv: fix VLAN priority offset Greg Kroah-Hartman
` (237 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 27c7d40008231ae4140d35501b60087a9de2d2c3 upstream.
batadv_send_tt_request() allocates a tt_req_node when none exists for the
destination originator node. This should prevent that a multiple TT
requests are send at the same time to an originator.
But if allocation of the send buffer failed, this request must be cleaned
up again. But indicator for such a failure is "ret == false". But the
actual implementation is checking for "ret == true".
The check must be inverted to not loose the information about the TT
request directly after it was attempted to be sent out. This should avoid
potential request storms.
Cc: stable@vger.kernel.org
Fixes: 335fbe0f5d25 ("batman-adv: tvlv - convert tt query packet to use tvlv unicast packets")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/translation-table.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -3260,7 +3260,7 @@ out:
if (primary_if)
batadv_hardif_put(primary_if);
- if (ret && tt_req_node) {
+ if (!ret && tt_req_node) {
spin_lock_bh(&bat_priv->tt.req_list_lock);
if (!hlist_unhashed(&tt_req_node->list)) {
hlist_del_init(&tt_req_node->list);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 466/699] batman-adv: fix VLAN priority offset
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (464 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 465/699] batman-adv: tt: avoid request storms during pending request Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 467/699] batman-adv: frag: free unfragmentable packet Greg Kroah-Hartman
` (236 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit fdb3be00ba4dafa313e699d6b5b90d13f22f3f25 upstream.
The batadv_skb_set_priority() receives an SKB with the inner ethernet
header at position "offset". When it tries to extract the IPv4 and IPv6
header, it needs to skip the ethernet header to get access to the IP
header.
But for VLAN header, it performs the access with the struct vlan_ethhdr.
This struct contains both both the ethernet header and the VLAN header. It
is therefore incorrect to skip over the whole vlan_ethhdr size to get
access to the vlan_ethhdr.
Cc: stable@vger.kernel.org
Fixes: c54f38c9aa22 ("batman-adv: set skb priority according to content")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -420,7 +420,7 @@ void batadv_skb_set_priority(struct sk_b
switch (ethhdr->h_proto) {
case htons(ETH_P_8021Q):
- vhdr = skb_header_pointer(skb, offset + sizeof(*vhdr),
+ vhdr = skb_header_pointer(skb, offset,
sizeof(*vhdr), &vhdr_tmp);
if (!vhdr)
return;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 467/699] batman-adv: frag: free unfragmentable packet
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (465 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 466/699] batman-adv: fix VLAN priority offset Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 468/699] batman-adv: frag: fix primary_if leak on failed linearization Greg Kroah-Hartman
` (235 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 6b628425aed49a1c7a4ffc997583840fc582d32b upstream.
The caller of batadv_frag_send_packet() assume that the skb provided to the
function are always consumed. But the pre-check for an empty payload or the
zero fragment size returned an error without any further actions.
A failed pre-check must use the same error handling code as the rest of the
function.
Cc: stable@vger.kernel.org
Fixes: ee75ed88879a ("batman-adv: Fragment and send skbs larger than mtu")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/fragmentation.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -525,8 +525,10 @@ int batadv_frag_send_packet(struct sk_bu
mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
max_fragment_size = mtu - header_size;
- if (skb->len == 0 || max_fragment_size == 0)
- return -EINVAL;
+ if (skb->len == 0 || max_fragment_size == 0) {
+ ret = -EINVAL;
+ goto free_skb;
+ }
num_fragments = (skb->len - 1) / max_fragment_size + 1;
max_fragment_size = (skb->len - 1) / num_fragments + 1;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 468/699] batman-adv: frag: fix primary_if leak on failed linearization
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (466 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 467/699] batman-adv: frag: free unfragmentable packet Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 469/699] batman-adv: tt: prevent TVLV OOB check overflow Greg Kroah-Hartman
` (234 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 353d2c1d5492e53ae34f490a84494124dc3d3531 upstream.
If the skb has a frag_list, it must be linearized before it can be split
using skb_split(). But when this step failed, it must not only free the skb
but also take care of the reference to the already found primary_if.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: a063f2fba3fa ("batman-adv: Don't skb_split skbuffs with frag_list")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/fragmentation.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -554,7 +554,7 @@ int batadv_frag_send_packet(struct sk_bu
*/
if (skb_has_frag_list(skb) && __skb_linearize(skb)) {
ret = -ENOMEM;
- goto free_skb;
+ goto put_primary_if;
}
/* Create one header to be copied to all fragments */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 469/699] batman-adv: tt: prevent TVLV OOB check overflow
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (467 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 468/699] batman-adv: frag: fix primary_if leak on failed linearization Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 470/699] mfd: tps6586x: Fix OF node refcount Greg Kroah-Hartman
` (233 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 7a581d9aaba8c82bd6177fa36b2588eea77f6e2b upstream.
A TT unicast TVLV contains the number of VLANs stored in it. This number is
an u16 and gets multiplied by the size of the struct
batadv_tvlv_tt_vlan_data (8 bytes). The size can therefore overflow the u16
used to store the tt_vlan_len. All additional safety checks to prevent
out-of-bounds access of the TVLV buffer are invalid due to this overflow.
Using size_t prevents this overflow and ensures that the safety checks
compare against the actual buffer requirements.
Cc: stable@vger.kernel.org
Fixes: 7ea7b4a14275 ("batman-adv: make the TT CRC logic VLAN specific")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/translation-table.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -4338,7 +4338,8 @@ static int batadv_tt_tvlv_unicast_handle
u16 tvlv_value_len)
{
struct batadv_tvlv_tt_data *tt_data;
- u16 tt_vlan_len, tt_num_entries;
+ u16 tt_num_entries;
+ size_t tt_vlan_len;
char tt_flag;
bool ret;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 470/699] mfd: tps6586x: Fix OF node refcount
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (468 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 469/699] batman-adv: tt: prevent TVLV OOB check overflow Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 471/699] nvdimm/btt: Free arenas on btt_init() error paths Greg Kroah-Hartman
` (232 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Lee Jones
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
commit 3001ed2b4e06da2276c42ace6551617065a5b1f9 upstream.
Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().
Cc: stable@vger.kernel.org
Fixes: 62f6b0879304 ("tps6586x: Add device tree support")
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260521-pdev-fwnode-ref-v1-1-88c324a1b8d2@oss.qualcomm.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mfd/tps6586x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -399,7 +399,7 @@ static int tps6586x_add_subdevs(struct t
pdev->dev.parent = tps6586x->dev;
pdev->dev.platform_data = subdev->platform_data;
- pdev->dev.of_node = subdev->of_node;
+ pdev->dev.of_node = of_node_get(subdev->of_node);
ret = platform_device_add(pdev);
if (ret) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 471/699] nvdimm/btt: Free arenas on btt_init() error paths
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (469 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 470/699] mfd: tps6586x: Fix OF node refcount Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 472/699] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Greg Kroah-Hartman
` (231 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Alison Schofield
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 1a6b6442a982d0ca5fb6a1a39b6f6dfd760eda57 upstream.
The arenas allocated by discover_arenas() or create_arenas() are not
freed on some error paths in btt_init(). This leaks memory when BTT
initialization fails.
Call free_arenas() from the affected error paths to release the
allocations.
[ as: commit message and log edits ]
Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-2-592300fb7a43@cse.iitm.ac.in
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/btt.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -1615,7 +1615,7 @@ static struct btt *btt_init(struct nd_bt
if (btt->init_state != INIT_READY && nd_region->ro) {
dev_warn(dev, "%s is read-only, unable to init btt metadata\n",
dev_name(&nd_region->dev));
- return NULL;
+ goto err;
} else if (btt->init_state != INIT_READY) {
btt->num_arenas = (rawsize / ARENA_MAX_SIZE) +
((rawsize % ARENA_MAX_SIZE) ? 1 : 0);
@@ -1625,25 +1625,28 @@ static struct btt *btt_init(struct nd_bt
ret = create_arenas(btt);
if (ret) {
dev_info(dev, "init: create_arenas: %d\n", ret);
- return NULL;
+ goto err;
}
ret = btt_meta_init(btt);
if (ret) {
dev_err(dev, "init: error in meta_init: %d\n", ret);
- return NULL;
+ goto err;
}
}
ret = btt_blk_init(btt);
if (ret) {
dev_err(dev, "init: error in blk_init: %d\n", ret);
- return NULL;
+ goto err;
}
btt_debugfs_init(btt);
return btt;
+err:
+ free_arenas(btt);
+ return NULL;
}
/**
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 472/699] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (470 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 471/699] nvdimm/btt: Free arenas on btt_init() error paths Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 473/699] lockd: Plug nlm_file leak when nlm_do_fopen() fails Greg Kroah-Hartman
` (230 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Alison Schofield
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 13fe4cd9ddd0aacb7777812328be525a11ea3fea upstream.
Memory allocated by btt_freelist_init(), btt_rtt_init(), and
btt_maplocks_init() is not freed on some discover_arenas() error
paths. This leaks memory when arena discovery fails.
Add the missing kfree() calls to release the allocations before
returning an error.
[ as: commit message and log edits ]
Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Link: https://patch.msgid.link/20260519-nvdimmleaks-v1-1-592300fb7a43@cse.iitm.ac.in
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/btt.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -923,6 +923,9 @@ static int discover_arenas(struct btt *b
return ret;
out:
+ kfree(arena->freelist);
+ kfree(arena->rtt);
+ kfree(arena->map_locks);
kfree(arena);
free_arenas(btt);
out_super:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 473/699] lockd: Plug nlm_file leak when nlm_do_fopen() fails
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (471 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 472/699] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 474/699] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Greg Kroah-Hartman
` (229 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit f16a1513452edb532fec81e591c64c320866719c upstream.
A client can repeatedly drive nlm_do_fopen() failures by presenting
file handles that the underlying export rejects. After kzalloc_obj()
succeeds in nlm_lookup_file(), the freshly allocated nlm_file is not
yet inserted into nlm_files[]. The nlm_do_fopen() failure path jumps
to out_unlock, which releases nlm_file_mutex and returns without
freeing the allocation, so each failure leaks one nlm_file.
Route the failure through out_free so kfree() runs before the
function returns.
Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file")
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svcsubs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -139,7 +139,7 @@ nlm_lookup_file(struct svc_rqst *rqstp,
nfserr = nlm_do_fopen(rqstp, file, mode);
if (nfserr)
- goto out_unlock;
+ goto out_free;
hlist_add_head(&file->f_list, &nlm_files[hash]);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 474/699] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (472 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 473/699] lockd: Plug nlm_file leak when nlm_do_fopen() fails Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 475/699] MIPS: ip22-gio: fix gio device memory leak Greg Kroah-Hartman
` (228 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 70a38f87bed7f0694fd07988b47b2db1e10d8df3 upstream.
The cached-file path in nlm_lookup_file() reaches the found: label
unconditionally, even when nlm_do_fopen() fails. At that label
*result and file->f_count are updated before the error is returned.
The wrappers nlm3svc_lookup_file() and nlm4svc_lookup_file() then
bail out of their switch without copying *result back to their
caller, so the proc handler's local nlm_file pointer remains NULL
and the cleanup path skips nlm_release_file(). The f_count
increment is never released, and nlm_traverse_files() can no
longer reap the file because its refcount never returns to zero
between requests.
Short-circuit the cached path so neither *result nor f_count is
touched when nlm_do_fopen() fails on a hashed nlm_file.
Fixes: 7f024fcd5c97 ("Keep read and write fds with each nlm_file")
Cc: stable@vger.kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svcsubs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/lockd/svcsubs.c
+++ b/fs/lockd/svcsubs.c
@@ -123,6 +123,8 @@ nlm_lookup_file(struct svc_rqst *rqstp,
mutex_lock(&file->f_mutex);
nfserr = nlm_do_fopen(rqstp, file, mode);
mutex_unlock(&file->f_mutex);
+ if (nfserr)
+ goto out_unlock;
goto found;
}
nlm_debug_print_fh("creating file for", &lock->fh);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 475/699] MIPS: ip22-gio: fix gio device memory leak
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (473 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 474/699] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 476/699] MIPS: ip22-gio: fix kfree() of static object Greg Kroah-Hartman
` (227 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Bogendoerfer, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 7de9a1b45f5a95b58145653c525c8fb80292d9ab upstream.
The gio device release callback was never wired up so gio devices are
not freed when the last reference is dropped.
Fixes: e84de0c61905 ("MIPS: GIO bus support for SGI IP22/28")
Cc: stable@vger.kernel.org # 3.3
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/sgi-ip22/ip22-gio.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/mips/sgi-ip22/ip22-gio.c
+++ b/arch/mips/sgi-ip22/ip22-gio.c
@@ -101,6 +101,8 @@ int gio_device_register(struct gio_devic
{
giodev->dev.bus = &gio_bus_type;
giodev->dev.parent = &gio_bus;
+ giodev->dev.release = gio_release_dev;
+
return device_register(&giodev->dev);
}
EXPORT_SYMBOL_GPL(gio_device_register);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 476/699] MIPS: ip22-gio: fix kfree() of static object
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (474 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 475/699] MIPS: ip22-gio: fix gio device memory leak Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 477/699] MIPS: ip22-gio: fix device reference leak in probe Greg Kroah-Hartman
` (226 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Levente Kurusa, Johan Hovold,
Thomas Bogendoerfer
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c62cdd3e919bdf84c37ec46810f87cdb1736e822 upstream.
The gio bus root device is a statically allocated object which must not
be freed by kfree() on failure to register the device or bus.
Fixes: 82242d28ff8b ("MIPS: IP22: Add missing put_device call")
Cc: stable@vger.kernel.org # 3.17
Cc: Levente Kurusa <levex@linux.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/sgi-ip22/ip22-gio.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/mips/sgi-ip22/ip22-gio.c
+++ b/arch/mips/sgi-ip22/ip22-gio.c
@@ -30,7 +30,6 @@ static struct {
static void gio_bus_release(struct device *dev)
{
- kfree(dev);
}
static struct device gio_bus = {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 477/699] MIPS: ip22-gio: fix device reference leak in probe
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (475 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 476/699] MIPS: ip22-gio: fix kfree() of static object Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 478/699] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() Greg Kroah-Hartman
` (225 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Bogendoerfer, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b82930a4c5dbc5c4df39c0f93d968c239f2c6885 upstream.
The gio probe function needlessly takes a device reference which is
never released and therefore prevents unbound gio devices from being
freed.
Fixes: e84de0c61905 ("MIPS: GIO bus support for SGI IP22/28")
Cc: stable@vger.kernel.org # 3.3
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/sgi-ip22/ip22-gio.c | 4 ----
1 file changed, 4 deletions(-)
--- a/arch/mips/sgi-ip22/ip22-gio.c
+++ b/arch/mips/sgi-ip22/ip22-gio.c
@@ -133,13 +133,9 @@ static int gio_device_probe(struct devic
if (!drv->probe)
return error;
- gio_dev_get(gio_dev);
-
match = gio_match_device(drv->id_table, gio_dev);
if (match)
error = drv->probe(gio_dev, match);
- if (error)
- gio_dev_put(gio_dev);
return error;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 478/699] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (476 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 477/699] MIPS: ip22-gio: fix device reference leak in probe Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 479/699] power: supply: charger-manager: fix refcount leak in is_full_charged() Greg Kroah-Hartman
` (224 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit 5ff79e8bdc75db51e30298a75939e2308e7658e0 upstream.
In 64-bit configurations calling any firmware entry points from a kernel
thread other than the initial one will result in a situation where the
stack has been placed in the XKPHYS 64-bit memory segment.
Consequently the stack pointer is no longer a 32-bit value and when the
32-bit firmware code called uses 32-bit ALU operations to manipulate the
stack pointer, the calculated result is incorrect (in fact in the 64-bit
MIPS ISA almost all 32-bit ALU operations will produce an unpredictable
result when executed on 64-bit data) and control goes astray.
This may happen when no final console driver has been enabled in the
configuration and consequently the initial console continues being used
late into bootstrap, or with an upcoming change that will switch the zs
driver to use a platform device, which in turn will make the console
handover happen only after other kernel threads have already been
started, and the kernel will hang at:
pid_max: default: 32768 minimum: 301
or somewhat later, but always before:
cblist_init_generic: Setting adjustable number of callback queues.
has been printed.
It seems that only the prom_printf() entry point is affected. Of all
the other entry points wired only rex_slot_address() and rex_gettcinfo()
are called from a kernel thread other than the initial one, specifically
kernel_init(), and they are leaf functions that do no business with the
stack, having worked with no issue ever since 64-bit support was added
for the platform back in 2002.
To address this issue then, arrange for the stack to be switched in the
o32 wrapper as required for prom_printf() only, by supplying call_o32()
with a pointer to a chunk of initdata space, which is placed in the
CKSEG0 32-bit compatibility segment, observing that prom_printf() is
only called from console output handler and therefore with the console
lock held, implying no need for this code to be reentrant.
Other firmware entry points may be called with interrupts enabled and no
lock held, and may therefore require that call_o32() be reentrant. They
trigger no issue at this point and "if it ain't broke, don't fix it," so
just leave them alone.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v2.6.12+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/dec/prom/init.c | 6 +++++-
arch/mips/include/asm/dec/prom.h | 15 +++++++++++++--
2 files changed, 18 insertions(+), 3 deletions(-)
--- a/arch/mips/dec/prom/init.c
+++ b/arch/mips/dec/prom/init.c
@@ -3,7 +3,7 @@
* init.c: PROM library initialisation code.
*
* Copyright (C) 1998 Harald Koerfgen
- * Copyright (C) 2002, 2004 Maciej W. Rozycki
+ * Copyright (C) 2002, 2004, 2026 Maciej W. Rozycki
*/
#include <linux/init.h>
#include <linux/kernel.h>
@@ -20,6 +20,10 @@
#include <asm/dec/prom.h>
+#ifdef CONFIG_64BIT
+unsigned long o32_stk[O32_STK_SIZE] __initdata = { 0 };
+#endif
+
int (*__rex_bootinit)(void);
int (*__rex_bootread)(void);
int (*__rex_getbitmap)(memmap *);
--- a/arch/mips/include/asm/dec/prom.h
+++ b/arch/mips/include/asm/dec/prom.h
@@ -4,7 +4,7 @@
*
* DECstation PROM interface.
*
- * Copyright (C) 2002 Maciej W. Rozycki
+ * Copyright (C) 2002, 2026 Maciej W. Rozycki
*
* Based on arch/mips/dec/prom/prom.h by the Anonymous.
*/
@@ -97,6 +97,17 @@ extern int (*__pmax_close)(int);
#ifdef CONFIG_64BIT
+#define O32_STK_SIZE 512
+extern unsigned long o32_stk[];
+
+/* Switch the stack if outside the 32-bit address space. */
+static inline unsigned long *o32_get_stk(void)
+{
+ long fp = (long)__builtin_frame_address(0);
+
+ return fp != (int)fp ? o32_stk + O32_STK_SIZE : NULL;
+}
+
/*
* On MIPS64 we have to call PROM functions via a helper
* dispatcher to accommodate ABI incompatibilities.
@@ -128,7 +139,7 @@ int __DEC_PROM_O32(_prom_printf, (int (*
#define prom_getchar() _prom_getchar(__prom_getchar, NULL)
#define prom_getenv(x) _prom_getenv(__prom_getenv, NULL, x)
-#define prom_printf(x...) _prom_printf(__prom_printf, NULL, x)
+#define prom_printf(x...) _prom_printf(__prom_printf, o32_get_stk(), x)
#else /* !CONFIG_64BIT */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 479/699] power: supply: charger-manager: fix refcount leak in is_full_charged()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (477 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 478/699] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 480/699] proc: only bump parent nlink when registering directories Greg Kroah-Hartman
` (223 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WenTao Liang, Sebastian Reichel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: WenTao Liang <vulab@iscas.ac.cn>
commit 4373cfa38ead58f980362c841b0d0bdf8c4d956c upstream.
In is_full_charged(), power_supply_get_by_name() is called to
obtain a reference to the fuel_gauge power supply. If the
voltage check (uV >= desc->fullbatt_uV) succeeds, the function
returns true directly without releasing the reference, leaking
the refcount.
Fix this by setting a flag and jumping to the out label where
power_supply_put() properly drops the reference.
Cc: stable@vger.kernel.org
Fixes: e132fc6bb89b ("power: supply: charger-manager: Make decisions focussed on battery status")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20260611005322.53096-1-vulab@iscas.ac.cn
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/supply/charger-manager.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/power/supply/charger-manager.c
+++ b/drivers/power/supply/charger-manager.c
@@ -302,8 +302,10 @@ static bool is_full_charged(struct charg
if (cm->battery_status == POWER_SUPPLY_STATUS_FULL
&& desc->fullbatt_vchkdrop_uV)
uV += desc->fullbatt_vchkdrop_uV;
- if (uV >= desc->fullbatt_uV)
- return true;
+ if (uV >= desc->fullbatt_uV) {
+ is_full = true;
+ goto out;
+ }
}
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 480/699] proc: only bump parent nlink when registering directories
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (478 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 479/699] power: supply: charger-manager: fix refcount leak in is_full_charged() Greg Kroah-Hartman
@ 2026-07-21 15:23 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 481/699] mtd: slram: remove failed entries from the device list Greg Kroah-Hartman
` (222 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Christian Brauner (Amutable)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit 16b02eb4b9b272c221255c20d34ccd5db53a3ed3 upstream.
proc_register() increments the parent directory's link count for every
entry it registers, while remove_proc_entry() and remove_proc_subtree()
decrement it only when the removed entry is a directory. Regular files
thus inflate the parent's count while they exist, and leak one link
permanently on every create and remove cycle.
For example, /proc/bus/pci/00 with twenty-two device files and no
subdirectories reports nlink 24 instead of 2, and SR-IOV VF enable
and disable cycles, each creating and removing the VF config space
entries under /proc/bus/pci/<bus>, inflate the link count of that
directory without bound.
Before commit e06689bf5701 ("proc: change ->nlink under
proc_subdir_lock"), the increment lived in proc_mkdir_data() and
proc_create_mount_point(), and was therefore applied only to
directories. Moving it into proc_register() to bring it under
proc_subdir_lock dropped the S_ISDIR check.
Thus, move the nlink accounting into pde_subdir_insert() and
pde_erase(), only updating it for directories in both, so the link
count is always changed together with the directory entry itself.
Fixes: e06689bf5701 ("proc: change ->nlink under proc_subdir_lock")
Cc: stable@vger.kernel.org # v5.5+
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Link: https://patch.msgid.link/20260613211005.921692-1-kwilczynski@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/generic.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -112,6 +112,8 @@ static bool pde_subdir_insert(struct pro
/* Add new node and rebalance tree. */
rb_link_node(&de->subdir_node, parent, new);
rb_insert_color(&de->subdir_node, root);
+ if (S_ISDIR(de->mode))
+ dir->nlink++;
return true;
}
@@ -383,7 +385,6 @@ struct proc_dir_entry *proc_register(str
write_unlock(&proc_subdir_lock);
goto out_free_inum;
}
- dir->nlink++;
write_unlock(&proc_subdir_lock);
return dp;
@@ -697,6 +698,8 @@ static void pde_erase(struct proc_dir_en
{
rb_erase(&pde->subdir_node, &parent->subdir);
RB_CLEAR_NODE(&pde->subdir_node);
+ if (S_ISDIR(pde->mode))
+ parent->nlink--;
}
/*
@@ -722,8 +725,6 @@ void remove_proc_entry(const char *name,
de = NULL;
} else {
pde_erase(de, parent);
- if (S_ISDIR(de->mode))
- parent->nlink--;
}
}
write_unlock(&proc_subdir_lock);
@@ -782,8 +783,6 @@ int remove_proc_subtree(const char *name
continue;
}
next = de->parent;
- if (S_ISDIR(de->mode))
- next->nlink--;
write_unlock(&proc_subdir_lock);
proc_entry_rundown(de);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 481/699] mtd: slram: remove failed entries from the device list
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (479 preceding siblings ...)
2026-07-21 15:23 ` [PATCH 5.10 480/699] proc: only bump parent nlink when registering directories Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 482/699] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() Greg Kroah-Hartman
` (221 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruoyu Wang, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruoyu Wang <ruoyuw560@gmail.com>
commit 36f1648644d769c496a8e47e53603e863e358d73 upstream.
register_device() links a new slram_mtdlist entry before allocating all
of the state needed by the entry. If a later allocation, memremap(), or
mtd_device_register() fails, the partially initialized entry remains on
the global list. A later cleanup can then dereference or free invalid
state from that failed entry.
Unwind the partially initialized entry and clear the list tail on each
failure path after the entry has been linked.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/devices/slram.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -129,6 +129,7 @@ static int slram_write(struct mtd_info *
static int register_device(char *name, unsigned long start, unsigned long length)
{
slram_mtd_list_t **curmtd;
+ int ret = -ENOMEM;
curmtd = &slram_mtdlist;
while (*curmtd) {
@@ -155,14 +156,15 @@ static int register_device(char *name, u
if (!(*curmtd)->mtdinfo) {
E("slram: Cannot allocate new MTD device.\n");
- return(-ENOMEM);
+ goto err_free_list;
}
if (!(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start =
memremap(start, length,
MEMREMAP_WB | MEMREMAP_WT | MEMREMAP_WC))) {
E("slram: memremap failed\n");
- return -EIO;
+ ret = -EIO;
+ goto err_free_priv;
}
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->end =
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start + length;
@@ -183,10 +185,8 @@ static int register_device(char *name, u
if (mtd_device_register((*curmtd)->mtdinfo, NULL, 0)) {
E("slram: Failed to register new device\n");
- memunmap(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start);
- kfree((*curmtd)->mtdinfo->priv);
- kfree((*curmtd)->mtdinfo);
- return(-EAGAIN);
+ ret = -EAGAIN;
+ goto err_unmap;
}
T("slram: Registered device %s from %luKiB to %luKiB\n", name,
(start / 1024), ((start + length) / 1024));
@@ -194,6 +194,16 @@ static int register_device(char *name, u
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start,
((slram_priv_t *)(*curmtd)->mtdinfo->priv)->end);
return(0);
+
+err_unmap:
+ memunmap(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start);
+err_free_priv:
+ kfree((*curmtd)->mtdinfo->priv);
+err_free_list:
+ kfree((*curmtd)->mtdinfo);
+ kfree(*curmtd);
+ *curmtd = NULL;
+ return ret;
}
static void unregister_devices(void)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 482/699] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (480 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 481/699] mtd: slram: remove failed entries from the device list Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 483/699] ocfs2: use kzalloc for quota recovery bitmap allocation Greg Kroah-Hartman
` (220 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Wilck, Don Brace, storagedev,
Hannes Reinecke, Hannes Reinecke, Christoph Hellwig,
Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Wilck <martin.wilck@suse.com>
commit 57db1307afb1f83d45f5ff53b93f8d040100d13e upstream.
shost_to_hba() is used everywhere except to obtain pqi_ctrl_info from
shosti, except in pqi_scan_finished(), where shost_priv() is used. This
causes one pointer dereference to be missed, as shost->hostdata is a
pointer in smartpqi. Fix it.
Fixes: 6c223761eb54 ("smartpqi: initial commit of Microsemi smartpqi driver")
Signed-off-by: Martin Wilck <martin.wilck@suse.com>
Reviewed-by: Don Brace <don.brace@microchip.com>
Cc: Don Brace <don.brace@microchip.com>
Cc: storagedev@microchip.com
Cc: stable@vger.kernel.org
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260513174236.430465-2-mwilck@suse.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/smartpqi/smartpqi_init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/smartpqi/smartpqi_init.c
+++ b/drivers/scsi/smartpqi/smartpqi_init.c
@@ -2191,7 +2191,7 @@ static int pqi_scan_finished(struct Scsi
{
struct pqi_ctrl_info *ctrl_info;
- ctrl_info = shost_priv(shost);
+ ctrl_info = shost_to_hba(shost);
return !mutex_is_locked(&ctrl_info->scan_mutex);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 483/699] ocfs2: use kzalloc for quota recovery bitmap allocation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (481 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 482/699] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 484/699] mtd: rawnand: fix condition in nand_select_target() Greg Kroah-Hartman
` (219 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7ea0b96c4ddb49fd1a70,
Tristan Madani, Joseph Qi, Mark Fasheh, Joel Becker, Junxiao Bi,
Changwei Ge, Jun Piao, Heming Zhao, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
commit 93c8c6ea90be9e9df8fe14048ad4e3caad0770a6 upstream.
ocfs2 quota recovery allocates a bitmap buffer with kmalloc and does not
fully initialize it. This can lead to use of uninitialized bits during
quota recovery from a corrupted filesystem image.
Use kzalloc instead to ensure the bitmap is zero-initialized.
Link: https://lore.kernel.org/20260418131048.1052507-1-tristmd@gmail.com
Reported-by: syzbot+7ea0b96c4ddb49fd1a70@syzkaller.appspotmail.com
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/quota_local.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ocfs2/quota_local.c
+++ b/fs/ocfs2/quota_local.c
@@ -302,7 +302,7 @@ static int ocfs2_add_recovery_chunk(stru
if (!rc)
return -ENOMEM;
rc->rc_chunk = chunk;
- rc->rc_bitmap = kmalloc(sb->s_blocksize, GFP_NOFS);
+ rc->rc_bitmap = kzalloc(sb->s_blocksize, GFP_NOFS);
if (!rc->rc_bitmap) {
kfree(rc);
return -ENOMEM;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 484/699] mtd: rawnand: fix condition in nand_select_target()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (482 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 483/699] ocfs2: use kzalloc for quota recovery bitmap allocation Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 485/699] ocfs2: avoid moving extents to occupied clusters Greg Kroah-Hartman
` (218 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arseniy Krasnov, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <avkrasnov@rulkc.org>
commit 8507c2cc9e4fa402401819f44d1e8a5ef4d11d8b upstream.
'cs' here must be in range [0:nanddev_ntargets[.
Cc: stable@vger.kernel.org
Fixes: 32813e288414 ("mtd: rawnand: Get rid of chip->numchips")
Signed-off-by: Arseniy Krasnov <avkrasnov@rulkc.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/nand_base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -174,7 +174,7 @@ void nand_select_target(struct nand_chip
* cs should always lie between 0 and nanddev_ntargets(), when that's
* not the case it's a bug and the caller should be fixed.
*/
- if (WARN_ON(cs > nanddev_ntargets(&chip->base)))
+ if (WARN_ON(cs >= nanddev_ntargets(&chip->base)))
return;
chip->cur_cs = cs;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 485/699] ocfs2: avoid moving extents to occupied clusters
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (483 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 484/699] mtd: rawnand: fix condition in nand_select_target() Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 486/699] ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits Greg Kroah-Hartman
` (217 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kyle Zeng, Joseph Qi, Mark Fasheh,
Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao,
Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <kylebot@openai.com>
commit 22920541c35a9f23f219038ba5874c843a7c4419 upstream.
For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical
me_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and
expects ocfs2_probe_alloc_group() to replace it with a free run in the
target block group.
The probe currently leaves *phys_cpos unchanged if the scan reaches the
end of the group without finding a free run. An occupied goal at the last
bit can therefore survive the probe and be passed to
__ocfs2_move_extent(), which copies file data into a cluster still owned
by another inode before the bitmap is updated.
When the probe does find a free run, it also subtracts move_len from the
ending bit. The start of an N-bit run ending at i is i - N + 1, so the
current calculation can report the bit immediately before the free run.
Clear *phys_cpos before scanning and use the correct free-run start.
Callers already treat a zero result as -ENOSPC, so failed probes no longer
continue with an occupied caller-controlled goal.
Link: https://lore.kernel.org/20260611213510.16956-1-kylebot@openai.com
Fixes: e6b5859cccfa ("Ocfs2/move_extents: helper to probe a proper region to move in an alloc group.")
Fixes: 236b9254f8d1 ("ocfs2: fix non-auto defrag path not working issue")
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/move_extents.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/ocfs2/move_extents.c
+++ b/fs/ocfs2/move_extents.c
@@ -536,6 +536,8 @@ static void ocfs2_probe_alloc_group(stru
u32 base_cpos = ocfs2_blocks_to_clusters(inode->i_sb,
le64_to_cpu(gd->bg_blkno));
+ *phys_cpos = 0;
+
for (i = base_bit; i < le16_to_cpu(gd->bg_bits); i++) {
used = ocfs2_test_bit(i, (unsigned long *)gd->bg_bitmap);
@@ -557,7 +559,7 @@ static void ocfs2_probe_alloc_group(stru
last_free_bits++;
if (last_free_bits == move_len) {
- i -= move_len;
+ i = i - move_len + 1;
*goal_bit = i;
*phys_cpos = base_cpos + i;
break;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 486/699] ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (484 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 485/699] ocfs2: avoid moving extents to occupied clusters Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 487/699] ocfs2: reject dinodes with non-canonical i_mode type Greg Kroah-Hartman
` (216 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Bridges,
syzbot+e9c15ff790cea6a0cfae, Joseph Qi, Mark Fasheh, Joel Becker,
Junxiao Bi, Changwei Ge, Jun Piao, Heming Zhao, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Bridges <icb@fastmail.org>
commit f9ab30c96b0f00c20c6dac93681bdae3a033d229 upstream.
[BUG]
A direct write over unwritten extents can panic the kernel in
ocfs2_assure_trans_credits() when the journal aborts during DIO
completion. The crash is a general protection fault from a NULL pointer
dereference.
[CAUSE]
ocfs2_dio_end_io_write() loops over a direct write's unwritten extents,
marking each written under a single journal handle. If the journal
aborts (for example after an I/O error) while the extent tree is being
updated, the handle is left aborted with its transaction pointer
cleared. The extent merge treats that failure as not critical and
reports success, so the loop keeps using the handle.
ocfs2_assure_trans_credits() reads the handle's remaining credits
without first checking whether the handle is aborted, and that read
dereferences the cleared transaction pointer.
[FIX]
A journal abort is recorded in the handle itself, so callers are
expected to test the handle rather than rely on a returned error.
Make ocfs2_assure_trans_credits() do that, as the other ocfs2 journal
helpers already do, and return -EROFS when the handle is aborted.
Link: https://lore.kernel.org/airKTsM1fRVN-Wj7@dev
Fixes: be346c1a6eeb ("ocfs2: fix DIO failure due to insufficient transaction credits")
Signed-off-by: Ian Bridges <icb@fastmail.org>
Reported-by: syzbot+e9c15ff790cea6a0cfae@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e9c15ff790cea6a0cfae
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/journal.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/ocfs2/journal.c
+++ b/fs/ocfs2/journal.c
@@ -480,8 +480,12 @@ bail:
*/
int ocfs2_assure_trans_credits(handle_t *handle, int nblocks)
{
- int old_nblks = jbd2_handle_buffer_credits(handle);
+ int old_nblks;
+ if (is_handle_aborted(handle))
+ return -EROFS;
+
+ old_nblks = jbd2_handle_buffer_credits(handle);
trace_ocfs2_assure_trans_credits(old_nblks);
if (old_nblks >= nblocks)
return 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 487/699] ocfs2: reject dinodes with non-canonical i_mode type
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (485 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 486/699] ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 488/699] ocfs2: reject dinodes whose i_rdev disagrees with the file type Greg Kroah-Hartman
` (215 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Joseph Qi,
Changwei Ge, Heming Zhao, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 5366a017099c6a3c443be908a05f26fd72af12a1 upstream.
Patch series "ocfs2: harden inode validators against forged metadata", v2.
This series adds three structural checks to OCFS2 dinode validation so
malformed on-disk fields are rejected before ocfs2_populate_inode() copies
them into the in-core inode.
The checks cover:
- i_mode values whose type bits do not name a canonical POSIX file
type;
- non-device dinodes whose id1.dev1.i_rdev field is non-zero; and
- non-inline dinodes that claim non-zero i_size while i_clusters is
zero, covering directories unconditionally and regular files on
non-sparse volumes.
The normal read path reports these through ocfs2_error(), matching the
existing suballoc-slot, inline-data, chain-list, and refcount checks. The
online filecheck path uses the same structural predicates but keeps its
own reporting contract, returning OCFS2_FILECHECK_ERR_INVALIDINO instead
of calling ocfs2_error().
This patch (of 3):
ocfs2_validate_inode_block() currently accepts any non-zero i_mode value.
ocfs2_populate_inode() then copies that mode verbatim into inode->i_mode
and dispatches on i_mode & S_IFMT to the file/dir/symlink/special_file
iops; an unrecognised type falls through to ocfs2_special_file_iops and
init_special_inode().
Reject dinodes whose type bits do not name one of the seven canonical
POSIX file types. Use fs_umode_to_ftype(), the same generic file-type
conversion helper OCFS2 already uses for directory entries, so the
accepted inode type set matches the kernel file-type vocabulary instead of
open-coding a local switch.
Apply the same structural check to the online filecheck read path.
filecheck keeps its own error namespace, so it reports malformed i_mode
through the filecheck logger and OCFS2_FILECHECK_ERR_INVALIDINO instead of
calling ocfs2_error(), but it must not allow a malformed dinode to proceed
into ocfs2_populate_inode().
Link: https://lore.kernel.org/20260519110404.1803902-1-michael.bommarito@gmail.com
Link: https://lore.kernel.org/20260519110404.1803902-2-michael.bommarito@gmail.com
Fixes: b657c95c1108 ("ocfs2: Wrap inode block reads in a dedicated function.")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://sashiko.dev/#/patchset/20260517111015.3187935-1-michael.bommarito%40gmail.com
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/inode.c | 35 +++++++++++++++++++++++++++++++++--
1 file changed, 33 insertions(+), 2 deletions(-)
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -68,7 +68,12 @@ static int ocfs2_filecheck_read_inode_bl
static int ocfs2_filecheck_validate_inode_block(struct super_block *sb,
struct buffer_head *bh);
static int ocfs2_filecheck_repair_inode_block(struct super_block *sb,
- struct buffer_head *bh);
+ struct buffer_head *bh);
+
+static bool ocfs2_valid_inode_mode(umode_t mode)
+{
+ return fs_umode_to_ftype(mode) != FT_UNKNOWN;
+}
void ocfs2_set_inode_flags(struct inode *inode)
{
@@ -1418,6 +1423,24 @@ int ocfs2_validate_inode_block(struct su
goto bail;
}
+ /*
+ * Reject dinodes whose i_mode does not name one of the seven
+ * canonical POSIX file types. ocfs2_populate_inode() copies
+ * i_mode verbatim into inode->i_mode and then dispatches via
+ * switch (mode & S_IFMT) to file/dir/symlink/special_file iops;
+ * an unrecognised type falls into ocfs2_special_file_iops with
+ * init_special_inode(), which interprets i_rdev. Constrain the
+ * type here so the dispatch only ever sees a value mkfs.ocfs2 /
+ * VFS can produce.
+ */
+ if (!ocfs2_valid_inode_mode(le16_to_cpu(di->i_mode))) {
+ rc = ocfs2_error(sb,
+ "Invalid dinode #%llu: mode 0%o has unknown file type\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(di->i_mode));
+ goto bail;
+ }
+
if (le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL) {
struct ocfs2_inline_data *data = &di->id2.i_data;
@@ -1514,6 +1537,15 @@ static int ocfs2_filecheck_validate_inod
(unsigned long long)bh->b_blocknr,
le32_to_cpu(di->i_fs_generation));
rc = -OCFS2_FILECHECK_ERR_GENERATION;
+ goto bail;
+ }
+
+ if (!ocfs2_valid_inode_mode(le16_to_cpu(di->i_mode))) {
+ mlog(ML_ERROR,
+ "Filecheck: invalid dinode #%llu: mode 0%o has unknown file type\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(di->i_mode));
+ rc = -OCFS2_FILECHECK_ERR_INVALIDINO;
}
bail:
@@ -1689,4 +1721,3 @@ const struct ocfs2_caching_operations oc
.co_io_lock = ocfs2_inode_cache_io_lock,
.co_io_unlock = ocfs2_inode_cache_io_unlock,
};
-
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 488/699] ocfs2: reject dinodes whose i_rdev disagrees with the file type
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (486 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 487/699] ocfs2: reject dinodes with non-canonical i_mode type Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 489/699] ocfs2: reject non-inline dinodes with i_size and zero i_clusters Greg Kroah-Hartman
` (214 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Joseph Qi,
Changwei Ge, Heming Zhao, Joel Becker, Jun Piao, Junxiao Bi,
Mark Fasheh, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 51407c2d249987a466416890a5c931a2354a46aa upstream.
id1.dev1.i_rdev is the device-number arm of the ocfs2_dinode id1 union.
It is only meaningful for character and block device inodes. For any
other user-visible file type the on-disk value must be zero.
ocfs2_populate_inode() currently copies id1.dev1.i_rdev into inode->i_rdev
before the S_IFMT switch decides whether the inode is a special file. A
non-device inode with a non-zero i_rdev can therefore publish stale or
attacker-controlled device state into the in-core inode.
System inodes legitimately use other arms of the same union, so keep the
cross-check restricted to non-system inodes. Factor that predicate into a
helper and use it in both the normal validator and online filecheck path;
filecheck reports the malformed dinode through
OCFS2_FILECHECK_ERR_INVALIDINO instead of ocfs2_error().
Link: https://lore.kernel.org/20260519110404.1803902-3-michael.bommarito@gmail.com
Fixes: b657c95c1108 ("ocfs2: Wrap inode block reads in a dedicated function.")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/inode.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 55 insertions(+)
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -75,6 +75,16 @@ static bool ocfs2_valid_inode_mode(umode
return fs_umode_to_ftype(mode) != FT_UNKNOWN;
}
+static bool ocfs2_dinode_has_unexpected_rdev(struct ocfs2_dinode *di)
+{
+ umode_t mode = le16_to_cpu(di->i_mode);
+
+ if (le32_to_cpu(di->i_flags) & OCFS2_SYSTEM_FL)
+ return false;
+
+ return !S_ISCHR(mode) && !S_ISBLK(mode) && di->id1.dev1.i_rdev != 0;
+}
+
void ocfs2_set_inode_flags(struct inode *inode)
{
unsigned int flags = OCFS2_I(inode)->ip_attr;
@@ -1441,6 +1451,41 @@ int ocfs2_validate_inode_block(struct su
goto bail;
}
+ /*
+ * id1.dev1.i_rdev is the device-number arm of the id1 union and
+ * is only meaningful for character and block device inodes. For
+ * any other regular user-visible file type the on-disk value
+ * must be zero. ocfs2_populate_inode() currently runs
+ *
+ * inode->i_rdev = huge_decode_dev(le64_to_cpu(fe->id1.dev1.i_rdev));
+ *
+ * unconditionally, before the S_IFMT switch decides whether the
+ * inode is a special file. As a result, an i_rdev value present
+ * on a non-device inode is silently published into the in-core
+ * inode; a subsequent forced re-read or in-core mode mutation
+ * (cluster peer with raw write access to the shared LUN,
+ * on-disk corruption, or a separately forged dinode) can then
+ * expose the attacker-controlled device number to
+ * init_special_inode() without ever showing an unusual i_mode
+ * at validation time.
+ *
+ * System inodes (OCFS2_SYSTEM_FL) legitimately use the bitmap1
+ * and journal1 arms of the same union (allocator i_used /
+ * i_total counters and the journal ij_flags /
+ * ij_recovery_generation pair); those bytes are not an i_rdev
+ * and must not be checked here. Restrict the cross-check to
+ * non-system inodes, which is the full attacker-controllable
+ * surface.
+ */
+ if (ocfs2_dinode_has_unexpected_rdev(di)) {
+ rc = ocfs2_error(sb,
+ "Invalid dinode #%llu: non-device mode 0%o with i_rdev %llu\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(di->i_mode),
+ (unsigned long long)le64_to_cpu(di->id1.dev1.i_rdev));
+ goto bail;
+ }
+
if (le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL) {
struct ocfs2_inline_data *data = &di->id2.i_data;
@@ -1546,6 +1591,16 @@ static int ocfs2_filecheck_validate_inod
(unsigned long long)bh->b_blocknr,
le16_to_cpu(di->i_mode));
rc = -OCFS2_FILECHECK_ERR_INVALIDINO;
+ goto bail;
+ }
+
+ if (ocfs2_dinode_has_unexpected_rdev(di)) {
+ mlog(ML_ERROR,
+ "Filecheck: invalid dinode #%llu: non-device mode 0%o with i_rdev %llu\n",
+ (unsigned long long)bh->b_blocknr,
+ le16_to_cpu(di->i_mode),
+ (unsigned long long)le64_to_cpu(di->id1.dev1.i_rdev));
+ rc = -OCFS2_FILECHECK_ERR_INVALIDINO;
}
bail:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 489/699] ocfs2: reject non-inline dinodes with i_size and zero i_clusters
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (487 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 488/699] ocfs2: reject dinodes whose i_rdev disagrees with the file type Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 490/699] mtd: maps: vmu-flash: fix NULL pointer dereference in initialization Greg Kroah-Hartman
` (213 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Joseph Qi,
Mark Fasheh, Joel Becker, Junxiao Bi, Changwei Ge, Jun Piao,
Heming Zhao, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 7ebc672fab7a76e1e47e0f2fc1ee48118d27fde4 upstream.
On a volume mounted without OCFS2_FEATURE_INCOMPAT_SPARSE_ALLOC, a
non-inline regular file with non-zero i_size and zero i_clusters is
structurally malformed: the extent map declares no allocated clusters yet
the size header claims content exists. Keep rejecting that shape, but
express it through a shared predicate so the same invariant is available
to normal inode reads and online filecheck.
The same zero-cluster shape is also malformed for non-inline directories.
ocfs2 directory growth allocates backing storage before advancing i_size,
and ocfs2_dir_foreach_blk_el() later walks until ctx->pos reaches
i_size_read(inode). A forged directory dinode with a huge i_size and no
clusters would repeatedly fail on holes while advancing through the
claimed size.
Sparse regular files remain exempt: on sparse-alloc volumes, truncate can
legitimately grow i_size without allocating clusters. System inodes and
inline-data dinodes also retain their separate storage rules.
Mirror the check in ocfs2_filecheck_validate_inode_block() as well.
filecheck reports through its own error namespace, so malformed
size/cluster state is logged as a filecheck invalid-inode result rather
than via ocfs2_error(), but it must not proceed into
ocfs2_populate_inode().
Link: https://lore.kernel.org/20260519110404.1803902-4-michael.bommarito@gmail.com
Fixes: b657c95c1108 ("ocfs2: Wrap inode block reads in a dedicated function.")
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://sashiko.dev/#/patchset/20260517111015.3187935-1-michael.bommarito%40gmail.com
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Heming Zhao <heming.zhao@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/inode.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 60 insertions(+)
--- a/fs/ocfs2/inode.c
+++ b/fs/ocfs2/inode.c
@@ -85,6 +85,24 @@ static bool ocfs2_dinode_has_unexpected_
return !S_ISCHR(mode) && !S_ISBLK(mode) && di->id1.dev1.i_rdev != 0;
}
+static bool ocfs2_dinode_has_size_without_clusters(struct super_block *sb,
+ struct ocfs2_dinode *di)
+{
+ umode_t mode = le16_to_cpu(di->i_mode);
+
+ if (le32_to_cpu(di->i_flags) & OCFS2_SYSTEM_FL)
+ return false;
+ if (le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL)
+ return false;
+ if (!le64_to_cpu(di->i_size) || le32_to_cpu(di->i_clusters))
+ return false;
+
+ if (S_ISDIR(mode))
+ return true;
+
+ return !ocfs2_sparse_alloc(OCFS2_SB(sb)) && S_ISREG(mode);
+}
+
void ocfs2_set_inode_flags(struct inode *inode)
{
unsigned int flags = OCFS2_I(inode)->ip_attr;
@@ -1486,6 +1504,33 @@ int ocfs2_validate_inode_block(struct su
goto bail;
}
+ /*
+ * Non-inline directories must not have i_size without allocated
+ * clusters: directory growth adds storage before advancing i_size,
+ * and readdir walks i_size block-by-block. A forged directory
+ * with zero clusters and a huge i_size would repeatedly fault on
+ * holes while advancing through the claimed size.
+ *
+ * Non-inline regular files have the same invariant on non-sparse
+ * volumes. Sparse regular files are different: truncate can
+ * legitimately grow i_size without allocating clusters, so keep
+ * the sparse-alloc carveout for S_IFREG only. System inodes and
+ * inline-data dinodes have their own storage rules.
+ */
+ if (ocfs2_dinode_has_size_without_clusters(sb, di)) {
+ if (S_ISDIR(le16_to_cpu(di->i_mode)))
+ rc = ocfs2_error(sb,
+ "Invalid dinode #%llu: directory i_size %llu with i_clusters 0 and no inline-data flag\n",
+ (unsigned long long)bh->b_blocknr,
+ (unsigned long long)le64_to_cpu(di->i_size));
+ else
+ rc = ocfs2_error(sb,
+ "Invalid dinode #%llu: regular file i_size %llu with i_clusters 0 and no inline-data flag on non-sparse volume\n",
+ (unsigned long long)bh->b_blocknr,
+ (unsigned long long)le64_to_cpu(di->i_size));
+ goto bail;
+ }
+
if (le16_to_cpu(di->i_dyn_features) & OCFS2_INLINE_DATA_FL) {
struct ocfs2_inline_data *data = &di->id2.i_data;
@@ -1601,6 +1646,21 @@ static int ocfs2_filecheck_validate_inod
le16_to_cpu(di->i_mode),
(unsigned long long)le64_to_cpu(di->id1.dev1.i_rdev));
rc = -OCFS2_FILECHECK_ERR_INVALIDINO;
+ goto bail;
+ }
+
+ if (ocfs2_dinode_has_size_without_clusters(sb, di)) {
+ if (S_ISDIR(le16_to_cpu(di->i_mode)))
+ mlog(ML_ERROR,
+ "Filecheck: invalid dinode #%llu: directory i_size %llu with i_clusters 0 and no inline-data flag\n",
+ (unsigned long long)bh->b_blocknr,
+ (unsigned long long)le64_to_cpu(di->i_size));
+ else
+ mlog(ML_ERROR,
+ "Filecheck: invalid dinode #%llu: regular file i_size %llu with i_clusters 0 and no inline-data flag on non-sparse volume\n",
+ (unsigned long long)bh->b_blocknr,
+ (unsigned long long)le64_to_cpu(di->i_size));
+ rc = -OCFS2_FILECHECK_ERR_INVALIDINO;
}
bail:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 490/699] mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (488 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 489/699] ocfs2: reject non-inline dinodes with i_size and zero i_clusters Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 491/699] irqchip/crossbar: Use correct index in crossbar_domain_free() Greg Kroah-Hartman
` (212 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Fuchs, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <fuchsfl@gmail.com>
commit 357e3b8e3a8769ba36eb8ec5e053e4825f1a9329 upstream.
The mtd_info contains a struct device, which must be linked to its
parent. Without this, the initialization of the MTD fails with a NULL
pointer dereference.
Fixes: 47a72688fae7 ("mtd: flash mapping support for Dreamcast VMU.")
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/maps/vmu-flash.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mtd/maps/vmu-flash.c
+++ b/drivers/mtd/maps/vmu-flash.c
@@ -547,6 +547,7 @@ static void vmu_queryblocks(struct maple
mpart->partition = card->partition;
mtd_cur->priv = mpart;
mtd_cur->owner = THIS_MODULE;
+ mtd_cur->dev.parent = &mdev->dev;
pcache = kzalloc(sizeof(struct vmu_cache), GFP_KERNEL);
if (!pcache)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 491/699] irqchip/crossbar: Use correct index in crossbar_domain_free()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (489 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 490/699] mtd: maps: vmu-flash: fix NULL pointer dereference in initialization Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 492/699] i2c: mediatek: fix WRRD for SoCs without auto_restart option Greg Kroah-Hartman
` (211 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bhargav Joshi, Thomas Gleixner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhargav Joshi <j.bhargav.u@gmail.com>
commit 043db005a8d6932dc7d217c86307e9af0bc10ddc upstream.
crossbar_domain_free() resets the domain data and then uses the nulled
out irq_data->hwirq member as index to reset the irq_map[] entry and to
write the relevant crossbar register with a safe entry. That means it
never frees the correct index and keeps the crossbar register connection
to the source interrupt active.
If it would not reset the domain data, then this would be even worse as
irq_data->hwirq holds the source interrupt number, but both the map and
register index need the corresponding GIC SPI number and not the source
interrupt number. This might even result in an out of bounds access as
the source interrupt number can be higher than the maximal index space.
Fix this by using the GIC SPI index from the parent domain's irq_data.
Fixes: 783d31863fb82 ("irqchip: crossbar: Convert dra7 crossbar to stacked domains")
Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260620-irq-crossbar-fix-v2-1-b8e8499f468a@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-crossbar.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -158,9 +158,14 @@ static void crossbar_domain_free(struct
for (i = 0; i < nr_irqs; i++) {
struct irq_data *d = irq_domain_get_irq_data(domain, virq + i);
+ /*
+ * irq_map[] is indexed by GIC SPI number. The parent domain's
+ * hwirq contains the GIC interrupt number (GIC SPI +
+ * GIC_IRQ_START).
+ */
+ cb->irq_map[d->parent_data->hwirq - GIC_IRQ_START] = IRQ_FREE;
+ cb->write(d->parent_data->hwirq - GIC_IRQ_START, cb->safe_map);
irq_domain_reset_irq_data(d);
- cb->irq_map[d->hwirq] = IRQ_FREE;
- cb->write(d->hwirq, cb->safe_map);
}
raw_spin_unlock(&cb->lock);
irq_domain_free_irqs_parent(domain, virq, nr_irqs);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 492/699] i2c: mediatek: fix WRRD for SoCs without auto_restart option
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (490 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 491/699] irqchip/crossbar: Use correct index in crossbar_domain_free() Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 493/699] i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() Greg Kroah-Hartman
` (210 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roman Vivchar,
AngeloGioacchino Del Regno, Andi Shyti
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Vivchar <rva333@protonmail.com>
commit deb35336b5bfed5db9231b5348bc1514db930797 upstream.
MediaTek mt65xx family SoCs have no auto restart, however, they still
support the WRRD mode in the hardware. Because auto_restart is set to 0,
the WRRD mode will be never enabled, leading to read errors.
Fix this by removing auto_restart check from the WRRD enable path.
Fixes: b49218365280 ("i2c: mediatek: fix potential incorrect use of I2C_MASTER_WRRD")
Signed-off-by: Roman Vivchar <rva333@protonmail.com>
Cc: <stable@vger.kernel.org> # v6.18+
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260709-6572-6595-i2c-v2-1-b2fb8510d1d3@protonmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-mt65xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -1075,7 +1075,7 @@ static int mtk_i2c_transfer(struct i2c_a
i2c->auto_restart = i2c->dev_comp->auto_restart;
/* checking if we can skip restart and optimize using WRRD mode */
- if (i2c->auto_restart && num == 2) {
+ if (num == 2) {
if (!(msgs[0].flags & I2C_M_RD) && (msgs[1].flags & I2C_M_RD) &&
msgs[0].addr == msgs[1].addr) {
i2c->auto_restart = 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 493/699] i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (491 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 492/699] i2c: mediatek: fix WRRD for SoCs without auto_restart option Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 494/699] xen/gntdev: fix error handling in ioctl Greg Kroah-Hartman
` (209 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xuanqiang Luo, Andi Shyti
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
commit 71356737a7a55c76fee847563e3d33f8e6dc6b6d upstream.
If devm_platform_get_and_ioremap_resource() returns an error,
mlxbf_i2c_init_resource() frees tmp_res before reading tmp_res->io to
get the error code. This results in a use-after-free.
Save the error code before freeing tmp_res.
Fixes: b5b5b32081cd ("i2c: mlxbf: I2C SMBus driver for Mellanox BlueField SoC")
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Cc: <stable@vger.kernel.org> # v5.10+
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260714150808.85045-1-xuanqiang.luo@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-mlxbf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-mlxbf.c
+++ b/drivers/i2c/busses/i2c-mlxbf.c
@@ -1063,8 +1063,10 @@ static int mlxbf_i2c_init_resource(struc
tmp_res->io = devm_ioremap_resource(dev, tmp_res->params);
if (IS_ERR(tmp_res->io)) {
+ int ret = PTR_ERR(tmp_res->io);
+
devm_kfree(dev, tmp_res);
- return PTR_ERR(tmp_res->io);
+ return ret;
}
tmp_res->type = type;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 494/699] xen/gntdev: fix error handling in ioctl
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (492 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 493/699] i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 495/699] xfrm: use compat translator only for u64 alignment mismatch Greg Kroah-Hartman
` (208 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wentao Liang, Juergen Gross
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit 45ca1afe2fd14c04e37227e79d3f8455831d8408 upstream.
When gntdev_ioctl_map_grant_ref() fails to copy the operation result
back to userspace after successfully adding the mapping to the list,
the error path returns -EFAULT without releasing the reference
acquired by gntdev_alloc_map(). The mapping remains in priv->maps
with a refcount of 1, causing a memory leak and a dangling list
entry.
Additionally, gntdev_add_map() may modify map->index to avoid overlap
with existing mappings. Therefore, the index returned to userspace
must be obtained after gntdev_add_map() completes.
Fix this by holding the mutex across gntdev_add_map(), retrieving
the correct index, and copy_to_user(). If copy_to_user() fails,
remove the mapping from the list and release the reference while
still holding the lock.
Cc: stable@vger.kernel.org
Fix these issues by properly handling all error cases.
Fixes: 1401c00e59ea ("xen/gntdev: convert priv->lock to a mutex")
Fixes: 68b025c813c2 ("xen-gntdev: Add reference counting to maps")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Message-ID: <20260622112541.38194-1-vulab@iscas.ac.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/gntdev.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -668,11 +668,15 @@ static long gntdev_ioctl_map_grant_ref(s
mutex_lock(&priv->lock);
gntdev_add_map(priv, map);
op.index = map->index << PAGE_SHIFT;
- mutex_unlock(&priv->lock);
- if (copy_to_user(u, &op, sizeof(op)) != 0)
+ if (copy_to_user(u, &op, sizeof(op)) != 0) {
+ list_del(&map->next);
+ mutex_unlock(&priv->lock);
+ gntdev_put_map(priv, map);
return -EFAULT;
+ }
+ mutex_unlock(&priv->lock);
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 495/699] xfrm: use compat translator only for u64 alignment mismatch
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (493 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 494/699] xen/gntdev: fix error handling in ioctl Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 496/699] xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
` (207 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sanman Pradhan, Steffen Klassert
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanman Pradhan <psanman@juniper.net>
commit 355fbcbdc2539cca7890b0d0914d4ce0f985ad74 upstream.
The XFRM compat layer (CONFIG_XFRM_USER_COMPAT) translates 32-bit xfrm
netlink and setsockopt messages into the native 64-bit layout. It is
only needed on architectures where the 32-bit and 64-bit ABIs disagree
on u64 alignment, which the kernel encodes as COMPAT_FOR_U64_ALIGNMENT.
That symbol is defined only by arch/x86. XFRM_USER_COMPAT depends on it,
so the translator can never be built on any other architecture,
including arm64, which still provides a 32-bit compat ABI (CONFIG_COMPAT)
for AArch32 EL0 userspace. On arm64 the AArch32 EABI already aligns u64
to 8 bytes, identical to the AArch64 ABI, so no translation is required
and the native code path is correct for 32-bit tasks.
However, xfrm_user_rcv_msg() and xfrm_user_policy() gate on
in_compat_syscall() alone and then call xfrm_get_translator(), which
returns NULL when no translator is registered. On arm64 that is always
the case, so every xfrm netlink message and the XFRM_POLICY setsockopt
issued by a 32-bit task returns -EOPNOTSUPP. A 32-bit userspace process
on arm64 (and on any other arch with CONFIG_COMPAT but without
COMPAT_FOR_U64_ALIGNMENT) therefore cannot configure XFRM state or
policy through the XFRM_USER netlink API, and cannot use the XFRM_POLICY
setsockopt path, because both fail before reaching the native parser.
The translator series replaced the blanket compat rejection with a
translator lookup. That made the path usable on x86 when the translator
is available, but left architectures that cannot build the translator
permanently rejected even when their compat layout already matches the
native layout. Let those architectures use the native parser instead.
Gate the translator requirement on COMPAT_FOR_U64_ALIGNMENT instead of
on in_compat_syscall() alone. Gating on the ABI property rather than on
CONFIG_XFRM_USER_COMPAT is deliberate: on x86 with IA32_EMULATION=y but
XFRM_USER_COMPAT=n, a 32-bit task must still be rejected rather than
routed through the native parser, which would misread genuinely
4-byte-aligned x86-32 messages. COMPAT_FOR_U64_ALIGNMENT is the ABI
property that makes the XFRM translator mandatory.
Only the receive/input direction needs the guard. The send, dump and
notification paths already call the translator as "if (xtr) { ... }"
with no error on NULL, so on arches without a translator they no-op and
the kernel emits native 64-bit-layout messages, which is what an AArch32
task expects.
Tested on Juniper SRX hardware: with the fix, 32-bit IPsec userspace
netlink and XFRM_POLICY setsockopt operations that previously failed
with -EOPNOTSUPP now succeed; x86 behaviour is unchanged by inspection.
Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator")
Fixes: 96392ee5a13b ("xfrm/compat: Translate 32-bit user_policy from sockptr")
Cc: stable@vger.kernel.org
Signed-off-by: Sanman Pradhan <psanman@juniper.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_state.c | 2 +-
net/xfrm/xfrm_user.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2410,7 +2410,7 @@ int xfrm_user_policy(struct sock *sk, in
if (IS_ERR(data))
return PTR_ERR(data);
- if (in_compat_syscall()) {
+ if (IS_ENABLED(CONFIG_COMPAT_FOR_U64_ALIGNMENT) && in_compat_syscall()) {
struct xfrm_translator *xtr = xfrm_get_translator();
if (!xtr) {
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2833,7 +2833,7 @@ static int xfrm_user_rcv_msg(struct sk_b
if (!netlink_net_capable(skb, CAP_NET_ADMIN))
return -EPERM;
- if (in_compat_syscall()) {
+ if (IS_ENABLED(CONFIG_COMPAT_FOR_U64_ALIGNMENT) && in_compat_syscall()) {
struct xfrm_translator *xtr = xfrm_get_translator();
if (!xtr)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 496/699] xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (494 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 495/699] xfrm: use compat translator only for u64 alignment mismatch Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 497/699] tpm: fix event_size output in tpm1_binary_bios_measurements_show Greg Kroah-Hartman
` (206 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Liang, Maoyi Xie,
Kuniyuki Iwashima, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 095515d89b19b6cc19dfcdc846f97403ed1ebce3 upstream.
xfrmi_changelink() operates on at most two netns, dev_net(dev) and the
interface link netns xi->net. They differ once the device is created in
or moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in xi->net can rewrite an interface that
lives in xi->net.
Gate xfrmi_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.
Reported-by: Xiao Liang <shaw.leon@gmail.com>
Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612085941.3158249-8-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_interface_core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -726,6 +726,9 @@ static int xfrmi_changelink(struct net_d
struct net *net = xi->net;
struct xfrm_if_parms p = {};
+ if (!rtnl_dev_link_net_capable(dev, net))
+ return -EPERM;
+
xfrmi_netlink_parms(data, &p);
if (!p.if_id) {
NL_SET_ERR_MSG(extack, "if_id must be non zero");
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 497/699] tpm: fix event_size output in tpm1_binary_bios_measurements_show
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (495 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 496/699] xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 498/699] tpm: Make the TPM character devices non-seekable Greg Kroah-Hartman
` (205 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Jarkko Sakkinen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
commit 1a58f6115bfb34eabcc7de8a3a9745b219179781 upstream.
Commit 186d124f07da ("tpm_eventlog.c: fix binary_bios_measurements")
split the output to write the endian-converted event header first and
then the variable-length event data.
However, the split was at sizeof(struct tcpa_event) - 1, even though
event_data was a zero-length array, and later a flexible array member,
both of which already excluded the event data.
Therefore, the current code writes the first three bytes of event_size
from the endian-converted header and then the last byte from the raw
header, which can emit a corrupted event_size on PPC64, where
do_endian_conversion() maps to be32_to_cpu().
Split one byte later to write the full endian-converted header first,
followed by the variable-length event->event_data.
Fixes: 186d124f07da ("tpm_eventlog.c: fix binary_bios_measurements")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/eventlog/tpm1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/char/tpm/eventlog/tpm1.c
+++ b/drivers/char/tpm/eventlog/tpm1.c
@@ -235,12 +235,12 @@ static int tpm1_binary_bios_measurements
temp_ptr = (char *) &temp_event;
- for (i = 0; i < (sizeof(struct tcpa_event) - 1) ; i++)
+ for (i = 0; i < sizeof(struct tcpa_event); i++)
seq_putc(m, temp_ptr[i]);
temp_ptr = (char *) v;
- for (i = (sizeof(struct tcpa_event) - 1);
+ for (i = sizeof(struct tcpa_event);
i < (sizeof(struct tcpa_event) + temp_event.event_size); i++)
seq_putc(m, temp_ptr[i]);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 498/699] tpm: Make the TPM character devices non-seekable
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (496 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 497/699] tpm: fix event_size output in tpm1_binary_bios_measurements_show Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 499/699] time: Fix off-by-one in compat settimeofday() usec validation Greg Kroah-Hartman
` (204 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jaewon Yang, Linus Torvalds
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaewon Yang <yong010301@gmail.com>
commit f20d61c22bcaf172d6790b6500e3838e532e71c8 upstream.
The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.
After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().
Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.
Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.
Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:
- sequential partial reads returned the complete response
- pread() and preadv() with offset 0x1400 returned -ESPIPE
- pwrite() and pwritev() with offset zero returned -ESPIPE
- the pending response remained intact after the rejected operations
- a subsequent normal command/response cycle completed normally
- no KASAN report was produced.
Fixes: 9488585b21be ("tpm: add support for partial reads")
Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jaewon Yang <yong010301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm-dev.c | 2 +-
drivers/char/tpm/tpmrm-dev.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/char/tpm/tpm-dev.c
+++ b/drivers/char/tpm/tpm-dev.c
@@ -36,7 +36,7 @@ static int tpm_open(struct inode *inode,
tpm_common_open(file, chip, priv, NULL);
- return 0;
+ return nonseekable_open(inode, file);
out:
clear_bit(0, &chip->is_open);
--- a/drivers/char/tpm/tpmrm-dev.c
+++ b/drivers/char/tpm/tpmrm-dev.c
@@ -29,7 +29,7 @@ static int tpmrm_open(struct inode *inod
tpm_common_open(file, chip, &priv->priv, &priv->space);
- return 0;
+ return nonseekable_open(inode, file);
}
static int tpmrm_release(struct inode *inode, struct file *file)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 499/699] time: Fix off-by-one in compat settimeofday() usec validation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (497 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 498/699] tpm: Make the TPM character devices non-seekable Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 500/699] spi: uniphier: Fix completion initialization order before devm_request_irq() Greg Kroah-Hartman
` (203 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wang Yan, Thomas Gleixner,
Arnd Bergmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Yan <wangyan01@kylinos.cn>
commit 269f2b43fae692d1f3988c9f888a6301aa537b82 upstream.
The compat version of settimeofday() uses '>' instead of '>=' when
validating tv_usec against USEC_PER_SEC, allowing the value 1000000 to pass
the check. After the subsequent conversion to nanoseconds (tv_nsec *=
NSEC_PER_USEC), this results in tv_nsec == NSEC_PER_SEC, which violates the
timespec invariant that tv_nsec must be strictly less than NSEC_PER_SEC.
The native settimeofday() was already fixed in commit ce4abda5e126 ("time:
Fix off-by-one in settimeofday() usec validation"), but the compat
counterpart was missed.
Fix it by using '>=' to reject tv_usec values outside the valid range [0,
USEC_PER_SEC - 1].
Fixes: 5e0fb1b57bea ("y2038: time: avoid timespec usage in settimeofday()")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260622103348.120255-1-wangyan01@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/time.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/time/time.c
+++ b/kernel/time/time.c
@@ -251,7 +251,7 @@ COMPAT_SYSCALL_DEFINE2(settimeofday, str
get_user(new_ts.tv_nsec, &tv->tv_usec))
return -EFAULT;
- if (new_ts.tv_nsec > USEC_PER_SEC || new_ts.tv_nsec < 0)
+ if (new_ts.tv_nsec >= USEC_PER_SEC || new_ts.tv_nsec < 0)
return -EINVAL;
new_ts.tv_nsec *= NSEC_PER_USEC;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 500/699] spi: uniphier: Fix completion initialization order before devm_request_irq()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (498 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 499/699] time: Fix off-by-one in compat settimeofday() usec validation Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 501/699] sctp: validate STALE_COOKIE cause length before reading staleness Greg Kroah-Hartman
` (202 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sangyun Kim, Kyungwook Boo,
Masami Hiramatsu, Kunihiko Hayashi, Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
commit f3ad1c87d8201e54b66bd6072442f0b5d5a308ee upstream.
The driver calls devm_request_irq() before initializing the completion
used by the interrupt handler. Because the interrupt may occur immediately
after devm_request_irq(), the handler may execute before init_completion().
This may result in calling complete() on an uninitialized completion,
causing undefined behavior. This has been observed with KASAN.
Fix this by initializing the completion before registering the IRQ.
Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
Fixes: 5ba155a4d4cc ("spi: add SPI controller driver for UniPhier SoC")
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Link: https://patch.msgid.link/20260616011223.201357-1-hayashi.kunihiko@socionext.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-uniphier.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-uniphier.c
+++ b/drivers/spi/spi-uniphier.c
@@ -659,6 +659,8 @@ static int uniphier_spi_probe(struct pla
priv->master = master;
priv->is_save_param = false;
+ init_completion(&priv->xfer_done);
+
priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
if (IS_ERR(priv->base)) {
ret = PTR_ERR(priv->base);
@@ -690,8 +692,6 @@ static int uniphier_spi_probe(struct pla
goto out_disable_clk;
}
- init_completion(&priv->xfer_done);
-
clk_rate = clk_get_rate(priv->clk);
master->max_speed_hz = DIV_ROUND_UP(clk_rate, SSI_MIN_CLK_DIVIDER);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 501/699] sctp: validate STALE_COOKIE cause length before reading staleness
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (499 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 500/699] spi: uniphier: Fix completion initialization order before devm_request_irq() Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 502/699] nvmet-rdma: handle inline data with a nonzero offset Greg Kroah-Hartman
` (201 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Mei, Weiming Shi, Xin Long,
Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weiming Shi <bestswngs@gmail.com>
commit 1cd23ca80784223fa2204e16203f754da4e821f8 upstream.
When an ERROR chunk with a STALE_COOKIE cause is received in the
COOKIE_ECHOED state, sctp_sf_do_5_2_6_stale() reads the 4-byte Measure
of Staleness that follows the cause header:
err = (struct sctp_errhdr *)(chunk->skb->data);
stale = ntohl(*(__be32 *)((u8 *)err + sizeof(*err)));
err is the first cause in the chunk, not the STALE_COOKIE cause that
caused the dispatch, and nothing guarantees the staleness field is
present. sctp_walk_errors() only requires a cause to be as long as the
4-byte header, so for a STALE_COOKIE cause of length 4 the read runs
past the cause, and for a minimal ERROR chunk past skb->tail. The value
is echoed to the peer in the Cookie Preservative of the reply INIT,
leaking uninitialized memory.
sctp_sf_cookie_echoed_err() already walks to the STALE_COOKIE cause, so
check its length there and pass it to sctp_sf_do_5_2_6_stale(), which
reads that cause instead of the first one. A STALE_COOKIE cause too
short to hold the staleness field is discarded.
The read is reachable by any peer that can drive an association into
COOKIE_ECHOED, including an unprivileged process using a raw SCTP socket
in a user and network namespace.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Cc: stable@vger.kernel.org
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260704033545.2438373-2-bestswngs@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/sm_statefuns.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -73,7 +73,8 @@ static enum sctp_disposition sctp_sf_do_
const struct sctp_association *asoc,
const union sctp_subtype type,
void *arg,
- struct sctp_cmd_seq *commands);
+ struct sctp_cmd_seq *commands,
+ struct sctp_errhdr *err);
static enum sctp_disposition sctp_sf_shut_8_4_5(
struct net *net,
const struct sctp_endpoint *ep,
@@ -2419,9 +2420,15 @@ enum sctp_disposition sctp_sf_cookie_ech
* errors.
*/
sctp_walk_errors(err, chunk->chunk_hdr) {
- if (SCTP_ERROR_STALE_COOKIE == err->cause)
- return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
- arg, commands);
+ if (err->cause != SCTP_ERROR_STALE_COOKIE)
+ continue;
+ /* The staleness is only meaningful if the cause is long
+ * enough to hold it; a shorter one is malformed.
+ */
+ if (ntohs(err->length) < sizeof(*err) + sizeof(__be32))
+ break;
+ return sctp_sf_do_5_2_6_stale(net, ep, asoc, type,
+ arg, commands, err);
}
/* It is possible to have malformed error causes, and that
@@ -2463,13 +2470,13 @@ static enum sctp_disposition sctp_sf_do_
const struct sctp_association *asoc,
const union sctp_subtype type,
void *arg,
- struct sctp_cmd_seq *commands)
+ struct sctp_cmd_seq *commands,
+ struct sctp_errhdr *err)
{
int attempts = asoc->init_err_counter + 1;
- struct sctp_chunk *chunk = arg, *reply;
struct sctp_cookie_preserve_param bht;
struct sctp_bind_addr *bp;
- struct sctp_errhdr *err;
+ struct sctp_chunk *reply;
u32 stale;
if (attempts > asoc->max_init_attempts) {
@@ -2480,8 +2487,6 @@ static enum sctp_disposition sctp_sf_do_
return SCTP_DISPOSITION_DELETE_TCB;
}
- err = (struct sctp_errhdr *)(chunk->skb->data);
-
/* When calculating the time extension, an implementation
* SHOULD use the RTT information measured based on the
* previous COOKIE ECHO / ERROR exchange, and should add no
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 502/699] nvmet-rdma: handle inline data with a nonzero offset
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (500 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 501/699] sctp: validate STALE_COOKIE cause length before reading staleness Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 503/699] can: isotp: use unconditional synchronize_rcu() in isotp_release() Greg Kroah-Hartman
` (200 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Keith Busch, Bryam Vargas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 48c0162f647bb47e6084ffbc71b8f213f5e2f4f8 upstream.
nvmet_rdma_use_inline_sg() maps the host-controlled inline data offset
into the per-command inline scatterlist. The bounds check admits any
offset with off + len <= inline_data_size, but the mapping still assumes
the data begins in the first inline page:
sg->offset = off;
sg->length = min_t(int, len, PAGE_SIZE - off);
When a port is configured with inline_data_size > PAGE_SIZE (settable up
to max(SZ_16K, PAGE_SIZE)), an offset in (PAGE_SIZE, inline_data_size]
makes "PAGE_SIZE - off" underflow, so sg->length is set to ~4 GiB and
the block backend reads far past the first inline page. num_pages(len)
also ignores the offset, so an in-bounds offset whose [off, off+len)
span crosses a page boundary under-counts the scatterlist.
Map the offset properly: split it into a page index and an in-page
offset, start the scatterlist at that page, and size the page count from
page_off + len. Because the request scatterlist may now start at
inline_sg[page_idx] rather than inline_sg[0], generalize the inline-SGL
identity test in nvmet_rdma_release_rsp() to a range test; otherwise the
persistent inline scatterlist is mistaken for an allocated one and
nvmet_req_free_sgls() frees an inline page (and warns in
free_large_kmalloc()).
Fixes: 0d5ee2b2ab4f ("nvmet-rdma: support max(16KB, PAGE_SIZE) inline data")
Cc: stable@vger.kernel.org
Suggested-by: Keith Busch <kbusch@kernel.org>
Reported-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/rdma.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/drivers/nvme/target/rdma.c
+++ b/drivers/nvme/target/rdma.c
@@ -665,7 +665,8 @@ static void nvmet_rdma_release_rsp(struc
if (rsp->n_rdma)
nvmet_rdma_rw_ctx_destroy(rsp);
- if (rsp->req.sg != rsp->cmd->inline_sg)
+ if (rsp->req.sg < rsp->cmd->inline_sg ||
+ rsp->req.sg >= rsp->cmd->inline_sg + queue->dev->inline_page_count)
nvmet_req_free_sgls(&rsp->req);
if (unlikely(!list_empty_careful(&queue->rsp_wr_wait_list)))
@@ -820,24 +821,25 @@ static void nvmet_rdma_write_data_done(s
static void nvmet_rdma_use_inline_sg(struct nvmet_rdma_rsp *rsp, u32 len,
u64 off)
{
- int sg_count = num_pages(len);
+ u64 page_off = off % PAGE_SIZE;
+ u64 page_idx = off / PAGE_SIZE;
+ int sg_count = num_pages(page_off + len);
struct scatterlist *sg;
int i;
- sg = rsp->cmd->inline_sg;
+ sg = &rsp->cmd->inline_sg[page_idx];
for (i = 0; i < sg_count; i++, sg++) {
if (i < sg_count - 1)
sg_unmark_end(sg);
else
sg_mark_end(sg);
- sg->offset = off;
- sg->length = min_t(int, len, PAGE_SIZE - off);
+ sg->offset = page_off;
+ sg->length = min_t(u64, len, PAGE_SIZE - page_off);
len -= sg->length;
- if (!i)
- off = 0;
+ page_off = 0;
}
- rsp->req.sg = rsp->cmd->inline_sg;
+ rsp->req.sg = &rsp->cmd->inline_sg[page_idx];
rsp->req.sg_cnt = sg_count;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 503/699] can: isotp: use unconditional synchronize_rcu() in isotp_release()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (501 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 502/699] nvmet-rdma: handle inline data with a nonzero offset Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 504/699] can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure Greg Kroah-Hartman
` (199 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nico Yip, Oliver Hartkopp, stable,
Marc Kleine-Budde
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 9b1a02e0d980ac6b0e36a90378f847062f81d7e4 upstream.
isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()
and clears so->bound without waiting for a grace period. isotp_release()
uses so->bound to decide whether it needs to call synchronize_rcu()
before cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it
skips that synchronize_rcu() and can cancel the timer while an
in-flight isotp_rcv() is still executing and about to re-arm it via
isotp_send_fc(), leading to a use-after-free timer callback on the
freed socket.
sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),
therefore make isotp_release() always call synchronize_rcu() before
cancelling the timers, regardless of so->bound. This still closes the
original race (isotp_notify() clearing so->bound without waiting for
in-flight isotp_rcv() callers before isotp_release() cancels the RX
timer) without adding any RCU wait to the netdevice notifier path.
Fixes: 14a4696bc311 ("can: isotp: isotp_release(): omit unintended hrtimer restart on socket release")
Closes: https://lore.kernel.org/linux-can/20260707085210.6B6C01F000E9@smtp.kernel.org/
Reported-by: Nico Yip <zdi-disclosures@trendmicro.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260712-isotp-fixes-v10-1-793a1b1ce17f@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/isotp.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -1184,11 +1184,18 @@ static int isotp_release(struct socket *
SINGLE_MASK(so->txid),
isotp_rcv_echo, sk);
dev_put(dev);
- synchronize_rcu();
}
}
}
+ /* Always wait for a grace period before touching the timers below.
+ * A concurrent NETDEV_UNREGISTER may have already unregistered our
+ * filters and cleared so->bound in isotp_notify() without waiting
+ * for in-flight isotp_rcv() callers to finish, so this call must not
+ * be skipped just because so->bound is already 0 here.
+ */
+ synchronize_rcu();
+
hrtimer_cancel(&so->txfrtimer);
hrtimer_cancel(&so->txtimer);
hrtimer_cancel(&so->rxtimer);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 504/699] can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (502 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 503/699] can: isotp: use unconditional synchronize_rcu() in isotp_release() Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 505/699] can: bcm: add missing rcu list annotations and operations Greg Kroah-Hartman
` (198 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ginger, Oliver Hartkopp, stable,
Marc Kleine-Budde
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit d9b091d9d22fee81ec53fb55d2032951993ceadb upstream.
bcm_sendmsg() reads bo->ifindex and checks bo->bound before taking
lock_sock(), while bcm_notify(), bcm_connect() and bcm_release() all
mutate both fields under that same lock. Because the lockless reads
and the locked writes are unordered with respect to each other, a
racing bcm_notify() (device unregister) or bcm_connect() (concurrent
bind on another thread sharing the socket) can make bcm_sendmsg()
observe an inconsistent combination, e.g. a stale bound=1 together
with the now-cleared ifindex=0, silently turning a socket bound to a
specific CAN interface into one that also matches "any" interface.
Keep the lockless bo->bound check purely as a fast-path reject, and
move the ifindex read (and a bo->bound re-check) into the locked
section, where every writer already serializes. This removes the
possibility of observing the two fields torn against each other,
rather than trying to fix it with more READ_ONCE()/WRITE_ONCE() pairs
on two independently updated fields. Annotate the now-purely-lockless
bo->bound accesses consistently across all its write sites.
Also fix bcm_rx_setup() silently returning success when the target
device disappears concurrently instead of reporting -ENODEV, so a
broken RX op is no longer left registered as if it had succeeded.
Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol")
Reported-by: Ginger <ginger.jzllee@gmail.com>
Closes: https://lore.kernel.org/linux-can/CAGp+u1aBK8QVjsvAxM2Ldzep4rEbsP9x_pV3At4g=h1kVEtyhA@mail.gmail.com/
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-2-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/bcm.c | 65 +++++++++++++++++++++++++++++++++++++++++++++-------------
1 file changed, 51 insertions(+), 14 deletions(-)
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -1251,6 +1251,11 @@ static int bcm_rx_setup(struct bcm_msg_h
op->rx_reg_dev = dev;
dev_put(dev);
+ } else {
+ /* the requested device is gone - do not
+ * silently succeed without registering
+ */
+ err = -ENODEV;
}
} else
@@ -1320,12 +1325,13 @@ static int bcm_sendmsg(struct socket *so
{
struct sock *sk = sock->sk;
struct bcm_sock *bo = bcm_sk(sk);
- int ifindex = bo->ifindex; /* default ifindex for this bcm_op */
+ int ifindex;
struct bcm_msg_head msg_head;
int cfsiz;
int ret; /* read bytes or error codes as return value */
- if (!bo->bound)
+ /* Lockless fast-path check for bound socket */
+ if (!READ_ONCE(bo->bound))
return -ENOTCONN;
/* check for valid message length from userspace */
@@ -1341,17 +1347,38 @@ static int bcm_sendmsg(struct socket *so
if ((size - MHSIZ) % cfsiz)
return -EINVAL;
+ lock_sock(sk);
+
+ /* Re-validate under the socket lock: a concurrent bcm_notify()
+ * may have unbound this socket (device removal) after the
+ * lockless fast-path check above. bo->ifindex is only ever
+ * mutated under lock_sock(), so reading it here - instead of
+ * before taking the lock - guarantees it can't be observed
+ * torn against bo->bound.
+ */
+ if (!bo->bound) {
+ ret = -ENOTCONN;
+ goto out_release;
+ }
+
+ /* default ifindex for this bcm_op */
+ ifindex = bo->ifindex;
+
/* check for alternative ifindex for this bcm_op */
if (!ifindex && msg->msg_name) {
/* no bound device as default => check msg_name */
DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name);
- if (msg->msg_namelen < BCM_MIN_NAMELEN)
- return -EINVAL;
+ if (msg->msg_namelen < BCM_MIN_NAMELEN) {
+ ret = -EINVAL;
+ goto out_release;
+ }
- if (addr->can_family != AF_CAN)
- return -EINVAL;
+ if (addr->can_family != AF_CAN) {
+ ret = -EINVAL;
+ goto out_release;
+ }
/* ifindex from sendto() */
ifindex = addr->can_ifindex;
@@ -1360,20 +1387,21 @@ static int bcm_sendmsg(struct socket *so
struct net_device *dev;
dev = dev_get_by_index(sock_net(sk), ifindex);
- if (!dev)
- return -ENODEV;
+ if (!dev) {
+ ret = -ENODEV;
+ goto out_release;
+ }
if (dev->type != ARPHRD_CAN) {
dev_put(dev);
- return -ENODEV;
+ ret = -ENODEV;
+ goto out_release;
}
dev_put(dev);
}
}
- lock_sock(sk);
-
switch (msg_head.opcode) {
case TX_SETUP:
@@ -1423,6 +1451,7 @@ static int bcm_sendmsg(struct socket *so
break;
}
+out_release:
release_sock(sk);
return ret;
@@ -1459,7 +1488,12 @@ static void bcm_notify(struct bcm_sock *
bo->bcm_proc_read = NULL;
}
#endif
- bo->bound = 0;
+ /* Paired with the lockless fast-path check in
+ * bcm_sendmsg(); bo->ifindex itself is only ever
+ * accessed under lock_sock() so it needs no
+ * annotation.
+ */
+ WRITE_ONCE(bo->bound, 0);
bo->ifindex = 0;
notify_enodev = 1;
}
@@ -1600,7 +1634,7 @@ static int bcm_release(struct socket *so
/* remove device reference */
if (bo->bound) {
- bo->bound = 0;
+ WRITE_ONCE(bo->bound, 0);
bo->ifindex = 0;
}
@@ -1669,7 +1703,10 @@ static int bcm_connect(struct socket *so
}
#endif /* CONFIG_PROC_FS */
- bo->bound = 1;
+ /* bo->ifindex above is fully assigned before this point; pairs
+ * with the lockless fast-path check in bcm_sendmsg()
+ */
+ WRITE_ONCE(bo->bound, 1);
fail:
release_sock(sk);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 505/699] can: bcm: add missing rcu list annotations and operations
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (503 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 504/699] can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 506/699] dm thin metadata: fix superblock refcount leak on snapshot shadow failure Greg Kroah-Hartman
` (197 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, sashiko-reviews, Oliver Hartkopp,
stable, Marc Kleine-Budde
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 7b2c3eabc4dafc062a25e10711154f2107526a78 upstream.
sashiko-bot remarked the missing use of list_add_rcu() in
bcm_[rx|tx]_setup() to have a proper initialized bcm_op structure
when bcm_proc_show() traverses the bcm_op's under rcu_read_lock().
To cover all initial settings of the bcm_op's the list_add_rcu() calls
are moved to the end of the setup code.
While at it, also fix the mirroring removal side: bcm_release() called
bcm_remove_op() - which frees the op via call_rcu() - on ops that were
still linked in bo->tx_ops/bo->rx_ops, without list_del_rcu() first.
Unlink each op with list_del_rcu() before handing it to bcm_remove_op(),
matching the existing pattern in bcm_delete_tx_op()/bcm_delete_rx_op().
Reported-by: sashiko-reviews@lists.linux.dev
Closes: https://lore.kernel.org/linux-can/20260610094654.A1FFE1F00893@smtp.kernel.org/
Fixes: dac5e6249159 ("can: bcm: add missing rcu read protection for procfs content")
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260714-bcm_fixes-v15-5-562f7e3e42da@hartkopp.net
Cc: stable@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/can/bcm.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -244,7 +244,7 @@ static int bcm_proc_show(struct seq_file
(reduction == 100) ? "near " : "", reduction);
}
- list_for_each_entry(op, &bo->tx_ops, list) {
+ list_for_each_entry_rcu(op, &bo->tx_ops, list) {
seq_printf(m, "tx_op: %03X %s ", op->can_id,
bcm_proc_getifname(net, ifname, op->ifindex));
@@ -877,6 +877,7 @@ static int bcm_tx_setup(struct bcm_msg_h
struct bcm_sock *bo = bcm_sk(sk);
struct bcm_op *op;
struct canfd_frame *cf;
+ bool add_op_to_list = false;
unsigned int i;
int err;
@@ -1018,8 +1019,7 @@ static int bcm_tx_setup(struct bcm_msg_h
hrtimer_init(&op->thrtimer, CLOCK_MONOTONIC,
HRTIMER_MODE_REL_SOFT);
- /* add this bcm_op to the list of the tx_ops */
- list_add(&op->list, &bo->tx_ops);
+ add_op_to_list = true;
} /* if ((op = bcm_find_op(&bo->tx_ops, msg_head->can_id, ifindex))) */
@@ -1041,6 +1041,10 @@ static int bcm_tx_setup(struct bcm_msg_h
op->flags |= TX_ANNOUNCE;
}
+ /* add this bcm_op to the list of the tx_ops? */
+ if (add_op_to_list)
+ list_add_rcu(&op->list, &bo->tx_ops);
+
if (op->flags & TX_ANNOUNCE)
bcm_can_tx(op);
@@ -1183,9 +1187,6 @@ static int bcm_rx_setup(struct bcm_msg_h
HRTIMER_MODE_REL_SOFT);
op->thrtimer.function = bcm_rx_thr_handler;
- /* add this bcm_op to the list of the rx_ops */
- list_add(&op->list, &bo->rx_ops);
-
/* call can_rx_register() */
do_rx_register = 1;
@@ -1264,10 +1265,12 @@ static int bcm_rx_setup(struct bcm_msg_h
bcm_rx_handler, op, "bcm", sk);
if (err) {
/* this bcm rx op is broken -> remove it */
- list_del_rcu(&op->list);
bcm_remove_op(op);
return err;
}
+
+ /* add this bcm_op to the list of the rx_ops */
+ list_add_rcu(&op->list, &bo->rx_ops);
}
return msg_head->nframes * op->cfsiz + MHSIZ;
@@ -1597,8 +1600,10 @@ static int bcm_release(struct socket *so
remove_proc_entry(bo->procname, net->can.bcmproc_dir);
#endif /* CONFIG_PROC_FS */
- list_for_each_entry_safe(op, next, &bo->tx_ops, list)
+ list_for_each_entry_safe(op, next, &bo->tx_ops, list) {
+ list_del_rcu(&op->list);
bcm_remove_op(op);
+ }
list_for_each_entry_safe(op, next, &bo->rx_ops, list) {
/*
@@ -1629,8 +1634,10 @@ static int bcm_release(struct socket *so
synchronize_rcu();
- list_for_each_entry_safe(op, next, &bo->rx_ops, list)
+ list_for_each_entry_safe(op, next, &bo->rx_ops, list) {
+ list_del_rcu(&op->list);
bcm_remove_op(op);
+ }
/* remove device reference */
if (bo->bound) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 506/699] dm thin metadata: fix superblock refcount leak on snapshot shadow failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (504 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 505/699] can: bcm: add missing rcu list annotations and operations Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 507/699] dm thin metadata: fix metadata snapshot consistency on commit failure Greg Kroah-Hartman
` (196 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Genjian Zhang, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Genjian Zhang <zhanggenjian@kylinos.cn>
commit 4b22d0801fadfcae2e106e6ba32e49439c7c7ebf upstream.
__reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the
metadata space map before shadowing it. When dm_tm_shadow_block()
fails, a reference is leaked in the metadata space map.
Fix by adding the missing dm_sm_dec_block().
Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: cc8394d86f04 ("dm thin: provide userspace access to pool metadata")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-thin-metadata.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1308,8 +1308,10 @@ static int __reserve_metadata_snap(struc
dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
r = dm_tm_shadow_block(pmd->tm, THIN_SUPERBLOCK_LOCATION,
&sb_validator, ©, &inc);
- if (r)
+ if (r) {
+ dm_sm_dec_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
return r;
+ }
BUG_ON(!inc);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 507/699] dm thin metadata: fix metadata snapshot consistency on commit failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (505 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 506/699] dm thin metadata: fix superblock refcount leak on snapshot shadow failure Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 508/699] dm era: fix out-of-bounds memory access for non-zero start sector Greg Kroah-Hartman
` (195 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming-Hung Tsai, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming-Hung Tsai <mtsai@redhat.com>
commit 5bcd4d3058ebaf46ad2e163829d87dd4870c7a45 upstream.
__reserve_metadata_snap() and __release_metadata_snap() modify the
superblock's held_root directly in the block_manager's buffer. If the
subsequent metadata commit fails, the held_root gets flushed to disk
through the abort_transaction path, resulting in inconsistent metadata.
Reproducer 1: __reserve_metadata_snap()
1. Create a 2 MiB metadata device and make the region after the 14th
block inaccessible, to trigger metadata commit failure in the
subsequent reserve_metadata_snap operation. The 14th block will be
the shadow destination for the index block.
dmsetup create tmeta --table "0 112 linear /dev/sdc 0
112 3984 error"
2. Create a 16 MiB thin-pool
dmsetup create tdata --table "0 32768 zero"
dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1
dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \
/dev/mapper/tdata 128 0 1 skip_block_zeroing"
3. Take a metadata snapshot to trigger metadata commit failure and
transaction abort. However, the held_root is written to disk,
breaking metadata consistency.
dmsetup message tpool 0 "reserve_metadata_snap"
thin_check v1.2.2 result:
Bad reference count for metadata block 6. Expected 2, but space map contains 1.
Bad reference count for metadata block 7. Expected 2, but space map contains 1.
Bad reference count for metadata block 13. Expected 1, but space map contains 0.
Reproducer 2: __release_metadata_snap()
1. Create a 2 MiB metadata device and make the region after the 16th
block inaccessible, to trigger metadata commit failure in the
subsequent release_metadata_snap operation. The 16th block will be
the shadow destination for the index block.
dmsetup create tmeta --table "0 128 linear /dev/sdc 0
128 3968 error"
2. Create a 16 MiB thin-pool
dmsetup create tdata --table "0 32768 zero"
dd if=/dev/zero of=/dev/mapper/tmeta bs=4k count=1
dmsetup create tpool --table "0 32768 thin-pool /dev/mapper/tmeta \
/dev/mapper/tdata 128 0 1 skip_block_zeroing"
3. Reserve then release the metadata snapshot, to trigger metadata
commit failure and transaction abort. The held_root gets removed
from the on-disk superblock, causing inconsistent metadata.
dmsetup message tpool 0 "reserve_metadata_snap"
dmsetup message tpool 0 "release_metadata_snap"
thin_check v1.2.2 result:
Bad reference count for metadata block 6. Expected 1, but space map contains 2.
Bad reference count for metadata block 7. Expected 1, but space map contains 2.
1 metadata blocks have leaked.
Fix by deferring the held_root update to commit time.
Additionally, move the existing-snapshot check in __reserve_metadata_snap
before the shadow operation to avoid unnecessary work. In
__release_metadata_snap, clear pmd->held_root before btree deletion so
partial failure leaks blocks rather than leaving a stale reference, and
unlock the snapshot block before decrementing its refcount.
Fixes: 991d9fa02da0 ("dm: add thin provisioning target")
Cc: stable@vger.kernel.org
Signed-off-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-thin-metadata.c | 63 ++++++++++++------------------------------
1 file changed, 18 insertions(+), 45 deletions(-)
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -183,6 +183,7 @@ struct dm_pool_metadata {
uint32_t time;
dm_block_t root;
dm_block_t details_root;
+ dm_block_t held_root;
struct list_head thin_devices;
uint64_t trans_id;
unsigned long flags;
@@ -709,6 +710,7 @@ static int __open_metadata(struct dm_poo
*/
pmd->root = le64_to_cpu(disk_super->data_mapping_root);
pmd->details_root = le64_to_cpu(disk_super->device_details_root);
+ pmd->held_root = le64_to_cpu(disk_super->held_root);
__setup_btree_details(pmd);
dm_bm_unlock(sblock);
@@ -792,6 +794,7 @@ static int __begin_transaction(struct dm
pmd->time = le32_to_cpu(disk_super->time);
pmd->root = le64_to_cpu(disk_super->data_mapping_root);
pmd->details_root = le64_to_cpu(disk_super->device_details_root);
+ pmd->held_root = le64_to_cpu(disk_super->held_root);
pmd->trans_id = le64_to_cpu(disk_super->trans_id);
pmd->flags = le32_to_cpu(disk_super->flags);
pmd->data_block_size = le32_to_cpu(disk_super->data_block_size);
@@ -882,6 +885,7 @@ static int __commit_transaction(struct d
disk_super->time = cpu_to_le32(pmd->time);
disk_super->data_mapping_root = cpu_to_le64(pmd->root);
disk_super->device_details_root = cpu_to_le64(pmd->details_root);
+ disk_super->held_root = cpu_to_le64(pmd->held_root);
disk_super->trans_id = cpu_to_le64(pmd->trans_id);
disk_super->flags = cpu_to_le32(pmd->flags);
@@ -1288,9 +1292,14 @@ static int __reserve_metadata_snap(struc
{
int r, inc;
struct thin_disk_superblock *disk_super;
- struct dm_block *copy, *sblock;
+ struct dm_block *copy;
dm_block_t held_root;
+ if (pmd->held_root) {
+ DMWARN("Pool metadata snapshot already exists: release this before taking another.");
+ return -EBUSY;
+ }
+
/*
* We commit to ensure the btree roots which we increment in a
* moment are up to date.
@@ -1318,14 +1327,6 @@ static int __reserve_metadata_snap(struc
held_root = dm_block_location(copy);
disk_super = dm_block_data(copy);
- if (le64_to_cpu(disk_super->held_root)) {
- DMWARN("Pool metadata snapshot already exists: release this before taking another.");
-
- dm_tm_dec(pmd->tm, held_root);
- dm_tm_unlock(pmd->tm, copy);
- return -EBUSY;
- }
-
/*
* Wipe the spacemap since we're not publishing this.
*/
@@ -1341,18 +1342,8 @@ static int __reserve_metadata_snap(struc
dm_tm_inc(pmd->tm, le64_to_cpu(disk_super->device_details_root));
dm_tm_unlock(pmd->tm, copy);
- /*
- * Write the held root into the superblock.
- */
- r = superblock_lock(pmd, &sblock);
- if (r) {
- dm_tm_dec(pmd->tm, held_root);
- return r;
- }
+ pmd->held_root = held_root;
- disk_super = dm_block_data(sblock);
- disk_super->held_root = cpu_to_le64(held_root);
- dm_bm_unlock(sblock);
return 0;
}
@@ -1372,18 +1363,10 @@ static int __release_metadata_snap(struc
{
int r;
struct thin_disk_superblock *disk_super;
- struct dm_block *sblock, *copy;
+ struct dm_block *copy;
dm_block_t held_root;
- r = superblock_lock(pmd, &sblock);
- if (r)
- return r;
-
- disk_super = dm_block_data(sblock);
- held_root = le64_to_cpu(disk_super->held_root);
- disk_super->held_root = cpu_to_le64(0);
-
- dm_bm_unlock(sblock);
+ held_root = pmd->held_root;
if (!held_root) {
DMWARN("No pool metadata snapshot found: nothing to release.");
@@ -1394,13 +1377,15 @@ static int __release_metadata_snap(struc
if (r)
return r;
+ pmd->held_root = 0;
+
disk_super = dm_block_data(copy);
dm_btree_del(&pmd->info, le64_to_cpu(disk_super->data_mapping_root));
dm_btree_del(&pmd->details_info, le64_to_cpu(disk_super->device_details_root));
- dm_sm_dec_block(pmd->metadata_sm, held_root);
-
dm_tm_unlock(pmd->tm, copy);
+ dm_sm_dec_block(pmd->metadata_sm, held_root);
+
return 0;
}
@@ -1419,19 +1404,7 @@ int dm_pool_release_metadata_snap(struct
static int __get_metadata_snap(struct dm_pool_metadata *pmd,
dm_block_t *result)
{
- int r;
- struct thin_disk_superblock *disk_super;
- struct dm_block *sblock;
-
- r = dm_bm_read_lock(pmd->bm, THIN_SUPERBLOCK_LOCATION,
- &sb_validator, &sblock);
- if (r)
- return r;
-
- disk_super = dm_block_data(sblock);
- *result = le64_to_cpu(disk_super->held_root);
-
- dm_bm_unlock(sblock);
+ *result = pmd->held_root;
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 508/699] dm era: fix out-of-bounds memory access for non-zero start sector
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (506 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 507/699] dm thin metadata: fix metadata snapshot consistency on commit failure Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 509/699] dm-bufio: fix wrong count calculation in dm_bufio_issue_discard Greg Kroah-Hartman
` (194 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samuel Moelius, Ming-Hung Tsai,
Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Moelius <sam.moelius@trailofbits.com>
commit a868196f03c2b19418ae3d2b69e195d668a271e5 upstream.
dm-era tracks writes in target-relative blocks, but era_map() calculates
the writeset block before applying the target offset. Tables with a
non-zero start sector can therefore pass an absolute mapped-device block
to metadata_current_marked().
If the absolute block is beyond the current writeset size,
writeset_marked() tests past the end of the in-core bitset. KASAN reports
this as a vmalloc-out-of-bounds access.
Apply the target offset before calculating the era block so writeset
lookups use the target-relative block number.
Assisted-by: Codex:gpt-5.5-cyber-preview
Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Fixes: eec40579d848 ("dm: add era target")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -1210,6 +1210,7 @@ static dm_block_t get_block(struct era *
static void remap_to_origin(struct era *era, struct bio *bio)
{
bio_set_dev(bio, era->origin_dev->bdev);
+ bio->bi_iter.bi_sector = dm_target_offset(era->ti, bio->bi_iter.bi_sector);
}
/*----------------------------------------------------------------
@@ -1534,7 +1535,7 @@ static void era_dtr(struct dm_target *ti
static int era_map(struct dm_target *ti, struct bio *bio)
{
struct era *era = ti->private;
- dm_block_t block = get_block(era, bio);
+ dm_block_t block;
/*
* All bios get remapped to the origin device. We do this now, but
@@ -1542,6 +1543,7 @@ static int era_map(struct dm_target *ti,
* block is marked in this era.
*/
remap_to_origin(era, bio);
+ block = get_block(era, bio);
/*
* REQ_PREFLUSH bios carry no data, so we're not interested in them.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 509/699] dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (507 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 508/699] dm era: fix out-of-bounds memory access for non-zero start sector Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 510/699] dm-log: fix a bitset_size overflow on 32bit machines Greg Kroah-Hartman
` (193 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 422f1d4f141eaa3a6e4199ceec86cc6b9bf26570 upstream.
block_to_sector converts a block number to a sector number and adds
c->start to the result. It is inappropriate to use this function for
converting the number of blocks to a number to sectors because c->start
would be incorrectly added to the result.
Luckily, the only target that uses dm_bufio_issue_discard is dm-ebs,
which sets c->start to 0, so this bug is latent.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Fixes: 6fbeb0048e6b ("dm bufio: implement discard")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-bufio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1375,7 +1375,9 @@ int dm_bufio_issue_discard(struct dm_buf
struct dm_io_region io_reg = {
.bdev = c->bdev,
.sector = block_to_sector(c, block),
- .count = block_to_sector(c, count),
+ .count = likely(c->sectors_per_block_bits >= 0) ?
+ count << c->sectors_per_block_bits :
+ count * (c->block_size >> SECTOR_SHIFT),
};
BUG_ON(dm_bufio_in_request());
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 510/699] dm-log: fix a bitset_size overflow on 32bit machines
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (508 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 509/699] dm-bufio: fix wrong count calculation in dm_bufio_issue_discard Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 511/699] dm-stats: fix dm_jiffies_to_msec64 Greg Kroah-Hartman
` (192 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Marzinski, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Marzinski <bmarzins@redhat.com>
commit 9743132a41f4d9d0e54c5f2adcb821b04796bab1 upstream.
Commit c20e36b7631d ("dm log: fix out-of-bounds write due to
region_count overflow") made sure that region_count could fit in an
unsigned int. But the bitmap memory isn't allocated based on
region_count. It uses bitset_size (a size_t variable). The first step of
calculating bitset_size is to set it to region_count, rounded up to a
multiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG
smaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit
architecture, this will make bitset_size wrap around to 0 and fail,
despite region_count being valid.
Since bitset_size gets divided by 8, it can hold any valid region_count.
It just needs a special case to handle the rollover. If it is 0, the
value rolled over, and bitset size should be set to the number of bytes
needed to hold 2^32 bits.
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: c20e36b7631d ("dm log: fix out-of-bounds write due to region_count overflow")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-log.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -421,6 +421,9 @@ static int create_log_context(struct dm_
*/
bitset_size = dm_round_up(region_count, BITS_PER_LONG);
bitset_size >>= BYTE_SHIFT;
+ /* Handle dm_round_up rollover on 32-bit systems */
+ if (!bitset_size)
+ bitset_size = 1UL << (BITS_PER_LONG - BYTE_SHIFT);
lc->bitset_uint32_count = bitset_size / sizeof(*lc->clean_bits);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 511/699] dm-stats: fix dm_jiffies_to_msec64
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (509 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 510/699] dm-log: fix a bitset_size overflow on 32bit machines Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 512/699] dm-stats: fix merge accounting Greg Kroah-Hartman
` (191 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 386df1a57b631c456d14f857cb0c0c2e11c16bef upstream.
There were wrong calculations in dm_jiffies_to_msec64 that produced
incorrect output when HZ was different from 1000. This commit fixes them.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Fixes: fd2ed4d25270 ("dm: add statistics support")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-stats.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -799,10 +799,10 @@ static unsigned long long dm_jiffies_to_
result = jiffies_to_msecs(j & 0x3fffff);
if (j >= 1 << 22) {
mult = jiffies_to_msecs(1 << 22);
- result += (unsigned long long)mult * (unsigned long long)jiffies_to_msecs((j >> 22) & 0x3fffff);
+ result += (unsigned long long)mult * ((j >> 22) & 0x3fffff);
}
if (j >= 1ULL << 44)
- result += (unsigned long long)mult * (unsigned long long)mult * (unsigned long long)jiffies_to_msecs(j >> 44);
+ result += (unsigned long long)mult * (unsigned long long)(1 << 22) * (j >> 44);
return result;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 512/699] dm-stats: fix merge accounting
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (510 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 511/699] dm-stats: fix dm_jiffies_to_msec64 Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 513/699] dm_early_create: fix freeing used table on dm_resume failure Greg Kroah-Hartman
` (190 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 1917eb2db750ecbdf710f79a8042eaa545a063c7 upstream.
There were wrong parentheses when setting stats_aux->merged, so that
merging was never properly accounted. This commit fixes it.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Fixes: fd2ed4d25270 ("dm: add statistics support")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-stats.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-stats.c
+++ b/drivers/md/dm-stats.c
@@ -651,10 +651,8 @@ void dm_stats_account_io(struct dm_stats
*/
last = raw_cpu_ptr(stats->last);
stats_aux->merged =
- (bi_sector == (READ_ONCE(last->last_sector) &&
- ((bi_rw == WRITE) ==
- (READ_ONCE(last->last_rw) == WRITE))
- ));
+ bi_sector == READ_ONCE(last->last_sector) &&
+ (bi_rw == WRITE) == (READ_ONCE(last->last_rw) == WRITE);
WRITE_ONCE(last->last_sector, end_sector);
WRITE_ONCE(last->last_rw, bi_rw);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 513/699] dm_early_create: fix freeing used table on dm_resume failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (511 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 512/699] dm-stats: fix merge accounting Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 514/699] dm-verity: increase sprintf buffer size Greg Kroah-Hartman
` (189 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 366665416f20527ff7cad548a32d1ddf23195740 upstream.
If dm_resume fails, the kernel attempts to free table with
dm_table_destroy, but the table was already instantiated with
dm_swap_table. This commit skips the call to dm_table_destroy in this
case.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Fixes: 6bbc923dfcf5 ("dm: add support to directly boot to a mapped device")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -2164,7 +2164,7 @@ int __init dm_early_create(struct dm_ioc
/* resume device */
r = dm_resume(md);
if (r)
- goto err_destroy_table;
+ goto err_hash_remove;
DMINFO("%s (%s) is ready", md->disk->disk_name, dmi->name);
dm_put(md);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 514/699] dm-verity: increase sprintf buffer size
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (512 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 513/699] dm_early_create: fix freeing used table on dm_resume failure Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 515/699] scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path Greg Kroah-Hartman
` (188 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 88dd117c92a142253fb7a17e791773902b3babc6 upstream.
The prefix "DM_VERITY_ERR_BLOCK_NR" is 22 chars. Add '=', one digit for
type, ',', up to 20 digits for a u64 block number, and a NUL terminator:
that's 46 bytes. The buffer is 42 bytes. For block numbers >= 16 decimal
digits (devices larger than ~16 EB with 4K blocks), snprintf silently
truncates the uevent environment variable.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Fixes: 65ff5b7ddf05 ("dm verity: add error handling modes for corrupted blocks")
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-verity-target.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm-verity-target.c
+++ b/drivers/md/dm-verity-target.c
@@ -21,7 +21,7 @@
#define DM_MSG_PREFIX "verity"
-#define DM_VERITY_ENV_LENGTH 42
+#define DM_VERITY_ENV_LENGTH 46
#define DM_VERITY_ENV_VAR_NAME "DM_VERITY_ERR_BLOCK_NR"
#define DM_VERITY_DEFAULT_PREFETCH_SIZE 262144
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 515/699] scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (513 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 514/699] dm-verity: increase sprintf buffer size Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 516/699] scsi: sg: Report request-table problems when any status is set Greg Kroah-Hartman
` (187 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Don Brace,
Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit e166bafc483e927150cb9b5f286c9191ea0df84e upstream.
If phys_disk->in_reset is set, the function returns directly without
undoing the resources acquired for the command. Add the missing error
cleanup by unmapping the IOACCEL2 SG chain block when needed, unmapping
the SCSI command, and dropping the outstanding IOACCEL command count
before returning.
Fixes: c5dfd106414f ("scsi: hpsa: correct device resets")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Acked-by: Don Brace <don.brace@microchip.com>
Link: https://patch.msgid.link/20260622160028.1240496-1-haoxiang_li2024@163.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/hpsa.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c
@@ -5035,6 +5035,10 @@ static int hpsa_scsi_ioaccel2_queue_comm
if (phys_disk->in_reset) {
cmd->result = DID_RESET << 16;
+ atomic_dec(&phys_disk->ioaccel_cmds_out);
+ scsi_dma_unmap(cmd);
+ if (use_sg > h->ioaccel_maxsg)
+ hpsa_unmap_ioaccel2_sg_chain_block(h, cp);
return -1;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 516/699] scsi: sg: Report request-table problems when any status is set
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (514 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 515/699] scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 517/699] scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE Greg Kroah-Hartman
` (186 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xu Rao, Bart Van Assche,
Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit 1d3a742afeb761eaead774691bde1ced699e9a5d upstream.
SG_GET_REQUEST_TABLE reports per-request diagnostic state through
sg_req_info::problem. The field is meant to indicate whether there is an
error to report for a completed request.
sg_fill_request_table() currently combines masked_status, host_status
and driver_status with bitwise AND. This only reports a problem when all
three status fields are non-zero at the same time. A normal target check
condition, for example, has masked_status set while host_status and
driver_status may both be zero, so the request is incorrectly reported
as clean.
Use the same condition as sg_new_read(), which sets SG_INFO_CHECK when
any of the three status fields is non-zero.
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/54B60C19F7DB8889+20260707030845.970018-1-raoxu@uniontech.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sg.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -864,10 +864,9 @@ sg_fill_request_table(Sg_fd *sfp, sg_req
if (val >= SG_MAX_QUEUE)
break;
rinfo[val].req_state = srp->done + 1;
- rinfo[val].problem =
- srp->header.masked_status &
- srp->header.host_status &
- srp->header.driver_status;
+ rinfo[val].problem = srp->header.masked_status ||
+ srp->header.host_status ||
+ srp->header.driver_status;
if (srp->done)
rinfo[val].duration =
srp->header.duration;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 517/699] scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (515 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 516/699] scsi: sg: Report request-table problems when any status is set Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 518/699] Input: ims-pcu - fix use-after-free and double-free in disconnect Greg Kroah-Hartman
` (185 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, John Garry,
David Disseldorp, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit fda6a1f3c3d7047b5ce5654487649c2daa738bfc upstream.
core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT
parameter list with transport_kmap_data_sg() and parses the destination
TransportID with target_parse_pr_out_transport_id(). For an iSCSI
TransportID (FORMAT CODE 01b), iscsi_parse_pr_out_transport_id() returns
the ISID in iport_ptr as a raw pointer into that mapped buffer.
The function then unmaps the buffer with transport_kunmap_data_sg() before
dereferencing iport_ptr in strcmp(), __core_scsi3_locate_pr_reg() and
core_scsi3_alloc_registration(). When the parameter list spans more than
one page (PARAMETER LIST LENGTH > 4096), transport_kmap_data_sg() uses
vmap() and transport_kunmap_data_sg() does vunmap(), so the kernel virtual
address backing iport_ptr is torn down and every subsequent dereference is
a use-after-free read of the unmapped region.
Keep the parameter list mapped until iport_ptr is no longer needed: drop
the early transport_kunmap_data_sg() and unmap once on the success path,
right before returning. The error paths already unmap through the existing
"if (buf) transport_kunmap_data_sg(cmd)" at the out: label, which now runs
on every post-map error exit because buf is no longer cleared early. Only
reads of the mapping happen while spinlocks are held; the map and unmap
calls remain outside any lock. The sibling caller
core_scsi3_decode_spec_i_port() already uses the buffer before unmapping it
and is left unchanged.
Fixes: 4949314c7283 ("target: Allow control CDBs with data > 1 page")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: David Disseldorp <ddiss@suse.de>
Link: https://patch.msgid.link/20260610042245.35473-1-hexlabsecurity@proton.me
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_pr.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -3293,9 +3293,6 @@ core_scsi3_emulate_pro_register_and_move
goto out;
}
- transport_kunmap_data_sg(cmd);
- buf = NULL;
-
pr_debug("SPC-3 PR [%s] Extracted initiator %s identifier: %s"
" %s\n", dest_tf_ops->fabric_name, (iport_ptr != NULL) ?
"port" : "device", initiator_str, (iport_ptr != NULL) ?
@@ -3529,6 +3526,11 @@ after_iport_check:
core_scsi3_update_and_write_aptpl(cmd->se_dev, aptpl);
core_scsi3_put_pr_reg(dest_pr_reg);
+ /*
+ * iport_ptr aliases the PR-OUT parameter list mapped above, so the
+ * buffer is unmapped only here on success (and at out: on error).
+ */
+ transport_kunmap_data_sg(cmd);
return 0;
out:
if (buf)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 518/699] Input: ims-pcu - fix use-after-free and double-free in disconnect
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (516 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 517/699] scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 519/699] Input: ims-pcu - release data interface on disconnect Greg Kroah-Hartman
` (184 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 462a999917755a3bf77448dfd64307963cf0a9f0 upstream.
ims_pcu_disconnect() only intended to perform cleanup when the primary
(control) interface is unbound. However, it currently relies on the
interface class to distinguish between control and data interfaces.
A malicious device could present a data interface with the same class
as the control interface, leading to premature cleanup and potential
use-after-free or double-free.
Switch to verifying that the interface being disconnected is indeed
the control interface.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -2066,7 +2066,6 @@ err_free_mem:
static void ims_pcu_disconnect(struct usb_interface *intf)
{
struct ims_pcu *pcu = usb_get_intfdata(intf);
- struct usb_host_interface *alt = intf->cur_altsetting;
usb_set_intfdata(intf, NULL);
@@ -2074,7 +2073,7 @@ static void ims_pcu_disconnect(struct us
* See if we are dealing with control or data interface. The cleanup
* happens when we unbind primary (control) interface.
*/
- if (alt->desc.bInterfaceClass != USB_CLASS_COMM)
+ if (intf != pcu->ctrl_intf)
return;
sysfs_remove_group(&intf->dev.kobj, &ims_pcu_attr_group);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 519/699] Input: ims-pcu - release data interface on disconnect
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (517 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 518/699] Input: ims-pcu - fix use-after-free and double-free in disconnect Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 520/699] Input: ims-pcu - validate control endpoint type Greg Kroah-Hartman
` (183 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 441c510a649c8ddce38aa0311334ed8bb546b36c upstream.
During probe the driver claims the data interface, but it never releases
it. Release it in disconnect to avoid leaving it permanently claimed.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -2086,6 +2086,7 @@ static void ims_pcu_disconnect(struct us
ims_pcu_destroy_application_mode(pcu);
ims_pcu_buffers_free(pcu);
+ usb_driver_release_interface(&ims_pcu_driver, pcu->data_intf);
kfree(pcu);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 520/699] Input: ims-pcu - validate control endpoint type
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (518 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 519/699] Input: ims-pcu - release data interface on disconnect Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 521/699] Input: ims-pcu - add response length checks Greg Kroah-Hartman
` (182 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit baf56975806534268e24acf9a8abb1c447ce11e9 upstream.
The driver currently assumes that the first endpoint of the control
interface is an interrupt IN endpoint without verifying it. A malicious
device could provide a different endpoint type, which would then be
passed to usb_fill_int_urb(), potentially leading to kernel warnings
or undefined behavior.
Verify that the control endpoint is an interrupt IN endpoint.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1676,6 +1676,12 @@ static int ims_pcu_parse_cdc_data(struct
return -ENODEV;
pcu->ep_ctrl = &alt->endpoint[0].desc;
+ if (!usb_endpoint_is_int_in(pcu->ep_ctrl)) {
+ dev_err(pcu->dev,
+ "Control endpoint is not INTERRUPT IN\n");
+ return -EINVAL;
+ }
+
pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl);
pcu->data_intf = usb_ifnum_to_if(pcu->udev,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 521/699] Input: ims-pcu - add response length checks
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (519 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 520/699] Input: ims-pcu - validate control endpoint type Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 522/699] Input: ims-pcu - fix DMA mapping violation in line setup Greg Kroah-Hartman
` (181 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 48c9d92fd4ee3a8f5d2cb46c802a0eff8e67c79c upstream.
The driver processes response data from device buffers without verifying
that the device actually sent enough data. This can lead to
out-of-bounds reads or processing stale data.
Add checks for the expected response length before accessing the
buffers.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 87 ++++++++++++++++++++++++++++++++++++++++---
1 file changed, 81 insertions(+), 6 deletions(-)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -407,7 +407,16 @@ static void ims_pcu_destroy_gamepad(stru
static void ims_pcu_report_events(struct ims_pcu *pcu)
{
- u32 data = get_unaligned_be32(&pcu->read_buf[3]);
+ u32 data;
+
+ /* 6-axis setting (1 byte) + button data + checksum */
+ if (pcu->read_pos < IMS_PCU_DATA_OFFSET + 1 + sizeof(data) + 1) {
+ dev_warn(pcu->dev, "Short buttons report: %d bytes\n",
+ pcu->read_pos);
+ return;
+ }
+
+ data = get_unaligned_be32(&pcu->read_buf[IMS_PCU_DATA_OFFSET + 1]);
ims_pcu_buttons_report(pcu, data & ~IMS_PCU_GAMEPAD_MASK);
if (pcu->gamepad)
@@ -667,11 +676,19 @@ static int __ims_pcu_execute_bl_command(
return error;
}
- if (expected_response && pcu->cmd_buf[2] != expected_response) {
- dev_err(pcu->dev,
- "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
- pcu->cmd_buf[2], expected_response);
- return -EINVAL;
+ if (expected_response) {
+ if (pcu->cmd_buf_len < 3) {
+ dev_err(pcu->dev, "Short response from bootloader: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
+ if (pcu->cmd_buf[2] != expected_response) {
+ dev_err(pcu->dev,
+ "Unexpected response from bootloader: 0x%02x, wanted 0x%02x\n",
+ pcu->cmd_buf[2], expected_response);
+ return -EINVAL;
+ }
}
return 0;
@@ -699,6 +716,12 @@ static int ims_pcu_get_info(struct ims_p
return error;
}
+ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + IMS_PCU_SET_INFO_SIZE + 1) {
+ dev_err(pcu->dev, "Short GET_INFO response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
memcpy(pcu->part_number,
&pcu->cmd_buf[IMS_PCU_INFO_PART_OFFSET],
sizeof(pcu->part_number));
@@ -796,6 +819,12 @@ static int ims_pcu_verify_block(struct i
return error;
}
+ if (pcu->cmd_buf_len < IMS_PCU_BL_DATA_OFFSET + sizeof(*fragment) + len + 1) {
+ dev_err(pcu->dev, "Short READ_APP response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
fragment = (void *)&pcu->cmd_buf[IMS_PCU_BL_DATA_OFFSET];
if (get_unaligned_le32(&fragment->addr) != addr ||
fragment->len != len) {
@@ -993,6 +1022,10 @@ ims_pcu_backlight_get_brightness(struct
error);
/* Assume the LED is OFF */
brightness = LED_OFF;
+ } else if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 2 + 1) {
+ dev_err(pcu->dev, "Short GET_BRIGHTNESS response: %d bytes\n",
+ pcu->cmd_buf_len);
+ brightness = LED_OFF;
} else {
brightness =
get_unaligned_le16(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
@@ -1272,6 +1305,12 @@ static int ims_pcu_read_ofn_config(struc
if (error)
return error;
+ if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
+ dev_err(pcu->dev, "Short OFN_GET_CONFIG response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
if (result < 0)
return -EIO;
@@ -1292,6 +1331,12 @@ static int ims_pcu_write_ofn_config(stru
if (error)
return error;
+ if (pcu->cmd_buf_len < OFN_REG_RESULT_OFFSET + 2 + 1) {
+ dev_err(pcu->dev, "Short OFN_SET_CONFIG response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
result = (s16)get_unaligned_le16(pcu->cmd_buf + OFN_REG_RESULT_OFFSET);
if (result < 0)
return -EIO;
@@ -1811,6 +1856,12 @@ static int ims_pcu_get_device_info(struc
return error;
}
+ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
+ dev_err(pcu->dev, "Short GET_FW_VERSION response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
snprintf(pcu->fw_version, sizeof(pcu->fw_version),
"%02d%02d%02d%02d.%c%c",
pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
@@ -1823,6 +1874,12 @@ static int ims_pcu_get_device_info(struc
return error;
}
+ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 6 + 1) {
+ dev_err(pcu->dev, "Short GET_BL_VERSION response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
snprintf(pcu->bl_version, sizeof(pcu->bl_version),
"%02d%02d%02d%02d.%c%c",
pcu->cmd_buf[2], pcu->cmd_buf[3], pcu->cmd_buf[4], pcu->cmd_buf[5],
@@ -1835,6 +1892,12 @@ static int ims_pcu_get_device_info(struc
return error;
}
+ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
+ dev_err(pcu->dev, "Short RESET_REASON response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
snprintf(pcu->reset_reason, sizeof(pcu->reset_reason),
"%02x", pcu->cmd_buf[IMS_PCU_DATA_OFFSET]);
@@ -1861,6 +1924,12 @@ static int ims_pcu_identify_type(struct
return error;
}
+ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 1 + 1) {
+ dev_err(pcu->dev, "Short GET_DEVICE_ID response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
*device_id = pcu->cmd_buf[IMS_PCU_DATA_OFFSET];
dev_dbg(pcu->dev, "Detected device ID: %d\n", *device_id);
@@ -1966,6 +2035,12 @@ static int ims_pcu_init_bootloader_mode(
return error;
}
+ if (pcu->cmd_buf_len < IMS_PCU_DATA_OFFSET + 15 + 4 + 1) {
+ dev_err(pcu->dev, "Short QUERY_DEVICE response: %d bytes\n",
+ pcu->cmd_buf_len);
+ return -EIO;
+ }
+
pcu->fw_start_addr =
get_unaligned_le32(&pcu->cmd_buf[IMS_PCU_DATA_OFFSET + 11]);
pcu->fw_end_addr =
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 522/699] Input: ims-pcu - fix DMA mapping violation in line setup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (520 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 521/699] Input: ims-pcu - add response length checks Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 523/699] Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging Greg Kroah-Hartman
` (180 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 8adf4289d945e8990e4336436a97da71d21d2cae upstream.
In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer
buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the
struct ims_pcu allocation, which violates DMA mapping rules regarding
cacheline alignment.
Use a heap-allocated buffer for the line coding data instead.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1808,11 +1808,16 @@ static void ims_pcu_stop_io(struct ims_p
static int ims_pcu_line_setup(struct ims_pcu *pcu)
{
struct usb_host_interface *interface = pcu->ctrl_intf->cur_altsetting;
- struct usb_cdc_line_coding *line = (void *)pcu->cmd_buf;
+ struct usb_cdc_line_coding *line __free(kfree) =
+ kmalloc(sizeof(*line), GFP_KERNEL);
int error;
- memset(line, 0, sizeof(*line));
+ if (!line)
+ return -ENOMEM;
+
line->dwDTERate = cpu_to_le32(57600);
+ line->bCharFormat = USB_CDC_1_STOP_BITS;
+ line->bParityType = USB_CDC_NO_PARITY;
line->bDataBits = 8;
error = usb_control_msg(pcu->udev, usb_sndctrlpipe(pcu->udev, 0),
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 523/699] Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (521 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 522/699] Input: ims-pcu - fix DMA mapping violation in line setup Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 524/699] Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing Greg Kroah-Hartman
` (179 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 403b0a6970b1084bb27907c0f8225801fdd0fe1d upstream.
The debug logging in ims_pcu_irq() unconditionally prints data from
pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the
actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the
control URB exceeds pcu->max_in_size, this leads to an out-of-bounds
read.
Fix this by printing from the correct buffer associated with the URB.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1547,7 +1547,7 @@ static void ims_pcu_irq(struct urb *urb)
}
dev_dbg(pcu->dev, "%s: received %d: %*ph\n", __func__,
- urb->actual_length, urb->actual_length, pcu->urb_in_buf);
+ urb->actual_length, urb->actual_length, urb->transfer_buffer);
if (urb == pcu->urb_in)
ims_pcu_process_data(pcu, urb);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 524/699] Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (522 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 523/699] Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 525/699] Input: ims-pcu - fix type confusion " Greg Kroah-Hartman
` (178 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit d4579af29e67ca8722db0a1194227f8015c8981d upstream.
The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc()
by iterating through the extra descriptor data. However, it does not
verify that the bLength of each descriptor is at least 2. A malicious
device could provide a descriptor with bLength = 0, leading to an
infinite loop in the driver.
Add a check to ensure bLength is at least 2 before proceeding with
parsing.
Fixes: 628329d52474 (Input: add IMS Passenger Control Unit driver)
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1675,8 +1675,9 @@ ims_pcu_get_cdc_union_desc(struct usb_in
while (buflen >= sizeof(*union_desc)) {
union_desc = (struct usb_cdc_union_desc *)buf;
- if (union_desc->bLength > buflen) {
- dev_err(&intf->dev, "Too large descriptor\n");
+ if (union_desc->bLength < 2 || union_desc->bLength > buflen) {
+ dev_err(&intf->dev, "Invalid descriptor length: %d\n",
+ union_desc->bLength);
return NULL;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 525/699] Input: ims-pcu - fix type confusion in CDC union descriptor parsing
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (523 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 524/699] Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 526/699] cpu: hotplug: Preserve per instance callback errors Greg Kroah-Hartman
` (177 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko bot, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit ca459e237bc49567649c56bc72e4c602fb92fd67 upstream.
The driver currently trusts the bMasterInterface0 from the CDC union
descriptor without verifying that it matches the interface being
probed. This could lead to the driver overwriting the private data of
another interface.
Validate that the control interface found in the descriptor is indeed
the one we are probing.
Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ims-pcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1713,7 +1713,7 @@ static int ims_pcu_parse_cdc_data(struct
pcu->ctrl_intf = usb_ifnum_to_if(pcu->udev,
union_desc->bMasterInterface0);
- if (!pcu->ctrl_intf)
+ if (pcu->ctrl_intf != intf)
return -EINVAL;
alt = pcu->ctrl_intf->cur_altsetting;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 526/699] cpu: hotplug: Preserve per instance callback errors
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (524 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 525/699] Input: ims-pcu - fix type confusion " Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 527/699] gpios: palmas: add .get_direction() op Greg Kroah-Hartman
` (176 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bradley Morgan, Thomas Gleixner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bradley Morgan <include@grrlz.net>
commit 673db10729fb121ea1b16fe57791a0cb9eac1eb5 upstream.
cpuhp_invoke_callback() unwinds earlier callbacks for the same
hotplug state when one instance fails. The rollback path currently
reuses ret, so a successful rollback can hide the original error and
make the failed transition look successful.
Keep the rollback result separate from the original error.
Fixes: 724a86881d03 ("smp/hotplug: Callback vs state-machine consistency")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260619163719.12103-1-include@grrlz.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -156,7 +156,7 @@ static int cpuhp_invoke_callback(unsigne
struct cpuhp_step *step = cpuhp_get_step(state);
int (*cbm)(unsigned int cpu, struct hlist_node *node);
int (*cb)(unsigned int cpu);
- int ret, cnt;
+ int ret, cnt, rollback_ret;
if (st->fail == state) {
st->fail = CPUHP_INVALID;
@@ -222,12 +222,12 @@ err:
break;
trace_cpuhp_multi_enter(cpu, st->target, state, cbm, node);
- ret = cbm(cpu, node);
- trace_cpuhp_exit(cpu, st->state, state, ret);
+ rollback_ret = cbm(cpu, node);
+ trace_cpuhp_exit(cpu, st->state, state, rollback_ret);
/*
* Rollback must not fail,
*/
- WARN_ON_ONCE(ret);
+ WARN_ON_ONCE(rollback_ret);
}
return ret;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 527/699] gpios: palmas: add .get_direction() op
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (525 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 526/699] cpu: hotplug: Preserve per instance callback errors Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 528/699] net: sit: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
` (175 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linus Walleij, Andreas Kemnade,
Bartosz Golaszewski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Kemnade <andreas@kemnade.info>
commit db4a79713ed8e252d5e4edf6eaaa80948b6855a2 upstream.
Accessing debug/gpio is quite noisy without a get_direction()
implementation. To calm that down add an implementation.
Fixes: 3d50a2785271 ("gpio: palmas: Add support for Palmas GPIO")
Cc: stable@vger.kernel.org
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Andreas Kemnade <andreas@kemnade.info>
Link: https://patch.msgid.link/20260704-palmas-getdirection-v2-1-2fd85fee3832@kemnade.info
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-palmas.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/drivers/gpio/gpio-palmas.c
+++ b/drivers/gpio/gpio-palmas.c
@@ -118,6 +118,24 @@ static int palmas_gpio_input(struct gpio
return ret;
}
+static int palmas_gpio_get_direction(struct gpio_chip *gc, unsigned int offset)
+{
+ struct palmas_gpio *pg = gpiochip_get_data(gc);
+ struct palmas *palmas = pg->palmas;
+ unsigned int val;
+ unsigned int reg;
+ int ret;
+ int gpio16 = (offset/8);
+
+ offset %= 8;
+ reg = (gpio16) ? PALMAS_GPIO_DATA_DIR2 : PALMAS_GPIO_DATA_DIR;
+ ret = palmas_read(palmas, PALMAS_GPIO_BASE, reg, &val);
+ if (ret)
+ return ret;
+
+ return (val & BIT(offset)) ? GPIO_LINE_DIRECTION_OUT : GPIO_LINE_DIRECTION_IN;
+}
+
static int palmas_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
{
struct palmas_gpio *pg = gpiochip_get_data(gc);
@@ -166,6 +184,7 @@ static int palmas_gpio_probe(struct plat
palmas_gpio->gpio_chip.can_sleep = true;
palmas_gpio->gpio_chip.direction_input = palmas_gpio_input;
palmas_gpio->gpio_chip.direction_output = palmas_gpio_output;
+ palmas_gpio->gpio_chip.get_direction = palmas_gpio_get_direction;
palmas_gpio->gpio_chip.to_irq = palmas_gpio_to_irq;
palmas_gpio->gpio_chip.set = palmas_gpio_set;
palmas_gpio->gpio_chip.get = palmas_gpio_get;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 528/699] net: sit: require CAP_NET_ADMIN in the device netns for changelink
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (526 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 527/699] gpios: palmas: add .get_direction() op Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 529/699] net: ena: clean up XDP TX queues when regular TX setup fails Greg Kroah-Hartman
` (174 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Nicolas Dichtel,
Kuniyuki Iwashima, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 27ccb68e7cccead5d8c611665a45d23032d468b3 upstream.
ipip6_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.
Gate ipip6_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed. sit was the one tunnel type not covered
by the recent series that added this check to the other changelink()
handlers.
Fixes: 5e6700b3bf98 ("sit: add support of x-netns")
Link: https://lore.kernel.org/netdev/20260612085941.3158249-1-maoyixie.tju@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260618070817.3378283-1-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/sit.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1670,6 +1670,9 @@ static int ipip6_changelink(struct net_d
__u32 fwmark = t->fwmark;
int err;
+ if (!rtnl_dev_link_net_capable(dev, net))
+ return -EPERM;
+
if (dev == sitn->fb_tunnel_dev)
return -EINVAL;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 529/699] net: ena: clean up XDP TX queues when regular TX setup fails
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (527 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 528/699] net: sit: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 530/699] net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
` (173 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dawei Feng, Arthur Kiyanovski,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit 1bd6676254b4ab6acd44b662b5e92822c036463a upstream.
create_queues_with_size_backoff() creates XDP TX queues before setting
up the regular TX path. If the subsequent allocation or creation of
regular TX queues fails, the error handling paths omit the teardown of the
XDP TX queues, leading to a resource leak.
Fix this by explicitly destroying the XDP TX queue subset at the two
missing failure points.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1-rc7.
An x86_64 allyesconfig build showed no new warnings. As we do not have
an ENA device to test with, no runtime testing was able to be performed.
Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action")
Cc: stable@vger.kernel.org
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Reviewed-by: Arthur Kiyanovski <akiyano@amazon.com>
Tested-by: Arthur Kiyanovski <akiyano@amazon.com>
Link: https://patch.msgid.link/20260616142424.4005130-1-dawei.feng@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/amazon/ena/ena_netdev.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
@@ -1162,6 +1162,18 @@ static void ena_destroy_all_tx_queues(st
}
}
+static void ena_destroy_xdp_tx_queues(struct ena_adapter *adapter)
+{
+ u16 ena_qid;
+ int i;
+
+ for (i = adapter->xdp_first_ring;
+ i < adapter->xdp_first_ring + adapter->xdp_num_queues; i++) {
+ ena_qid = ENA_IO_TXQ_IDX(i);
+ ena_com_destroy_io_queue(adapter->ena_dev, ena_qid);
+ }
+}
+
static void ena_destroy_all_rx_queues(struct ena_adapter *adapter)
{
u16 ena_qid;
@@ -2465,14 +2477,21 @@ static int create_queues_with_size_backo
rc = ena_setup_tx_resources_in_range(adapter,
0,
adapter->num_io_queues);
- if (rc)
+ if (rc) {
+ ena_destroy_xdp_tx_queues(adapter);
+ ena_free_all_io_tx_resources_in_range(adapter,
+ adapter->xdp_first_ring,
+ adapter->xdp_num_queues);
goto err_setup_tx;
+ }
rc = ena_create_io_tx_queues_in_range(adapter,
0,
adapter->num_io_queues);
- if (rc)
+ if (rc) {
+ ena_destroy_xdp_tx_queues(adapter);
goto err_create_tx_queues;
+ }
rc = ena_setup_all_rx_resources(adapter);
if (rc)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 530/699] net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (528 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 529/699] net: ena: clean up XDP TX queues when regular TX setup fails Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 531/699] net: ip_vti: " Greg Kroah-Hartman
` (172 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Liang, Maoyi Xie,
Kuniyuki Iwashima, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit e2ac3b242c37dff323a964962e43854f4b1a2b79 upstream.
vti6_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.
Gate vti6_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.
Reported-by: Xiao Liang <shaw.leon@gmail.com>
Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
Fixes: 61220ab34948 ("vti6: Enable namespace changing")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612085941.3158249-7-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_vti.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -1048,6 +1048,9 @@ static int vti6_changelink(struct net_de
struct __ip6_tnl_parm p;
struct vti6_net *ip6n;
+ if (!rtnl_dev_link_net_capable(dev, net))
+ return -EPERM;
+
ip6n = net_generic(net, vti6_net_id);
if (dev == ip6n->fb_tnl_dev)
return -EINVAL;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 531/699] net: ip_vti: require CAP_NET_ADMIN in the device netns for changelink
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (529 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 530/699] net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 532/699] net: ip6_gre: " Greg Kroah-Hartman
` (171 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Liang, Maoyi Xie,
Kuniyuki Iwashima, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 95cceadbfd52d7239bd730afdda0655287d77425 upstream.
vti_changelink() operates on at most two netns, dev_net(dev) and the
tunnel link netns t->net. They differ once the device is created in or
moved to a netns other than the one the request runs in. The rtnl
changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
caller privileged there but not in t->net can rewrite a tunnel that
lives in t->net.
Gate vti_changelink() on rtnl_dev_link_net_capable() at its top,
before any attribute is parsed.
Reported-by: Xiao Liang <shaw.leon@gmail.com>
Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
Fixes: 895de9a3488a ("vti4: Enable namespace changing")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612085941.3158249-4-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_vti.c | 3 +++
1 file changed, 3 insertions(+)
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -576,6 +576,9 @@ static int vti_changelink(struct net_dev
__u32 fwmark = t->fwmark;
struct ip_tunnel_parm p;
+ if (!rtnl_dev_link_net_capable(dev, t->net))
+ return -EPERM;
+
vti_netlink_parms(data, &p, &fwmark);
return ip_tunnel_changelink(dev, tb, &p, fwmark);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 532/699] net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (530 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 531/699] net: ip_vti: " Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 533/699] ieee802154: admin-gate legacy LLSEC dump operations Greg Kroah-Hartman
` (170 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Liang, Maoyi Xie,
Kuniyuki Iwashima, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit f00a50876d2818bd6dc86fa98b3ef360884c53c8 upstream.
ip6gre_changelink() and ip6erspan_changelink() operate on at most two
netns, dev_net(dev) and the tunnel link netns t->net. They differ once
the device is created in or moved to a netns other than the one the
request runs in. The rtnl changelink path checks CAP_NET_ADMIN only
against dev_net(dev), so a caller privileged there but not in t->net can
rewrite a tunnel that lives in t->net.
Gate both ops on rtnl_dev_link_net_capable() at their top, before any
attribute is parsed.
Reported-by: Xiao Liang <shaw.leon@gmail.com>
Closes: https://lore.kernel.org/netdev/CABAhCOSzP1vaThGV35_VnsRCb=87_CPjPVsTHbq905k8A+BuUg@mail.gmail.com/
Fixes: 690afc165bb3 ("net: ip6_gre: fix moving ip6gre between namespaces")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20260612085941.3158249-6-maoyixie.tju@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_gre.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -2090,6 +2090,9 @@ static int ip6gre_changelink(struct net_
struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
struct __ip6_tnl_parm p;
+ if (!rtnl_dev_link_net_capable(dev, t->net))
+ return -EPERM;
+
t = ip6gre_changelink_common(dev, tb, data, &p, extack);
if (IS_ERR(t))
return PTR_ERR(t);
@@ -2304,6 +2307,9 @@ static int ip6erspan_changelink(struct n
struct __ip6_tnl_parm p;
struct ip6gre_net *ign;
+ if (!rtnl_dev_link_net_capable(dev, t->net))
+ return -EPERM;
+
ign = net_generic(t->net, ip6gre_net_id);
t = ip6gre_changelink_common(dev, tb, data, &p, extack);
if (IS_ERR(t))
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 533/699] ieee802154: admin-gate legacy LLSEC dump operations
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (531 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 532/699] net: ip6_gre: " Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 534/699] ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation Greg Kroah-Hartman
` (169 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Stefan Schmidt
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 9c1e0b6d49471a712511d23fc9d06901561135e8 upstream.
In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table
builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV,
LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which
sets no .flags, so generic netlink runs them ungated. The modern
nl802154 family admin-gates the equivalent reads via
NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM.
Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve
the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev
that has an LLSEC key installed; the dump handler writes the raw
16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied
verbatim from struct ieee802154_llsec_key.key) into the reply.
Recovering the AES key compromises 802.15.4 LLSEC link confidentiality
and authenticity, since LLSEC uses CCM* and the same key authenticates
and encrypts frames.
Impact: any local uid with no capabilities can read the raw 16-byte
AES-128 LLSEC key from the kernel keytable on any wpan netdev that has
an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY
dump on the legacy IEEE802154_NL generic-netlink family.
Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but
setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump
entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the
modern nl802154 family exposes their equivalents to unprivileged
readers by design (NL802154_CMD_GET_WPAN_PHY and
NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged
users" annotations).
Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://lore.kernel.org/20260520141640.1149513-2-michael.bommarito@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ieee802154/ieee802154.h | 8 ++++++++
net/ieee802154/netlink.c | 16 ++++++++--------
2 files changed, 16 insertions(+), 8 deletions(-)
--- a/net/ieee802154/ieee802154.h
+++ b/net/ieee802154/ieee802154.h
@@ -23,6 +23,14 @@ void ieee802154_nl_exit(void);
.dumpit = _dump, \
}
+#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \
+ { \
+ .cmd = _cmd, \
+ .doit = _func, \
+ .dumpit = _dump, \
+ .flags = GENL_ADMIN_PERM, \
+ }
+
struct genl_info;
struct sk_buff *ieee802154_nl_create(int flags, u8 req);
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -98,20 +98,20 @@ static const struct genl_small_ops ieee8
IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams),
IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams),
IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),
- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL,
- ieee802154_llsec_dump_keys),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL,
+ ieee802154_llsec_dump_keys),
IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL,
- ieee802154_llsec_dump_devs),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL,
+ ieee802154_llsec_dump_devs),
IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
- ieee802154_llsec_dump_devkeys),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
+ ieee802154_llsec_dump_devkeys),
IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
- IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
- ieee802154_llsec_dump_seclevels),
+ IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
+ ieee802154_llsec_dump_seclevels),
IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL,
ieee802154_llsec_add_seclevel),
IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 534/699] ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (532 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 533/699] ieee802154: admin-gate legacy LLSEC dump operations Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 535/699] ieee802154: ca8210: fix cas_ctl leak on spi_async failure Greg Kroah-Hartman
` (168 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Stefan Schmidt
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit a6bfdfcc6711d1d5a92e98644359dedc67c0c858 upstream.
The LLSEC ADD/DEL doit handlers under the legacy IEEE802154_NL family
consume IEEE802154_ATTR_LLSEC_KEY_BYTES and
IEEE802154_ATTR_LLSEC_KEY_USAGE_COMMANDS, both declared in
net/ieee802154/nl_policy.c as bare length entries with no .type
(defaulting to NLA_UNSPEC). Generic netlink strict validation rejects
all NLA_UNSPEC attributes via validate_nla(), so every LLSEC_ADD_KEY,
LLSEC_DEL_KEY, LLSEC_ADD_DEV, LLSEC_DEL_DEV, LLSEC_ADD_DEVKEY,
LLSEC_DEL_DEVKEY, LLSEC_ADD_SECLEVEL, and LLSEC_DEL_SECLEVEL request
fails at the dispatcher with "Unsupported attribute" before reaching
the handler.
The doit path has been silently dead since strict validation became
the default for genl families that do not opt out. The dump path is
unaffected because dump requests carry no LLSEC attributes to
validate, which is why the LLSEC_LIST_KEY read remained reachable
(patch 1/2). Introduce IEEE802154_OP_RELAXED() mirroring
IEEE802154_OP() but with .validate = GENL_DONT_VALIDATE_STRICT, and
use it for the eight legacy LLSEC mutate ops so admin-driven LLSEC
configuration via the legacy interface works again.
Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://lore.kernel.org/20260520141640.1149513-3-michael.bommarito@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ieee802154/ieee802154.h | 9 +++++++++
net/ieee802154/netlink.c | 20 ++++++++++----------
2 files changed, 19 insertions(+), 10 deletions(-)
--- a/net/ieee802154/ieee802154.h
+++ b/net/ieee802154/ieee802154.h
@@ -16,6 +16,15 @@ void ieee802154_nl_exit(void);
.flags = GENL_ADMIN_PERM, \
}
+#define IEEE802154_OP_RELAXED(_cmd, _func) \
+ { \
+ .cmd = _cmd, \
+ .doit = _func, \
+ .dumpit = NULL, \
+ .flags = GENL_ADMIN_PERM, \
+ .validate = GENL_DONT_VALIDATE_STRICT,\
+ }
+
#define IEEE802154_DUMP(_cmd, _func, _dump) \
{ \
.cmd = _cmd, \
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -100,22 +100,22 @@ static const struct genl_small_ops ieee8
IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams),
IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL,
ieee802154_llsec_dump_keys),
- IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
- IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key),
IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL,
ieee802154_llsec_dump_devs),
- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev),
IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL,
ieee802154_llsec_dump_devkeys),
- IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
- IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey),
IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL,
ieee802154_llsec_dump_seclevels),
- IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL,
- ieee802154_llsec_add_seclevel),
- IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL,
- ieee802154_llsec_del_seclevel),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_ADD_SECLEVEL,
+ ieee802154_llsec_add_seclevel),
+ IEEE802154_OP_RELAXED(IEEE802154_LLSEC_DEL_SECLEVEL,
+ ieee802154_llsec_del_seclevel),
};
static const struct genl_multicast_group ieee802154_mcgrps[] = {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 535/699] ieee802154: ca8210: fix cas_ctl leak on spi_async failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (533 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 534/699] ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 536/699] ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit Greg Kroah-Hartman
` (167 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shitalkumar Gandhi, Miquel Raynal,
Stefan Schmidt
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
commit e09390e439bd7cca30dd10893b1f64802961667a upstream.
ca8210_spi_transfer() allocates cas_ctl with kzalloc_obj(GFP_ATOMIC)
and relies entirely on the SPI completion callback
ca8210_spi_transfer_complete() to free it.
The spi_async() API only invokes the completion callback on successful
submission. On failure it returns a negative error code without ever
queuing the callback, which leaves cas_ctl and its embedded spi_message
and spi_transfer orphaned. Every kfree(cas_ctl) in the driver is
inside the completion callback, so there is no other reclamation path.
ca8210_spi_transfer() is called from ca8210_spi_exchange(), the
interrupt handler ca8210_interrupt_handler(), and from the retry path
inside the completion callback itself. The exchange and interrupt
handler paths loop on -EBUSY, so under sustained SPI bus contention
every retry iteration leaks a fresh cas_ctl (~600 bytes per
occurrence).
Fix it by freeing cas_ctl on the spi_async() error path. While here,
correct the misleading error string: the function calls spi_async(),
not spi_sync().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/20260421073259.2259783-1-shitalkumar.gandhi@cambiumnetworks.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/ca8210.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -962,9 +962,10 @@ static int ca8210_spi_transfer(
if (status < 0) {
dev_crit(
&spi->dev,
- "status %d from spi_sync in write\n",
+ "status %d from spi_async in write\n",
status
);
+ kfree(cas_ctl);
}
return status;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 536/699] ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (534 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 535/699] ieee802154: ca8210: fix cas_ctl leak on spi_async failure Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 537/699] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path Greg Kroah-Hartman
` (166 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shitalkumar Gandhi, Simon Horman,
Stefan Schmidt
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shitalkumar Gandhi <shital.gandhi45@gmail.com>
commit 6d7f7bcf225b2d566176bf6229dbd1252940cb3c upstream.
ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange
a kmalloc'd buffer pointer through a struct kfifo, but pass a literal
'4' as the byte count to kfifo_in()/kfifo_out().
This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the
low 4 bytes of the 8-byte pointer are written into the FIFO. The reader
then reads back 4 bytes into an 8-byte local pointer variable, leaving
the upper 4 bytes uninitialized stack data. The first dereference of
the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel
address and generally results in an oops.
Use sizeof(fifo_buffer) so the byte count matches pointer width on every
architecture.
The driver has no architecture restriction in Kconfig, so any 64-bit
build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has
been latent since the driver was added in 2017 because it is most
commonly deployed on 32-bit MCUs.
Found via a custom Coccinelle semantic patch hunting for short-byte
kfifo I/O on byte-mode kfifos used to shuttle pointers.
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/20260520105750.30144-1-shitalkumar.gandhi@cambiumnetworks.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/ca8210.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -638,7 +638,7 @@ static int ca8210_test_int_driver_write(
fifo_buffer = kmemdup(buf, len, GFP_KERNEL);
if (!fifo_buffer)
return -ENOMEM;
- kfifo_in(&test->up_fifo, &fifo_buffer, 4);
+ kfifo_in(&test->up_fifo, &fifo_buffer, sizeof(fifo_buffer));
wake_up_interruptible(&priv->test.readq);
return 0;
@@ -2571,6 +2571,7 @@ static ssize_t ca8210_test_int_user_read
struct ca8210_priv *priv = filp->private_data;
unsigned char *fifo_buffer;
unsigned long bytes_not_copied;
+ unsigned int copied;
if (filp->f_flags & O_NONBLOCK) {
/* Non-blocking mode */
@@ -2584,7 +2585,8 @@ static ssize_t ca8210_test_int_user_read
);
}
- if (kfifo_out(&priv->test.up_fifo, &fifo_buffer, 4) != 4) {
+ copied = kfifo_out(&priv->test.up_fifo, &fifo_buffer, sizeof(fifo_buffer));
+ if (copied != sizeof(fifo_buffer)) {
dev_err(
&priv->spi->dev,
"test_interface: Wrong number of elements popped from upstream fifo\n"
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 537/699] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (535 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 536/699] ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 538/699] batman-adv: retrieve ethhdr after potential skb realloc on RX Greg Kroah-Hartman
` (165 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Shivam Kumar,
Keith Busch, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shivam Kumar <kumar.shivam43666@gmail.com>
commit 4606467a75cfc16721937272ed29462a750b60c8 upstream.
In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected,
nvmet_req_uninit() is called unconditionally. However, if the command
arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init()
had returned false and percpu_ref_tryget_live() was never executed. The
unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a
refcount underflow, leading to a WARNING in
percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and
eventually a permanent workqueue deadlock.
Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling
nvmet_req_uninit(), matching the existing pattern in
nvmet_tcp_execute_request().
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
[shivam: inlined nvmet_tcp_finish_cmd() at the fix site for 5.10.y]
Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 4bd82e9b113ff5..3d9a830950ef26 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -1227,7 +1227,9 @@ static int nvmet_tcp_try_recv_ddgst(struct nvmet_tcp_queue *queue)
queue->idx, cmd->req.cmd->common.command_id,
queue->pdu.cmd.hdr.type, le32_to_cpu(cmd->recv_ddgst),
le32_to_cpu(cmd->exp_ddgst));
- nvmet_tcp_finish_cmd(cmd);
+ if (!(cmd->flags & NVMET_TCP_F_INIT_FAILED))
+ nvmet_req_uninit(&cmd->req);
+ nvmet_tcp_free_cmd_buffers(cmd);
nvmet_tcp_fatal_error(queue);
ret = -EPROTO;
goto out;
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 538/699] batman-adv: retrieve ethhdr after potential skb realloc on RX
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (536 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 537/699] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 539/699] batman-adv: ensure minimal ethernet header on TX Greg Kroah-Hartman
` (164 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 035e1fed892d3d06002a73ff73668f618a514644 upstream.
pskb_may_pull() in batadv_interface_rx() could reallocate the buffer behind
the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
This was done correctly for the VLAN header but missed for the ethernet
header which is later used for the TT and AP isolation handling.
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Fixes: c78296665c3d ("batman-adv: Check skb size before using encapsulated ETH+VLAN header")
[ move from mesh- to soft-interface.c ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/batman-adv/soft-interface.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index c8c62b0cd54c76..8b4a8e80c0a320 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -454,6 +454,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
if (!pskb_may_pull(skb, VLAN_ETH_HLEN))
goto dropped;
+ ethhdr = eth_hdr(skb);
vhdr = skb_vlan_eth_hdr(skb);
/* drop batman-in-batman packets to prevent loops */
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 539/699] batman-adv: ensure minimal ethernet header on TX
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (537 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 538/699] batman-adv: retrieve ethhdr after potential skb realloc on RX Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 540/699] rtmutex: Use waiter::task instead of current in remove_waiter() Greg Kroah-Hartman
` (163 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sashiko, Sven Eckelmann, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 49df66b7993c80b80c7eb9a84ba5b3410c8296a0 upstream.
As documented in commit 8bd67ebb50c0 ("net: bridge: xmit: make sure we have
at least eth header len bytes"), it is possible by for a local user with
eBPF TC hook access to attach a tc filter which truncates the packet and
redirects to an batadv interface. But the code assumes that at least
ETH_HLEN bytes are available and thus might read outside of the available
buffer.
The batadv_interface_tx() must therefore always check itself if enough data
is available for the ethernet header and don't rely on min_header_len.
Cc: stable@vger.kernel.org
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Reported-by: Sashiko <sashiko-bot@kernel.org>
[ move from mesh- to soft-interface.c ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/batman-adv/soft-interface.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 8b4a8e80c0a320..c044d0d46bf808 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -210,6 +210,9 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
goto dropped;
+ if (!pskb_may_pull(skb, ETH_HLEN))
+ goto dropped;
+
/* reset control block to avoid left overs from previous users */
memset(skb->cb, 0, sizeof(struct batadv_skb_cb));
--
2.53.0
^ permalink raw reply related [flat|nested] 704+ messages in thread
* [PATCH 5.10 540/699] rtmutex: Use waiter::task instead of current in remove_waiter()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (538 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 539/699] batman-adv: ensure minimal ethernet header on TX Greg Kroah-Hartman
@ 2026-07-21 15:24 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 541/699] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Greg Kroah-Hartman
` (162 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Xin Liu, Keenan Dong, Thomas Gleixner, Lee Jones
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keenan Dong <keenanat2000@gmail.com>
commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 upstream.
remove_waiter() is used by the slowlock paths, but it is also used for
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
futex_requeue().
In the latter case waiter::task is not current, but remove_waiter()
operates on current for the dequeue operation. That results in several
problems:
1) the rbtree dequeue happens without waiter::task::pi_lock being held
2) the waiter task's pi_blocked_on state is not cleared, which leaves a
dangling pointer primed for UAF around.
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
task
Use waiter::task instead of current in all related operations in
remove_waiter() to cure those problems.
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
changelog ]
Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
(cherry picked from commit d8cce4773c2b23d819baf5abedc62f7b430e8745)
[Lee: Backported to linux-5.10.y from linux-6.1.y]
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/locking/rtmutex.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1061,20 +1061,23 @@ static void mark_wakeup_next_waiter(stru
*
* Must be called with lock->wait_lock held and interrupts disabled. I must
* have just failed to try_to_take_rt_mutex().
+ *
+ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current !
*/
static void remove_waiter(struct rt_mutex *lock,
struct rt_mutex_waiter *waiter)
{
bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock));
struct task_struct *owner = rt_mutex_owner(lock);
+ struct task_struct *waiter_task = waiter->task;
struct rt_mutex *next_lock;
lockdep_assert_held(&lock->wait_lock);
- raw_spin_lock(¤t->pi_lock);
+ raw_spin_lock(&waiter_task->pi_lock);
rt_mutex_dequeue(lock, waiter);
- current->pi_blocked_on = NULL;
- raw_spin_unlock(¤t->pi_lock);
+ waiter_task->pi_blocked_on = NULL;
+ raw_spin_unlock(&waiter_task->pi_lock);
/*
* Only update priority if the waiter was the highest priority
@@ -1110,7 +1113,7 @@ static void remove_waiter(struct rt_mute
raw_spin_unlock_irq(&lock->wait_lock);
rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock,
- next_lock, NULL, current);
+ next_lock, NULL, waiter_task);
raw_spin_lock_irq(&lock->wait_lock);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 541/699] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (539 preceding siblings ...)
2026-07-21 15:24 ` [PATCH 5.10 540/699] rtmutex: Use waiter::task instead of current in remove_waiter() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 542/699] bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() Greg Kroah-Hartman
` (161 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+78147abe6c524f183ee9,
Davidlohr Bueso, Thomas Gleixner, Lee Jones
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davidlohr Bueso <dave@stgolabs.net>
commit 40a25d59e85b3c8709ac2424d44f65610467871e upstream.
syzbot triggered the following splat in remove_waiter() via
FUTEX_CMP_REQUEUE_PI:
KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]
class_raw_spinlock_constructor
remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561
rt_mutex_start_proxy_lock+0x103/0x120
futex_requeue+0x10e4/0x20d0
__x64_sys_futex+0x34f/0x4d0
task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,
leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead
of current in remove_waiter()") made this fatal.
Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()
upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock
return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()
(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to
account for try_to_take_rt_mutex().
Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()")
Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com
Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/
Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net
[Lee: Backported to linux-5.10.y from linux-6.1.y]
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/locking/rtmutex.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1074,6 +1074,9 @@ static void remove_waiter(struct rt_mute
lockdep_assert_held(&lock->wait_lock);
+ if (!waiter_task) /* never enqueued */
+ return;
+
raw_spin_lock(&waiter_task->pi_lock);
rt_mutex_dequeue(lock, waiter);
waiter_task->pi_blocked_on = NULL;
@@ -1803,7 +1806,7 @@ int rt_mutex_start_proxy_lock(struct rt_
raw_spin_lock_irq(&lock->wait_lock);
ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
- if (unlikely(ret))
+ if (unlikely(ret < 0))
remove_waiter(lock, waiter);
raw_spin_unlock_irq(&lock->wait_lock);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 542/699] bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (540 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 541/699] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 543/699] hwmon: (w83627hf) remove VID sysfs files on error and remove Greg Kroah-Hartman
` (160 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Simon Horman,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit a986fde914d88af47eb78fd29c5d1af7952c3500 upstream.
If the allocation of fp[i].tpa_info fails, the error path will not free
the struct bnx2x_fastpath allocated earlier, as it is not linked to the
bp structure yet. Fix that by linking it immediately after allocation.
Cc: stable@vger.kernel.org
Fixes: 15192a8cf8a8 ("bnx2x: Split the FP structure")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260620062402.89549-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -4740,6 +4740,7 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
fp = kcalloc(bp->fp_array_size, sizeof(*fp), GFP_KERNEL);
if (!fp)
goto alloc_err;
+ bp->fp = fp;
for (i = 0; i < bp->fp_array_size; i++) {
fp[i].tpa_info =
kcalloc(ETH_MAX_AGGREGATION_QUEUES_E1H_E2,
@@ -4748,8 +4749,6 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
goto alloc_err;
}
- bp->fp = fp;
-
/* allocate sp objs */
bp->sp_objs = kcalloc(bp->fp_array_size, sizeof(struct bnx2x_sp_objs),
GFP_KERNEL);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 543/699] hwmon: (w83627hf) remove VID sysfs files on error and remove
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (541 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 542/699] bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 544/699] hwmon: (w83793) remove vrm sysfs file on probe failure Greg Kroah-Hartman
` (159 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Guenter Roeck
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 5264b389c4e02dec214a46c400eb3ab867a7749a upstream.
w83627hf_probe() creates cpu0_vid and vrm with device_create_file() when
VID information is available.
The error path and remove callback only remove the common and optional
attribute groups. Those groups do not contain cpu0_vid or vrm, so the
files can remain after a later probe failure or after device removal
while their callbacks still expect live driver data.
Remove the standalone VID sysfs files from both the probe error path and
the remove callback.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20260615064732.48113-1-pengpeng@iscas.ac.cn
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/w83627hf.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/hwmon/w83627hf.c
+++ b/drivers/hwmon/w83627hf.c
@@ -1551,6 +1551,8 @@ static int w83627hf_probe(struct platfor
return 0;
error:
+ device_remove_file(dev, &dev_attr_vrm);
+ device_remove_file(dev, &dev_attr_cpu0_vid);
sysfs_remove_group(&dev->kobj, &w83627hf_group);
sysfs_remove_group(&dev->kobj, &w83627hf_group_opt);
return err;
@@ -1562,6 +1564,8 @@ static int w83627hf_remove(struct platfo
hwmon_device_unregister(data->hwmon_dev);
+ device_remove_file(&pdev->dev, &dev_attr_vrm);
+ device_remove_file(&pdev->dev, &dev_attr_cpu0_vid);
sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group);
sysfs_remove_group(&pdev->dev.kobj, &w83627hf_group_opt);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 544/699] hwmon: (w83793) remove vrm sysfs file on probe failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (542 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 543/699] hwmon: (w83627hf) remove VID sysfs files on error and remove Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 545/699] net: liquidio: fix BAR resource leak on PF number failure Greg Kroah-Hartman
` (158 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Guenter Roeck
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 77b983757280c69b0290811669ff1d31022e5f1d upstream.
w83793_probe() creates the vrm sysfs file after creating the VID files
when VID support is present.
The normal remove path deletes vrm, but the probe error path only
removes the sensor, SDA, VID, fan, PWM and temperature files. A later
probe failure can therefore leave vrm behind after the driver data has
been freed.
Remove vrm in the probe error path next to the VID files, matching the
normal remove path.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20260615064806.51139-1-pengpeng@iscas.ac.cn
Cc: stable@vger.kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/w83793.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/hwmon/w83793.c
+++ b/drivers/hwmon/w83793.c
@@ -1920,6 +1920,7 @@ exit_remove:
for (i = 0; i < ARRAY_SIZE(w83793_vid); i++)
device_remove_file(dev, &w83793_vid[i].dev_attr);
+ device_remove_file(dev, &dev_attr_vrm);
for (i = 0; i < ARRAY_SIZE(w83793_left_fan); i++)
device_remove_file(dev, &w83793_left_fan[i].dev_attr);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 545/699] net: liquidio: fix BAR resource leak on PF number failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (543 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 544/699] hwmon: (w83793) remove vrm sysfs file on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 546/699] fsl/fman: Free init resources on KeyGen failure in fman_init() Greg Kroah-Hartman
` (157 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Larysa Zaremba,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496 upstream.
If cn23xx_get_pf_num() fails, the function returns without
unmapping either BAR. Unmap both BARs before returning from
the error path.
Found by manual code review.
Fixes: 0c45d7fe12c7 ("liquidio: fix use of pf in pass-through mode in a virtual machine")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Larysa Zaremba <larysa.zaremba@intel.com>
Link: https://patch.msgid.link/20260624064013.2809570-1-haoxiang_li2024@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c | 18 ++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
+++ b/drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c
@@ -1334,18 +1334,14 @@ int setup_cn23xx_octeon_pf_device(struct
if (octeon_map_pci_barx(oct, 1, MAX_BAR1_IOREMAP_SIZE)) {
dev_err(&oct->pci_dev->dev, "%s CN23XX BAR1 map failed\n",
__func__);
- octeon_unmap_pci_barx(oct, 0);
- return 1;
+ goto err_unmap_bar0;
}
if (cn23xx_get_pf_num(oct) != 0)
- return 1;
+ goto err_unmap_bar1;
- if (cn23xx_sriov_config(oct)) {
- octeon_unmap_pci_barx(oct, 0);
- octeon_unmap_pci_barx(oct, 1);
- return 1;
- }
+ if (cn23xx_sriov_config(oct))
+ goto err_unmap_bar1;
octeon_write_csr64(oct, CN23XX_SLI_MAC_CREDIT_CNT, 0x3F802080802080ULL);
@@ -1376,6 +1372,12 @@ int setup_cn23xx_octeon_pf_device(struct
oct->coproc_clock_rate = 1000000ULL * cn23xx_coprocessor_clock(oct);
return 0;
+
+err_unmap_bar1:
+ octeon_unmap_pci_barx(oct, 1);
+err_unmap_bar0:
+ octeon_unmap_pci_barx(oct, 0);
+ return 1;
}
int validate_cn23xx_pf_config_info(struct octeon_device *oct,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 546/699] fsl/fman: Free init resources on KeyGen failure in fman_init()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (544 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 545/699] net: liquidio: fix BAR resource leak on PF number failure Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 547/699] net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked Greg Kroah-Hartman
` (156 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Haoxiang Li, Pavan Chebbi,
Breno Leitao, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit d288efa2b94abc2e45a061fceb156b4f4e5b37be upstream.
fman_muram_alloc() allocates initialization resources before
initializing the KeyGen block. If keygen_init() fails, the
function returns -EINVAL directly and leaves those resources
allocated. Free the initialization resources before returning
from the KeyGen failure path.
Fixes: 7472f4f281d0 ("fsl/fman: enable FMan Keygen")
Cc: stable@kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260625004834.3394389-1-haoxiang_li2024@163.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/fman/fman.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/freescale/fman/fman.c
+++ b/drivers/net/ethernet/freescale/fman/fman.c
@@ -2022,8 +2022,10 @@ static int fman_init(struct fman *fman)
/* Init KeyGen */
fman->keygen = keygen_init(fman->kg_regs);
- if (!fman->keygen)
+ if (!fman->keygen) {
+ free_init_resources(fman);
return -EINVAL;
+ }
err = enable(fman, cfg);
if (err != 0)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 547/699] net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (545 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 546/699] fsl/fman: Free init resources on KeyGen failure in fman_init() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 548/699] tracing/probes: Fix double addition of offset for @+FOFFSET Greg Kroah-Hartman
` (155 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas, Victor Nogueira,
Jamal Hadi Salim, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d upstream.
multiq_dequeue() takes a packet from a band's child with a direct
->dequeue() call after multiq_peek() peeked it. When the child is
non-work-conserving the peek stashes the skb in the child's gso_skb, so
the direct dequeue returns a different skb and orphans the stash,
desyncing the child's qlen/backlog. With a qfq child reached through a
peeking parent (e.g. tbf) this re-enters the child on an emptied list and
dereferences NULL, panicking the kernel from softirq on ordinary egress.
Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
when the child has no stash, so a work-conserving child is unaffected.
Fixes: 77be155cba4e ("pkt_sched: Add peek emulation for non-work-conserving qdiscs.")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260625-b4-disp-31bcb279-v1-2-85c40b83c529@proton.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_multiq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -103,7 +103,7 @@ static struct sk_buff *multiq_dequeue(st
if (!netif_xmit_stopped(
netdev_get_tx_queue(qdisc_dev(sch), q->curband))) {
qdisc = q->queues[q->curband];
- skb = qdisc->dequeue(qdisc);
+ skb = qdisc_dequeue_peeked(qdisc);
if (skb) {
qdisc_bstats_update(sch, skb);
sch->q.qlen--;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 548/699] tracing/probes: Fix double addition of offset for @+FOFFSET
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (546 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 547/699] net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 549/699] orangefs: keep the readdir entry size 64-bit in fill_from_part() Greg Kroah-Hartman
` (154 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
commit 9a667b7750dda88cbf1cca96a53a2163b2ee71f7 upstream.
Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument
fetching code") wrongly use @offset local variable during the parsing,
the offset value is added twice when dereferencing.
Reset the @offset after setting it in FETCH_OP_FOFFS.
Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/
Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_probe.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -401,6 +401,7 @@ parse_probe_arg(char *arg, const struct
code->op = FETCH_OP_FOFFS;
code->immediate = (unsigned long)offset; // imm64?
+ offset = 0;
} else {
/* uprobes don't support symbols */
if (!(flags & TPARG_FL_KERNEL)) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 549/699] orangefs: keep the readdir entry size 64-bit in fill_from_part()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (547 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 548/699] tracing/probes: Fix double addition of offset for @+FOFFSET Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 550/699] ata: pata_pxa: Fix DMA channel leak on probe error Greg Kroah-Hartman
` (153 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryam Vargas,
Christian Brauner (Amutable)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc upstream.
fill_from_part() computes the size of a directory entry in size_t but
stores it in a __u32. An entry length near U32_MAX wraps it to a small
value, bypasses the bounds check, and is then used to index the entry,
reading far past the directory part -- an out-of-bounds read that oopses
the kernel.
Compute the size as a u64 so it cannot truncate; the bounds check then
rejects the entry. The trailer is supplied by the userspace client.
Fixes: 480e3e532e31 ("orangefs: support very large directories")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260619-b4-disp-50d2bd59-v1-1-ce332969b4a2@proton.me
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/orangefs/dir.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/orangefs/dir.c
+++ b/fs/orangefs/dir.c
@@ -191,7 +191,8 @@ static int fill_from_part(struct orangef
{
const int offset = sizeof(struct orangefs_readdir_response_s);
struct orangefs_khandle *khandle;
- __u32 *len, padlen;
+ __u32 *len;
+ u64 padlen;
loff_t i;
char *s;
i = ctx->pos & ~PART_MASK;
@@ -215,8 +216,8 @@ static int fill_from_part(struct orangef
* len is the size of the string itself. padlen is the
* total size of the encoded string.
*/
- padlen = (sizeof *len + *len + 1) +
- (8 - (sizeof *len + *len + 1)%8)%8;
+ padlen = (u64)sizeof *len + *len + 1;
+ padlen += (8 - padlen % 8) % 8;
if (part->len < i + padlen + sizeof *khandle)
goto next;
s = (void *)part + offset + i + sizeof *len;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 550/699] ata: pata_pxa: Fix DMA channel leak on probe error
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (548 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 549/699] orangefs: keep the readdir entry size 64-bit in fill_from_part() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 551/699] hwmon: (asus_atk0110) Check package count before accessing element Greg Kroah-Hartman
` (152 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wentao Liang, Niklas Cassel,
Damien Le Moal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wentao Liang <vulab@iscas.ac.cn>
commit fcaf242e7fc406e78f444a35441e3b58f5e28781 upstream.
When dmaengine_slave_config() fails, the DMA channel acquired by
dma_request_chan() is not released before returning the error,
leaking the channel reference.
Fix by adding dma_release_channel() in the error path.
The ata_host_activate() error path already correctly releases the
DMA channel.
Cc: stable@vger.kernel.org
Fixes: 88622d80af82 ("ata: pata_pxa: dmaengine conversion")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Reviewed-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/pata_pxa.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/ata/pata_pxa.c
+++ b/drivers/ata/pata_pxa.c
@@ -287,6 +287,7 @@ static int pxa_ata_probe(struct platform
ret = dmaengine_slave_config(data->dma_chan, &config);
if (ret < 0) {
dev_err(&pdev->dev, "dma configuration failed: %d\n", ret);
+ dma_release_channel(data->dma_chan);
return ret;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 551/699] hwmon: (asus_atk0110) Check package count before accessing element
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (549 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 550/699] ata: pata_pxa: Fix DMA channel leak on probe error Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 552/699] s390/monwriter: Reject buffer reuse with different data length Greg Kroah-Hartman
` (151 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HyeongJun An, Guenter Roeck
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: HyeongJun An <sammiee5311@gmail.com>
commit e2735b39f044bad7bf2017aef248935525bc0b97 upstream.
atk_ec_present() walks the management group package returned by the GGRP
ACPI method and, for each sub-package, reads its first element:
id = &obj->package.elements[0];
if (id->type != ACPI_TYPE_INTEGER)
without checking that the sub-package is non-empty. ACPICA allocates the
element array with exactly package.count entries, so for a sub-package
with a zero count this reads past the allocation.
The sibling function atk_debugfs_ggrp_open() performs the same access but
skips empty packages with a package.count check first. Add the same
check to atk_ec_present() so a malformed firmware package cannot trigger
an out-of-bounds read.
Fixes: 9e6eba610c2e ("hwmon: (asus_atk0110) Enable the EC")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
Link: https://lore.kernel.org/r/20260619122746.721981-1-sammiee5311@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwmon/asus_atk0110.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -1037,6 +1037,9 @@ static int atk_ec_present(struct atk_dat
if (obj->type != ACPI_TYPE_PACKAGE)
continue;
+ if (!obj->package.count)
+ continue;
+
id = &obj->package.elements[0];
if (id->type != ACPI_TYPE_INTEGER)
continue;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 552/699] s390/monwriter: Reject buffer reuse with different data length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (550 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 551/699] hwmon: (asus_atk0110) Check package count before accessing element Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 553/699] mac802154: remove interfaces with RCU list deletion Greg Kroah-Hartman
` (150 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gerald Schaefer,
Christian Borntraeger, Vasily Gorbik
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
commit 2995ccec260caa9e85b3301a4aba1e66ed80ad74 upstream.
When data buffers are reused, e.g. for interval sample records, the
first record determines the data length, and the size of the buffer for
user copy. Current monwriter code does not check if the data length was
changed for subsequent records, which also would never happen for valid
user programs.
However, a malicious user could change the data length, resulting in out
of bounds user copy to the kernel buffer, and memory corruption. By
default, the monwriter misc device is created with root-only permissions,
so practical impact is typically low.
Fix this by checking for changed data length and rejecting such records.
Cc: stable@vger.kernel.org
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/char/monwriter.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/s390/char/monwriter.c
+++ b/drivers/s390/char/monwriter.c
@@ -126,6 +126,9 @@ static int monwrite_new_hdr(struct mon_p
kfree(monbuf->data);
kfree(monbuf);
monbuf = NULL;
+ } else if (monbuf->hdr.datalen != monhdr->datalen) {
+ /* Data with buffer reuse must not change its length */
+ return -EINVAL;
}
} else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) {
if (mon_buf_count >= mon_max_bufs)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 553/699] mac802154: remove interfaces with RCU list deletion
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (551 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 552/699] s390/monwriter: Reject buffer reuse with different data length Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 554/699] llc: fix SAP refcount leak in llc_ui_autobind() Greg Kroah-Hartman
` (149 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+36256deb69a588e9290e,
Yousef Alhouseen, Kuniyuki Iwashima, Miquel Raynal, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
commit 539dfcf69105d8d3d4d677b71de6e5ede2e6dfa0 upstream.
Queue wake, stop, and disable paths walk local->interfaces under RCU.
The bulk hardware teardown path removes entries with list_del(), so an
asynchronous transmit completion can follow a poisoned list node in
ieee802154_wake_queue().
Use list_del_rcu() as in the single-interface removal path. The following
unregister_netdevice() waits for in-flight RCU readers before freeing the
netdevice, so no separate grace-period wait is needed.
Fixes: 592dfbfc72f5 ("mac820154: move interface unregistration into iface")
Reported-by: syzbot+36256deb69a588e9290e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=36256deb69a588e9290e
Cc: stable@vger.kernel.org
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://patch.msgid.link/20260701164222.9094-1-alhouseenyousef@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac802154/iface.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/mac802154/iface.c
+++ b/net/mac802154/iface.c
@@ -705,7 +705,7 @@ void ieee802154_remove_interfaces(struct
mutex_lock(&local->iflist_mtx);
list_for_each_entry_safe(sdata, tmp, &local->interfaces, list) {
- list_del(&sdata->list);
+ list_del_rcu(&sdata->list);
unregister_netdevice(sdata->dev);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 554/699] llc: fix SAP refcount leak in llc_ui_autobind()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (552 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 553/699] mac802154: remove interfaces with RCU list deletion Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 555/699] ipvs: use parsed transport offset in SCTP state lookup Greg Kroah-Hartman
` (148 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
commit 660667cd406648bbaffbd5c0d897c2263a852f11 upstream.
llc_ui_autobind() opens a SAP after choosing a dynamic LSAP.
llc_sap_open() returns a reference owned by the caller, and
llc_sap_add_socket() takes a second reference for the socket's
membership in the SAP hash tables.
llc_ui_bind() drops the caller's reference after adding the socket,
but llc_ui_autobind() keeps it. When the socket is closed,
llc_sap_remove_socket() releases only the socket reference, leaving
the SAP on llc_sap_list with sk_count == 0.
This is user-visible because repeated autobind and close cycles can consume
all dynamic SAP values and make later autobinds fail with -EUSERS.
Drop the caller's reference after a successful autobind, matching
llc_ui_bind()'s ownership model.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Link: https://patch.msgid.link/20260630194856.1036497-1-shuangpeng.kernel@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/llc/af_llc.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -317,6 +317,7 @@ static int llc_ui_autobind(struct socket
/* assign new connection to its SAP */
llc_sap_add_socket(sap, sk);
sock_reset_flag(sk, SOCK_ZAPPED);
+ llc_sap_put(sap);
rc = 0;
out:
dev_put(dev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 555/699] ipvs: use parsed transport offset in SCTP state lookup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (553 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 554/699] llc: fix SAP refcount leak in llc_ui_autobind() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 556/699] ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Greg Kroah-Hartman
` (147 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Julian Anastasov, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
commit 2f75c0faa3361b28e36cc0512b3299e163e25789 upstream.
set_sctp_state() reads the SCTP chunk header again in order to drive the
IPVS SCTP state table. For IPv6 it computes the offset with
sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from
ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped
extension headers and found the real transport header.
This makes the state machine read from the wrong offset for IPv6 SCTP
packets that carry extension headers. For example, an INIT packet with an
8-byte destination options header can be scheduled correctly by
sctp_conn_schedule(), but set_sctp_state() reads the first byte of the
SCTP verification tag as a DATA chunk type. The connection then moves
from NONE to ESTABLISHED instead of INIT1, gets the longer established
timeout, and updates the active/inactive destination counters
incorrectly. This happens even though the SCTP handshake has not
completed.
Use the parsed transport offset passed down from ip_vs_set_state() for
the SCTP chunk-header lookup. For IPv4 and IPv6 packets without
extension headers this preserves the existing offset.
Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -372,20 +372,15 @@ static const char *sctp_state_name(int s
static inline void
set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
- int direction, const struct sk_buff *skb)
+ int direction, const struct sk_buff *skb,
+ unsigned int iph_len)
{
struct sctp_chunkhdr _sctpch, *sch;
unsigned char chunk_type;
int event, next_state;
- int ihl, cofs;
-
-#ifdef CONFIG_IP_VS_IPV6
- ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
-#else
- ihl = ip_hdrlen(skb);
-#endif
+ int cofs;
- cofs = ihl + sizeof(struct sctphdr);
+ cofs = iph_len + sizeof(struct sctphdr);
sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch);
if (sch == NULL)
return;
@@ -472,7 +467,7 @@ sctp_state_transition(struct ip_vs_conn
unsigned int iph_len)
{
spin_lock_bh(&cp->lock);
- set_sctp_state(pd, cp, direction, skb);
+ set_sctp_state(pd, cp, direction, skb, iph_len);
spin_unlock_bh(&cp->lock);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 556/699] ipvs: reset full ip_vs_seq structs in ip_vs_conn_new
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (554 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 555/699] ipvs: use parsed transport offset in SCTP state lookup Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 557/699] drbd: reject data replies with an out-of-range payload size Greg Kroah-Hartman
` (146 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yizhou Zhao, Yuxiang Yang, Ao Wang,
Xuewei Feng, Qi Li, Ke Xu, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
commit 2975324d164c552b028632f107b567302863b7f6 upstream.
Commit 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in
ip_vs_conn_new") changed ip_vs_conn_new() to allocate an ip_vs_conn
object with kmem_cache_alloc(). The function then initializes many
fields explicitly, but only resets in_seq.delta and out_seq.delta in the
two struct ip_vs_seq members.
That leaves init_seq and previous_delta uninitialized. This is normally
harmless while the corresponding IP_VS_CONN_F_IN_SEQ or
IP_VS_CONN_F_OUT_SEQ flag is clear. For connections learned from a sync
message, however, ip_vs_proc_conn() preserves those flags from
IP_VS_CONN_F_BACKUP_MASK and passes opt=NULL when the message omits
IPVS_OPT_SEQ_DATA. In that case the new connection can be hashed with
SEQ flags set but with the rest of in_seq/out_seq still containing stale
slab data.
When a packet for such a connection is later handled by an IPVS
application helper, vs_fix_seq() and vs_fix_ack_seq() use
previous_delta and init_seq to rewrite TCP sequence numbers. A malformed
sync message can therefore make forwarded packets carry stale slab bytes
in their TCP seq/ack numbers, and can also corrupt the forwarded TCP
flow.
Reset both struct ip_vs_seq members completely before publishing the
connection. This matches the existing "reset struct ip_vs_seq" comment
and keeps the sequence-adjustment gates inactive unless valid sequence
data is installed later.
Fixes: 9a05475cebdd ("ipvs: avoid kmem_cache_zalloc in ip_vs_conn_new")
Cc: stable@vger.kernel.org
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_conn.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -996,8 +996,8 @@ ip_vs_conn_new(const struct ip_vs_conn_p
cp->app = NULL;
cp->app_data = NULL;
/* reset struct ip_vs_seq */
- cp->in_seq.delta = 0;
- cp->out_seq.delta = 0;
+ memset(&cp->in_seq, 0, sizeof(cp->in_seq));
+ memset(&cp->out_seq, 0, sizeof(cp->out_seq));
atomic_inc(&ipvs->conn_count);
if (flags & IP_VS_CONN_F_NO_CPORT)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 557/699] drbd: reject data replies with an out-of-range payload size
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (555 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 556/699] ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 558/699] cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Greg Kroah-Hartman
` (145 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Christoph Böhmwalder, Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit bd910a7660d280595ef94cb6d193951d855d330f upstream.
recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an
outstanding read request. The peer-supplied payload length reaches it as
the signed int data_size, and two peer-controlled inputs can make it
negative. With a negotiated data-integrity-alg the digest length is
subtracted first, so a reply whose payload is smaller than the digest
underflows data_size. With no integrity algorithm (the default) data_size
is assigned from the unsigned h95/h100 wire length and drbdd() never
bounds it for a payload-carrying command, so a length above INT_MAX casts
it negative; this path needs no non-default feature. The bio receive loop
then computes expect = min_t(int, data_size, bv_len), which is negative,
and drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX
into the first mapped page.
The sibling receive path read_in_block() is not affected: it uses an
unsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.
Reject a data reply whose size is negative after the optional digest
subtraction, covering both triggers.
Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen
bytes past a bio page in the receiver, corrupting kernel memory. A node
that reads from its peer (a diskless node, or read-balancing to the peer)
is exposed in the default configuration; data-integrity-alg is not
required.
Fixes: b411b3637fa7 ("The DRBD driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5-5-xhigh
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Link: https://patch.msgid.link/20260710022837.3738461-1-michael.bommarito@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/drbd/drbd_receiver.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -2025,6 +2025,11 @@ static int recv_dless_read(struct drbd_p
data_size -= digest_size;
}
+ if (data_size < 0) {
+ drbd_err(peer_device, "Invalid data reply size\n");
+ return -EIO;
+ }
+
/* optimistically update recv_cnt. if receiving fails below,
* we disconnect anyways, and counters will be reset. */
peer_device->device->recv_cnt += data_size>>9;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 558/699] cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (556 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 557/699] drbd: reject data replies with an out-of-range payload size Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 559/699] wifi: rt2x00: avoid full teardown before work setup in probe Greg Kroah-Hartman
` (144 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregory Price, Waiman Long,
Farhad Alemi, Andrew Morton, Alistair Popple, Byungchul Park,
Huang, Ying, Joshua Hahn, Matthew Brost, Rakie Kim,
Rasmus Villemoes, Zi Yan, Tejun Heo, Ridong Chen, Johannes Weiner,
Michal Koutný, David Hildenbrand (Arm)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Farhad Alemi <farhad.alemi@berkeley.edu>
commit b983c56426383e4a06fa5970c4e33cee879b1482 upstream.
Creating a child cpuset where cpuset.mems is never set leads to a div/0
when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a
CPU hotplug event.
Reproduction steps:
1) Create a cgroup w/ cpuset controls (do not set cpuset.mems)
2) Move the task into the child cpuset
3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES
4) unplug and hotplug a cpu
echo 0 > /sys/devices/system/cpu/cpu1/online
echo 1 > /sys/devices/system/cpu/cpu1/online
5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the
call to __nodes_fold()
The cpuset code passes (cs->mems_allowed) which is not guaranteed to have
nodes to the rebind routine. Use cs->effective_mems instead, which is
guaranteed to have a non-empty nodemask once we reach that code path.
Link: https://lore.kernel.org/all/CA+0ovCiEz6SP_sn3kN4Tb+_oC=eHMXy_Ffj=usV3wREdQrUtww@mail.gmail.com/
Fixes: ae1c802382f7 ("cpuset: apply cs->effective_{cpus,mems}")
Closes: https://lore.kernel.org/linux-mm/CA+0ovCgxbZkXa+OU8w3s84R3KNPNxxRfmsNR-udh+afQBbGNmw@mail.gmail.com/
Suggested-by: Gregory Price <gourry@gourry.net>
Suggested-by: Waiman Long <longman@redhat.com>
Acked-by: Waiman Long <longman@redhat.com>
Signed-off-by: Farhad Alemi <farhad.alemi@berkeley.edu>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: "Huang, Ying" <ying.huang@linux.alibaba.com>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Ridong Chen <ridong.chen@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Michal Koutný" <mkoutny@suse.com>
Cc: <stable@vger.kernel.org>
[ david: add a comment, slightly rephrase description ]
Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup/cpuset.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1768,7 +1768,12 @@ static void update_tasks_nodemask(struct
migrate = is_memory_migrate(cs);
- mpol_rebind_mm(mm, &cs->mems_allowed);
+ /*
+ * For v1 we can have empty effective_mems, but we cannot
+ * attach any tasks (see cpuset_can_attach_check()). For v2,
+ * effective_mems is guaranteed to not be empty.
+ */
+ mpol_rebind_mm(mm, &cs->effective_mems);
if (migrate)
cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems);
else
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 559/699] wifi: rt2x00: avoid full teardown before work setup in probe
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (557 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 558/699] cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 560/699] wifi: mac80211: fix memory leak in ieee80211_register_hw() Greg Kroah-Hartman
` (143 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit 536fb3d739d75a03cb318c0c6fe799425cfea501 upstream.
rt2x00lib_probe_dev() uses the full rt2x00lib_remove_dev() teardown for
all probe failures. However, drv_data allocation and workqueue allocation
can fail before intf_work, autowakeup_work and sleep_work have been
initialized.
Do not enter the full remove path until the probe has reached the point
where those work items are set up. Return directly for drv_data allocation
failure, and use a small early cleanup path for workqueue allocation
failure.
This issue was found by our static analysis tool and then confirmed by
manual review of rt2x00lib_probe_dev() and rt2x00lib_remove_dev(). The
early probe exits should not call a common teardown path that assumes the
later work setup has already completed.
A QEMU PoC forced alloc_ordered_workqueue() to fail before the work
initializers are reached. The resulting fail path entered
rt2x00lib_remove_dev(), and DEBUG_OBJECTS reported invalid work drains with
rt2x00lib_probe_dev() and rt2x00lib_remove_dev() in the stack.
Fixes: 1ebbc48520a0 ("rt2x00: Introduce concept of driver data in struct rt2x00_dev.")
Fixes: 0439f5367c8d ("rt2x00: Move TX/RX work into dedicated workqueue")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Link: https://patch.msgid.link/20260619073104.1809161-1-runyu.xiao@seu.edu.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
@@ -1368,7 +1368,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de
GFP_KERNEL);
if (!rt2x00dev->drv_data) {
retval = -ENOMEM;
- goto exit;
+ return retval;
}
}
@@ -1402,7 +1402,7 @@ int rt2x00lib_probe_dev(struct rt2x00_de
alloc_ordered_workqueue("%s", 0, wiphy_name(rt2x00dev->hw->wiphy));
if (!rt2x00dev->workqueue) {
retval = -ENOMEM;
- goto exit;
+ goto exit_free_drv_data;
}
INIT_WORK(&rt2x00dev->intf_work, rt2x00lib_intf_scheduled);
@@ -1478,6 +1478,14 @@ exit:
rt2x00lib_remove_dev(rt2x00dev);
return retval;
+
+exit_free_drv_data:
+ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+
+ kfree(rt2x00dev->drv_data);
+ rt2x00dev->drv_data = NULL;
+
+ return retval;
}
EXPORT_SYMBOL_GPL(rt2x00lib_probe_dev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 560/699] wifi: mac80211: fix memory leak in ieee80211_register_hw()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (558 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 559/699] wifi: rt2x00: avoid full teardown before work setup in probe Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 561/699] regulator: ltc3676: Fix incorrect IRQSTAT bit offsets Greg Kroah-Hartman
` (142 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zilin Guan, Dawei Feng,
Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
commit 95fc02722edde02946d0d475221f2b2054d3d8ba upstream.
If kmemdup() fails while copying supported band structures, the error
path jumps to fail_rate. This skips rate_control_deinitialize() and
leaks the initialized local->rate_ctrl.
Fix this by adding a fail_band label that shares the rate-control cleanup
path before falling through to the remaining teardown.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still present in
v7.1-rc7.
An x86_64 allyesconfig build showed no new warnings. As we do not have a
suitable mac80211 device/driver combination to test with, no runtime
testing was able to be performed.
Fixes: 09b4a4faf9d0 ("mac80211: introduce capability flags for VHT EXT NSS support")
Cc: stable@vger.kernel.org
Reviewed-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Link: https://patch.msgid.link/20260706143507.146131-1-dawei.feng@seu.edu.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1279,7 +1279,7 @@ int ieee80211_register_hw(struct ieee802
sband = kmemdup(sband, sizeof(*sband), GFP_KERNEL);
if (!sband) {
result = -ENOMEM;
- goto fail_rate;
+ goto fail_band;
}
wiphy_dbg(hw->wiphy, "copying sband (band %d) due to VHT EXT NSS BW flag\n",
@@ -1342,6 +1342,7 @@ int ieee80211_register_hw(struct ieee802
#endif
wiphy_unregister(local->hw.wiphy);
fail_wiphy_register:
+ fail_band:
rtnl_lock();
rate_control_deinitialize(local);
ieee80211_remove_interfaces(local);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 561/699] regulator: ltc3676: Fix incorrect IRQSTAT bit offsets
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (559 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 560/699] wifi: mac80211: fix memory leak in ieee80211_register_hw() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 562/699] Bluetooth: btrtl: validate firmware patch bounds Greg Kroah-Hartman
` (141 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abhishek Ojha, Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
commit 50dce2e2f84b56d8b4b406d97a1543709e8a87f5 upstream.
The LTC3676_IRQSTAT_* bit definitions do not match the IRQSTAT
(Interrupt Request Status) register layout documented in Table 15
of the LTC3676/LTC3676-1 datasheet:
bit 0 - Pushbutton Status Active
bit 1 - Hard Reset Occurred
bit 2 - PGOOD Timeout Occurred
bit 3 - Undervoltage Warning
bit 4 - Undervoltage Standby (Fault) Occurred
bit 5 - Overtemperature Warning
bit 6 - Overtemperature Standby (Fault) Occurred
bit 7 - Reserved
The driver instead defines these starting at bit 3, one bit higher
than the datasheet specifies, which causes ltc3676_regulator_isr()
to check the wrong status bits and misreport (or miss) PGOOD
timeout, undervoltage and thermal warning/fault conditions.
Fix the bit offsets to match the datasheet.
Fixes: 37b918a034fe ("regulator: Add LTC3676 support")
Cc: stable@vger.kernel.org
Signed-off-by: Abhishek Ojha <Abhishek.ojha@savoirfairelinux.com>
Link: https://patch.msgid.link/20260715170408.295552-1-Abhishek.ojha@savoirfairelinux.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/ltc3676.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/regulator/ltc3676.c
+++ b/drivers/regulator/ltc3676.c
@@ -45,11 +45,11 @@
#define LTC3676_DVBxA_REF_SELECT BIT(5)
#define LTC3676_DVBxB_PGOOD_MASK BIT(5)
-#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(3)
-#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(4)
-#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(5)
-#define LTC3676_IRQSTAT_THERMAL_WARN BIT(6)
-#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(7)
+#define LTC3676_IRQSTAT_PGOOD_TIMEOUT BIT(2)
+#define LTC3676_IRQSTAT_UNDERVOLT_WARN BIT(3)
+#define LTC3676_IRQSTAT_UNDERVOLT_FAULT BIT(4)
+#define LTC3676_IRQSTAT_THERMAL_WARN BIT(5)
+#define LTC3676_IRQSTAT_THERMAL_FAULT BIT(6)
enum ltc3676_reg {
LTC3676_SW1,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 562/699] Bluetooth: btrtl: validate firmware patch bounds
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (560 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 561/699] regulator: ltc3676: Fix incorrect IRQSTAT bit offsets Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 563/699] llc: fix SAP refcount leak when creating incoming sockets Greg Kroah-Hartman
` (140 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laxman Acharya Padhya,
Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
commit 609c5b04a28dc1b0f3af6a7bc93055135b2d2059 upstream.
rtlbt_parse_firmware() copies patch_length - 4 bytes before appending the
firmware version. A malformed firmware patch shorter than the version field
can make this subtraction underflow and turn the copy into an oversized
read and write during Bluetooth setup.
The existing patch_offset + patch_length check can also wrap on 32-bit
architectures. Validate the patch length and range without arithmetic
overflow before allocating or copying the patch.
Fixes: db33c77dddc2 ("Bluetooth: btrtl: Create separate module for Realtek BT driver")
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btrtl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -382,8 +382,9 @@ static int rtlbt_parse_firmware(struct h
}
BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i);
- min_size = patch_offset + patch_length;
- if (btrtl_dev->fw_len < min_size)
+ if (patch_length < sizeof(epatch_info->fw_version) ||
+ patch_offset > btrtl_dev->fw_len ||
+ patch_length > btrtl_dev->fw_len - patch_offset)
return -EINVAL;
/* Copy the firmware into a new buffer and write the version at
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 563/699] llc: fix SAP refcount leak when creating incoming sockets
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (561 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 562/699] Bluetooth: btrtl: validate firmware patch bounds Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 564/699] macsec: fix promiscuity refcount leak in macsec_dev_open() Greg Kroah-Hartman
` (139 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xuanqiang Luo, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
commit 2c72eb6286347d05a885412fb076993bd5286b53 upstream.
llc_sap_add_socket() takes a SAP reference for each socket added to a SAP,
and llc_sap_remove_socket() releases it. llc_create_incoming_sock() takes
an additional SAP reference after adding the child socket.
This extra reference was balanced by an explicit llc_sap_put() in
llc_ui_release() until commit 3100aa9d74db ("llc: fix SAP reference
counting w.r.t. socket handling") removed that put. The corresponding hold
in the accept path was left behind.
When such a child socket is removed, only the reference taken by
llc_sap_add_socket() is released. The extra reference keeps the SAP alive
after its last socket is removed. Remove the obsolete hold.
Fixes: 3100aa9d74db ("llc: fix SAP reference counting w.r.t. socket handling")
Cc: stable@vger.kernel.org
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260712130343.518797-1-xuanqiang.luo@linux.dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/llc/llc_conn.c | 1 -
1 file changed, 1 deletion(-)
--- a/net/llc/llc_conn.c
+++ b/net/llc/llc_conn.c
@@ -761,7 +761,6 @@ static struct sock *llc_create_incoming_
newllc->dev = dev;
dev_hold(dev);
llc_sap_add_socket(llc->sap, newsk);
- llc_sap_hold(llc->sap);
out:
return newsk;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 564/699] macsec: fix promiscuity refcount leak in macsec_dev_open()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (562 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 563/699] llc: fix SAP refcount leak when creating incoming sockets Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 565/699] memstick: ms_block: reject a card that reports too many blocks Greg Kroah-Hartman
` (138 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Raphael Tiovalen,
Sabrina Dubroca, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Raphael Tiovalen <jamestiotio@gmail.com>
commit 7410d11460eb90d6c9281162ccc6a128534d897d upstream.
When a MACsec interface with IFF_PROMISC set is brought up on top of a
device that has hardware offload enabled, macsec_dev_open() first calls
dev_set_promiscuity(real_dev, 1) and then propagates the open to the
offload device. If that propagation fails, the error path jumps to the
clear_allmulti label, which only reverts allmulti and the unicast
address. The promiscuity taken on the lower device is never dropped, so
real_dev is left permanently stuck in promiscuous mode. Its promiscuity
count can no longer be balanced from software.
Add a clear_promisc label that drops the promiscuity reference and
route the two offload failure paths to it. The dev_set_promiscuity()
failure itself still jumps to clear_allmulti, since on that failure the
count was not incremented.
Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: James Raphael Tiovalen <jamestiotio@gmail.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20260705113629.187490-1-jamestiotio@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/macsec.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -3560,19 +3560,22 @@ static int macsec_dev_open(struct net_de
ops = macsec_get_ops(netdev_priv(dev), &ctx);
if (!ops) {
err = -EOPNOTSUPP;
- goto clear_allmulti;
+ goto clear_promisc;
}
ctx.secy = &macsec->secy;
err = macsec_offload(ops->mdo_dev_open, &ctx);
if (err)
- goto clear_allmulti;
+ goto clear_promisc;
}
if (netif_carrier_ok(real_dev))
netif_carrier_on(dev);
return 0;
+clear_promisc:
+ if (dev->flags & IFF_PROMISC)
+ dev_set_promiscuity(real_dev, -1);
clear_allmulti:
if (dev->flags & IFF_ALLMULTI)
dev_set_allmulti(real_dev, -1);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 565/699] memstick: ms_block: reject a card that reports too many blocks
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (563 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 564/699] macsec: fix promiscuity refcount leak in macsec_dev_open() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 566/699] ipvs: fix more places with wrong ipv6 transport offsets Greg Kroah-Hartman
` (137 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maoyi Xie, Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maoyi Xie <maoyixie.tju@gmail.com>
commit 718178f524b98bc920d74bc771aed823c8b81425 upstream.
msb_ftl_initialize() computes the zone count from the card block count
with no bound:
msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
...
for (i = 0; i < msb->zone_count; i++)
msb->free_block_count[i] = MS_BLOCKS_IN_ZONE;
msb->block_count is a card value. msb_read_boot_blocks() reads
number_of_blocks from the card boot page and byte swaps it.
free_block_count is a fixed int[MS_MAX_ZONES]. MS_MAX_ZONES is 16, so the
valid indices are 0 to 15. The init loop above indexes it by zone_count.
msb_mark_block_used() and msb_mark_block_unused() index it by
pba / MS_BLOCKS_IN_ZONE, for pba up to block_count - 1. A card may report
up to 65535 blocks. A block_count above 8192 (MS_MAX_ZONES *
MS_BLOCKS_IN_ZONE) lets the pba index reach 16. That writes past
free_block_count[] and corrupts struct msb_data. A larger count runs the
init loop past the end too.
A real Memory Stick has at most 16 zones. So it has at most 8192 blocks.
msb_ftl_initialize() now rejects a card that reports more than
MS_MAX_ZONES * MS_BLOCKS_IN_ZONE blocks.
Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/memstick/core/ms_block.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1333,6 +1333,10 @@ static int msb_ftl_initialize(struct msb
return 0;
msb->zone_count = msb->block_count / MS_BLOCKS_IN_ZONE;
+ if (msb->block_count > MS_MAX_ZONES * MS_BLOCKS_IN_ZONE) {
+ pr_err("Too many blocks: %d\n", msb->block_count);
+ return -EINVAL;
+ }
msb->logical_block_count = msb->zone_count * 496 - 2;
msb->used_blocks_bitmap = bitmap_zalloc(msb->block_count, GFP_KERNEL);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 566/699] ipvs: fix more places with wrong ipv6 transport offsets
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (564 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 565/699] memstick: ms_block: reject a card that reports too many blocks Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 567/699] reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ Greg Kroah-Hartman
` (136 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Julian Anastasov, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit b3fe4cbd583895987935a9bdad01c8f9d3a02310 upstream.
Sashiko reports for more incorrect IPv6 transport offsets.
The app code for TCP was assuming IPv4 network header
even after the ipvsh argument was provided. This can
cause problems with apps over IPv6. As for the only
official app in the kernel tree (FTP) this problem is
harmless because we use Netfilter to mangle the FTP
ports and we do not adjust the TCP seq numbers.
Also, provide correct offset of the ICMPV6 header in
ip_vs_out_icmp_v6() for correct checksum checks when
the IPv6 packet has extension headers.
Fixes: d12e12299a69 ("ipvs: add ipv6 support to ftp")
Fixes: 2a3b791e6e11 ("IPVS: Add/adjust Netfilter hook functions and helpers for v6")
Cc: stable@vger.kernel.org
Link: https://sashiko.dev/#/patchset/20260706101624.69471-1-zhaoyz24%40mails.tsinghua.edu.cn
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_app.c | 10 ++++------
net/netfilter/ipvs/ip_vs_core.c | 3 +--
2 files changed, 5 insertions(+), 8 deletions(-)
--- a/net/netfilter/ipvs/ip_vs_app.c
+++ b/net/netfilter/ipvs/ip_vs_app.c
@@ -362,14 +362,13 @@ static inline int app_tcp_pkt_out(struct
struct ip_vs_iphdr *ipvsh)
{
int diff;
- const unsigned int tcp_offset = ip_hdrlen(skb);
struct tcphdr *th;
__u32 seq;
- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
+ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
return 0;
- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
+ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
/*
* Remember seq number in case this pkt gets resized
@@ -439,14 +438,13 @@ static inline int app_tcp_pkt_in(struct
struct ip_vs_iphdr *ipvsh)
{
int diff;
- const unsigned int tcp_offset = ip_hdrlen(skb);
struct tcphdr *th;
__u32 seq;
- if (skb_ensure_writable(skb, tcp_offset + sizeof(*th)))
+ if (skb_ensure_writable(skb, ipvsh->len + sizeof(*th)))
return 0;
- th = (struct tcphdr *)(skb_network_header(skb) + tcp_offset);
+ th = (struct tcphdr *)(skb_network_header(skb) + ipvsh->len);
/*
* Remember seq number in case this pkt gets resized
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1053,8 +1053,7 @@ static int ip_vs_out_icmp_v6(struct netn
snet.in6 = ciph.saddr.in6;
offset = ciph.len;
return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp,
- pp, offset, sizeof(struct ipv6hdr),
- hooknum);
+ pp, offset, ipvsh->len, hooknum);
}
#endif
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 567/699] reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (565 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 566/699] ipvs: fix more places with wrong ipv6 transport offsets Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 568/699] reset: sunxi: fix memory region leak on ioremap failure Greg Kroah-Hartman
` (135 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philipp Zabel, Robby Cai,
Guoniu Zhou, Frank Li
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robby Cai <robby.cai@nxp.com>
commit 71827776667f4e4677a4fa806bcfb24d4b8dd9d7 upstream.
On i.MX8MQ, the MIPI CSI reset lines are active-low and not self-clearing.
Writing '0' asserts reset and it remains asserted until explicitly
deasserted by software.
This driver previously treated the MIPI CSI reset signals as active-high,
which led to incorrect reset assert/deassert sequencing. This issue was
exposed by commit 6d79bb8fd2aa ("media: imx8mq-mipi-csi2: Explicitly
release reset").
Fix this by reflecting the correct reset polarity and ensuring proper
reset handling.
Fixes: c979dbf59987 ("reset: imx7: Add support for i.MX8MQ IP block variant")
Cc: stable@vger.kernel.org # 6d79bb8fd2aa: media: imx8mq-mipi-csi2: Explicitly release reset
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Robby Cai <robby.cai@nxp.com>
Reviewed-by: Guoniu Zhou <guoniu.zhou@oss.nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/reset/reset-imx7.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/reset/reset-imx7.c
+++ b/drivers/reset/reset-imx7.c
@@ -236,6 +236,12 @@ static int imx8mq_reset_set(struct reset
case IMX8MQ_RESET_PCIE_CTRL_APPS_EN:
case IMX8MQ_RESET_PCIE2_CTRL_APPS_EN:
+ case IMX8MQ_RESET_MIPI_CSI1_CORE_RESET:
+ case IMX8MQ_RESET_MIPI_CSI1_PHY_REF_RESET:
+ case IMX8MQ_RESET_MIPI_CSI1_ESC_RESET:
+ case IMX8MQ_RESET_MIPI_CSI2_CORE_RESET:
+ case IMX8MQ_RESET_MIPI_CSI2_PHY_REF_RESET:
+ case IMX8MQ_RESET_MIPI_CSI2_ESC_RESET:
case IMX8MQ_RESET_MIPI_DSI_PCLK_RESET_N:
case IMX8MQ_RESET_MIPI_DSI_ESC_RESET_N:
case IMX8MQ_RESET_MIPI_DSI_DPI_RESET_N:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 568/699] reset: sunxi: fix memory region leak on ioremap failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (566 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 567/699] reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 569/699] powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() Greg Kroah-Hartman
` (134 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Philipp Zabel,
Jernej Skrabec
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
commit 1a8c89f8c112c75e84ff9a140f969e372aed0c9a upstream.
In sunxi_reset_init(), when ioremap() fails, the memory region obtained
via request_mem_region() is not released, leading to a resource leak.
Add an err_mem_region label to properly release the memory region before
freeing the data structure.
Fixes: 8f1ae77f4666 ("reset: Add Allwinner SoCs Reset Controller Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/reset/reset-sunxi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/reset/reset-sunxi.c
+++ b/drivers/reset/reset-sunxi.c
@@ -44,7 +44,7 @@ static int sunxi_reset_init(struct devic
data->membase = ioremap(res.start, size);
if (!data->membase) {
ret = -ENOMEM;
- goto err_alloc;
+ goto err_mem_region;
}
spin_lock_init(&data->lock);
@@ -57,6 +57,8 @@ static int sunxi_reset_init(struct devic
return reset_controller_register(&data->rcdev);
+err_mem_region:
+ release_mem_region(res.start, size);
err_alloc:
kfree(data);
return ret;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 569/699] powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (567 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 568/699] reset: sunxi: fix memory region leak on ioremap failure Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 570/699] wifi: mac80211: free ack status frame on TX header build failure Greg Kroah-Hartman
` (133 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Madhavan Srinivasan
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit 47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6 upstream.
spufs_mem_mmap_access() computes the local store offset as
address - vma->vm_start, but bounds-checks it against vma->vm_end
instead of the local store size. On 64-bit, offset is always well
below vma->vm_end, so the clamp never fires and len stays unbounded
against the LS_SIZE buffer returned by ctx->ops->get_ls().
Reject offsets at or beyond LS_SIZE and clamp len to the remaining
space, mirroring the guard already used by spufs_mem_mmap_fault() and
spufs_ps_fault().
Fixes: a352894d0705 ("spufs: use new vm_ops->access to allow local state access from gdb")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/SYBPR01MB7881EE775E8B51C09F5A29E7AF152@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/cell/spufs/file.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -268,10 +268,12 @@ static int spufs_mem_mmap_access(struct
if (write && !(vma->vm_flags & VM_WRITE))
return -EACCES;
+ if (offset >= LS_SIZE)
+ return -EFAULT;
if (spu_acquire(ctx))
return -EINTR;
- if ((offset + len) > vma->vm_end)
- len = vma->vm_end - offset;
+ if ((offset + len) > LS_SIZE)
+ len = LS_SIZE - offset;
local_store = ctx->ops->get_ls(ctx);
if (write)
memcpy_toio(local_store + offset, buf, len);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 570/699] wifi: mac80211: free ack status frame on TX header build failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (568 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 569/699] powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 571/699] wifi: mwifiex: fix permanently busy scans after multiple roam iterations Greg Kroah-Hartman
` (132 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Xin Liu, Zhiling Zou, Ren Wei, Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <roxy520tt@gmail.com>
commit 2c51457d930f723e5f2903af90f5847f7df53f42 upstream.
ieee80211_build_hdr() stores an ACK status frame before it has
finished all validation and header construction. If a later error path
is taken, the transmit skb is freed but the stored ACK status frame
remains in local->ack_status_frames.
This can happen for control port frames when the requested MLO link ID
does not match the link selected for a non-MLO station. Repeated
failures can fill the ACK status IDR and leave pending ACK frames until
hardware teardown.
Remove any stored ACK status frame before returning an error after it
has been inserted into the IDR.
Fixes: a729cff8ad51 ("mac80211: implement wifi TX status")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/9de0423da840e92084915b8f92e66a421245c4b8.1782462409.git.roxy520tt@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/tx.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -2516,6 +2516,18 @@ static u16 ieee80211_store_ack_skb(struc
return info_id;
}
+static void ieee80211_remove_ack_skb(struct ieee80211_local *local, u16 info_id)
+{
+ struct sk_buff *ack_skb;
+ unsigned long flags;
+
+ spin_lock_irqsave(&local->ack_status_lock, flags);
+ ack_skb = idr_remove(&local->ack_status_frames, info_id);
+ spin_unlock_irqrestore(&local->ack_status_lock, flags);
+
+ kfree_skb(ack_skb);
+}
+
/**
* ieee80211_build_hdr - build 802.11 header in the given frame
* @sdata: virtual interface to build the header for
@@ -2875,7 +2887,8 @@ static struct sk_buff *ieee80211_build_h
if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) {
ieee80211_free_txskb(&local->hw, skb);
skb = NULL;
- return ERR_PTR(-ENOMEM);
+ ret = -ENOMEM;
+ goto free;
}
}
@@ -2912,6 +2925,8 @@ static struct sk_buff *ieee80211_build_h
return skb;
free:
+ if (info_id)
+ ieee80211_remove_ack_skb(local, info_id);
kfree_skb(skb);
return ERR_PTR(ret);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 571/699] wifi: mwifiex: fix permanently busy scans after multiple roam iterations
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (569 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 570/699] wifi: mac80211: free ack status frame on TX header build failure Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 572/699] mtd: onenand: samsung: report DMA completion timeouts Greg Kroah-Hartman
` (131 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael Beims, Jeff Chen,
Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael Beims <rafael.beims@toradex.com>
commit d78a407bad6f500884a8606aea1a5a9207be4030 upstream.
In order for the firmware to sleep, the driver has to confirm a
previously received sleep request. The normal sequence of evets goes
like this:
EVENT_SLEEP -> adapter->ps_state = PS_STATE_PRE_SLEEP -> sleep-confirm
-> SLEEP -> EVENT_AWAKE -> AWAKE.
Before sending the sleep-confirm command, the driver must make sure
there are no commands either running or waiting to be completed.
mwifiex_ret_802_11_associate() unconditionally sets
ps_state = PS_STATE_AWAKE when it processes the association command
response, outside of the normal powersave management flow. If
EVENT_SLEEP arrives while the association command is in flight,
ps_state is PRE_SLEEP when the association command response is parsed,
and the forced AWAKE overwrites it. The deferred sleep-confirm is
never sent.
A subsequent scan_start command is correctly acknowledged, but the
firmware doesn't generate scan_result events. The scan request never
finishes, and additional requests from userspace fail with -EBUSY.
After testing on both IW412 and W8997, I could only trigger the bug on
the IW412 and observed the firmwares behave differently. On the IW412
the firmware still sends EVENT_SLEEP while the authentication /
association process is ongoing. A W8997 under the same
conditions seems to suppress power-save for the duration of the
association, so PRE_SLEEP never coincided with the association response
even after extended periods of testing using the loops
described below (>12hours).
On the IW412, the delay between commands that triggers an EVENT_SLEEP
was empirically determined to be ~20ms. This delay can naturally occur
when the driver is outputting debugging information
(debug_mask = 0x00000037), in which situation the busy scans issue is
repeatable while running "test 1)" as described below. If the delay
between commands is less than ~20ms, the firmware stays awake and
the issue was not reproducible running the same test.
The host_mlme=false path also behaves differently. In this case, the
entire authentication / association transaction is executed by one
command (HostCmd_CMD_802_11_ASSOCIATE), and the firmware doesn't emit
EVENT_SLEEP while the command is running.
Remove the assignment so the ps_state is only manipulated in the paths
that are related to powersave event handling and on the main workqueue
for correct sleep confirmation.
The following loop tests were performed (with debugging output enabled):
1) force roaming between two AP's, one 5GHz and one 2.4GHz, same
SSID. Use wpa_cli to trigger the roaming behavior, sleep 2s
between iterations.
2) force a disconnection to AP 1 and a connection to AP 2, test
scan. Use wpa_cli to trigger the connection changes, sleep 2s
between iterations.
Each test ran in each device for at least 3 hours.
Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Rafael Beims <rafael.beims@toradex.com>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Link: https://patch.msgid.link/20260612122547.1586872-2-rafael@beims.me
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/join.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -702,7 +702,6 @@ int mwifiex_ret_802_11_associate(struct
/* Send a Media Connected event, according to the Spec */
priv->media_connected = true;
- priv->adapter->ps_state = PS_STATE_AWAKE;
priv->adapter->pps_uapsd_mode = false;
priv->adapter->tx_lock_flag = false;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 572/699] mtd: onenand: samsung: report DMA completion timeouts
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (570 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 571/699] wifi: mwifiex: fix permanently busy scans after multiple roam iterations Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 573/699] mmc: vub300: defer reset until cmd_mutex is unlocked Greg Kroah-Hartman
` (130 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit d03a19bd6c7f86b99ca8fb61a6ec2345cee1d9d6 upstream.
The S5PC110 OneNAND DMA helpers have bounded waits for transfer
completion. The polling helper falls out of its timeout loop and returns
success, and the IRQ helper ignores wait_for_completion_timeout().
Return -ETIMEDOUT when the DMA transfer-done bit or completion does not
arrive before the timeout so callers can treat the buffer transfer as
failed.
Fixes: e23abf4b7743 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/onenand/onenand_samsung.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/onenand/onenand_samsung.c
+++ b/drivers/mtd/nand/onenand/onenand_samsung.c
@@ -553,6 +553,9 @@ static int s5pc110_dma_poll(dma_addr_t d
} while (!(status & S5PC110_DMA_TRANS_STATUS_TD) &&
time_before(jiffies, timeout));
+ if (!(status & S5PC110_DMA_TRANS_STATUS_TD))
+ return -ETIMEDOUT;
+
writel(S5PC110_DMA_TRANS_CMD_TDC, base + S5PC110_DMA_TRANS_CMD);
return 0;
@@ -607,7 +610,9 @@ static int s5pc110_dma_irq(dma_addr_t ds
writel(S5PC110_DMA_TRANS_CMD_TR, base + S5PC110_DMA_TRANS_CMD);
- wait_for_completion_timeout(&onenand->complete, msecs_to_jiffies(20));
+ if (!wait_for_completion_timeout(&onenand->complete,
+ msecs_to_jiffies(20)))
+ return -ETIMEDOUT;
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 573/699] mmc: vub300: defer reset until cmd_mutex is unlocked
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (571 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 572/699] mtd: onenand: samsung: report DMA completion timeouts Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 574/699] mtd: rawnand: fsl_ifc: return errors for failed page reads Greg Kroah-Hartman
` (129 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit ee5fb641c4ccac8406c668d3e947eb20ce44f233 upstream.
vub300_cmndwork_thread() holds cmd_mutex while it sends a command and
waits for the command response. If the response wait times out,
__vub300_command_response() kills the command URBs and then synchronously
resets the USB device through usb_reset_device().
That reset path re-enters the driver through vub300_pre_reset(), which
also takes cmd_mutex. The worker therefore tries to acquire the same
mutex recursively while it is still holding it from the command path.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the real worker and timeout/reset carrier:
vub300_cmndwork_thread()
__vub300_command_response()
usb_lock_device_for_reset()
usb_reset_device()
vub300_pre_reset()
Lockdep reported the same-task recursive acquisition on cmd_mutex:
WARNING: possible recursive locking detected
... (&test_vub300.cmd_mutex) ... at: usb_reset_device... [vuln_msv]
... (&test_vub300.cmd_mutex) ... at: vub300_cmndwork_thread+0x12/0x20 [vuln_msv]
Workqueue: vub300_cmd_wq vub300_cmndwork_thread [vuln_msv]
*** DEADLOCK ***
Return a flag from __vub300_command_response() when the timeout path needs
a device reset, then perform the reset after vub300_cmndwork_thread() has
cleared the in-flight command state and dropped cmd_mutex. The reset is
still attempted before mmc_request_done(), preserving the existing request
completion ordering while avoiding the recursive lock.
Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Ulf Hansson <ulfh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/vub300.c | 26 +++++++++++++++++---------
1 file changed, 17 insertions(+), 9 deletions(-)
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -1587,7 +1587,7 @@ static int __command_write_data(struct v
return linear_length;
}
-static void __vub300_command_response(struct vub300_mmc_host *vub300,
+static bool __vub300_command_response(struct vub300_mmc_host *vub300,
struct mmc_command *cmd,
struct mmc_data *data, int data_length)
{
@@ -1599,17 +1599,11 @@ static void __vub300_command_response(st
msecs_to_jiffies(msec_timeout));
if (respretval == 0) { /* TIMED OUT */
/* we don't know which of "out" and "res" if any failed */
- int result;
vub300->usb_timed_out = 1;
usb_kill_urb(vub300->command_out_urb);
usb_kill_urb(vub300->command_res_urb);
cmd->error = -ETIMEDOUT;
- result = usb_lock_device_for_reset(vub300->udev,
- vub300->interface);
- if (result == 0) {
- result = usb_reset_device(vub300->udev);
- usb_unlock_device(vub300->udev);
- }
+ return true;
} else if (respretval < 0) {
/* we don't know which of "out" and "res" if any failed */
usb_kill_urb(vub300->command_out_urb);
@@ -1705,6 +1699,8 @@ static void __vub300_command_response(st
} else {
cmd->error = -EINVAL;
}
+
+ return false;
}
static void construct_request_response(struct vub300_mmc_host *vub300,
@@ -1750,6 +1746,7 @@ static void vub300_cmndwork_thread(struc
struct mmc_request *req = vub300->req;
struct mmc_command *cmd = vub300->cmd;
struct mmc_data *data = vub300->data;
+ bool reset_device;
int data_length;
mutex_lock(&vub300->cmd_mutex);
init_completion(&vub300->command_complete);
@@ -1772,7 +1769,8 @@ static void vub300_cmndwork_thread(struc
data_length = __command_read_data(vub300, cmd, data);
else
data_length = __command_write_data(vub300, cmd, data);
- __vub300_command_response(vub300, cmd, data, data_length);
+ reset_device = __vub300_command_response(vub300, cmd,
+ data, data_length);
vub300->req = NULL;
vub300->cmd = NULL;
vub300->data = NULL;
@@ -1780,6 +1778,16 @@ static void vub300_cmndwork_thread(struc
if (cmd->error == -ENOMEDIUM)
check_vub300_port_status(vub300);
mutex_unlock(&vub300->cmd_mutex);
+ if (reset_device) {
+ int result;
+
+ result = usb_lock_device_for_reset(vub300->udev,
+ vub300->interface);
+ if (result == 0) {
+ result = usb_reset_device(vub300->udev);
+ usb_unlock_device(vub300->udev);
+ }
+ }
mmc_request_done(vub300->mmc, req);
kref_put(&vub300->kref, vub300_delete);
return;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 574/699] mtd: rawnand: fsl_ifc: return errors for failed page reads
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (572 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 573/699] mmc: vub300: defer reset until cmd_mutex is unlocked Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 575/699] mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout Greg Kroah-Hartman
` (128 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit f9a13e05a327080c3a1c8165adf9e678fb68fef2 upstream.
fsl_ifc_run_command() logs controller timeout and other non-OPC
completion states in ctrl->nand_stat. fsl_ifc_read_page() then only
increments the ECC failure counter for non-OPC status and still returns
max_bitflips, which can be zero.
Return -ETIMEDOUT when the command did not complete at all and -EIO for
other non-OPC read completions so the NAND core does not treat a failed
page read as a clean page.
Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/fsl_ifc_nand.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
@@ -683,8 +683,15 @@ static int fsl_ifc_read_page(struct nand
return check_erased_page(chip, buf);
}
- if (ctrl->nand_stat != IFC_NAND_EVTER_STAT_OPC)
+ if (!ctrl->nand_stat) {
mtd->ecc_stats.failed++;
+ return -ETIMEDOUT;
+ }
+
+ if (ctrl->nand_stat != IFC_NAND_EVTER_STAT_OPC) {
+ mtd->ecc_stats.failed++;
+ return -EIO;
+ }
return nctrl->max_bitflips;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 575/699] mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (573 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 574/699] mtd: rawnand: fsl_ifc: return errors for failed page reads Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 576/699] mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout Greg Kroah-Hartman
` (127 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Pengpeng Hou,
Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit dbf590b662695b16fbf5917ef129697be4410ea9 upstream.
lpc32xx_xmit_dma() starts a DMA transfer and waits up to one second
for its completion, but it ignores the wait result and returns success
after unmapping the buffer.
A timed out read can therefore return success with incomplete data, and
a timed out write can continue the NAND operation without proof that the
DMA payload reached the controller.
Terminate the DMA channel on timeout, unmap the scatterlist through the
existing cleanup path, and return -ETIMEDOUT to the NAND read/write
callers. Initialize the shared cleanup-path result before using it for
dmaengine_prep_slave_sg() failures.
Fixes: 70f7cb78ec53 ("mtd: add LPC32xx MLC NAND driver")
Cc: stable@vger.kernel.org
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/lpc32xx_mlc.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/raw/lpc32xx_mlc.c
+++ b/drivers/mtd/nand/raw/lpc32xx_mlc.c
@@ -397,6 +397,7 @@ static int lpc32xx_xmit_dma(struct mtd_i
struct lpc32xx_nand_host *host = nand_get_controller_data(chip);
struct dma_async_tx_descriptor *desc;
int flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
+ unsigned long time_left;
int res;
sg_init_one(&host->sgl, mem, len);
@@ -411,6 +412,7 @@ static int lpc32xx_xmit_dma(struct mtd_i
flags);
if (!desc) {
dev_err(mtd->dev.parent, "Failed to prepare slave sg\n");
+ res = -ENXIO;
goto out1;
}
@@ -421,7 +423,13 @@ static int lpc32xx_xmit_dma(struct mtd_i
dmaengine_submit(desc);
dma_async_issue_pending(host->dma_chan);
- wait_for_completion_timeout(&host->comp_dma, msecs_to_jiffies(1000));
+ time_left = wait_for_completion_timeout(&host->comp_dma,
+ msecs_to_jiffies(1000));
+ if (!time_left) {
+ dmaengine_terminate_sync(host->dma_chan);
+ res = -ETIMEDOUT;
+ goto out1;
+ }
dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1,
DMA_BIDIRECTIONAL);
@@ -429,7 +437,7 @@ static int lpc32xx_xmit_dma(struct mtd_i
out1:
dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1,
DMA_BIDIRECTIONAL);
- return -ENXIO;
+ return res;
}
static int lpc32xx_read_page(struct nand_chip *chip, uint8_t *buf,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 576/699] mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (574 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 575/699] mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 577/699] crypto: amcc - fix incorrect kernel-doc comment syntax in files Greg Kroah-Hartman
` (126 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Pengpeng Hou,
Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 17a8ce84964f243c8f89dc7353ac7e8d3137bc74 upstream.
lpc32xx_xmit_dma() waits for the DMA completion callback but ignores
wait_for_completion_timeout(). A timed out DMA transfer is therefore
unmapped and reported as successful to the NAND read/write path.
Return -ETIMEDOUT when the completion wait expires. Terminate the DMA
channel before unmapping the scatterlist so the timed out transfer cannot
continue to access the buffer after the error is returned.
Fixes: 2944a44da09e ("mtd: add LPC32xx SLC NAND driver")
Cc: stable@vger.kernel.org
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/lpc32xx_slc.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/raw/lpc32xx_slc.c
+++ b/drivers/mtd/nand/raw/lpc32xx_slc.c
@@ -432,6 +432,7 @@ static int lpc32xx_xmit_dma(struct mtd_i
struct dma_async_tx_descriptor *desc;
int flags = DMA_CTRL_ACK | DMA_PREP_INTERRUPT;
int res;
+ unsigned long time_left;
host->dma_slave_config.direction = dir;
host->dma_slave_config.src_addr = dma;
@@ -469,12 +470,19 @@ static int lpc32xx_xmit_dma(struct mtd_i
dmaengine_submit(desc);
dma_async_issue_pending(host->dma_chan);
- wait_for_completion_timeout(&host->comp, msecs_to_jiffies(1000));
+ time_left = wait_for_completion_timeout(&host->comp,
+ msecs_to_jiffies(1000));
+ if (!time_left) {
+ dmaengine_terminate_sync(host->dma_chan);
+ res = -ETIMEDOUT;
+ } else {
+ res = 0;
+ }
dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1,
DMA_BIDIRECTIONAL);
- return 0;
+ return res;
out1:
dma_unmap_sg(host->dma_chan->device->dev, &host->sgl, 1,
DMA_BIDIRECTIONAL);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 577/699] crypto: amcc - fix incorrect kernel-doc comment syntax in files
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (575 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 576/699] mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 578/699] crypto: crypto4xx - Remove ahash-related code Greg Kroah-Hartman
` (125 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aditya Srivastava, Randy Dunlap,
Herbert Xu, Eric Biggers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Srivastava <yashsri421@gmail.com>
commit 73f04d3d800f3c8058bb00447e3e1c4cdc85a2b0 upstream.
The opening comment mark '/**' is used for highlighting the beginning of
kernel-doc comments.
There are certain files in drivers/crypto/amcc, which follow this syntax,
but the content inside does not comply with kernel-doc.
Such lines were probably not meant for kernel-doc parsing, but are parsed
due to the presence of kernel-doc like comment syntax(i.e, '/**'), which
causes unexpected warnings from kernel-doc.
E.g., presence of kernel-doc like comment in
drivers/crypto/amcc/crypto4xx_alg.c at header, and some other lines,
causes these warnings by kernel-doc:
"warning: expecting prototype for AMCC SoC PPC4xx Crypto Driver(). Prototype was for set_dynamic_sa_command_0() instead"
"warning: Function parameter or member 'dir' not described in 'set_dynamic_sa_command_0'"
etc..
Provide a simple fix by replacing such occurrences with general comment
format, i.e. '/*', to prevent kernel-doc from parsing it.
Signed-off-by: Aditya Srivastava <yashsri421@gmail.com>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/amcc/crypto4xx_alg.c | 12 ++++++------
drivers/crypto/amcc/crypto4xx_core.c | 18 +++++++++---------
drivers/crypto/amcc/crypto4xx_core.h | 4 ++--
drivers/crypto/amcc/crypto4xx_reg_def.h | 8 ++++----
drivers/crypto/amcc/crypto4xx_sa.h | 18 +++++++++---------
drivers/crypto/amcc/crypto4xx_trng.h | 2 +-
6 files changed, 31 insertions(+), 31 deletions(-)
--- a/drivers/crypto/amcc/crypto4xx_alg.c
+++ b/drivers/crypto/amcc/crypto4xx_alg.c
@@ -1,5 +1,5 @@
// SPDX-License-Identifier: GPL-2.0-or-later
-/**
+/*
* AMCC SoC PPC4xx Crypto Driver
*
* Copyright (c) 2008 Applied Micro Circuits Corporation.
@@ -115,7 +115,7 @@ int crypto4xx_decrypt_iv_block(struct sk
return crypto4xx_crypt(req, AES_IV_SIZE, true, true);
}
-/**
+/*
* AES Functions
*/
static int crypto4xx_setkey_aes(struct crypto_skcipher *cipher,
@@ -374,7 +374,7 @@ static int crypto4xx_aead_setup_fallback
return crypto_aead_setkey(ctx->sw_cipher.aead, key, keylen);
}
-/**
+/*
* AES-CCM Functions
*/
@@ -489,7 +489,7 @@ int crypto4xx_setauthsize_aead(struct cr
return crypto_aead_setauthsize(ctx->sw_cipher.aead, authsize);
}
-/**
+/*
* AES-GCM Functions
*/
@@ -617,7 +617,7 @@ int crypto4xx_decrypt_aes_gcm(struct aea
return crypto4xx_crypt_aes_gcm(req, true);
}
-/**
+/*
* HASH SHA1 Functions
*/
static int crypto4xx_hash_alg_init(struct crypto_tfm *tfm,
@@ -711,7 +711,7 @@ int crypto4xx_hash_digest(struct ahash_r
ctx->sa_len, 0, NULL);
}
-/**
+/*
* SHA1 Algorithm
*/
int crypto4xx_sha1_alg_init(struct crypto_tfm *tfm)
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -1,5 +1,5 @@
// SPDX-License-Identifier: GPL-2.0-or-later
-/**
+/*
* AMCC SoC PPC4xx Crypto Driver
*
* Copyright (c) 2008 Applied Micro Circuits Corporation.
@@ -44,7 +44,7 @@
#define PPC4XX_SEC_VERSION_STR "0.5"
-/**
+/*
* PPC4xx Crypto Engine Initialization Routine
*/
static void crypto4xx_hw_init(struct crypto4xx_device *dev)
@@ -159,7 +159,7 @@ void crypto4xx_free_sa(struct crypto4xx_
ctx->sa_len = 0;
}
-/**
+/*
* alloc memory for the gather ring
* no need to alloc buf for the ring
* gdr_tail, gdr_head and gdr_count are initialized by this function
@@ -268,7 +268,7 @@ static u32 crypto4xx_put_pd_to_pdr(struc
return tail;
}
-/**
+/*
* alloc memory for the gather ring
* no need to alloc buf for the ring
* gdr_tail, gdr_head and gdr_count are initialized by this function
@@ -346,7 +346,7 @@ static inline struct ce_gd *crypto4xx_ge
return &dev->gdr[idx];
}
-/**
+/*
* alloc memory for the scatter ring
* need to alloc buf for the ring
* sdr_tail, sdr_head and sdr_count are initialized by this function
@@ -928,7 +928,7 @@ int crypto4xx_build_pd(struct crypto_asy
return is_busy ? -EBUSY : -EINPROGRESS;
}
-/**
+/*
* Algorithm Registration Functions
*/
static void crypto4xx_ctx_init(struct crypto4xx_alg *amcc_alg,
@@ -1095,7 +1095,7 @@ static void crypto4xx_bh_tasklet_cb(unsi
} while (head != tail);
}
-/**
+/*
* Top Half of isr.
*/
static inline irqreturn_t crypto4xx_interrupt_handler(int irq, void *data,
@@ -1184,7 +1184,7 @@ static int crypto4xx_prng_seed(struct cr
return 0;
}
-/**
+/*
* Supported Crypto Algorithms
*/
static struct crypto4xx_alg_common crypto4xx_alg[] = {
@@ -1367,7 +1367,7 @@ static struct crypto4xx_alg_common crypt
} },
};
-/**
+/*
* Module Initialization Routine
*/
static int crypto4xx_probe(struct platform_device *ofdev)
--- a/drivers/crypto/amcc/crypto4xx_core.h
+++ b/drivers/crypto/amcc/crypto4xx_core.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0-or-later */
-/**
+/*
* AMCC SoC PPC4xx Crypto Driver
*
* Copyright (c) 2008 Applied Micro Circuits Corporation.
@@ -188,7 +188,7 @@ int crypto4xx_hash_final(struct ahash_re
int crypto4xx_hash_update(struct ahash_request *req);
int crypto4xx_hash_init(struct ahash_request *req);
-/**
+/*
* Note: Only use this function to copy items that is word aligned.
*/
static inline void crypto4xx_memcpy_swab32(u32 *dst, const void *buf,
--- a/drivers/crypto/amcc/crypto4xx_reg_def.h
+++ b/drivers/crypto/amcc/crypto4xx_reg_def.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0-or-later */
-/**
+/*
* AMCC SoC PPC4xx Crypto Driver
*
* Copyright (c) 2008 Applied Micro Circuits Corporation.
@@ -104,7 +104,7 @@
#define CRYPTO4XX_PRNG_LFSR_L 0x00070030
#define CRYPTO4XX_PRNG_LFSR_H 0x00070034
-/**
+/*
* Initialize CRYPTO ENGINE registers, and memory bases.
*/
#define PPC4XX_PDR_POLL 0x3ff
@@ -123,7 +123,7 @@
#define PPC4XX_INT_TIMEOUT_CNT 0
#define PPC4XX_INT_TIMEOUT_CNT_REVB 0x3FF
#define PPC4XX_INT_CFG 1
-/**
+/*
* all follow define are ad hoc
*/
#define PPC4XX_RING_RETRY 100
@@ -131,7 +131,7 @@
#define PPC4XX_SDR_SIZE PPC4XX_NUM_SD
#define PPC4XX_GDR_SIZE PPC4XX_NUM_GD
-/**
+/*
* Generic Security Association (SA) with all possible fields. These will
* never likely used except for reference purpose. These structure format
* can be not changed as the hardware expects them to be layout as defined.
--- a/drivers/crypto/amcc/crypto4xx_sa.h
+++ b/drivers/crypto/amcc/crypto4xx_sa.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0-or-later */
-/**
+/*
* AMCC SoC PPC4xx Crypto Driver
*
* Copyright (c) 2008 Applied Micro Circuits Corporation.
@@ -14,7 +14,7 @@
#define AES_IV_SIZE 16
-/**
+/*
* Contents of Dynamic Security Association (SA) with all possible fields
*/
union dynamic_sa_contents {
@@ -122,7 +122,7 @@ union sa_command_0 {
#define SA_AES_KEY_LEN_256 4
#define SA_REV2 1
-/**
+/*
* The follow defines bits sa_command_1
* In Basic hash mode this bit define simple hash or hmac.
* In IPsec mode, this bit define muting control.
@@ -172,7 +172,7 @@ struct dynamic_sa_ctl {
union sa_command_1 sa_command_1;
} __attribute__((packed));
-/**
+/*
* State Record for Security Association (SA)
*/
struct sa_state_record {
@@ -184,7 +184,7 @@ struct sa_state_record {
};
} __attribute__((packed));
-/**
+/*
* Security Association (SA) for AES128
*
*/
@@ -213,7 +213,7 @@ struct dynamic_sa_aes192 {
#define SA_AES192_LEN (sizeof(struct dynamic_sa_aes192)/4)
#define SA_AES192_CONTENTS 0x3e000062
-/**
+/*
* Security Association (SA) for AES256
*/
struct dynamic_sa_aes256 {
@@ -228,7 +228,7 @@ struct dynamic_sa_aes256 {
#define SA_AES256_CONTENTS 0x3e000082
#define SA_AES_CONTENTS 0x3e000002
-/**
+/*
* Security Association (SA) for AES128 CCM
*/
struct dynamic_sa_aes128_ccm {
@@ -242,7 +242,7 @@ struct dynamic_sa_aes128_ccm {
#define SA_AES128_CCM_CONTENTS 0x3e000042
#define SA_AES_CCM_CONTENTS 0x3e000002
-/**
+/*
* Security Association (SA) for AES128_GCM
*/
struct dynamic_sa_aes128_gcm {
@@ -258,7 +258,7 @@ struct dynamic_sa_aes128_gcm {
#define SA_AES128_GCM_CONTENTS 0x3e000442
#define SA_AES_GCM_CONTENTS 0x3e000402
-/**
+/*
* Security Association (SA) for HASH160: HMAC-SHA1
*/
struct dynamic_sa_hash160 {
--- a/drivers/crypto/amcc/crypto4xx_trng.h
+++ b/drivers/crypto/amcc/crypto4xx_trng.h
@@ -1,5 +1,5 @@
/* SPDX-License-Identifier: GPL-2.0-or-later */
-/**
+/*
* AMCC SoC PPC4xx Crypto Driver
*
* Copyright (c) 2008 Applied Micro Circuits Corporation.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 578/699] crypto: crypto4xx - Remove ahash-related code
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (576 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 577/699] crypto: amcc - fix incorrect kernel-doc comment syntax in files Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 579/699] crypto: crypto4xx - Remove insecure and unused rng_alg Greg Kroah-Hartman
` (124 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Eric Biggers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 97855e7f1ccf4917f305baab199edb9f2595ff5b upstream.
The hash implementation in crypto4xx has been disabled since 2009.
As nobody has tried to fix this remove all the dead code.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/amcc/crypto4xx_alg.c | 106 -----------------------------------
drivers/crypto/amcc/crypto4xx_core.c | 43 --------------
drivers/crypto/amcc/crypto4xx_core.h | 7 --
3 files changed, 1 insertion(+), 155 deletions(-)
--- a/drivers/crypto/amcc/crypto4xx_alg.c
+++ b/drivers/crypto/amcc/crypto4xx_alg.c
@@ -12,9 +12,6 @@
#include <linux/interrupt.h>
#include <linux/spinlock_types.h>
#include <linux/scatterlist.h>
-#include <linux/crypto.h>
-#include <linux/hash.h>
-#include <crypto/internal/hash.h>
#include <linux/dma-mapping.h>
#include <crypto/algapi.h>
#include <crypto/aead.h>
@@ -616,106 +613,3 @@ int crypto4xx_decrypt_aes_gcm(struct aea
{
return crypto4xx_crypt_aes_gcm(req, true);
}
-
-/*
- * HASH SHA1 Functions
- */
-static int crypto4xx_hash_alg_init(struct crypto_tfm *tfm,
- unsigned int sa_len,
- unsigned char ha,
- unsigned char hm)
-{
- struct crypto_alg *alg = tfm->__crt_alg;
- struct crypto4xx_alg *my_alg;
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(tfm);
- struct dynamic_sa_hash160 *sa;
- int rc;
-
- my_alg = container_of(__crypto_ahash_alg(alg), struct crypto4xx_alg,
- alg.u.hash);
- ctx->dev = my_alg->dev;
-
- /* Create SA */
- if (ctx->sa_in || ctx->sa_out)
- crypto4xx_free_sa(ctx);
-
- rc = crypto4xx_alloc_sa(ctx, sa_len);
- if (rc)
- return rc;
-
- crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
- sizeof(struct crypto4xx_ctx));
- sa = (struct dynamic_sa_hash160 *)ctx->sa_in;
- set_dynamic_sa_command_0(&sa->ctrl, SA_SAVE_HASH, SA_NOT_SAVE_IV,
- SA_NOT_LOAD_HASH, SA_LOAD_IV_FROM_SA,
- SA_NO_HEADER_PROC, ha, SA_CIPHER_ALG_NULL,
- SA_PAD_TYPE_ZERO, SA_OP_GROUP_BASIC,
- SA_OPCODE_HASH, DIR_INBOUND);
- set_dynamic_sa_command_1(&sa->ctrl, 0, SA_HASH_MODE_HASH,
- CRYPTO_FEEDBACK_MODE_NO_FB, SA_EXTENDED_SN_OFF,
- SA_SEQ_MASK_OFF, SA_MC_ENABLE,
- SA_NOT_COPY_PAD, SA_NOT_COPY_PAYLOAD,
- SA_NOT_COPY_HDR);
- /* Need to zero hash digest in SA */
- memset(sa->inner_digest, 0, sizeof(sa->inner_digest));
- memset(sa->outer_digest, 0, sizeof(sa->outer_digest));
-
- return 0;
-}
-
-int crypto4xx_hash_init(struct ahash_request *req)
-{
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
- int ds;
- struct dynamic_sa_ctl *sa;
-
- sa = ctx->sa_in;
- ds = crypto_ahash_digestsize(
- __crypto_ahash_cast(req->base.tfm));
- sa->sa_command_0.bf.digest_len = ds >> 2;
- sa->sa_command_0.bf.load_hash_state = SA_LOAD_HASH_FROM_SA;
-
- return 0;
-}
-
-int crypto4xx_hash_update(struct ahash_request *req)
-{
- struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
- struct scatterlist dst;
- unsigned int ds = crypto_ahash_digestsize(ahash);
-
- sg_init_one(&dst, req->result, ds);
-
- return crypto4xx_build_pd(&req->base, ctx, req->src, &dst,
- req->nbytes, NULL, 0, ctx->sa_in,
- ctx->sa_len, 0, NULL);
-}
-
-int crypto4xx_hash_final(struct ahash_request *req)
-{
- return 0;
-}
-
-int crypto4xx_hash_digest(struct ahash_request *req)
-{
- struct crypto_ahash *ahash = crypto_ahash_reqtfm(req);
- struct crypto4xx_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
- struct scatterlist dst;
- unsigned int ds = crypto_ahash_digestsize(ahash);
-
- sg_init_one(&dst, req->result, ds);
-
- return crypto4xx_build_pd(&req->base, ctx, req->src, &dst,
- req->nbytes, NULL, 0, ctx->sa_in,
- ctx->sa_len, 0, NULL);
-}
-
-/*
- * SHA1 Algorithm
- */
-int crypto4xx_sha1_alg_init(struct crypto_tfm *tfm)
-{
- return crypto4xx_hash_alg_init(tfm, SA_HASH160_LEN, SA_HASH_ALG_SHA1,
- SA_HASH_MODE_HASH);
-}
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -485,18 +485,6 @@ static void crypto4xx_copy_pkt_to_dst(st
}
}
-static void crypto4xx_copy_digest_to_dst(void *dst,
- struct pd_uinfo *pd_uinfo,
- struct crypto4xx_ctx *ctx)
-{
- struct dynamic_sa_ctl *sa = (struct dynamic_sa_ctl *) ctx->sa_in;
-
- if (sa->sa_command_0.bf.hash_alg == SA_HASH_ALG_SHA1) {
- memcpy(dst, pd_uinfo->sr_va->save_digest,
- SA_HASH_ALG_SHA1_DIGEST_SIZE);
- }
-}
-
static void crypto4xx_ret_sg_desc(struct crypto4xx_device *dev,
struct pd_uinfo *pd_uinfo)
{
@@ -549,23 +537,6 @@ static void crypto4xx_cipher_done(struct
skcipher_request_complete(req, 0);
}
-static void crypto4xx_ahash_done(struct crypto4xx_device *dev,
- struct pd_uinfo *pd_uinfo)
-{
- struct crypto4xx_ctx *ctx;
- struct ahash_request *ahash_req;
-
- ahash_req = ahash_request_cast(pd_uinfo->async_req);
- ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(ahash_req));
-
- crypto4xx_copy_digest_to_dst(ahash_req->result, pd_uinfo, ctx);
- crypto4xx_ret_sg_desc(dev, pd_uinfo);
-
- if (pd_uinfo->state & PD_ENTRY_BUSY)
- ahash_request_complete(ahash_req, -EINPROGRESS);
- ahash_request_complete(ahash_req, 0);
-}
-
static void crypto4xx_aead_done(struct crypto4xx_device *dev,
struct pd_uinfo *pd_uinfo,
struct ce_pd *pd)
@@ -642,9 +613,6 @@ static void crypto4xx_pd_done(struct cry
case CRYPTO_ALG_TYPE_AEAD:
crypto4xx_aead_done(dev, pd_uinfo, pd);
break;
- case CRYPTO_ALG_TYPE_AHASH:
- crypto4xx_ahash_done(dev, pd_uinfo);
- break;
}
}
@@ -915,8 +883,7 @@ int crypto4xx_build_pd(struct crypto_asy
}
pd->pd_ctl.w = PD_CTL_HOST_READY |
- ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) ||
- (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
+ ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ?
PD_CTL_HASH_FINAL : 0);
pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen);
pd_uinfo->state = PD_ENTRY_INUSE | (is_busy ? PD_ENTRY_BUSY : 0);
@@ -1022,10 +989,6 @@ static int crypto4xx_register_alg(struct
rc = crypto_register_aead(&alg->alg.u.aead);
break;
- case CRYPTO_ALG_TYPE_AHASH:
- rc = crypto_register_ahash(&alg->alg.u.hash);
- break;
-
case CRYPTO_ALG_TYPE_RNG:
rc = crypto_register_rng(&alg->alg.u.rng);
break;
@@ -1051,10 +1014,6 @@ static void crypto4xx_unregister_alg(str
list_for_each_entry_safe(alg, tmp, &sec_dev->alg_list, entry) {
list_del(&alg->entry);
switch (alg->alg.type) {
- case CRYPTO_ALG_TYPE_AHASH:
- crypto_unregister_ahash(&alg->alg.u.hash);
- break;
-
case CRYPTO_ALG_TYPE_AEAD:
crypto_unregister_aead(&alg->alg.u.aead);
break;
--- a/drivers/crypto/amcc/crypto4xx_core.h
+++ b/drivers/crypto/amcc/crypto4xx_core.h
@@ -16,7 +16,6 @@
#include <linux/ratelimit.h>
#include <linux/mutex.h>
#include <linux/scatterlist.h>
-#include <crypto/internal/hash.h>
#include <crypto/internal/aead.h>
#include <crypto/internal/rng.h>
#include <crypto/internal/skcipher.h>
@@ -135,7 +134,6 @@ struct crypto4xx_alg_common {
u32 type;
union {
struct skcipher_alg cipher;
- struct ahash_alg hash;
struct aead_alg aead;
struct rng_alg rng;
} u;
@@ -182,11 +180,6 @@ int crypto4xx_encrypt_noiv_block(struct
int crypto4xx_decrypt_noiv_block(struct skcipher_request *req);
int crypto4xx_rfc3686_encrypt(struct skcipher_request *req);
int crypto4xx_rfc3686_decrypt(struct skcipher_request *req);
-int crypto4xx_sha1_alg_init(struct crypto_tfm *tfm);
-int crypto4xx_hash_digest(struct ahash_request *req);
-int crypto4xx_hash_final(struct ahash_request *req);
-int crypto4xx_hash_update(struct ahash_request *req);
-int crypto4xx_hash_init(struct ahash_request *req);
/*
* Note: Only use this function to copy items that is word aligned.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 579/699] crypto: crypto4xx - Remove insecure and unused rng_alg
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (577 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 578/699] crypto: crypto4xx - Remove ahash-related code Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 580/699] batman-adv: clean untagged VLAN on netdev registration failure Greg Kroah-Hartman
` (123 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Christian Lamparter,
Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 7811ec9e973d2c9e465083699f0c8240b98cb8c4 upstream.
Remove crypto4xx_rng, as it is insecure and unused:
- It has only a 64-bit security strength, which is highly inadequate.
This can be seen by the fact that crypto4xx_hw_init() seeds it with
only 64 bits of entropy, and the fact that the original commit
mentions that it implements ANSI X9.17 Annex C.
Another issue was that this driver didn't implement the crypto_rng API
correctly, as crypto4xx_prng_generate() didn't return 0 on success.
- No user of this code is known. It's usable only theoretically via the
"rng" algorithm type of AF_ALG. But userspace actually just uses the
actual Linux RNG (/dev/random etc) instead. And rng_algs don't
contribute entropy to the actual Linux RNG either. (This may have
been confused with hwrng, which does contribute entropy.)
Fixes: d072bfa48853 ("crypto: crypto4xx - add prng crypto support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/amcc/crypto4xx_core.c | 87 --------------------------------
drivers/crypto/amcc/crypto4xx_core.h | 4 -
drivers/crypto/amcc/crypto4xx_reg_def.h | 11 ----
3 files changed, 102 deletions(-)
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -31,11 +31,9 @@
#include <crypto/ctr.h>
#include <crypto/gcm.h>
#include <crypto/sha.h>
-#include <crypto/rng.h>
#include <crypto/scatterwalk.h>
#include <crypto/skcipher.h>
#include <crypto/internal/aead.h>
-#include <crypto/internal/rng.h>
#include <crypto/internal/skcipher.h>
#include "crypto4xx_reg_def.h"
#include "crypto4xx_core.h"
@@ -989,10 +987,6 @@ static int crypto4xx_register_alg(struct
rc = crypto_register_aead(&alg->alg.u.aead);
break;
- case CRYPTO_ALG_TYPE_RNG:
- rc = crypto_register_rng(&alg->alg.u.rng);
- break;
-
default:
rc = crypto_register_skcipher(&alg->alg.u.cipher);
break;
@@ -1018,10 +1012,6 @@ static void crypto4xx_unregister_alg(str
crypto_unregister_aead(&alg->alg.u.aead);
break;
- case CRYPTO_ALG_TYPE_RNG:
- crypto_unregister_rng(&alg->alg.u.rng);
- break;
-
default:
crypto_unregister_skcipher(&alg->alg.u.cipher);
}
@@ -1080,69 +1070,6 @@ static irqreturn_t crypto4xx_ce_interrup
PPC4XX_TMO_ERR_INT);
}
-static int ppc4xx_prng_data_read(struct crypto4xx_device *dev,
- u8 *data, unsigned int max)
-{
- unsigned int i, curr = 0;
- u32 val[2];
-
- do {
- /* trigger PRN generation */
- writel(PPC4XX_PRNG_CTRL_AUTO_EN,
- dev->ce_base + CRYPTO4XX_PRNG_CTRL);
-
- for (i = 0; i < 1024; i++) {
- /* usually 19 iterations are enough */
- if ((readl(dev->ce_base + CRYPTO4XX_PRNG_STAT) &
- CRYPTO4XX_PRNG_STAT_BUSY))
- continue;
-
- val[0] = readl_be(dev->ce_base + CRYPTO4XX_PRNG_RES_0);
- val[1] = readl_be(dev->ce_base + CRYPTO4XX_PRNG_RES_1);
- break;
- }
- if (i == 1024)
- return -ETIMEDOUT;
-
- if ((max - curr) >= 8) {
- memcpy(data, &val, 8);
- data += 8;
- curr += 8;
- } else {
- /* copy only remaining bytes */
- memcpy(data, &val, max - curr);
- break;
- }
- } while (curr < max);
-
- return curr;
-}
-
-static int crypto4xx_prng_generate(struct crypto_rng *tfm,
- const u8 *src, unsigned int slen,
- u8 *dstn, unsigned int dlen)
-{
- struct rng_alg *alg = crypto_rng_alg(tfm);
- struct crypto4xx_alg *amcc_alg;
- struct crypto4xx_device *dev;
- int ret;
-
- amcc_alg = container_of(alg, struct crypto4xx_alg, alg.u.rng);
- dev = amcc_alg->dev;
-
- mutex_lock(&dev->core_dev->rng_lock);
- ret = ppc4xx_prng_data_read(dev, dstn, dlen);
- mutex_unlock(&dev->core_dev->rng_lock);
- return ret;
-}
-
-
-static int crypto4xx_prng_seed(struct crypto_rng *tfm, const u8 *seed,
- unsigned int slen)
-{
- return 0;
-}
-
/*
* Supported Crypto Algorithms
*/
@@ -1312,18 +1239,6 @@ static struct crypto4xx_alg_common crypt
.cra_module = THIS_MODULE,
},
} },
- { .type = CRYPTO_ALG_TYPE_RNG, .u.rng = {
- .base = {
- .cra_name = "stdrng",
- .cra_driver_name = "crypto4xx_rng",
- .cra_priority = 300,
- .cra_ctxsize = 0,
- .cra_module = THIS_MODULE,
- },
- .generate = crypto4xx_prng_generate,
- .seed = crypto4xx_prng_seed,
- .seedsize = 0,
- } },
};
/*
@@ -1393,7 +1308,6 @@ static int crypto4xx_probe(struct platfo
core_dev->dev->core_dev = core_dev;
core_dev->dev->is_revb = is_revb;
core_dev->device = dev;
- mutex_init(&core_dev->rng_lock);
spin_lock_init(&core_dev->lock);
INIT_LIST_HEAD(&core_dev->dev->alg_list);
ratelimit_default_init(&core_dev->dev->aead_ratelimit);
@@ -1471,7 +1385,6 @@ static int crypto4xx_remove(struct platf
tasklet_kill(&core_dev->tasklet);
/* Un-register with Linux CryptoAPI */
crypto4xx_unregister_alg(core_dev->dev);
- mutex_destroy(&core_dev->rng_lock);
/* Free all allocated memory */
crypto4xx_stop_all(core_dev);
--- a/drivers/crypto/amcc/crypto4xx_core.h
+++ b/drivers/crypto/amcc/crypto4xx_core.h
@@ -14,10 +14,8 @@
#define __CRYPTO4XX_CORE_H__
#include <linux/ratelimit.h>
-#include <linux/mutex.h>
#include <linux/scatterlist.h>
#include <crypto/internal/aead.h>
-#include <crypto/internal/rng.h>
#include <crypto/internal/skcipher.h>
#include "crypto4xx_reg_def.h"
#include "crypto4xx_sa.h"
@@ -111,7 +109,6 @@ struct crypto4xx_core_device {
u32 irq;
struct tasklet_struct tasklet;
spinlock_t lock;
- struct mutex rng_lock;
};
struct crypto4xx_ctx {
@@ -135,7 +132,6 @@ struct crypto4xx_alg_common {
union {
struct skcipher_alg cipher;
struct aead_alg aead;
- struct rng_alg rng;
} u;
};
--- a/drivers/crypto/amcc/crypto4xx_reg_def.h
+++ b/drivers/crypto/amcc/crypto4xx_reg_def.h
@@ -90,20 +90,9 @@
#define CRYPTO4XX_BYTE_ORDER_CFG 0x000600d8
#define CRYPTO4XX_ENDIAN_CFG 0x000600d8
-#define CRYPTO4XX_PRNG_STAT 0x00070000
-#define CRYPTO4XX_PRNG_STAT_BUSY 0x1
#define CRYPTO4XX_PRNG_CTRL 0x00070004
#define CRYPTO4XX_PRNG_SEED_L 0x00070008
#define CRYPTO4XX_PRNG_SEED_H 0x0007000c
-
-#define CRYPTO4XX_PRNG_RES_0 0x00070020
-#define CRYPTO4XX_PRNG_RES_1 0x00070024
-#define CRYPTO4XX_PRNG_RES_2 0x00070028
-#define CRYPTO4XX_PRNG_RES_3 0x0007002C
-
-#define CRYPTO4XX_PRNG_LFSR_L 0x00070030
-#define CRYPTO4XX_PRNG_LFSR_H 0x00070034
-
/*
* Initialize CRYPTO ENGINE registers, and memory bases.
*/
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 580/699] batman-adv: clean untagged VLAN on netdev registration failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (578 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 579/699] crypto: crypto4xx - Remove insecure and unused rng_alg Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 581/699] ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup Greg Kroah-Hartman
` (122 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Eckelmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 8669a550c752d86baebc5fdc83b8ff35c4372c0e upstream.
When an mesh interface is registered, it creates an untagged struct
batadv_meshif_vlan on top of it via the NETDEV_REGISTER notifier. But in
this process, another receiver of this notification can veto the
registration. The netdev registration will be aborted because of this veto.
The register_netdevice() call will try to clean up the net_device using
unregister_netdevice_queue() - which only uses the .priv_destructor to
free private resources. In this situation, .dellink will not be called.
The cleanup of the untagged batadv_meshif_vlan must thefore be done in the
destructor to avoid a leak of this object.
Cc: stable@vger.kernel.org
Fixes: 5d2c05b21337 ("batman-adv: add per VLAN interface attribute framework")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[ switch to old "mesh_iface" name "soft_iface", Context, keep early
batadv_softif_destroy_netlink() cleanup in case sysfs support is active,
only run destructor VLAN code on non-softif_destroy context ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/main.c | 17 +++++++++++++++++
net/batman-adv/soft-interface.c | 7 +++++--
net/batman-adv/soft-interface.h | 2 ++
net/batman-adv/types.h | 7 +++++++
4 files changed, 31 insertions(+), 2 deletions(-)
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -265,6 +265,7 @@ err_orig:
void batadv_mesh_free(struct net_device *soft_iface)
{
struct batadv_priv *bat_priv = netdev_priv(soft_iface);
+ struct batadv_softif_vlan *vlan;
atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
@@ -280,6 +281,22 @@ void batadv_mesh_free(struct net_device
batadv_mcast_free(bat_priv);
+ /* destroy the "untagged" VLAN in case of an register_netdevice() error.
+ *
+ * It will be handled normally by batadv_softif_destroy_netlink() and
+ * batadv_softif_destroy_sysfs() before they call batadv_sysfs_del_meshif().
+ *
+ * But when a veto was received during the registration, the VLAN has to
+ * be cleaned up in the destructor.
+ */
+ if (!bat_priv->softif_destroy) {
+ vlan = batadv_softif_vlan_get(bat_priv, BATADV_NO_FLAGS);
+ if (vlan) {
+ batadv_softif_destroy_vlan(bat_priv, vlan);
+ batadv_softif_vlan_put(vlan);
+ }
+ }
+
/* Free the TT and the originator tables only after having terminated
* all the other depending components which may use these structures for
* their purposes.
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -629,8 +629,8 @@ int batadv_softif_create_vlan(struct bat
* @bat_priv: the bat priv with all the soft interface information
* @vlan: the object to remove
*/
-static void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
- struct batadv_softif_vlan *vlan)
+void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
+ struct batadv_softif_vlan *vlan)
{
/* explicitly remove the associated TT local entry because it is marked
* with the NOPURGE flag
@@ -834,6 +834,7 @@ static int batadv_softif_init_late(struc
bat_priv->tt.last_changeset_len = 0;
bat_priv->isolation_mark = 0;
bat_priv->isolation_mark_mask = 0;
+ bat_priv->softif_destroy = false;
/* randomize initial seqno to avoid collision */
get_random_bytes(&random_seqno, sizeof(random_seqno));
@@ -1121,6 +1122,7 @@ void batadv_softif_destroy_sysfs(struct
batadv_softif_vlan_put(vlan);
}
+ bat_priv->softif_destroy = true;
batadv_sysfs_del_meshif(soft_iface);
unregister_netdevice(soft_iface);
}
@@ -1151,6 +1153,7 @@ static void batadv_softif_destroy_netlin
batadv_softif_vlan_put(vlan);
}
+ bat_priv->softif_destroy = true;
batadv_sysfs_del_meshif(soft_iface);
unregister_netdevice_queue(soft_iface, head);
}
--- a/net/batman-adv/soft-interface.h
+++ b/net/batman-adv/soft-interface.h
@@ -25,6 +25,8 @@ void batadv_softif_destroy_sysfs(struct
bool batadv_softif_is_valid(const struct net_device *net_dev);
extern struct rtnl_link_ops batadv_link_ops;
int batadv_softif_create_vlan(struct batadv_priv *bat_priv, unsigned short vid);
+void batadv_softif_destroy_vlan(struct batadv_priv *bat_priv,
+ struct batadv_softif_vlan *vlan);
void batadv_softif_vlan_release(struct kref *ref);
struct batadv_softif_vlan *batadv_softif_vlan_get(struct batadv_priv *bat_priv,
unsigned short vid);
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1791,6 +1791,13 @@ struct batadv_priv {
/** @bat_v: B.A.T.M.A.N. V per soft-interface private data */
struct batadv_priv_bat_v bat_v;
#endif
+
+ /**
+ * @softif_destroy: whether the mesh_free() is called via the
+ * batadv_softif_destroy_sysfs() or batadv_softif_destroy_netlink()
+ * codepath and doesn't have to clean up the untagged VLAN (sysfs)
+ */
+ bool softif_destroy:1;
};
/**
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 581/699] ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (579 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 580/699] batman-adv: clean untagged VLAN on netdev registration failure Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 582/699] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Greg Kroah-Hartman
` (121 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Dave Jiang,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
[ Upstream commit 38bf27511ef41bffebd157ec3eba41fc89ba59cd ]
If acpi_nfit_init() fails after adding the acpi_desc object to the
acpi_descs list, that object is never removed from that list because
the acpi_nfit_shutdown() devm action is not added for the NFIT device
in that case. Next, the acpi_nfit_init() failure causes
acpi_nfit_probe() to fail, the acpi_desc object is freed, and a
dangling pointer is left behind in the acpi_descs. Any subsequent
ACPI Machine Check Exception will trigger nfit_handle_mce() which
iterates over acpi_descs and so a use-after-free will occur.
Moreover, if acpi_nfit_probe() returns 0 after installing a notify
handler for the NFIT device and without allocating the acpi_desc
object and setting the NFIT device's driver data pointer, the
acpi_desc object will be allocated by acpi_nfit_update_notify()
and acpi_nfit_init() will be called to initialize it. Regardless
of whether or not acpi_nfit_init() fails in that case, the
acpi_nfit_shutdown() devm action is not added for the NFIT device
and acpi_desc is never removed from the acpi_descs list. If the
acpi_desc object is freed subsequently on driver removal, any
subsequent ACPI MCE will lead to a use-after-free like in the
previous case.
To address the first issue mentioned above, make acpi_nfit_probe()
call acpi_nfit_shutdown() directly on acpi_nfit_init() failures and
to address the other one, add a remove callback to the driver and
make it call acpi_nfit_shutdown(). Also, since it is now possible to
pass NULL to acpi_nfit_shutdown() or the acpi_desc object passed to it
may not have been initialized, add checks against NULL for acpi_desc and
its nvdimm_bus field to that function and make acpi_nfit_unregister()
clear the latter after unregistering the NVDIMM bus.
Fixes: a61fe6f7902e ("nfit, tools/testing/nvdimm: unify common init for acpi_nfit_desc")
Fixes: fbabd829fe76 ("acpi, nfit: fix module unload vs workqueue shutdown race")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: All applicable <stable@vger.kernel.org>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Link: https://patch.msgid.link/1963615.tdWV9SEqCh@rafael.j.wysocki
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/nfit/core.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -3456,6 +3456,8 @@ static void acpi_nfit_unregister(void *d
struct acpi_nfit_desc *acpi_desc = data;
nvdimm_bus_unregister(acpi_desc->nvdimm_bus);
+ /* The nvdimm_bus object may have been freed, so clear the pointer. */
+ acpi_desc->nvdimm_bus = NULL;
}
int acpi_nfit_init(struct acpi_nfit_desc *acpi_desc, void *data, acpi_size sz)
@@ -3680,7 +3682,10 @@ static void acpi_nfit_put_table(void *ta
void acpi_nfit_shutdown(void *data)
{
struct acpi_nfit_desc *acpi_desc = data;
- struct device *bus_dev = to_nvdimm_bus_dev(acpi_desc->nvdimm_bus);
+ struct device *bus_dev;
+
+ if (!acpi_desc || !acpi_desc->nvdimm_bus)
+ return;
/*
* Destruct under acpi_desc_lock so that nfit_handle_mce does not
@@ -3695,6 +3700,7 @@ void acpi_nfit_shutdown(void *data)
mutex_unlock(&acpi_desc->init_mutex);
cancel_delayed_work_sync(&acpi_desc->dwork);
+ bus_dev = to_nvdimm_bus_dev(acpi_desc->nvdimm_bus);
/*
* Bounce the nvdimm bus lock to make sure any in-flight
* acpi_nfit_ars_rescan() submissions have had a chance to
@@ -3762,13 +3768,14 @@ static int acpi_nfit_add(struct acpi_dev
sz - sizeof(struct acpi_table_nfit));
if (rc)
- return rc;
- return devm_add_action_or_reset(dev, acpi_nfit_shutdown, acpi_desc);
+ acpi_nfit_shutdown(acpi_desc);
+
+ return rc;
}
static int acpi_nfit_remove(struct acpi_device *adev)
{
- /* see acpi_nfit_unregister */
+ acpi_nfit_shutdown(dev_get_drvdata(&adev->dev));
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 582/699] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (580 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 581/699] ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 583/699] iio: hid-sensor-rotation: Fix stale or zero output when reading raw values Greg Kroah-Hartman
` (120 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Jonathan Cameron,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 6e1b9bff1202da55c464e36bd34a2b6863d7fe30 ]
devm_adis_probe_trigger() registers iio_trigger_generic_data_rdy_poll()
through devm_request_irq() on the non-FIFO path, but it does not add
IRQF_NO_THREAD to the IRQ flags.
When the kernel is booted with forced IRQ threading, the parent IRQ can
otherwise be threaded by the IRQ core and the subsequent IIO trigger
child IRQ is then dispatched from irq/... thread context instead of
hardirq context. Because iio_trigger_generic_data_rdy_poll()
immediately drives iio_trigger_poll(), this violates the hardirq-only
IIO trigger helper contract and can push downstream trigger consumers
through the wrong execution context.
Add IRQF_NO_THREAD on top of the existing adis->irq_flag value for the
non-FIFO request_irq() path, while preserving the current trigger
polarity and IRQF_NO_AUTOEN behavior.
Fixes: fec86c6b8369 ("iio: imu: adis: Add Managed device functions")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/adis_trigger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/imu/adis_trigger.c
+++ b/drivers/iio/imu/adis_trigger.c
@@ -84,7 +84,7 @@ int devm_adis_probe_trigger(struct adis
ret = devm_request_irq(&adis->spi->dev, adis->spi->irq,
&iio_trigger_generic_data_rdy_poll,
- adis->irq_flag,
+ adis->irq_flag | IRQF_NO_THREAD,
indio_dev->name,
adis->trig);
if (ret)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 583/699] iio: hid-sensor-rotation: Fix stale or zero output when reading raw values
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (581 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 582/699] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 584/699] iio: imu: inv_icm42600: make timestamp module chip independent Greg Kroah-Hartman
` (119 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Lixu, Andy Shevchenko, Stable,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Lixu <lixu.zhang@intel.com>
[ Upstream commit 3ce8d099e0afc5a7da75a2007a67f67c4f5a4af1 ]
When reading the raw quaternion attribute (in_rot_quaternion_raw), the
driver currently returns either all zeros (if the sensor was never enabled)
or stale data (if the sensor was previously enabled) because it reads from
the internal buffer without explicitly requesting a new sample from the
sensor.
To fix this, power up the sensor, call sensor_hub_input_attr_read_values()
to issue a synchronous GET_REPORT and receive the full quaternion data
directly into a local buffer, then decode the four components.
Fixes: fc18dddc0625 ("iio: hid-sensors: Added device rotation support")
Signed-off-by: Zhang Lixu <lixu.zhang@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/orientation/hid-sensor-rotation.c | 40 ++++++++++++++++++++++++--
1 file changed, 38 insertions(+), 2 deletions(-)
--- a/drivers/iio/orientation/hid-sensor-rotation.c
+++ b/drivers/iio/orientation/hid-sensor-rotation.c
@@ -60,6 +60,13 @@ static int dev_rot_read_raw(struct iio_d
long mask)
{
struct dev_rot_state *rot_state = iio_priv(indio_dev);
+ struct hid_sensor_hub_device *hsdev = rot_state->common_attributes.hsdev;
+ struct hid_sensor_hub_attribute_info *info = &rot_state->quaternion;
+ u32 usage_id = HID_USAGE_SENSOR_ORIENT_QUATERNION;
+ union {
+ s16 val16[4];
+ s32 val32[4];
+ } raw_buf;
int ret_type;
int i;
@@ -69,8 +76,37 @@ static int dev_rot_read_raw(struct iio_d
switch (mask) {
case IIO_CHAN_INFO_RAW:
if (size >= 4) {
- for (i = 0; i < 4; ++i)
- vals[i] = rot_state->sampled_vals[i];
+ if (info->size <= 0 || info->size > sizeof(raw_buf))
+ return -EINVAL;
+
+ hid_sensor_power_state(&rot_state->common_attributes, true);
+
+ ret_type = sensor_hub_input_attr_read_values(hsdev,
+ hsdev->usage,
+ usage_id,
+ info->report_id,
+ SENSOR_HUB_SYNC,
+ info->size,
+ (u8 *)&raw_buf);
+
+ hid_sensor_power_state(&rot_state->common_attributes, false);
+
+ if (ret_type < 0)
+ return ret_type;
+
+ switch (info->size) {
+ case sizeof(raw_buf.val16):
+ for (i = 0; i < ARRAY_SIZE(raw_buf.val16); i++)
+ vals[i] = raw_buf.val16[i];
+ break;
+ case sizeof(raw_buf.val32):
+ for (i = 0; i < ARRAY_SIZE(raw_buf.val32); i++)
+ vals[i] = raw_buf.val32[i];
+ break;
+ default:
+ return -EINVAL;
+ }
+
ret_type = IIO_VAL_INT_MULTIPLE;
*val_len = 4;
} else
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 584/699] iio: imu: inv_icm42600: make timestamp module chip independent
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (582 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 583/699] iio: hid-sensor-rotation: Fix stale or zero output when reading raw values Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 585/699] iio: move inv_icm42600 timestamp module in common Greg Kroah-Hartman
` (118 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit 6e9f2d8375cb24ba75e02e0272e9164d06a1522e ]
Move icm42600 dependent function inside the core module.
Do some headers cleanup at the same time.
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20230606162147.79667-2-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 11 +++++++++++
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c | 14 +-------------
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h | 6 ------
3 files changed, 12 insertions(+), 19 deletions(-)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -522,6 +522,17 @@ static int inv_icm42600_irq_init(struct
"inv_icm42600", st);
}
+static int inv_icm42600_timestamp_setup(struct inv_icm42600_state *st)
+{
+ unsigned int val;
+
+ /* enable timestamp register */
+ val = INV_ICM42600_TMST_CONFIG_TMST_TO_REGS_EN |
+ INV_ICM42600_TMST_CONFIG_TMST_EN;
+ return regmap_update_bits(st->map, INV_ICM42600_REG_TMST_CONFIG,
+ INV_ICM42600_TMST_CONFIG_MASK, val);
+}
+
static int inv_icm42600_enable_regulator_vddio(struct inv_icm42600_state *st)
{
int ret;
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c
@@ -3,11 +3,10 @@
* Copyright (C) 2020 Invensense, Inc.
*/
+#include <linux/errno.h>
#include <linux/kernel.h>
-#include <linux/regmap.h>
#include <linux/math64.h>
-#include "inv_icm42600.h"
#include "inv_icm42600_timestamp.h"
/* internal chip period is 32kHz, 31250ns */
@@ -56,17 +55,6 @@ void inv_icm42600_timestamp_init(struct
inv_update_acc(&ts->chip_period, INV_ICM42600_TIMESTAMP_PERIOD);
}
-int inv_icm42600_timestamp_setup(struct inv_icm42600_state *st)
-{
- unsigned int val;
-
- /* enable timestamp register */
- val = INV_ICM42600_TMST_CONFIG_TMST_TO_REGS_EN |
- INV_ICM42600_TMST_CONFIG_TMST_EN;
- return regmap_update_bits(st->map, INV_ICM42600_REG_TMST_CONFIG,
- INV_ICM42600_TMST_CONFIG_MASK, val);
-}
-
int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
uint32_t period, bool fifo)
{
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h
@@ -6,10 +6,6 @@
#ifndef INV_ICM42600_TIMESTAMP_H_
#define INV_ICM42600_TIMESTAMP_H_
-#include <linux/kernel.h>
-
-struct inv_icm42600_state;
-
/**
* struct inv_icm42600_timestamp_interval - timestamps interval
* @lo: interval lower bound
@@ -53,8 +49,6 @@ struct inv_icm42600_timestamp {
void inv_icm42600_timestamp_init(struct inv_icm42600_timestamp *ts,
uint32_t period);
-int inv_icm42600_timestamp_setup(struct inv_icm42600_state *st);
-
int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
uint32_t period, bool fifo);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 585/699] iio: move inv_icm42600 timestamp module in common
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (583 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 584/699] iio: imu: inv_icm42600: make timestamp module chip independent Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 586/699] iio: make invensense timestamp module generic Greg Kroah-Hartman
` (117 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit d99ff463ecf651437e9e4abe68f331dfb6b5bd9d ]
Create new inv_sensors common modules and move inv_icm42600
timestamp module inside. This module will be used by IMUs and
also in the future by other chips.
Modify inv_icm42600 driver to use timestamp module and do some
headers cleanup.
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20230606162147.79667-3-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/Kconfig | 1 +
drivers/iio/common/Makefile | 1 +
drivers/iio/common/inv_sensors/Kconfig | 7 +++++++
drivers/iio/common/inv_sensors/Makefile | 6 ++++++
.../inv_sensors}/inv_icm42600_timestamp.c | 11 ++++++++++-
drivers/iio/imu/inv_icm42600/Kconfig | 1 +
drivers/iio/imu/inv_icm42600/Makefile | 1 -
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 5 +++--
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 5 +++--
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4 +++-
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 5 +++--
.../linux/iio/common}/inv_icm42600_timestamp.h | 0
drivers/iio/common/Kconfig | 1
drivers/iio/common/Makefile | 1
drivers/iio/common/inv_sensors/Kconfig | 7
drivers/iio/common/inv_sensors/Makefile | 6
drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c | 192 ++++++++++++++++
drivers/iio/imu/inv_icm42600/Kconfig | 1
drivers/iio/imu/inv_icm42600/Makefile | 1
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 5
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 5
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 4
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 5
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c | 183 ---------------
drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h | 79 ------
include/linux/iio/common/inv_icm42600_timestamp.h | 79 ++++++
14 files changed, 299 insertions(+), 270 deletions(-)
create mode 100644 drivers/iio/common/inv_sensors/Kconfig
create mode 100644 drivers/iio/common/inv_sensors/Makefile
rename drivers/iio/{imu/inv_icm42600 => common/inv_sensors}/inv_icm42600_timestamp.c (91%)
rename {drivers/iio/imu/inv_icm42600 => include/linux/iio/common}/inv_icm42600_timestamp.h (100%)
--- a/drivers/iio/common/Kconfig
+++ b/drivers/iio/common/Kconfig
@@ -5,6 +5,7 @@
source "drivers/iio/common/cros_ec_sensors/Kconfig"
source "drivers/iio/common/hid-sensors/Kconfig"
+source "drivers/iio/common/inv_sensors/Kconfig"
source "drivers/iio/common/ms_sensors/Kconfig"
source "drivers/iio/common/ssp_sensors/Kconfig"
source "drivers/iio/common/st_sensors/Kconfig"
--- a/drivers/iio/common/Makefile
+++ b/drivers/iio/common/Makefile
@@ -10,6 +10,7 @@
# When adding new entries keep the list in alphabetical order
obj-y += cros_ec_sensors/
obj-y += hid-sensors/
+obj-y += inv_sensors/
obj-y += ms_sensors/
obj-y += ssp_sensors/
obj-y += st_sensors/
--- /dev/null
+++ b/drivers/iio/common/inv_sensors/Kconfig
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# TDK-InvenSense sensors common library
+#
+
+config IIO_INV_SENSORS_TIMESTAMP
+ tristate
--- /dev/null
+++ b/drivers/iio/common/inv_sensors/Makefile
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# Makefile for TDK-InvenSense sensors module.
+#
+
+obj-$(CONFIG_IIO_INV_SENSORS_TIMESTAMP) += inv_icm42600_timestamp.o
--- /dev/null
+++ b/drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c
@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2020 Invensense, Inc.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/math64.h>
+#include <linux/module.h>
+
+#include <linux/iio/common/inv_icm42600_timestamp.h>
+
+/* internal chip period is 32kHz, 31250ns */
+#define INV_ICM42600_TIMESTAMP_PERIOD 31250
+/* allow a jitter of +/- 2% */
+#define INV_ICM42600_TIMESTAMP_JITTER 2
+/* compute min and max periods accepted */
+#define INV_ICM42600_TIMESTAMP_MIN_PERIOD(_p) \
+ (((_p) * (100 - INV_ICM42600_TIMESTAMP_JITTER)) / 100)
+#define INV_ICM42600_TIMESTAMP_MAX_PERIOD(_p) \
+ (((_p) * (100 + INV_ICM42600_TIMESTAMP_JITTER)) / 100)
+
+/* Add a new value inside an accumulator and update the estimate value */
+static void inv_update_acc(struct inv_icm42600_timestamp_acc *acc, uint32_t val)
+{
+ uint64_t sum = 0;
+ size_t i;
+
+ acc->values[acc->idx++] = val;
+ if (acc->idx >= ARRAY_SIZE(acc->values))
+ acc->idx = 0;
+
+ /* compute the mean of all stored values, use 0 as empty slot */
+ for (i = 0; i < ARRAY_SIZE(acc->values); ++i) {
+ if (acc->values[i] == 0)
+ break;
+ sum += acc->values[i];
+ }
+
+ acc->val = div_u64(sum, i);
+}
+
+void inv_icm42600_timestamp_init(struct inv_icm42600_timestamp *ts,
+ uint32_t period)
+{
+ /* initial odr for sensor after reset is 1kHz */
+ const uint32_t default_period = 1000000;
+
+ /* current multiplier and period values after reset */
+ ts->mult = default_period / INV_ICM42600_TIMESTAMP_PERIOD;
+ ts->period = default_period;
+ /* new set multiplier is the one from chip initialization */
+ ts->new_mult = period / INV_ICM42600_TIMESTAMP_PERIOD;
+
+ /* use theoretical value for chip period */
+ inv_update_acc(&ts->chip_period, INV_ICM42600_TIMESTAMP_PERIOD);
+}
+EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_init, IIO_INV_SENSORS_TIMESTAMP);
+
+int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
+ uint32_t period, bool fifo)
+{
+ /* when FIFO is on, prevent odr change if one is already pending */
+ if (fifo && ts->new_mult != 0)
+ return -EAGAIN;
+
+ ts->new_mult = period / INV_ICM42600_TIMESTAMP_PERIOD;
+
+ return 0;
+}
+EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_update_odr, IIO_INV_SENSORS_TIMESTAMP);
+
+static bool inv_validate_period(uint32_t period, uint32_t mult)
+{
+ const uint32_t chip_period = INV_ICM42600_TIMESTAMP_PERIOD;
+ uint32_t period_min, period_max;
+
+ /* check that period is acceptable */
+ period_min = INV_ICM42600_TIMESTAMP_MIN_PERIOD(chip_period) * mult;
+ period_max = INV_ICM42600_TIMESTAMP_MAX_PERIOD(chip_period) * mult;
+ if (period > period_min && period < period_max)
+ return true;
+ else
+ return false;
+}
+
+static bool inv_compute_chip_period(struct inv_icm42600_timestamp *ts,
+ uint32_t mult, uint32_t period)
+{
+ uint32_t new_chip_period;
+
+ if (!inv_validate_period(period, mult))
+ return false;
+
+ /* update chip internal period estimation */
+ new_chip_period = period / mult;
+ inv_update_acc(&ts->chip_period, new_chip_period);
+
+ return true;
+}
+
+void inv_icm42600_timestamp_interrupt(struct inv_icm42600_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ size_t sensor_nb, int64_t timestamp)
+{
+ struct inv_icm42600_timestamp_interval *it;
+ int64_t delta, interval;
+ const uint32_t fifo_mult = fifo_period / INV_ICM42600_TIMESTAMP_PERIOD;
+ uint32_t period = ts->period;
+ int32_t m;
+ bool valid = false;
+
+ if (fifo_nb == 0)
+ return;
+
+ /* update interrupt timestamp and compute chip and sensor periods */
+ it = &ts->it;
+ it->lo = it->up;
+ it->up = timestamp;
+ delta = it->up - it->lo;
+ if (it->lo != 0) {
+ /* compute period: delta time divided by number of samples */
+ period = div_s64(delta, fifo_nb);
+ valid = inv_compute_chip_period(ts, fifo_mult, period);
+ /* update sensor period if chip internal period is updated */
+ if (valid)
+ ts->period = ts->mult * ts->chip_period.val;
+ }
+
+ /* no previous data, compute theoritical value from interrupt */
+ if (ts->timestamp == 0) {
+ /* elapsed time: sensor period * sensor samples number */
+ interval = (int64_t)ts->period * (int64_t)sensor_nb;
+ ts->timestamp = it->up - interval;
+ return;
+ }
+
+ /* if interrupt interval is valid, sync with interrupt timestamp */
+ if (valid) {
+ /* compute measured fifo_period */
+ fifo_period = fifo_mult * ts->chip_period.val;
+ /* delta time between last sample and last interrupt */
+ delta = it->lo - ts->timestamp;
+ /* if there are multiple samples, go back to first one */
+ while (delta >= (fifo_period * 3 / 2))
+ delta -= fifo_period;
+ /* compute maximal adjustment value */
+ m = INV_ICM42600_TIMESTAMP_MAX_PERIOD(ts->period) - ts->period;
+ if (delta > m)
+ delta = m;
+ else if (delta < -m)
+ delta = -m;
+ ts->timestamp += delta;
+ }
+}
+EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_interrupt, IIO_INV_SENSORS_TIMESTAMP);
+
+void inv_icm42600_timestamp_apply_odr(struct inv_icm42600_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ unsigned int fifo_no)
+{
+ int64_t interval;
+ uint32_t fifo_mult;
+
+ if (ts->new_mult == 0)
+ return;
+
+ /* update to new multiplier and update period */
+ ts->mult = ts->new_mult;
+ ts->new_mult = 0;
+ ts->period = ts->mult * ts->chip_period.val;
+
+ /*
+ * After ODR change the time interval with the previous sample is
+ * undertermined (depends when the change occures). So we compute the
+ * timestamp from the current interrupt using the new FIFO period, the
+ * total number of samples and the current sample numero.
+ */
+ if (ts->timestamp != 0) {
+ /* compute measured fifo period */
+ fifo_mult = fifo_period / INV_ICM42600_TIMESTAMP_PERIOD;
+ fifo_period = fifo_mult * ts->chip_period.val;
+ /* computes time interval between interrupt and this sample */
+ interval = (int64_t)(fifo_nb - fifo_no) * (int64_t)fifo_period;
+ ts->timestamp = ts->it.up - interval;
+ }
+}
+EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_apply_odr, IIO_INV_SENSORS_TIMESTAMP);
+
+MODULE_AUTHOR("InvenSense, Inc.");
+MODULE_DESCRIPTION("InvenSense sensors timestamp module");
+MODULE_LICENSE("GPL");
--- a/drivers/iio/imu/inv_icm42600/Kconfig
+++ b/drivers/iio/imu/inv_icm42600/Kconfig
@@ -3,6 +3,7 @@
config INV_ICM42600
tristate
select IIO_BUFFER
+ select IIO_INV_SENSORS_TIMESTAMP
config INV_ICM42600_I2C
tristate "InvenSense ICM-426xx I2C driver"
--- a/drivers/iio/imu/inv_icm42600/Makefile
+++ b/drivers/iio/imu/inv_icm42600/Makefile
@@ -6,7 +6,6 @@ inv-icm42600-y += inv_icm42600_gyro.o
inv-icm42600-y += inv_icm42600_accel.o
inv-icm42600-y += inv_icm42600_temp.o
inv-icm42600-y += inv_icm42600_buffer.o
-inv-icm42600-y += inv_icm42600_timestamp.o
obj-$(CONFIG_INV_ICM42600_I2C) += inv-icm42600-i2c.o
inv-icm42600-i2c-y += inv_icm42600_i2c.o
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -10,14 +10,15 @@
#include <linux/regmap.h>
#include <linux/delay.h>
#include <linux/math64.h>
-#include <linux/iio/iio.h>
+
#include <linux/iio/buffer.h>
+#include <linux/iio/common/inv_icm42600_timestamp.h>
+#include <linux/iio/iio.h>
#include <linux/iio/kfifo_buf.h>
#include "inv_icm42600.h"
#include "inv_icm42600_temp.h"
#include "inv_icm42600_buffer.h"
-#include "inv_icm42600_timestamp.h"
#define INV_ICM42600_ACCEL_CHAN(_modifier, _index, _ext_info) \
{ \
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -9,11 +9,12 @@
#include <linux/pm_runtime.h>
#include <linux/regmap.h>
#include <linux/delay.h>
-#include <linux/iio/iio.h>
+
#include <linux/iio/buffer.h>
+#include <linux/iio/common/inv_icm42600_timestamp.h>
+#include <linux/iio/iio.h>
#include "inv_icm42600.h"
-#include "inv_icm42600_timestamp.h"
#include "inv_icm42600_buffer.h"
/* FIFO header: 1 byte */
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -15,11 +15,12 @@
#include <linux/pm_runtime.h>
#include <linux/property.h>
#include <linux/regmap.h>
+
+#include <linux/iio/common/inv_icm42600_timestamp.h>
#include <linux/iio/iio.h>
#include "inv_icm42600.h"
#include "inv_icm42600_buffer.h"
-#include "inv_icm42600_timestamp.h"
static const struct regmap_range_cfg inv_icm42600_regmap_ranges[] = {
{
@@ -798,3 +799,4 @@ EXPORT_SYMBOL_GPL(inv_icm42600_pm_ops);
MODULE_AUTHOR("InvenSense, Inc.");
MODULE_DESCRIPTION("InvenSense ICM-426xx device driver");
MODULE_LICENSE("GPL");
+MODULE_IMPORT_NS(IIO_INV_SENSORS_TIMESTAMP);
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -10,14 +10,15 @@
#include <linux/regmap.h>
#include <linux/delay.h>
#include <linux/math64.h>
-#include <linux/iio/iio.h>
+
#include <linux/iio/buffer.h>
+#include <linux/iio/common/inv_icm42600_timestamp.h>
+#include <linux/iio/iio.h>
#include <linux/iio/kfifo_buf.h>
#include "inv_icm42600.h"
#include "inv_icm42600_temp.h"
#include "inv_icm42600_buffer.h"
-#include "inv_icm42600_timestamp.h"
#define INV_ICM42600_GYRO_CHAN(_modifier, _index, _ext_info) \
{ \
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.c
+++ /dev/null
@@ -1,183 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Copyright (C) 2020 Invensense, Inc.
- */
-
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/math64.h>
-
-#include "inv_icm42600_timestamp.h"
-
-/* internal chip period is 32kHz, 31250ns */
-#define INV_ICM42600_TIMESTAMP_PERIOD 31250
-/* allow a jitter of +/- 2% */
-#define INV_ICM42600_TIMESTAMP_JITTER 2
-/* compute min and max periods accepted */
-#define INV_ICM42600_TIMESTAMP_MIN_PERIOD(_p) \
- (((_p) * (100 - INV_ICM42600_TIMESTAMP_JITTER)) / 100)
-#define INV_ICM42600_TIMESTAMP_MAX_PERIOD(_p) \
- (((_p) * (100 + INV_ICM42600_TIMESTAMP_JITTER)) / 100)
-
-/* Add a new value inside an accumulator and update the estimate value */
-static void inv_update_acc(struct inv_icm42600_timestamp_acc *acc, uint32_t val)
-{
- uint64_t sum = 0;
- size_t i;
-
- acc->values[acc->idx++] = val;
- if (acc->idx >= ARRAY_SIZE(acc->values))
- acc->idx = 0;
-
- /* compute the mean of all stored values, use 0 as empty slot */
- for (i = 0; i < ARRAY_SIZE(acc->values); ++i) {
- if (acc->values[i] == 0)
- break;
- sum += acc->values[i];
- }
-
- acc->val = div_u64(sum, i);
-}
-
-void inv_icm42600_timestamp_init(struct inv_icm42600_timestamp *ts,
- uint32_t period)
-{
- /* initial odr for sensor after reset is 1kHz */
- const uint32_t default_period = 1000000;
-
- /* current multiplier and period values after reset */
- ts->mult = default_period / INV_ICM42600_TIMESTAMP_PERIOD;
- ts->period = default_period;
- /* new set multiplier is the one from chip initialization */
- ts->new_mult = period / INV_ICM42600_TIMESTAMP_PERIOD;
-
- /* use theoretical value for chip period */
- inv_update_acc(&ts->chip_period, INV_ICM42600_TIMESTAMP_PERIOD);
-}
-
-int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
- uint32_t period, bool fifo)
-{
- /* when FIFO is on, prevent odr change if one is already pending */
- if (fifo && ts->new_mult != 0)
- return -EAGAIN;
-
- ts->new_mult = period / INV_ICM42600_TIMESTAMP_PERIOD;
-
- return 0;
-}
-
-static bool inv_validate_period(uint32_t period, uint32_t mult)
-{
- const uint32_t chip_period = INV_ICM42600_TIMESTAMP_PERIOD;
- uint32_t period_min, period_max;
-
- /* check that period is acceptable */
- period_min = INV_ICM42600_TIMESTAMP_MIN_PERIOD(chip_period) * mult;
- period_max = INV_ICM42600_TIMESTAMP_MAX_PERIOD(chip_period) * mult;
- if (period > period_min && period < period_max)
- return true;
- else
- return false;
-}
-
-static bool inv_compute_chip_period(struct inv_icm42600_timestamp *ts,
- uint32_t mult, uint32_t period)
-{
- uint32_t new_chip_period;
-
- if (!inv_validate_period(period, mult))
- return false;
-
- /* update chip internal period estimation */
- new_chip_period = period / mult;
- inv_update_acc(&ts->chip_period, new_chip_period);
-
- return true;
-}
-
-void inv_icm42600_timestamp_interrupt(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- size_t sensor_nb, int64_t timestamp)
-{
- struct inv_icm42600_timestamp_interval *it;
- int64_t delta, interval;
- const uint32_t fifo_mult = fifo_period / INV_ICM42600_TIMESTAMP_PERIOD;
- uint32_t period = ts->period;
- int32_t m;
- bool valid = false;
-
- if (fifo_nb == 0)
- return;
-
- /* update interrupt timestamp and compute chip and sensor periods */
- it = &ts->it;
- it->lo = it->up;
- it->up = timestamp;
- delta = it->up - it->lo;
- if (it->lo != 0) {
- /* compute period: delta time divided by number of samples */
- period = div_s64(delta, fifo_nb);
- valid = inv_compute_chip_period(ts, fifo_mult, period);
- /* update sensor period if chip internal period is updated */
- if (valid)
- ts->period = ts->mult * ts->chip_period.val;
- }
-
- /* no previous data, compute theoritical value from interrupt */
- if (ts->timestamp == 0) {
- /* elapsed time: sensor period * sensor samples number */
- interval = (int64_t)ts->period * (int64_t)sensor_nb;
- ts->timestamp = it->up - interval;
- return;
- }
-
- /* if interrupt interval is valid, sync with interrupt timestamp */
- if (valid) {
- /* compute measured fifo_period */
- fifo_period = fifo_mult * ts->chip_period.val;
- /* delta time between last sample and last interrupt */
- delta = it->lo - ts->timestamp;
- /* if there are multiple samples, go back to first one */
- while (delta >= (fifo_period * 3 / 2))
- delta -= fifo_period;
- /* compute maximal adjustment value */
- m = INV_ICM42600_TIMESTAMP_MAX_PERIOD(ts->period) - ts->period;
- if (delta > m)
- delta = m;
- else if (delta < -m)
- delta = -m;
- ts->timestamp += delta;
- }
-}
-
-void inv_icm42600_timestamp_apply_odr(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- unsigned int fifo_no)
-{
- int64_t interval;
- uint32_t fifo_mult;
-
- if (ts->new_mult == 0)
- return;
-
- /* update to new multiplier and update period */
- ts->mult = ts->new_mult;
- ts->new_mult = 0;
- ts->period = ts->mult * ts->chip_period.val;
-
- /*
- * After ODR change the time interval with the previous sample is
- * undertermined (depends when the change occures). So we compute the
- * timestamp from the current interrupt using the new FIFO period, the
- * total number of samples and the current sample numero.
- */
- if (ts->timestamp != 0) {
- /* compute measured fifo period */
- fifo_mult = fifo_period / INV_ICM42600_TIMESTAMP_PERIOD;
- fifo_period = fifo_mult * ts->chip_period.val;
- /* computes time interval between interrupt and this sample */
- interval = (int64_t)(fifo_nb - fifo_no) * (int64_t)fifo_period;
- ts->timestamp = ts->it.up - interval;
- }
-}
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_timestamp.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-/*
- * Copyright (C) 2020 Invensense, Inc.
- */
-
-#ifndef INV_ICM42600_TIMESTAMP_H_
-#define INV_ICM42600_TIMESTAMP_H_
-
-/**
- * struct inv_icm42600_timestamp_interval - timestamps interval
- * @lo: interval lower bound
- * @up: interval upper bound
- */
-struct inv_icm42600_timestamp_interval {
- int64_t lo;
- int64_t up;
-};
-
-/**
- * struct inv_icm42600_timestamp_acc - accumulator for computing an estimation
- * @val: current estimation of the value, the mean of all values
- * @idx: current index of the next free place in values table
- * @values: table of all measured values, use for computing the mean
- */
-struct inv_icm42600_timestamp_acc {
- uint32_t val;
- size_t idx;
- uint32_t values[32];
-};
-
-/**
- * struct inv_icm42600_timestamp - timestamp management states
- * @it: interrupts interval timestamps
- * @timestamp: store last timestamp for computing next data timestamp
- * @mult: current internal period multiplier
- * @new_mult: new set internal period multiplier (not yet effective)
- * @period: measured current period of the sensor
- * @chip_period: accumulator for computing internal chip period
- */
-struct inv_icm42600_timestamp {
- struct inv_icm42600_timestamp_interval it;
- int64_t timestamp;
- uint32_t mult;
- uint32_t new_mult;
- uint32_t period;
- struct inv_icm42600_timestamp_acc chip_period;
-};
-
-void inv_icm42600_timestamp_init(struct inv_icm42600_timestamp *ts,
- uint32_t period);
-
-int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
- uint32_t period, bool fifo);
-
-void inv_icm42600_timestamp_interrupt(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- size_t sensor_nb, int64_t timestamp);
-
-static inline int64_t
-inv_icm42600_timestamp_pop(struct inv_icm42600_timestamp *ts)
-{
- ts->timestamp += ts->period;
- return ts->timestamp;
-}
-
-void inv_icm42600_timestamp_apply_odr(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- unsigned int fifo_no);
-
-static inline void
-inv_icm42600_timestamp_reset(struct inv_icm42600_timestamp *ts)
-{
- const struct inv_icm42600_timestamp_interval interval_init = {0LL, 0LL};
-
- ts->it = interval_init;
- ts->timestamp = 0;
-}
-
-#endif
--- /dev/null
+++ b/include/linux/iio/common/inv_icm42600_timestamp.h
@@ -0,0 +1,79 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2020 Invensense, Inc.
+ */
+
+#ifndef INV_ICM42600_TIMESTAMP_H_
+#define INV_ICM42600_TIMESTAMP_H_
+
+/**
+ * struct inv_icm42600_timestamp_interval - timestamps interval
+ * @lo: interval lower bound
+ * @up: interval upper bound
+ */
+struct inv_icm42600_timestamp_interval {
+ int64_t lo;
+ int64_t up;
+};
+
+/**
+ * struct inv_icm42600_timestamp_acc - accumulator for computing an estimation
+ * @val: current estimation of the value, the mean of all values
+ * @idx: current index of the next free place in values table
+ * @values: table of all measured values, use for computing the mean
+ */
+struct inv_icm42600_timestamp_acc {
+ uint32_t val;
+ size_t idx;
+ uint32_t values[32];
+};
+
+/**
+ * struct inv_icm42600_timestamp - timestamp management states
+ * @it: interrupts interval timestamps
+ * @timestamp: store last timestamp for computing next data timestamp
+ * @mult: current internal period multiplier
+ * @new_mult: new set internal period multiplier (not yet effective)
+ * @period: measured current period of the sensor
+ * @chip_period: accumulator for computing internal chip period
+ */
+struct inv_icm42600_timestamp {
+ struct inv_icm42600_timestamp_interval it;
+ int64_t timestamp;
+ uint32_t mult;
+ uint32_t new_mult;
+ uint32_t period;
+ struct inv_icm42600_timestamp_acc chip_period;
+};
+
+void inv_icm42600_timestamp_init(struct inv_icm42600_timestamp *ts,
+ uint32_t period);
+
+int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
+ uint32_t period, bool fifo);
+
+void inv_icm42600_timestamp_interrupt(struct inv_icm42600_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ size_t sensor_nb, int64_t timestamp);
+
+static inline int64_t
+inv_icm42600_timestamp_pop(struct inv_icm42600_timestamp *ts)
+{
+ ts->timestamp += ts->period;
+ return ts->timestamp;
+}
+
+void inv_icm42600_timestamp_apply_odr(struct inv_icm42600_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ unsigned int fifo_no);
+
+static inline void
+inv_icm42600_timestamp_reset(struct inv_icm42600_timestamp *ts)
+{
+ const struct inv_icm42600_timestamp_interval interval_init = {0LL, 0LL};
+
+ ts->it = interval_init;
+ ts->timestamp = 0;
+}
+
+#endif
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 586/699] iio: make invensense timestamp module generic
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (584 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 585/699] iio: move inv_icm42600 timestamp module in common Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 587/699] iio: imu: inv_mpu6050: use the common inv_sensors timestamp module Greg Kroah-Hartman
` (116 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit 0ecc363ccea71eda6a2cceade120489259bcdb33 ]
Rename common module to inv_sensors_timestamp, add configuration
at init (chip internal clock, acceptable jitter, ...) and update
inv_icm42600 driver integration.
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20230606162147.79667-4-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/inv_sensors/Makefile | 2
drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c | 192 ----------------
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 191 +++++++++++++++
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 32 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 34 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 10
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 32 +-
include/linux/iio/common/inv_icm42600_timestamp.h | 79 ------
include/linux/iio/common/inv_sensors_timestamp.h | 95 +++++++
9 files changed, 349 insertions(+), 318 deletions(-)
rename drivers/iio/common/inv_sensors/{inv_icm42600_timestamp.c => inv_sensors_timestamp.c} (61%)
delete mode 100644 include/linux/iio/common/inv_icm42600_timestamp.h
create mode 100644 include/linux/iio/common/inv_sensors_timestamp.h
--- a/drivers/iio/common/inv_sensors/Makefile
+++ b/drivers/iio/common/inv_sensors/Makefile
@@ -3,4 +3,4 @@
# Makefile for TDK-InvenSense sensors module.
#
-obj-$(CONFIG_IIO_INV_SENSORS_TIMESTAMP) += inv_icm42600_timestamp.o
+obj-$(CONFIG_IIO_INV_SENSORS_TIMESTAMP) += inv_sensors_timestamp.o
--- a/drivers/iio/common/inv_sensors/inv_icm42600_timestamp.c
+++ /dev/null
@@ -1,192 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-/*
- * Copyright (C) 2020 Invensense, Inc.
- */
-
-#include <linux/errno.h>
-#include <linux/kernel.h>
-#include <linux/math64.h>
-#include <linux/module.h>
-
-#include <linux/iio/common/inv_icm42600_timestamp.h>
-
-/* internal chip period is 32kHz, 31250ns */
-#define INV_ICM42600_TIMESTAMP_PERIOD 31250
-/* allow a jitter of +/- 2% */
-#define INV_ICM42600_TIMESTAMP_JITTER 2
-/* compute min and max periods accepted */
-#define INV_ICM42600_TIMESTAMP_MIN_PERIOD(_p) \
- (((_p) * (100 - INV_ICM42600_TIMESTAMP_JITTER)) / 100)
-#define INV_ICM42600_TIMESTAMP_MAX_PERIOD(_p) \
- (((_p) * (100 + INV_ICM42600_TIMESTAMP_JITTER)) / 100)
-
-/* Add a new value inside an accumulator and update the estimate value */
-static void inv_update_acc(struct inv_icm42600_timestamp_acc *acc, uint32_t val)
-{
- uint64_t sum = 0;
- size_t i;
-
- acc->values[acc->idx++] = val;
- if (acc->idx >= ARRAY_SIZE(acc->values))
- acc->idx = 0;
-
- /* compute the mean of all stored values, use 0 as empty slot */
- for (i = 0; i < ARRAY_SIZE(acc->values); ++i) {
- if (acc->values[i] == 0)
- break;
- sum += acc->values[i];
- }
-
- acc->val = div_u64(sum, i);
-}
-
-void inv_icm42600_timestamp_init(struct inv_icm42600_timestamp *ts,
- uint32_t period)
-{
- /* initial odr for sensor after reset is 1kHz */
- const uint32_t default_period = 1000000;
-
- /* current multiplier and period values after reset */
- ts->mult = default_period / INV_ICM42600_TIMESTAMP_PERIOD;
- ts->period = default_period;
- /* new set multiplier is the one from chip initialization */
- ts->new_mult = period / INV_ICM42600_TIMESTAMP_PERIOD;
-
- /* use theoretical value for chip period */
- inv_update_acc(&ts->chip_period, INV_ICM42600_TIMESTAMP_PERIOD);
-}
-EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_init, IIO_INV_SENSORS_TIMESTAMP);
-
-int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
- uint32_t period, bool fifo)
-{
- /* when FIFO is on, prevent odr change if one is already pending */
- if (fifo && ts->new_mult != 0)
- return -EAGAIN;
-
- ts->new_mult = period / INV_ICM42600_TIMESTAMP_PERIOD;
-
- return 0;
-}
-EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_update_odr, IIO_INV_SENSORS_TIMESTAMP);
-
-static bool inv_validate_period(uint32_t period, uint32_t mult)
-{
- const uint32_t chip_period = INV_ICM42600_TIMESTAMP_PERIOD;
- uint32_t period_min, period_max;
-
- /* check that period is acceptable */
- period_min = INV_ICM42600_TIMESTAMP_MIN_PERIOD(chip_period) * mult;
- period_max = INV_ICM42600_TIMESTAMP_MAX_PERIOD(chip_period) * mult;
- if (period > period_min && period < period_max)
- return true;
- else
- return false;
-}
-
-static bool inv_compute_chip_period(struct inv_icm42600_timestamp *ts,
- uint32_t mult, uint32_t period)
-{
- uint32_t new_chip_period;
-
- if (!inv_validate_period(period, mult))
- return false;
-
- /* update chip internal period estimation */
- new_chip_period = period / mult;
- inv_update_acc(&ts->chip_period, new_chip_period);
-
- return true;
-}
-
-void inv_icm42600_timestamp_interrupt(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- size_t sensor_nb, int64_t timestamp)
-{
- struct inv_icm42600_timestamp_interval *it;
- int64_t delta, interval;
- const uint32_t fifo_mult = fifo_period / INV_ICM42600_TIMESTAMP_PERIOD;
- uint32_t period = ts->period;
- int32_t m;
- bool valid = false;
-
- if (fifo_nb == 0)
- return;
-
- /* update interrupt timestamp and compute chip and sensor periods */
- it = &ts->it;
- it->lo = it->up;
- it->up = timestamp;
- delta = it->up - it->lo;
- if (it->lo != 0) {
- /* compute period: delta time divided by number of samples */
- period = div_s64(delta, fifo_nb);
- valid = inv_compute_chip_period(ts, fifo_mult, period);
- /* update sensor period if chip internal period is updated */
- if (valid)
- ts->period = ts->mult * ts->chip_period.val;
- }
-
- /* no previous data, compute theoritical value from interrupt */
- if (ts->timestamp == 0) {
- /* elapsed time: sensor period * sensor samples number */
- interval = (int64_t)ts->period * (int64_t)sensor_nb;
- ts->timestamp = it->up - interval;
- return;
- }
-
- /* if interrupt interval is valid, sync with interrupt timestamp */
- if (valid) {
- /* compute measured fifo_period */
- fifo_period = fifo_mult * ts->chip_period.val;
- /* delta time between last sample and last interrupt */
- delta = it->lo - ts->timestamp;
- /* if there are multiple samples, go back to first one */
- while (delta >= (fifo_period * 3 / 2))
- delta -= fifo_period;
- /* compute maximal adjustment value */
- m = INV_ICM42600_TIMESTAMP_MAX_PERIOD(ts->period) - ts->period;
- if (delta > m)
- delta = m;
- else if (delta < -m)
- delta = -m;
- ts->timestamp += delta;
- }
-}
-EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_interrupt, IIO_INV_SENSORS_TIMESTAMP);
-
-void inv_icm42600_timestamp_apply_odr(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- unsigned int fifo_no)
-{
- int64_t interval;
- uint32_t fifo_mult;
-
- if (ts->new_mult == 0)
- return;
-
- /* update to new multiplier and update period */
- ts->mult = ts->new_mult;
- ts->new_mult = 0;
- ts->period = ts->mult * ts->chip_period.val;
-
- /*
- * After ODR change the time interval with the previous sample is
- * undertermined (depends when the change occures). So we compute the
- * timestamp from the current interrupt using the new FIFO period, the
- * total number of samples and the current sample numero.
- */
- if (ts->timestamp != 0) {
- /* compute measured fifo period */
- fifo_mult = fifo_period / INV_ICM42600_TIMESTAMP_PERIOD;
- fifo_period = fifo_mult * ts->chip_period.val;
- /* computes time interval between interrupt and this sample */
- interval = (int64_t)(fifo_nb - fifo_no) * (int64_t)fifo_period;
- ts->timestamp = ts->it.up - interval;
- }
-}
-EXPORT_SYMBOL_NS_GPL(inv_icm42600_timestamp_apply_odr, IIO_INV_SENSORS_TIMESTAMP);
-
-MODULE_AUTHOR("InvenSense, Inc.");
-MODULE_DESCRIPTION("InvenSense sensors timestamp module");
-MODULE_LICENSE("GPL");
--- /dev/null
+++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
@@ -0,0 +1,191 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (C) 2020 Invensense, Inc.
+ */
+
+#include <linux/errno.h>
+#include <linux/kernel.h>
+#include <linux/math64.h>
+#include <linux/module.h>
+
+#include <linux/iio/common/inv_sensors_timestamp.h>
+
+/* compute jitter, min and max following jitter in per mille */
+#define INV_SENSORS_TIMESTAMP_JITTER(_val, _jitter) \
+ (div_s64((_val) * (_jitter), 1000))
+#define INV_SENSORS_TIMESTAMP_MIN(_val, _jitter) \
+ (((_val) * (1000 - (_jitter))) / 1000)
+#define INV_SENSORS_TIMESTAMP_MAX(_val, _jitter) \
+ (((_val) * (1000 + (_jitter))) / 1000)
+
+/* Add a new value inside an accumulator and update the estimate value */
+static void inv_update_acc(struct inv_sensors_timestamp_acc *acc, uint32_t val)
+{
+ uint64_t sum = 0;
+ size_t i;
+
+ acc->values[acc->idx++] = val;
+ if (acc->idx >= ARRAY_SIZE(acc->values))
+ acc->idx = 0;
+
+ /* compute the mean of all stored values, use 0 as empty slot */
+ for (i = 0; i < ARRAY_SIZE(acc->values); ++i) {
+ if (acc->values[i] == 0)
+ break;
+ sum += acc->values[i];
+ }
+
+ acc->val = div_u64(sum, i);
+}
+
+void inv_sensors_timestamp_init(struct inv_sensors_timestamp *ts,
+ const struct inv_sensors_timestamp_chip *chip)
+{
+ memset(ts, 0, sizeof(*ts));
+
+ /* save chip parameters and compute min and max clock period */
+ ts->chip = *chip;
+ ts->min_period = INV_SENSORS_TIMESTAMP_MIN(chip->clock_period, chip->jitter);
+ ts->max_period = INV_SENSORS_TIMESTAMP_MAX(chip->clock_period, chip->jitter);
+
+ /* current multiplier and period values after reset */
+ ts->mult = chip->init_period / chip->clock_period;
+ ts->period = chip->init_period;
+
+ /* use theoretical value for chip period */
+ inv_update_acc(&ts->chip_period, chip->clock_period);
+}
+EXPORT_SYMBOL_NS_GPL(inv_sensors_timestamp_init, IIO_INV_SENSORS_TIMESTAMP);
+
+int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
+ uint32_t period, bool fifo)
+{
+ /* when FIFO is on, prevent odr change if one is already pending */
+ if (fifo && ts->new_mult != 0)
+ return -EAGAIN;
+
+ ts->new_mult = period / ts->chip.clock_period;
+
+ return 0;
+}
+EXPORT_SYMBOL_NS_GPL(inv_sensors_timestamp_update_odr, IIO_INV_SENSORS_TIMESTAMP);
+
+static bool inv_validate_period(struct inv_sensors_timestamp *ts, uint32_t period, uint32_t mult)
+{
+ uint32_t period_min, period_max;
+
+ /* check that period is acceptable */
+ period_min = ts->min_period * mult;
+ period_max = ts->max_period * mult;
+ if (period > period_min && period < period_max)
+ return true;
+ else
+ return false;
+}
+
+static bool inv_compute_chip_period(struct inv_sensors_timestamp *ts,
+ uint32_t mult, uint32_t period)
+{
+ uint32_t new_chip_period;
+
+ if (!inv_validate_period(ts, period, mult))
+ return false;
+
+ /* update chip internal period estimation */
+ new_chip_period = period / mult;
+ inv_update_acc(&ts->chip_period, new_chip_period);
+
+ return true;
+}
+
+void inv_sensors_timestamp_interrupt(struct inv_sensors_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ size_t sensor_nb, int64_t timestamp)
+{
+ struct inv_sensors_timestamp_interval *it;
+ int64_t delta, interval;
+ const uint32_t fifo_mult = fifo_period / ts->chip.clock_period;
+ uint32_t period = ts->period;
+ int32_t m;
+ bool valid = false;
+
+ if (fifo_nb == 0)
+ return;
+
+ /* update interrupt timestamp and compute chip and sensor periods */
+ it = &ts->it;
+ it->lo = it->up;
+ it->up = timestamp;
+ delta = it->up - it->lo;
+ if (it->lo != 0) {
+ /* compute period: delta time divided by number of samples */
+ period = div_s64(delta, fifo_nb);
+ valid = inv_compute_chip_period(ts, fifo_mult, period);
+ /* update sensor period if chip internal period is updated */
+ if (valid)
+ ts->period = ts->mult * ts->chip_period.val;
+ }
+
+ /* no previous data, compute theoritical value from interrupt */
+ if (ts->timestamp == 0) {
+ /* elapsed time: sensor period * sensor samples number */
+ interval = (int64_t)ts->period * (int64_t)sensor_nb;
+ ts->timestamp = it->up - interval;
+ return;
+ }
+
+ /* if interrupt interval is valid, sync with interrupt timestamp */
+ if (valid) {
+ /* compute measured fifo_period */
+ fifo_period = fifo_mult * ts->chip_period.val;
+ /* delta time between last sample and last interrupt */
+ delta = it->lo - ts->timestamp;
+ /* if there are multiple samples, go back to first one */
+ while (delta >= (fifo_period * 3 / 2))
+ delta -= fifo_period;
+ /* compute maximal adjustment value */
+ m = INV_SENSORS_TIMESTAMP_JITTER((int64_t)ts->period, ts->chip.jitter);
+ if (delta > m)
+ delta = m;
+ else if (delta < -m)
+ delta = -m;
+ ts->timestamp += delta;
+ }
+}
+EXPORT_SYMBOL_NS_GPL(inv_sensors_timestamp_interrupt, IIO_INV_SENSORS_TIMESTAMP);
+
+void inv_sensors_timestamp_apply_odr(struct inv_sensors_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ unsigned int fifo_no)
+{
+ int64_t interval;
+ uint32_t fifo_mult;
+
+ if (ts->new_mult == 0)
+ return;
+
+ /* update to new multiplier and update period */
+ ts->mult = ts->new_mult;
+ ts->new_mult = 0;
+ ts->period = ts->mult * ts->chip_period.val;
+
+ /*
+ * After ODR change the time interval with the previous sample is
+ * undertermined (depends when the change occures). So we compute the
+ * timestamp from the current interrupt using the new FIFO period, the
+ * total number of samples and the current sample numero.
+ */
+ if (ts->timestamp != 0) {
+ /* compute measured fifo period */
+ fifo_mult = fifo_period / ts->chip.clock_period;
+ fifo_period = fifo_mult * ts->chip_period.val;
+ /* computes time interval between interrupt and this sample */
+ interval = (int64_t)(fifo_nb - fifo_no) * (int64_t)fifo_period;
+ ts->timestamp = ts->it.up - interval;
+ }
+}
+EXPORT_SYMBOL_NS_GPL(inv_sensors_timestamp_apply_odr, IIO_INV_SENSORS_TIMESTAMP);
+
+MODULE_AUTHOR("InvenSense, Inc.");
+MODULE_DESCRIPTION("InvenSense sensors timestamp module");
+MODULE_LICENSE("GPL");
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -12,7 +12,7 @@
#include <linux/math64.h>
#include <linux/iio/buffer.h>
-#include <linux/iio/common/inv_icm42600_timestamp.h>
+#include <linux/iio/common/inv_sensors_timestamp.h>
#include <linux/iio/iio.h>
#include <linux/iio/kfifo_buf.h>
@@ -99,7 +99,7 @@ static int inv_icm42600_accel_update_sca
const unsigned long *scan_mask)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
unsigned int fifo_en = 0;
unsigned int sleep_temp = 0;
@@ -127,7 +127,7 @@ static int inv_icm42600_accel_update_sca
}
/* update data FIFO write */
- inv_icm42600_timestamp_apply_odr(ts, 0, 0, 0);
+ inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
out_unlock:
@@ -308,7 +308,7 @@ static int inv_icm42600_accel_write_odr(
int val, int val2)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
struct device *dev = regmap_get_device(st->map);
unsigned int idx;
struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
@@ -329,8 +329,8 @@ static int inv_icm42600_accel_write_odr(
pm_runtime_get_sync(dev);
mutex_lock(&st->lock);
- ret = inv_icm42600_timestamp_update_odr(ts, inv_icm42600_odr_to_period(conf.odr),
- iio_buffer_enabled(indio_dev));
+ ret = inv_sensors_timestamp_update_odr(ts, inv_icm42600_odr_to_period(conf.odr),
+ iio_buffer_enabled(indio_dev));
if (ret)
goto out_unlock;
@@ -706,7 +706,8 @@ struct iio_dev *inv_icm42600_accel_init(
{
struct device *dev = regmap_get_device(st->map);
const char *name;
- struct inv_icm42600_timestamp *ts;
+ struct inv_sensors_timestamp_chip ts_chip;
+ struct inv_sensors_timestamp *ts;
struct iio_dev *indio_dev;
struct iio_buffer *buffer;
int ret;
@@ -723,8 +724,15 @@ struct iio_dev *inv_icm42600_accel_init(
if (!buffer)
return ERR_PTR(-ENOMEM);
+ /*
+ * clock period is 32kHz (31250ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+ ts_chip.clock_period = 31250;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
ts = iio_priv(indio_dev);
- inv_icm42600_timestamp_init(ts, inv_icm42600_odr_to_period(st->conf.accel.odr));
+ inv_sensors_timestamp_init(ts, &ts_chip);
iio_device_set_drvdata(indio_dev, st);
indio_dev->name = name;
@@ -747,7 +755,7 @@ struct iio_dev *inv_icm42600_accel_init(
int inv_icm42600_accel_parse_fifo(struct iio_dev *indio_dev)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
ssize_t i, size;
unsigned int no;
const void *accel, *gyro, *timestamp;
@@ -771,13 +779,13 @@ int inv_icm42600_accel_parse_fifo(struct
/* update odr */
if (odr & INV_ICM42600_SENSOR_ACCEL)
- inv_icm42600_timestamp_apply_odr(ts, st->fifo.period,
- st->fifo.nb.total, no);
+ inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
+ st->fifo.nb.total, no);
memcpy(&buffer.accel, accel, sizeof(buffer.accel));
/* convert 8 bits FIFO temperature in high resolution format */
buffer.temp = temp ? (*temp * 64) : 0;
- ts_val = inv_icm42600_timestamp_pop(ts);
+ ts_val = inv_sensors_timestamp_pop(ts);
iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ts_val);
}
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -11,7 +11,7 @@
#include <linux/delay.h>
#include <linux/iio/buffer.h>
-#include <linux/iio/common/inv_icm42600_timestamp.h>
+#include <linux/iio/common/inv_sensors_timestamp.h>
#include <linux/iio/iio.h>
#include "inv_icm42600.h"
@@ -276,12 +276,12 @@ static int inv_icm42600_buffer_preenable
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
struct device *dev = regmap_get_device(st->map);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
pm_runtime_get_sync(dev);
mutex_lock(&st->lock);
- inv_icm42600_timestamp_reset(ts);
+ inv_sensors_timestamp_reset(ts);
mutex_unlock(&st->lock);
return 0;
@@ -378,7 +378,7 @@ out_unlock:
static int inv_icm42600_buffer_postdisable(struct iio_dev *indio_dev)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
struct device *dev = regmap_get_device(st->map);
unsigned int sensor;
unsigned int *watermark;
@@ -400,7 +400,7 @@ static int inv_icm42600_buffer_postdisab
mutex_lock(&st->lock);
- inv_icm42600_timestamp_apply_odr(ts, 0, 0, 0);
+ inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
ret = inv_icm42600_buffer_set_fifo_en(st, st->fifo.en & ~sensor);
if (ret)
@@ -508,7 +508,7 @@ int inv_icm42600_buffer_fifo_read(struct
int inv_icm42600_buffer_fifo_parse(struct inv_icm42600_state *st)
{
- struct inv_icm42600_timestamp *ts;
+ struct inv_sensors_timestamp *ts;
int ret;
if (st->fifo.nb.total == 0)
@@ -516,8 +516,8 @@ int inv_icm42600_buffer_fifo_parse(struc
/* handle gyroscope timestamp and FIFO data parsing */
ts = iio_priv(st->indio_gyro);
- inv_icm42600_timestamp_interrupt(ts, st->fifo.period, st->fifo.nb.total,
- st->fifo.nb.gyro, st->timestamp.gyro);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.period, st->fifo.nb.total,
+ st->fifo.nb.gyro, st->timestamp.gyro);
if (st->fifo.nb.gyro > 0) {
ret = inv_icm42600_gyro_parse_fifo(st->indio_gyro);
if (ret)
@@ -526,8 +526,8 @@ int inv_icm42600_buffer_fifo_parse(struc
/* handle accelerometer timestamp and FIFO data parsing */
ts = iio_priv(st->indio_accel);
- inv_icm42600_timestamp_interrupt(ts, st->fifo.period, st->fifo.nb.total,
- st->fifo.nb.accel, st->timestamp.accel);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.period, st->fifo.nb.total,
+ st->fifo.nb.accel, st->timestamp.accel);
if (st->fifo.nb.accel > 0) {
ret = inv_icm42600_accel_parse_fifo(st->indio_accel);
if (ret)
@@ -540,7 +540,7 @@ int inv_icm42600_buffer_fifo_parse(struc
int inv_icm42600_buffer_hwfifo_flush(struct inv_icm42600_state *st,
unsigned int count)
{
- struct inv_icm42600_timestamp *ts;
+ struct inv_sensors_timestamp *ts;
int64_t gyro_ts, accel_ts;
int ret;
@@ -556,9 +556,9 @@ int inv_icm42600_buffer_hwfifo_flush(str
if (st->fifo.nb.gyro > 0) {
ts = iio_priv(st->indio_gyro);
- inv_icm42600_timestamp_interrupt(ts, st->fifo.period,
- st->fifo.nb.total, st->fifo.nb.gyro,
- gyro_ts);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.period,
+ st->fifo.nb.total, st->fifo.nb.gyro,
+ gyro_ts);
ret = inv_icm42600_gyro_parse_fifo(st->indio_gyro);
if (ret)
return ret;
@@ -566,9 +566,9 @@ int inv_icm42600_buffer_hwfifo_flush(str
if (st->fifo.nb.accel > 0) {
ts = iio_priv(st->indio_accel);
- inv_icm42600_timestamp_interrupt(ts, st->fifo.period,
- st->fifo.nb.total, st->fifo.nb.accel,
- accel_ts);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.period,
+ st->fifo.nb.total, st->fifo.nb.accel,
+ accel_ts);
ret = inv_icm42600_accel_parse_fifo(st->indio_accel);
if (ret)
return ret;
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -16,7 +16,7 @@
#include <linux/property.h>
#include <linux/regmap.h>
-#include <linux/iio/common/inv_icm42600_timestamp.h>
+#include <linux/iio/common/inv_sensors_timestamp.h>
#include <linux/iio/iio.h>
#include "inv_icm42600.h"
@@ -720,8 +720,8 @@ out_unlock:
static int __maybe_unused inv_icm42600_resume(struct device *dev)
{
struct inv_icm42600_state *st = dev_get_drvdata(dev);
- struct inv_icm42600_timestamp *gyro_ts = iio_priv(st->indio_gyro);
- struct inv_icm42600_timestamp *accel_ts = iio_priv(st->indio_accel);
+ struct inv_sensors_timestamp *gyro_ts = iio_priv(st->indio_gyro);
+ struct inv_sensors_timestamp *accel_ts = iio_priv(st->indio_accel);
int ret = 0;
mutex_lock(&st->lock);
@@ -742,8 +742,8 @@ static int __maybe_unused inv_icm42600_r
/* restore FIFO data streaming */
if (st->fifo.on) {
- inv_icm42600_timestamp_reset(gyro_ts);
- inv_icm42600_timestamp_reset(accel_ts);
+ inv_sensors_timestamp_reset(gyro_ts);
+ inv_sensors_timestamp_reset(accel_ts);
ret = regmap_write(st->map, INV_ICM42600_REG_FIFO_CONFIG,
INV_ICM42600_FIFO_CONFIG_STREAM);
}
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -12,7 +12,7 @@
#include <linux/math64.h>
#include <linux/iio/buffer.h>
-#include <linux/iio/common/inv_icm42600_timestamp.h>
+#include <linux/iio/common/inv_sensors_timestamp.h>
#include <linux/iio/iio.h>
#include <linux/iio/kfifo_buf.h>
@@ -99,7 +99,7 @@ static int inv_icm42600_gyro_update_scan
const unsigned long *scan_mask)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
unsigned int fifo_en = 0;
unsigned int sleep_gyro = 0;
@@ -127,7 +127,7 @@ static int inv_icm42600_gyro_update_scan
}
/* update data FIFO write */
- inv_icm42600_timestamp_apply_odr(ts, 0, 0, 0);
+ inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
out_unlock:
@@ -320,7 +320,7 @@ static int inv_icm42600_gyro_write_odr(s
int val, int val2)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
struct device *dev = regmap_get_device(st->map);
unsigned int idx;
struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
@@ -341,8 +341,8 @@ static int inv_icm42600_gyro_write_odr(s
pm_runtime_get_sync(dev);
mutex_lock(&st->lock);
- ret = inv_icm42600_timestamp_update_odr(ts, inv_icm42600_odr_to_period(conf.odr),
- iio_buffer_enabled(indio_dev));
+ ret = inv_sensors_timestamp_update_odr(ts, inv_icm42600_odr_to_period(conf.odr),
+ iio_buffer_enabled(indio_dev));
if (ret)
goto out_unlock;
@@ -717,7 +717,8 @@ struct iio_dev *inv_icm42600_gyro_init(s
{
struct device *dev = regmap_get_device(st->map);
const char *name;
- struct inv_icm42600_timestamp *ts;
+ struct inv_sensors_timestamp_chip ts_chip;
+ struct inv_sensors_timestamp *ts;
struct iio_dev *indio_dev;
struct iio_buffer *buffer;
int ret;
@@ -734,8 +735,15 @@ struct iio_dev *inv_icm42600_gyro_init(s
if (!buffer)
return ERR_PTR(-ENOMEM);
+ /*
+ * clock period is 32kHz (31250ns)
+ * jitter is +/- 2% (20 per mille)
+ */
+ ts_chip.clock_period = 31250;
+ ts_chip.jitter = 20;
+ ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
ts = iio_priv(indio_dev);
- inv_icm42600_timestamp_init(ts, inv_icm42600_odr_to_period(st->conf.gyro.odr));
+ inv_sensors_timestamp_init(ts, &ts_chip);
iio_device_set_drvdata(indio_dev, st);
indio_dev->name = name;
@@ -758,7 +766,7 @@ struct iio_dev *inv_icm42600_gyro_init(s
int inv_icm42600_gyro_parse_fifo(struct iio_dev *indio_dev)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
+ struct inv_sensors_timestamp *ts = iio_priv(indio_dev);
ssize_t i, size;
unsigned int no;
const void *accel, *gyro, *timestamp;
@@ -782,13 +790,13 @@ int inv_icm42600_gyro_parse_fifo(struct
/* update odr */
if (odr & INV_ICM42600_SENSOR_GYRO)
- inv_icm42600_timestamp_apply_odr(ts, st->fifo.period,
- st->fifo.nb.total, no);
+ inv_sensors_timestamp_apply_odr(ts, st->fifo.period,
+ st->fifo.nb.total, no);
memcpy(&buffer.gyro, gyro, sizeof(buffer.gyro));
/* convert 8 bits FIFO temperature in high resolution format */
buffer.temp = temp ? (*temp * 64) : 0;
- ts_val = inv_icm42600_timestamp_pop(ts);
+ ts_val = inv_sensors_timestamp_pop(ts);
iio_push_to_buffers_with_timestamp(indio_dev, &buffer, ts_val);
}
--- a/include/linux/iio/common/inv_icm42600_timestamp.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-or-later */
-/*
- * Copyright (C) 2020 Invensense, Inc.
- */
-
-#ifndef INV_ICM42600_TIMESTAMP_H_
-#define INV_ICM42600_TIMESTAMP_H_
-
-/**
- * struct inv_icm42600_timestamp_interval - timestamps interval
- * @lo: interval lower bound
- * @up: interval upper bound
- */
-struct inv_icm42600_timestamp_interval {
- int64_t lo;
- int64_t up;
-};
-
-/**
- * struct inv_icm42600_timestamp_acc - accumulator for computing an estimation
- * @val: current estimation of the value, the mean of all values
- * @idx: current index of the next free place in values table
- * @values: table of all measured values, use for computing the mean
- */
-struct inv_icm42600_timestamp_acc {
- uint32_t val;
- size_t idx;
- uint32_t values[32];
-};
-
-/**
- * struct inv_icm42600_timestamp - timestamp management states
- * @it: interrupts interval timestamps
- * @timestamp: store last timestamp for computing next data timestamp
- * @mult: current internal period multiplier
- * @new_mult: new set internal period multiplier (not yet effective)
- * @period: measured current period of the sensor
- * @chip_period: accumulator for computing internal chip period
- */
-struct inv_icm42600_timestamp {
- struct inv_icm42600_timestamp_interval it;
- int64_t timestamp;
- uint32_t mult;
- uint32_t new_mult;
- uint32_t period;
- struct inv_icm42600_timestamp_acc chip_period;
-};
-
-void inv_icm42600_timestamp_init(struct inv_icm42600_timestamp *ts,
- uint32_t period);
-
-int inv_icm42600_timestamp_update_odr(struct inv_icm42600_timestamp *ts,
- uint32_t period, bool fifo);
-
-void inv_icm42600_timestamp_interrupt(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- size_t sensor_nb, int64_t timestamp);
-
-static inline int64_t
-inv_icm42600_timestamp_pop(struct inv_icm42600_timestamp *ts)
-{
- ts->timestamp += ts->period;
- return ts->timestamp;
-}
-
-void inv_icm42600_timestamp_apply_odr(struct inv_icm42600_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- unsigned int fifo_no);
-
-static inline void
-inv_icm42600_timestamp_reset(struct inv_icm42600_timestamp *ts)
-{
- const struct inv_icm42600_timestamp_interval interval_init = {0LL, 0LL};
-
- ts->it = interval_init;
- ts->timestamp = 0;
-}
-
-#endif
--- /dev/null
+++ b/include/linux/iio/common/inv_sensors_timestamp.h
@@ -0,0 +1,95 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Copyright (C) 2020 Invensense, Inc.
+ */
+
+#ifndef INV_SENSORS_TIMESTAMP_H_
+#define INV_SENSORS_TIMESTAMP_H_
+
+/**
+ * struct inv_sensors_timestamp_chip - chip internal properties
+ * @clock_period: internal clock period in ns
+ * @jitter: acceptable jitter in per-mille
+ * @init_period: chip initial period at reset in ns
+ */
+struct inv_sensors_timestamp_chip {
+ uint32_t clock_period;
+ uint32_t jitter;
+ uint32_t init_period;
+};
+
+/**
+ * struct inv_sensors_timestamp_interval - timestamps interval
+ * @lo: interval lower bound
+ * @up: interval upper bound
+ */
+struct inv_sensors_timestamp_interval {
+ int64_t lo;
+ int64_t up;
+};
+
+/**
+ * struct inv_sensors_timestamp_acc - accumulator for computing an estimation
+ * @val: current estimation of the value, the mean of all values
+ * @idx: current index of the next free place in values table
+ * @values: table of all measured values, use for computing the mean
+ */
+struct inv_sensors_timestamp_acc {
+ uint32_t val;
+ size_t idx;
+ uint32_t values[32];
+};
+
+/**
+ * struct inv_sensors_timestamp - timestamp management states
+ * @chip: chip internal characteristics
+ * @min_period: minimal acceptable clock period
+ * @max_period: maximal acceptable clock period
+ * @it: interrupts interval timestamps
+ * @timestamp: store last timestamp for computing next data timestamp
+ * @mult: current internal period multiplier
+ * @new_mult: new set internal period multiplier (not yet effective)
+ * @period: measured current period of the sensor
+ * @chip_period: accumulator for computing internal chip period
+ */
+struct inv_sensors_timestamp {
+ struct inv_sensors_timestamp_chip chip;
+ uint32_t min_period;
+ uint32_t max_period;
+ struct inv_sensors_timestamp_interval it;
+ int64_t timestamp;
+ uint32_t mult;
+ uint32_t new_mult;
+ uint32_t period;
+ struct inv_sensors_timestamp_acc chip_period;
+};
+
+void inv_sensors_timestamp_init(struct inv_sensors_timestamp *ts,
+ const struct inv_sensors_timestamp_chip *chip);
+
+int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
+ uint32_t period, bool fifo);
+
+void inv_sensors_timestamp_interrupt(struct inv_sensors_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ size_t sensor_nb, int64_t timestamp);
+
+static inline int64_t inv_sensors_timestamp_pop(struct inv_sensors_timestamp *ts)
+{
+ ts->timestamp += ts->period;
+ return ts->timestamp;
+}
+
+void inv_sensors_timestamp_apply_odr(struct inv_sensors_timestamp *ts,
+ uint32_t fifo_period, size_t fifo_nb,
+ unsigned int fifo_no);
+
+static inline void inv_sensors_timestamp_reset(struct inv_sensors_timestamp *ts)
+{
+ const struct inv_sensors_timestamp_interval interval_init = {0LL, 0LL};
+
+ ts->it = interval_init;
+ ts->timestamp = 0;
+}
+
+#endif
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 587/699] iio: imu: inv_mpu6050: use the common inv_sensors timestamp module
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (585 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 586/699] iio: make invensense timestamp module generic Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 588/699] iio: invensense: remove redundant initialization of variable period Greg Kroah-Hartman
` (115 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit 111e1abd00455971f6a568900f033cbddec9d4e5 ]
Replace timestamping by the new common inv_sensors timestamp
module. The principle behind is the same but the implementation in
the new module is far better providing less jitter and a better
estimation.
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Link: https://lore.kernel.org/r/20230606162147.79667-5-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_mpu6050/Kconfig | 1
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 30 +++++++--
drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h | 18 ++---
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 83 ++------------------------
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 6 +
5 files changed, 45 insertions(+), 93 deletions(-)
--- a/drivers/iio/imu/inv_mpu6050/Kconfig
+++ b/drivers/iio/imu/inv_mpu6050/Kconfig
@@ -7,6 +7,7 @@ config INV_MPU6050_IIO
tristate
select IIO_BUFFER
select IIO_TRIGGERED_BUFFER
+ select IIO_INV_SENSORS_TIMESTAMP
config INV_MPU6050_I2C
tristate "Invensense MPU6050 devices (I2C)"
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -12,12 +12,15 @@
#include <linux/jiffies.h>
#include <linux/irq.h>
#include <linux/interrupt.h>
-#include <linux/iio/iio.h>
#include <linux/acpi.h>
#include <linux/platform_device.h>
#include <linux/regulator/consumer.h>
#include <linux/pm.h>
#include <linux/pm_runtime.h>
+
+#include <linux/iio/common/inv_sensors_timestamp.h>
+#include <linux/iio/iio.h>
+
#include "inv_mpu_iio.h"
#include "inv_mpu_magn.h"
@@ -481,6 +484,7 @@ static int inv_mpu6050_init_config(struc
int result;
u8 d;
struct inv_mpu6050_state *st = iio_priv(indio_dev);
+ struct inv_sensors_timestamp_chip timestamp;
result = inv_mpu6050_set_gyro_fsr(st, st->chip_config.fsr);
if (result)
@@ -504,12 +508,12 @@ static int inv_mpu6050_init_config(struc
if (result)
return result;
- /*
- * Internal chip period is 1ms (1kHz).
- * Let's use at the beginning the theorical value before measuring
- * with interrupt timestamps.
- */
- st->chip_period = NSEC_PER_MSEC;
+ /* clock jitter is +/- 2% */
+ timestamp.clock_period = NSEC_PER_SEC / INV_MPU6050_INTERNAL_FREQ_HZ;
+ timestamp.jitter = 20;
+ timestamp.init_period =
+ NSEC_PER_SEC / INV_MPU6050_DIVIDER_TO_FIFO_RATE(st->chip_config.divider);
+ inv_sensors_timestamp_init(&st->timestamp, ×tamp);
/* magn chip init, noop if not present in the chip */
result = inv_mpu_magn_probe(st);
@@ -900,6 +904,8 @@ inv_mpu6050_fifo_rate_store(struct devic
const char *buf, size_t count)
{
int fifo_rate;
+ u32 fifo_period;
+ bool fifo_on;
u8 d;
int result;
struct iio_dev *indio_dev = dev_to_iio_dev(dev);
@@ -916,12 +922,21 @@ inv_mpu6050_fifo_rate_store(struct devic
d = INV_MPU6050_FIFO_RATE_TO_DIVIDER(fifo_rate);
/* compute back the fifo rate to handle truncation cases */
fifo_rate = INV_MPU6050_DIVIDER_TO_FIFO_RATE(d);
+ fifo_period = NSEC_PER_SEC / fifo_rate;
mutex_lock(&st->lock);
if (d == st->chip_config.divider) {
result = 0;
goto fifo_rate_fail_unlock;
}
+
+ fifo_on = st->chip_config.accl_fifo_enable ||
+ st->chip_config.gyro_fifo_enable ||
+ st->chip_config.magn_fifo_enable;
+ result = inv_sensors_timestamp_update_odr(&st->timestamp, fifo_period, fifo_on);
+ if (result)
+ goto fifo_rate_fail_unlock;
+
result = pm_runtime_get_sync(pdev);
if (result < 0) {
pm_runtime_put_noidle(pdev);
@@ -1741,3 +1756,4 @@ EXPORT_SYMBOL_GPL(inv_mpu_pmops);
MODULE_AUTHOR("Invensense Corporation");
MODULE_DESCRIPTION("Invensense device MPU6050 driver");
MODULE_LICENSE("GPL");
+MODULE_IMPORT_NS(IIO_INV_SENSORS_TIMESTAMP);
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_iio.h
@@ -9,15 +9,17 @@
#include <linux/i2c.h>
#include <linux/i2c-mux.h>
#include <linux/mutex.h>
-#include <linux/iio/iio.h>
-#include <linux/iio/buffer.h>
+#include <linux/platform_data/invensense_mpu6050.h>
#include <linux/regmap.h>
-#include <linux/iio/sysfs.h>
+
+#include <linux/iio/buffer.h>
+#include <linux/iio/common/inv_sensors_timestamp.h>
+#include <linux/iio/iio.h>
#include <linux/iio/kfifo_buf.h>
#include <linux/iio/trigger.h>
#include <linux/iio/triggered_buffer.h>
#include <linux/iio/trigger_consumer.h>
-#include <linux/platform_data/invensense_mpu6050.h>
+#include <linux/iio/sysfs.h>
/**
* struct inv_mpu6050_reg_map - Notable registers.
@@ -163,9 +165,7 @@ struct inv_mpu6050_hw {
* @map regmap pointer.
* @irq interrupt number.
* @irq_mask the int_pin_cfg mask to configure interrupt type.
- * @chip_period: chip internal period estimation (~1kHz).
- * @it_timestamp: timestamp from previous interrupt.
- * @data_timestamp: timestamp for next data sample.
+ * @timestamp: timestamping module
* @vdd_supply: VDD voltage regulator for the chip.
* @vddio_supply I/O voltage regulator for the chip.
* @magn_disabled: magnetometer disabled for backward compatibility reason.
@@ -189,9 +189,7 @@ struct inv_mpu6050_state {
int irq;
u8 irq_mask;
unsigned skip_samples;
- s64 chip_period;
- s64 it_timestamp;
- s64 data_timestamp;
+ struct inv_sensors_timestamp timestamp;
struct regulator *vdd_supply;
struct regulator *vddio_supply;
bool magn_disabled;
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@@ -13,81 +13,10 @@
#include <linux/interrupt.h>
#include <linux/poll.h>
#include <linux/math64.h>
-#include "inv_mpu_iio.h"
-
-/**
- * inv_mpu6050_update_period() - Update chip internal period estimation
- *
- * @st: driver state
- * @timestamp: the interrupt timestamp
- * @nb: number of data set in the fifo
- *
- * This function uses interrupt timestamps to estimate the chip period and
- * to choose the data timestamp to come.
- */
-static void inv_mpu6050_update_period(struct inv_mpu6050_state *st,
- s64 timestamp, size_t nb)
-{
- /* Period boundaries for accepting timestamp */
- const s64 period_min =
- (NSEC_PER_MSEC * (100 - INV_MPU6050_TS_PERIOD_JITTER)) / 100;
- const s64 period_max =
- (NSEC_PER_MSEC * (100 + INV_MPU6050_TS_PERIOD_JITTER)) / 100;
- const s32 divider = INV_MPU6050_FREQ_DIVIDER(st);
- s64 delta, interval;
- bool use_it_timestamp = false;
-
- if (st->it_timestamp == 0) {
- /* not initialized, forced to use it_timestamp */
- use_it_timestamp = true;
- } else if (nb == 1) {
- /*
- * Validate the use of it timestamp by checking if interrupt
- * has been delayed.
- * nb > 1 means interrupt was delayed for more than 1 sample,
- * so it's obviously not good.
- * Compute the chip period between 2 interrupts for validating.
- */
- delta = div_s64(timestamp - st->it_timestamp, divider);
- if (delta > period_min && delta < period_max) {
- /* update chip period and use it timestamp */
- st->chip_period = (st->chip_period + delta) / 2;
- use_it_timestamp = true;
- }
- }
- if (use_it_timestamp) {
- /*
- * Manage case of multiple samples in the fifo (nb > 1):
- * compute timestamp corresponding to the first sample using
- * estimated chip period.
- */
- interval = (nb - 1) * st->chip_period * divider;
- st->data_timestamp = timestamp - interval;
- }
+#include <linux/iio/common/inv_sensors_timestamp.h>
- /* save it timestamp */
- st->it_timestamp = timestamp;
-}
-
-/**
- * inv_mpu6050_get_timestamp() - Return the current data timestamp
- *
- * @st: driver state
- * @return: current data timestamp
- *
- * This function returns the current data timestamp and prepares for next one.
- */
-static s64 inv_mpu6050_get_timestamp(struct inv_mpu6050_state *st)
-{
- s64 ts;
-
- /* return current data timestamp and increment */
- ts = st->data_timestamp;
- st->data_timestamp += st->chip_period * INV_MPU6050_FREQ_DIVIDER(st);
-
- return ts;
-}
+#include "inv_mpu_iio.h"
static int inv_reset_fifo(struct iio_dev *indio_dev)
{
@@ -121,6 +50,7 @@ irqreturn_t inv_mpu6050_read_fifo(int ir
size_t bytes_per_datum;
int result;
u16 fifo_count;
+ u32 fifo_period;
s64 timestamp;
int int_status;
size_t i, nb;
@@ -177,7 +107,10 @@ irqreturn_t inv_mpu6050_read_fifo(int ir
/* compute and process all complete datum */
nb = fifo_count / bytes_per_datum;
- inv_mpu6050_update_period(st, pf->timestamp, nb);
+ /* Each FIFO data contains all sensors, so same number for FIFO and sensor data */
+ fifo_period = NSEC_PER_SEC / INV_MPU6050_DIVIDER_TO_FIFO_RATE(st->chip_config.divider);
+ inv_sensors_timestamp_interrupt(&st->timestamp, fifo_period, nb, nb, pf->timestamp);
+ inv_sensors_timestamp_apply_odr(&st->timestamp, fifo_period, nb, 0);
for (i = 0; i < nb; ++i) {
result = regmap_noinc_read(st->map, st->reg->fifo_r_w,
st->data, bytes_per_datum);
@@ -188,7 +121,7 @@ irqreturn_t inv_mpu6050_read_fifo(int ir
st->skip_samples--;
continue;
}
- timestamp = inv_mpu6050_get_timestamp(st);
+ timestamp = inv_sensors_timestamp_pop(&st->timestamp);
iio_push_to_buffers_with_timestamp(indio_dev, st->data, timestamp);
}
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
@@ -4,6 +4,9 @@
*/
#include <linux/pm_runtime.h>
+
+#include <linux/iio/common/inv_sensors_timestamp.h>
+
#include "inv_mpu_iio.h"
static unsigned int inv_scan_query_mpu6050(struct iio_dev *indio_dev)
@@ -107,7 +110,8 @@ int inv_mpu6050_prepare_fifo(struct inv_
int ret;
if (enable) {
- st->it_timestamp = 0;
+ /* reset timestamping */
+ inv_sensors_timestamp_reset(&st->timestamp);
/* reset FIFO */
d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
ret = regmap_write(st->map, st->reg->user_ctrl, d);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 588/699] iio: invensense: remove redundant initialization of variable period
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (586 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 587/699] iio: imu: inv_mpu6050: use the common inv_sensors timestamp module Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 589/699] iio: invensense: fix timestamp glitches when switching frequency Greg Kroah-Hartman
` (114 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King,
Jean-Baptiste Maneyrol, Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit b58b13f156c00c2457035b7071eaaac105fe6836 ]
The variable period is being initialized with a value that is never
read, it is being re-assigned a new value later on before it is read.
The initialization is redundant and can be removed.
Cleans up clang scan build warning:
Value stored to 'period' during its initialization is never
read [deadcode.DeadStores]
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Acked-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Link: https://lore.kernel.org/r/20240106153202.54861-1-colin.i.king@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
@@ -105,7 +105,7 @@ void inv_sensors_timestamp_interrupt(str
struct inv_sensors_timestamp_interval *it;
int64_t delta, interval;
const uint32_t fifo_mult = fifo_period / ts->chip.clock_period;
- uint32_t period = ts->period;
+ uint32_t period;
int32_t m;
bool valid = false;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 589/699] iio: invensense: fix timestamp glitches when switching frequency
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (587 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 588/699] iio: invensense: remove redundant initialization of variable period Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 590/699] iio: imu: inv_icm42600: stabilized timestamp in interrupt Greg Kroah-Hartman
` (113 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stable, Jean-Baptiste Maneyrol,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit bf8367b00c33c64a9391c262bb2e11d274c9f2a4 ]
When a sensor is running and there is a FIFO frequency change due to
another sensor turned on/off, there are glitches on timestamp. Fix that
by using only interrupt timestamp when there is the corresponding sensor
data in the FIFO.
Delete FIFO period handling and simplify internal functions.
Update integration inside inv_mpu6050 and inv_icm42600 drivers.
Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
Cc: Stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Link: https://lore.kernel.org/r/20240426094835.138389-1-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 30 +++++++----------
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 20 ++++-------
drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c | 2 -
include/linux/iio/common/inv_sensors_timestamp.h | 3 -
4 files changed, 23 insertions(+), 32 deletions(-)
--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
@@ -70,13 +70,13 @@ int inv_sensors_timestamp_update_odr(str
}
EXPORT_SYMBOL_NS_GPL(inv_sensors_timestamp_update_odr, IIO_INV_SENSORS_TIMESTAMP);
-static bool inv_validate_period(struct inv_sensors_timestamp *ts, uint32_t period, uint32_t mult)
+static bool inv_validate_period(struct inv_sensors_timestamp *ts, uint32_t period)
{
uint32_t period_min, period_max;
/* check that period is acceptable */
- period_min = ts->min_period * mult;
- period_max = ts->max_period * mult;
+ period_min = ts->min_period * ts->mult;
+ period_max = ts->max_period * ts->mult;
if (period > period_min && period < period_max)
return true;
else
@@ -84,32 +84,30 @@ static bool inv_validate_period(struct i
}
static bool inv_compute_chip_period(struct inv_sensors_timestamp *ts,
- uint32_t mult, uint32_t period)
+ uint32_t period)
{
uint32_t new_chip_period;
- if (!inv_validate_period(ts, period, mult))
+ if (!inv_validate_period(ts, period))
return false;
/* update chip internal period estimation */
- new_chip_period = period / mult;
+ new_chip_period = period / ts->mult;
inv_update_acc(&ts->chip_period, new_chip_period);
return true;
}
void inv_sensors_timestamp_interrupt(struct inv_sensors_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- size_t sensor_nb, int64_t timestamp)
+ size_t sample_nb, int64_t timestamp)
{
struct inv_sensors_timestamp_interval *it;
int64_t delta, interval;
- const uint32_t fifo_mult = fifo_period / ts->chip.clock_period;
uint32_t period;
int32_t m;
bool valid = false;
- if (fifo_nb == 0)
+ if (sample_nb == 0)
return;
/* update interrupt timestamp and compute chip and sensor periods */
@@ -119,8 +117,8 @@ void inv_sensors_timestamp_interrupt(str
delta = it->up - it->lo;
if (it->lo != 0) {
/* compute period: delta time divided by number of samples */
- period = div_s64(delta, fifo_nb);
- valid = inv_compute_chip_period(ts, fifo_mult, period);
+ period = div_s64(delta, sample_nb);
+ valid = inv_compute_chip_period(ts, period);
/* update sensor period if chip internal period is updated */
if (valid)
ts->period = ts->mult * ts->chip_period.val;
@@ -129,20 +127,18 @@ void inv_sensors_timestamp_interrupt(str
/* no previous data, compute theoritical value from interrupt */
if (ts->timestamp == 0) {
/* elapsed time: sensor period * sensor samples number */
- interval = (int64_t)ts->period * (int64_t)sensor_nb;
+ interval = (int64_t)ts->period * (int64_t)sample_nb;
ts->timestamp = it->up - interval;
return;
}
/* if interrupt interval is valid, sync with interrupt timestamp */
if (valid) {
- /* compute measured fifo_period */
- fifo_period = fifo_mult * ts->chip_period.val;
/* delta time between last sample and last interrupt */
delta = it->lo - ts->timestamp;
/* if there are multiple samples, go back to first one */
- while (delta >= (fifo_period * 3 / 2))
- delta -= fifo_period;
+ while (delta >= (ts->period * 3 / 2))
+ delta -= ts->period;
/* compute maximal adjustment value */
m = INV_SENSORS_TIMESTAMP_JITTER((int64_t)ts->period, ts->chip.jitter);
if (delta > m)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -515,20 +515,20 @@ int inv_icm42600_buffer_fifo_parse(struc
return 0;
/* handle gyroscope timestamp and FIFO data parsing */
- ts = iio_priv(st->indio_gyro);
- inv_sensors_timestamp_interrupt(ts, st->fifo.period, st->fifo.nb.total,
- st->fifo.nb.gyro, st->timestamp.gyro);
if (st->fifo.nb.gyro > 0) {
+ ts = iio_priv(st->indio_gyro);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.nb.gyro,
+ st->timestamp.gyro);
ret = inv_icm42600_gyro_parse_fifo(st->indio_gyro);
if (ret)
return ret;
}
/* handle accelerometer timestamp and FIFO data parsing */
- ts = iio_priv(st->indio_accel);
- inv_sensors_timestamp_interrupt(ts, st->fifo.period, st->fifo.nb.total,
- st->fifo.nb.accel, st->timestamp.accel);
if (st->fifo.nb.accel > 0) {
+ ts = iio_priv(st->indio_accel);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.nb.accel,
+ st->timestamp.accel);
ret = inv_icm42600_accel_parse_fifo(st->indio_accel);
if (ret)
return ret;
@@ -556,9 +556,7 @@ int inv_icm42600_buffer_hwfifo_flush(str
if (st->fifo.nb.gyro > 0) {
ts = iio_priv(st->indio_gyro);
- inv_sensors_timestamp_interrupt(ts, st->fifo.period,
- st->fifo.nb.total, st->fifo.nb.gyro,
- gyro_ts);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.nb.gyro, gyro_ts);
ret = inv_icm42600_gyro_parse_fifo(st->indio_gyro);
if (ret)
return ret;
@@ -566,9 +564,7 @@ int inv_icm42600_buffer_hwfifo_flush(str
if (st->fifo.nb.accel > 0) {
ts = iio_priv(st->indio_accel);
- inv_sensors_timestamp_interrupt(ts, st->fifo.period,
- st->fifo.nb.total, st->fifo.nb.accel,
- accel_ts);
+ inv_sensors_timestamp_interrupt(ts, st->fifo.nb.accel, accel_ts);
ret = inv_icm42600_accel_parse_fifo(st->indio_accel);
if (ret)
return ret;
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
@@ -109,7 +109,7 @@ irqreturn_t inv_mpu6050_read_fifo(int ir
nb = fifo_count / bytes_per_datum;
/* Each FIFO data contains all sensors, so same number for FIFO and sensor data */
fifo_period = NSEC_PER_SEC / INV_MPU6050_DIVIDER_TO_FIFO_RATE(st->chip_config.divider);
- inv_sensors_timestamp_interrupt(&st->timestamp, fifo_period, nb, nb, pf->timestamp);
+ inv_sensors_timestamp_interrupt(&st->timestamp, nb, pf->timestamp);
inv_sensors_timestamp_apply_odr(&st->timestamp, fifo_period, nb, 0);
for (i = 0; i < nb; ++i) {
result = regmap_noinc_read(st->map, st->reg->fifo_r_w,
--- a/include/linux/iio/common/inv_sensors_timestamp.h
+++ b/include/linux/iio/common/inv_sensors_timestamp.h
@@ -71,8 +71,7 @@ int inv_sensors_timestamp_update_odr(str
uint32_t period, bool fifo);
void inv_sensors_timestamp_interrupt(struct inv_sensors_timestamp *ts,
- uint32_t fifo_period, size_t fifo_nb,
- size_t sensor_nb, int64_t timestamp);
+ size_t sample_nb, int64_t timestamp);
static inline int64_t inv_sensors_timestamp_pop(struct inv_sensors_timestamp *ts)
{
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 590/699] iio: imu: inv_icm42600: stabilized timestamp in interrupt
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (588 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 589/699] iio: invensense: fix timestamp glitches when switching frequency Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 591/699] iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Greg Kroah-Hartman
` (112 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit d7bd473632d07f8a54655c270c0940cc3671c548 ]
Use IRQF_ONESHOT flag to ensure the timestamp is not updated in the
hard handler during the thread handler. And compute and use the
effective watermark value that correspond to this first timestamp.
This way we can ensure the timestamp is always corresponding to the
value used by the timestamping mechanism. Otherwise, it is possible
that between FIFO count read and FIFO processing the timestamp is
overwritten in the hard handler.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Link: https://lore.kernel.org/r/20240529154717.651863-1-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: affe3f077d7a ("iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 19 +++++++++++++++++--
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 2 ++
drivers/iio/imu/inv_icm42600/inv_icm42600_core.c | 1 +
3 files changed, 20 insertions(+), 2 deletions(-)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -222,10 +222,15 @@ int inv_icm42600_buffer_update_watermark
latency_accel = period_accel * wm_accel;
/* 0 value for watermark means that the sensor is turned off */
+ if (wm_gyro == 0 && wm_accel == 0)
+ return 0;
+
if (latency_gyro == 0) {
watermark = wm_accel;
+ st->fifo.watermark.eff_accel = wm_accel;
} else if (latency_accel == 0) {
watermark = wm_gyro;
+ st->fifo.watermark.eff_gyro = wm_gyro;
} else {
/* compute the smallest latency that is a multiple of both */
if (latency_gyro <= latency_accel)
@@ -241,6 +246,13 @@ int inv_icm42600_buffer_update_watermark
watermark = latency / period;
if (watermark < 1)
watermark = 1;
+ /* update effective watermark */
+ st->fifo.watermark.eff_gyro = latency / period_gyro;
+ if (st->fifo.watermark.eff_gyro < 1)
+ st->fifo.watermark.eff_gyro = 1;
+ st->fifo.watermark.eff_accel = latency / period_accel;
+ if (st->fifo.watermark.eff_accel < 1)
+ st->fifo.watermark.eff_accel = 1;
}
/* compute watermark value in bytes */
@@ -517,7 +529,7 @@ int inv_icm42600_buffer_fifo_parse(struc
/* handle gyroscope timestamp and FIFO data parsing */
if (st->fifo.nb.gyro > 0) {
ts = iio_priv(st->indio_gyro);
- inv_sensors_timestamp_interrupt(ts, st->fifo.nb.gyro,
+ inv_sensors_timestamp_interrupt(ts, st->fifo.watermark.eff_gyro,
st->timestamp.gyro);
ret = inv_icm42600_gyro_parse_fifo(st->indio_gyro);
if (ret)
@@ -527,7 +539,7 @@ int inv_icm42600_buffer_fifo_parse(struc
/* handle accelerometer timestamp and FIFO data parsing */
if (st->fifo.nb.accel > 0) {
ts = iio_priv(st->indio_accel);
- inv_sensors_timestamp_interrupt(ts, st->fifo.nb.accel,
+ inv_sensors_timestamp_interrupt(ts, st->fifo.watermark.eff_accel,
st->timestamp.accel);
ret = inv_icm42600_accel_parse_fifo(st->indio_accel);
if (ret)
@@ -578,6 +590,9 @@ int inv_icm42600_buffer_init(struct inv_
unsigned int val;
int ret;
+ st->fifo.watermark.eff_gyro = 1;
+ st->fifo.watermark.eff_accel = 1;
+
/*
* Default FIFO configuration (bits 7 to 5)
* - use invalid value
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h
@@ -32,6 +32,8 @@ struct inv_icm42600_fifo {
struct {
unsigned int gyro;
unsigned int accel;
+ unsigned int eff_gyro;
+ unsigned int eff_accel;
} watermark;
size_t count;
struct {
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_core.c
@@ -518,6 +518,7 @@ static int inv_icm42600_irq_init(struct
if (ret)
return ret;
+ irq_type |= IRQF_ONESHOT;
return devm_request_threaded_irq(dev, irq, inv_icm42600_irq_timestamp,
inv_icm42600_irq_handler, irq_type,
"inv_icm42600", st);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 591/699] iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (589 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 590/699] iio: imu: inv_icm42600: stabilized timestamp in interrupt Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 592/699] bitops: make BYTES_TO_BITS() treewide-available Greg Kroah-Hartman
` (111 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
[ Upstream commit affe3f077d7a4eeb25937f5323ff059a54b4712c ]
Timestamps are made by measuring the chip clock using the watermark
interrupts. If we read more than watermark samples as done today, we
are reducing the period between interrupts and distort the time
measurement. Fix that by reading only watermark samples in the
interrupt case.
Fixes: 7f85e42a6c54 ("iio: imu: inv_icm42600: add buffer support in iio devices")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 9 +++++----
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h | 1 +
2 files changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -257,6 +257,7 @@ int inv_icm42600_buffer_update_watermark
/* compute watermark value in bytes */
wm_size = watermark * packet_size;
+ st->fifo.watermark.value = watermark;
/* changing FIFO watermark requires to turn off watermark interrupt */
ret = regmap_update_bits_check(st->map, INV_ICM42600_REG_INT_SOURCE0,
@@ -476,11 +477,10 @@ int inv_icm42600_buffer_fifo_read(struct
st->fifo.nb.accel = 0;
st->fifo.nb.total = 0;
- /* compute maximum FIFO read size */
+ /* compute maximum FIFO read size (watermark for max = 0 interrupt case) */
if (max == 0)
- max_count = sizeof(st->fifo.data);
- else
- max_count = max * inv_icm42600_get_packet_size(st->fifo.en);
+ max = st->fifo.watermark.value;
+ max_count = max * inv_icm42600_get_packet_size(st->fifo.en);
/* read FIFO count value */
raw_fifo_count = (__be16 *)st->buffer;
@@ -592,6 +592,7 @@ int inv_icm42600_buffer_init(struct inv_
st->fifo.watermark.eff_gyro = 1;
st->fifo.watermark.eff_accel = 1;
+ st->fifo.watermark.value = 1;
/*
* Default FIFO configuration (bits 7 to 5)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.h
@@ -34,6 +34,7 @@ struct inv_icm42600_fifo {
unsigned int accel;
unsigned int eff_gyro;
unsigned int eff_accel;
+ unsigned int value;
} watermark;
size_t count;
struct {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 592/699] bitops: make BYTES_TO_BITS() treewide-available
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (590 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 591/699] iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 593/699] iio: common: st_sensors: honour channel endianness in read_axis_data Greg Kroah-Hartman
` (110 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Przemek Kitszel,
Yury Norov, Alexander Lobakin, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Lobakin <aleksander.lobakin@intel.com>
[ Upstream commit 7d8296b250f2eed73f1758607926d4d258dea5d4 ]
Avoid open-coding that simple expression each time by moving
BYTES_TO_BITS() from the probes code to <linux/bitops.h> to export
it to the rest of the kernel.
Simplify the macro while at it. `BITS_PER_LONG / sizeof(long)` always
equals to %BITS_PER_BYTE, regardless of the target architecture.
Do the same for the tools ecosystem as well (incl. its version of
bitops.h). The previous implementation had its implicit type of long,
while the new one is int, so adjust the format literal accordingly in
the perf code.
Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Acked-by: Yury Norov <yury.norov@gmail.com>
Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 55052184ac90 ("iio: common: st_sensors: honour channel endianness in read_axis_data")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bitops.h | 2 ++
kernel/trace/trace_probe.c | 2 --
tools/include/linux/bitops.h | 2 ++
tools/perf/util/probe-finder.c | 4 +---
4 files changed, 5 insertions(+), 5 deletions(-)
--- a/include/linux/bitops.h
+++ b/include/linux/bitops.h
@@ -17,6 +17,8 @@
#define BITS_TO_U32(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(u32))
#define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char))
+#define BYTES_TO_BITS(nb) ((nb) * BITS_PER_BYTE)
+
extern unsigned int __sw_hweight8(unsigned int w);
extern unsigned int __sw_hweight16(unsigned int w);
extern unsigned int __sw_hweight32(unsigned int w);
--- a/kernel/trace/trace_probe.c
+++ b/kernel/trace/trace_probe.c
@@ -503,8 +503,6 @@ parse_probe_arg(char *arg, const struct
return ret;
}
-#define BYTES_TO_BITS(nb) ((BITS_PER_LONG * (nb)) / sizeof(long))
-
/* Bitfield type needs to be parsed into a fetch function */
static int __parse_bitfield_probe_arg(const char *bf,
const struct fetch_type *t,
--- a/tools/include/linux/bitops.h
+++ b/tools/include/linux/bitops.h
@@ -20,6 +20,8 @@
#define BITS_TO_U32(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(u32))
#define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char))
+#define BYTES_TO_BITS(nb) ((nb) * BITS_PER_BYTE)
+
extern unsigned int __sw_hweight8(unsigned int w);
extern unsigned int __sw_hweight16(unsigned int w);
extern unsigned int __sw_hweight32(unsigned int w);
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -299,8 +299,6 @@ static_var:
return ret2;
}
-#define BYTES_TO_BITS(nb) ((nb) * BITS_PER_LONG / sizeof(long))
-
static int convert_variable_type(Dwarf_Die *vr_die,
struct probe_trace_arg *tvar,
const char *cast, bool user_access)
@@ -330,7 +328,7 @@ static int convert_variable_type(Dwarf_D
total = dwarf_bytesize(vr_die);
if (boffs < 0 || total < 0)
return -ENOENT;
- ret = snprintf(buf, 16, "b%d@%d/%zd", bsize, boffs,
+ ret = snprintf(buf, 16, "b%d@%d/%d", bsize, boffs,
BYTES_TO_BITS(total));
goto formatted;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 593/699] iio: common: st_sensors: honour channel endianness in read_axis_data
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (591 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 592/699] bitops: make BYTES_TO_BITS() treewide-available Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 594/699] ALSA: aoa: check snd_ctl_new1() return value Greg Kroah-Hartman
` (109 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herman van Hazendonk,
Andy Shevchenko, Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herman van Hazendonk <github.com@herrie.org>
[ Upstream commit 55052184ac9011db2ea983e54d6c21f0b1079a12 ]
st_sensors_read_axis_data() unconditionally decoded multi-byte
results with get_unaligned_le16() / get_unaligned_le24() regardless
of the channel's declared scan_type.endianness.
For every ST sensor that has used this helper since it was introduced
this happened to be fine because the ST IMU/accel/gyro/pressure
families publish their data registers as little-endian and the
channel specs in those drivers declare IIO_LE accordingly.
The LSM303DLH magnetometer however publishes its X/Y/Z output as a
pair of big-endian bytes (the H register sits at the lower address,
0x03/0x05/0x07, and the L register immediately after), and its
channel specs in st_magn_core.c correctly declare IIO_BE -- but
read_axis_data() ignored that and decoded as little-endian, swapping
the high and low bytes of every magnetometer sample. The LSM303DLHC
and LSM303DLM share the same st_magn_16bit_channels (IIO_BE) and
were therefore byte-swapped by the same bug; users of those parts
will see different in_magn_*_raw values after this fix lands.
The bug is most visible on a stationary chip: in earth's field the
true X reading is small and the high byte sits at 0x00, so swapping
the bytes pins sysfs X at exactly the low byte's pattern (e.g. 0x00F0
= 240). Y and Z still appear "to vary" because their magnitudes are
larger and the noise in the low byte produces big swings in the
swapped high byte:
before (LSM303DLH flat, sysfs in_magn_*_raw):
X=240 (stuck), Y= 12032..23296, Z=-16128..-9728
after (direct i2c-dev big-endian decode, same chip same orientation):
X≈-4096, Y≈210, Z≈80 (sensible values reflecting earth's
ambient field at low gauss range)
Fix read_axis_data() to dispatch on ch->scan_type.endianness and
call get_unaligned_be16() / get_unaligned_be24() when the channel
declares IIO_BE. Existing IIO_LE consumers (st_accel, st_gyro,
st_pressure, st_lsm6dsx and others) are unaffected because their
channel specs already declare IIO_LE and the LE path is unchanged.
While restructuring the branches, replace the previously implicit
silent-success-with-uninitialised-*data fall-through for
byte_for_channel outside 1..3 with an explicit return -EINVAL. No
in-tree ST sensor publishes such a channel, but the new behaviour
is strictly safer than handing userspace garbage.
Fixes: 23491b513bcd ("iio:common: Add STMicroelectronics common library")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7 sparse smatch clang-analyzer coccinelle checkpatch
Assisted-by: Sashiko:claude-opus-4-7
Signed-off-by: Herman van Hazendonk <github.com@herrie.org>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/st_sensors/st_sensors_core.c | 23 +++++++++++++++++------
1 file changed, 17 insertions(+), 6 deletions(-)
--- a/drivers/iio/common/st_sensors/st_sensors_core.c
+++ b/drivers/iio/common/st_sensors/st_sensors_core.c
@@ -527,6 +527,7 @@ static int st_sensors_read_axis_data(str
u8 *outdata;
struct st_sensor_data *sdata = iio_priv(indio_dev);
unsigned int byte_for_channel;
+ u32 tmp;
byte_for_channel = DIV_ROUND_UP(ch->scan_type.realbits +
ch->scan_type.shift, 8);
@@ -539,12 +540,22 @@ static int st_sensors_read_axis_data(str
if (err < 0)
goto st_sensors_free_memory;
- if (byte_for_channel == 1)
- *data = (s8)*outdata;
- else if (byte_for_channel == 2)
- *data = (s16)get_unaligned_le16(outdata);
- else if (byte_for_channel == 3)
- *data = (s32)sign_extend32(get_unaligned_le24(outdata), 23);
+ if (byte_for_channel == 1) {
+ tmp = *outdata;
+ } else if (byte_for_channel == 2) {
+ if (ch->scan_type.endianness == IIO_BE)
+ tmp = get_unaligned_be16(outdata);
+ else
+ tmp = get_unaligned_le16(outdata);
+ } else if (byte_for_channel == 3) {
+ if (ch->scan_type.endianness == IIO_BE)
+ tmp = get_unaligned_be24(outdata);
+ else
+ tmp = get_unaligned_le24(outdata);
+ } else {
+ return -EINVAL;
+ }
+ *data = sign_extend32(tmp, BYTES_TO_BITS(byte_for_channel) - 1);
st_sensors_free_memory:
kfree(outdata);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 594/699] ALSA: aoa: check snd_ctl_new1() return value
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (592 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 593/699] iio: common: st_sensors: honour channel endianness in read_axis_data Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 595/699] Bluetooth: btintel: Fix offset calculation boot address parameter Greg Kroah-Hartman
` (108 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhao Dongdong, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Dongdong <zhaodongdong@kylinos.cn>
[ Upstream commit 8df560fefe6fed6a20b7e06720eeaeccec349ac0 ]
snd_ctl_new1() can return NULL when memory allocation fails. In
layout.c, the function does not check the return value before
dereferencing ctl->id.name or passing to aoa_snd_ctl_add(), which can
lead to a NULL pointer dereference.
Add NULL checks after snd_ctl_new1() calls and return early if any
fails.
Assisted-by: Opencode:DeepSeek-V4-Flash
Cc: stable@vger.kernel.org
Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
Link: https://patch.msgid.link/tencent_35F3A25FEEBF190A2E15ED787754C57E3708@qq.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/aoa/fabrics/layout.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/sound/aoa/fabrics/layout.c
+++ b/sound/aoa/fabrics/layout.c
@@ -947,6 +947,8 @@ static void layout_attached_codec(struct
if (lineout == 1)
ldev->gpio.methods->set_lineout(codec->gpio, 1);
ctl = snd_ctl_new1(&lineout_ctl, codec->gpio);
+ if (!ctl)
+ return;
if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
strlcpy(ctl->id.name,
"Headphone Switch", sizeof(ctl->id.name));
@@ -961,6 +963,8 @@ static void layout_attached_codec(struct
if (ldev->have_lineout_detect) {
ctl = snd_ctl_new1(&lineout_detect_choice,
ldev);
+ if (!ctl)
+ return;
if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
strlcpy(ctl->id.name,
"Headphone Detect Autoswitch",
@@ -968,6 +972,8 @@ static void layout_attached_codec(struct
aoa_snd_ctl_add(ctl);
ctl = snd_ctl_new1(&lineout_detected,
ldev);
+ if (!ctl)
+ return;
if (cc->connected & CC_LINEOUT_LABELLED_HEADPHONE)
strlcpy(ctl->id.name,
"Headphone Detected",
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 595/699] Bluetooth: btintel: Fix offset calculation boot address parameter
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (593 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 594/699] ALSA: aoa: check snd_ctl_new1() return value Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 596/699] Bluetooth: btintel: Check firmware version before download Greg Kroah-Hartman
` (107 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kiran K, Marcel Holtmann,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiran K <kiran.k@intel.com>
[ Upstream commit d00745da644d42c2f97293eb3fe19cfd5c0b073c ]
Boot address parameter was not getting updated properly
due to wrong offset
Signed-off-by: Kiran K <kiran.k@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Stable-dep-of: c5b600a3c05b ("Bluetooth: btusb: fix use-after-free on marvell probe failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btintel.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -863,7 +863,8 @@ static int btintel_download_firmware_pay
/* The boot parameter is the first 32-bit value
* and rest of 3 octets are reserved.
*/
- *boot_param = get_unaligned_le32(fw_ptr + sizeof(*cmd));
+ *boot_param = get_unaligned_le32(fw_ptr + frag_len +
+ sizeof(*cmd));
bt_dev_dbg(hdev, "boot_param=0x%x", *boot_param);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 596/699] Bluetooth: btintel: Check firmware version before download
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (594 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 595/699] Bluetooth: btintel: Fix offset calculation boot address parameter Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 597/699] Bluetooth: btusb: fix use-after-free on marvell probe failure Greg Kroah-Hartman
` (106 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz,
Tedd Ho-Jeong An, Marcel Holtmann, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit ac0565462e330a2b762ca5849a4140b29d725786 ]
This checks the firmware build number, week and year against the
repective loaded version. If details are a match, skip the download
process.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tested-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Stable-dep-of: c5b600a3c05b ("Bluetooth: btusb: fix use-after-free on marvell probe failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btintel.c | 106 +++++++++++++++++++++++++++++++++---------
drivers/bluetooth/btintel.h | 5 +
drivers/bluetooth/btusb.c | 9 +++
drivers/bluetooth/hci_intel.c | 7 +-
4 files changed, 101 insertions(+), 26 deletions(-)
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -24,6 +24,14 @@
#define ECDSA_OFFSET 644
#define ECDSA_HEADER_LEN 320
+#define CMD_WRITE_BOOT_PARAMS 0xfc0e
+struct cmd_write_boot_params {
+ u32 boot_addr;
+ u8 fw_build_num;
+ u8 fw_build_ww;
+ u8 fw_build_yy;
+} __packed;
+
int btintel_check_bdaddr(struct hci_dev *hdev)
{
struct hci_rp_read_bd_addr *bda;
@@ -841,7 +849,7 @@ static int btintel_sfi_ecdsa_header_secu
static int btintel_download_firmware_payload(struct hci_dev *hdev,
const struct firmware *fw,
- u32 *boot_param, size_t offset)
+ size_t offset)
{
int err;
const u8 *fw_ptr;
@@ -854,21 +862,6 @@ static int btintel_download_firmware_pay
while (fw_ptr - fw->data < fw->size) {
struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
- /* Each SKU has a different reset parameter to use in the
- * HCI_Intel_Reset command and it is embedded in the firmware
- * data. So, instead of using static value per SKU, check
- * the firmware data and save it for later use.
- */
- if (le16_to_cpu(cmd->opcode) == 0xfc0e) {
- /* The boot parameter is the first 32-bit value
- * and rest of 3 octets are reserved.
- */
- *boot_param = get_unaligned_le32(fw_ptr + frag_len +
- sizeof(*cmd));
-
- bt_dev_dbg(hdev, "boot_param=0x%x", *boot_param);
- }
-
frag_len += sizeof(*cmd) + cmd->plen;
/* The parameter length of the secure send command requires
@@ -897,28 +890,101 @@ done:
return err;
}
+static bool btintel_firmware_version(struct hci_dev *hdev,
+ u8 num, u8 ww, u8 yy,
+ const struct firmware *fw,
+ u32 *boot_addr)
+{
+ const u8 *fw_ptr;
+
+ fw_ptr = fw->data;
+
+ while (fw_ptr - fw->data < fw->size) {
+ struct hci_command_hdr *cmd = (void *)(fw_ptr);
+
+ /* Each SKU has a different reset parameter to use in the
+ * HCI_Intel_Reset command and it is embedded in the firmware
+ * data. So, instead of using static value per SKU, check
+ * the firmware data and save it for later use.
+ */
+ if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
+ struct cmd_write_boot_params *params;
+
+ params = (void *)(fw_ptr + sizeof(*cmd));
+
+ bt_dev_info(hdev, "Boot Address: 0x%x",
+ le32_to_cpu(params->boot_addr));
+
+ bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
+ params->fw_build_num, params->fw_build_ww,
+ params->fw_build_yy);
+
+ return (num == params->fw_build_num &&
+ ww == params->fw_build_ww &&
+ yy == params->fw_build_yy);
+ }
+
+ fw_ptr += sizeof(*cmd) + cmd->plen;
+ }
+
+ return false;
+}
+
int btintel_download_firmware(struct hci_dev *hdev,
+ struct intel_version *ver,
const struct firmware *fw,
u32 *boot_param)
{
int err;
+ /* SfP and WsP don't seem to update the firmware version on file
+ * so version checking is currently not possible.
+ */
+ switch (ver->hw_variant) {
+ case 0x0b: /* SfP */
+ case 0x0c: /* WsP */
+ /* Skip version checking */
+ break;
+ default:
+ /* Skip download if firmware has the same version */
+ if (btintel_firmware_version(hdev, ver->fw_build_num,
+ ver->fw_build_ww, ver->fw_build_yy,
+ fw, boot_param)) {
+ bt_dev_info(hdev, "Firmware already loaded");
+ /* Return -EALREADY to indicate that the firmware has
+ * already been loaded.
+ */
+ return -EALREADY;
+ }
+ }
+
err = btintel_sfi_rsa_header_secure_send(hdev, fw);
if (err)
return err;
- return btintel_download_firmware_payload(hdev, fw, boot_param,
- RSA_HEADER_LEN);
+ return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
}
EXPORT_SYMBOL_GPL(btintel_download_firmware);
int btintel_download_firmware_newgen(struct hci_dev *hdev,
+ struct intel_version_tlv *ver,
const struct firmware *fw, u32 *boot_param,
u8 hw_variant, u8 sbe_type)
{
int err;
u32 css_header_ver;
+ /* Skip download if firmware has the same version */
+ if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
+ ver->min_fw_build_cw, ver->min_fw_build_yy,
+ fw, boot_param)) {
+ bt_dev_info(hdev, "Firmware already loaded");
+ /* Return -EALREADY to indicate that firmware has already been
+ * loaded.
+ */
+ return -EALREADY;
+ }
+
/* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
* only RSA secure boot engine. Hence, the corresponding sfi file will
* have RSA header of 644 bytes followed by Command Buffer.
@@ -948,7 +1014,7 @@ int btintel_download_firmware_newgen(str
if (err)
return err;
- err = btintel_download_firmware_payload(hdev, fw, boot_param, RSA_HEADER_LEN);
+ err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
if (err)
return err;
} else if (hw_variant >= 0x17) {
@@ -969,7 +1035,6 @@ int btintel_download_firmware_newgen(str
return err;
err = btintel_download_firmware_payload(hdev, fw,
- boot_param,
RSA_HEADER_LEN + ECDSA_HEADER_LEN);
if (err)
return err;
@@ -979,7 +1044,6 @@ int btintel_download_firmware_newgen(str
return err;
err = btintel_download_firmware_payload(hdev, fw,
- boot_param,
RSA_HEADER_LEN + ECDSA_HEADER_LEN);
if (err)
return err;
--- a/drivers/bluetooth/btintel.h
+++ b/drivers/bluetooth/btintel.h
@@ -157,9 +157,10 @@ struct regmap *btintel_regmap_init(struc
int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param);
int btintel_read_boot_params(struct hci_dev *hdev,
struct intel_boot_params *params);
-int btintel_download_firmware(struct hci_dev *dev, const struct firmware *fw,
- u32 *boot_param);
+int btintel_download_firmware(struct hci_dev *dev, struct intel_version *ver,
+ const struct firmware *fw, u32 *boot_param);
int btintel_download_firmware_newgen(struct hci_dev *hdev,
+ struct intel_version_tlv *ver,
const struct firmware *fw,
u32 *boot_param, u8 hw_variant,
u8 sbe_type);
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2602,8 +2602,15 @@ static int btusb_intel_download_firmware
set_bit(BTUSB_DOWNLOADING, &data->flags);
/* Start firmware downloading and get boot parameter */
- err = btintel_download_firmware(hdev, fw, boot_param);
+ err = btintel_download_firmware(hdev, ver, fw, boot_param);
if (err < 0) {
+ if (err == -EALREADY) {
+ /* Firmware has already been loaded */
+ set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
+ err = 0;
+ goto done;
+ }
+
/* When FW download fails, send Intel Reset to retry
* FW download.
*/
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -735,7 +735,7 @@ static int intel_setup(struct hci_uart *
set_bit(STATE_DOWNLOADING, &intel->flags);
/* Start firmware downloading and get boot parameter */
- err = btintel_download_firmware(hdev, fw, &boot_param);
+ err = btintel_download_firmware(hdev, &ver, fw, &boot_param);
if (err < 0)
goto done;
@@ -784,7 +784,10 @@ static int intel_setup(struct hci_uart *
done:
release_firmware(fw);
- if (err < 0)
+ /* Check if there was an error and if is not -EALREADY which means the
+ * firmware has already been loaded.
+ */
+ if (err < 0 && err != -EALREADY)
return err;
/* We need to restore the default speed before Intel reset */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 597/699] Bluetooth: btusb: fix use-after-free on marvell probe failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (595 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 596/699] Bluetooth: btintel: Check firmware version before download Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 598/699] Bluetooth: btusb: fix wakeup source leak on " Greg Kroah-Hartman
` (105 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rajat Jain, Johan Hovold,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit c5b600a3c05b1a7a110d558df935a8fc8a471c79 ]
Make sure to stop any TX URBs submitted during Marvell OOB wakeup
configuration on later probe failures to avoid use-after-free in the
completion callback.
This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.
Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the pins for oob wakeup")
Cc: stable@vger.kernel.org # 4.11
Cc: Rajat Jain <rajatja@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4352,7 +4352,7 @@ static int btusb_probe(struct usb_interf
err = usb_set_interface(data->udev, 0, 0);
if (err < 0) {
BT_ERR("failed to set interface 0, alt 0 %d", err);
- goto out_free_dev;
+ goto err_kill_tx_urbs;
}
}
@@ -4360,7 +4360,7 @@ static int btusb_probe(struct usb_interf
err = usb_driver_claim_interface(&btusb_driver,
data->isoc, data);
if (err < 0)
- goto out_free_dev;
+ goto err_kill_tx_urbs;
}
if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
@@ -4391,6 +4391,8 @@ err_release_siblings:
usb_set_intfdata(data->isoc, NULL);
usb_driver_release_interface(&btusb_driver, data->isoc);
}
+err_kill_tx_urbs:
+ usb_kill_anchored_urbs(&data->tx_anchor);
out_free_dev:
if (data->reset_gpio)
gpiod_put(data->reset_gpio);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 598/699] Bluetooth: btusb: fix wakeup source leak on probe failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (596 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 597/699] Bluetooth: btusb: fix use-after-free on marvell probe failure Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 599/699] vfio/pci: Release the VGA arbiter client on register_device() failure Greg Kroah-Hartman
` (104 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rajat Jain, Johan Hovold,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 3d93e1bb0fb881fe3ef961d1120556658e9cac4d ]
Make sure to disable wakeup on probe failure to avoid leaking the wakeup
source.
Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support")
Cc: stable@vger.kernel.org # 4.11
Cc: Rajat Jain <rajatja@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3501,6 +3501,11 @@ static int marvell_config_oob_wake(struc
return 0;
}
+#else
+static inline int marvell_config_oob_wake(struct hci_dev *hdev)
+{
+ return 0;
+}
#endif
static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
@@ -4011,6 +4016,11 @@ static int btusb_config_oob_wake(struct
bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
return 0;
}
+#else
+static inline int btusb_config_oob_wake(struct hci_dev *hdev)
+{
+ return 0;
+}
#endif
static void btusb_check_needs_reset_resume(struct usb_interface *intf)
@@ -4164,7 +4174,6 @@ static int btusb_probe(struct usb_interf
hdev->notify = btusb_notify;
hdev->prevent_wake = btusb_prevent_wake;
-#ifdef CONFIG_PM
err = btusb_config_oob_wake(hdev);
if (err)
goto out_free_dev;
@@ -4173,9 +4182,9 @@ static int btusb_probe(struct usb_interf
if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
err = marvell_config_oob_wake(hdev);
if (err)
- goto out_free_dev;
+ goto err_disable_wakeup;
}
-#endif
+
if (id->driver_info & BTUSB_CW6622)
set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
@@ -4393,6 +4402,9 @@ err_release_siblings:
}
err_kill_tx_urbs:
usb_kill_anchored_urbs(&data->tx_anchor);
+err_disable_wakeup:
+ if (data->oob_wake_irq)
+ device_init_wakeup(&data->udev->dev, false);
out_free_dev:
if (data->reset_gpio)
gpiod_put(data->reset_gpio);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 599/699] vfio/pci: Release the VGA arbiter client on register_device() failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (597 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 598/699] Bluetooth: btusb: fix wakeup source leak on " Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 600/699] binder: fix UAF in binder_free_transaction() Greg Kroah-Hartman
` (103 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Williamson, Kevin Tian,
Alex Williamson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <alex.williamson@nvidia.com>
[ Upstream commit daedde7f024ecf88bc8e832ed40cf2c795f0796a ]
The re-order in the Fixes commit below displaced vfio_pci_vga_init() as
the last failure point of what is now vfio_pci_core_register_device()
without introducing an unwind for the VGA arbiter registration.
In current kernels this is mostly benign because vfio_pci_set_decode()
only uses pci_dev state, but the original failure path could leave a
callback with a freed vdev cookie. The stale registration also becomes
unsafe again once the callback follows drvdata to the vfio device.
Add the required VGA unwind callout.
Fixes: 4aeec3984ddc ("vfio/pci: Re-order vfio_pci_probe()")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Alex Williamson <alex.williamson@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/20260615191241.688297-3-alex.williamson@nvidia.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/pci/vfio_pci.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -2094,6 +2094,7 @@ static int vfio_pci_probe(struct pci_dev
out_power:
if (!disable_idle_d3)
vfio_pci_set_power_state(vdev, PCI_D0);
+ vfio_pci_vga_uninit(vdev);
out_vf:
vfio_pci_vf_uninit(vdev);
out_reflck:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 600/699] binder: fix UAF in binder_free_transaction()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (598 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 599/699] vfio/pci: Release the VGA arbiter client on register_device() failure Greg Kroah-Hartman
@ 2026-07-21 15:25 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 601/699] PCI: altera: Fix resource leaks on probe failure Greg Kroah-Hartman
` (102 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Alice Ryhl, Carlos Llamas,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
[ Upstream commit f223d27a546c1e1f48d38fd67760e78f068fe8c4 ]
In binder_free_transaction(), the t->to_proc is read under the t->lock.
However, once the t->lock is dropped, the to_proc can die in parallel.
This leads to a use-after-free error when we attempt to acquire its
inner lock right afterwards:
==================================================================
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x1a0
Write of size 4 at addr ffff00001125da70 by task B/672
CPU: 20 UID: 0 PID: 672 Comm: B Not tainted 7.1.0-rc6-00284-g8e65320d91cd #4 PREEMPT
Hardware name: linux,dummy-virt (DT)
Call trace:
_raw_spin_lock+0xe4/0x1a0
binder_free_transaction+0x8c/0x320
binder_send_failed_reply+0x21c/0x2f8
binder_thread_release+0x488/0x7e0
binder_ioctl+0x12c0/0x29a0
[...]
Allocated by task 675:
__kmalloc_cache_noprof+0x174/0x444
binder_open+0x118/0xb70
do_dentry_open+0x374/0x1040
vfs_open+0x58/0x3bc
[...]
Freed by task 212:
__kasan_slab_free+0x58/0x80
kfree+0x1a0/0x4a4
binder_proc_dec_tmpref+0x32c/0x5e0
binder_deferred_func+0xc48/0x104c
process_one_work+0x53c/0xbc0
[...]
==================================================================
To prevent this, pin the target thread (t->to_thread) to guarantee the
target process remains alive. Undelivered transactions without a target
thread are already safe, as the target process can only be the current
context in those paths.
Cc: stable <stable@kernel.org>
Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://lore.kernel.org/all/aikJKVuny_eOivwN@google.com/
Fixes: a370003cc301 ("binder: fix possible UAF when freeing buffer")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260619185233.2194678-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1909,10 +1909,19 @@ static void binder_free_txn_fixups(struc
static void binder_free_transaction(struct binder_transaction *t)
{
+ struct binder_thread *target_thread;
struct binder_proc *target_proc;
spin_lock(&t->lock);
target_proc = t->to_proc;
+ target_thread = t->to_thread;
+ /*
+ * Pin target_thread to keep target_proc alive. Undelivered
+ * transactions with !target_thread are safe, as target_proc
+ * can only be the current context there.
+ */
+ if (target_thread)
+ atomic_inc(&target_thread->tmp_ref);
spin_unlock(&t->lock);
if (target_proc) {
@@ -1921,6 +1930,10 @@ static void binder_free_transaction(stru
t->buffer->transaction = NULL;
binder_inner_proc_unlock(target_proc);
}
+
+ if (target_thread)
+ binder_thread_dec_tmpref(target_thread);
+
/*
* If the transaction has no target_proc, then
* t->buffer->transaction has already been cleared.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 601/699] PCI: altera: Fix resource leaks on probe failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (599 preceding siblings ...)
2026-07-21 15:25 ` [PATCH 5.10 600/699] binder: fix UAF in binder_free_transaction() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 602/699] media: atomisp: replace boolean comparison of values with bool variables Greg Kroah-Hartman
` (101 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahesh Vaidya, Manivannan Sadhasivam,
Subhransu S. Prusty, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Vaidya <mahesh.vaidya@altera.com>
[ Upstream commit 7a94138caeb27f3c49c1dbd93bf422098925bb28 ]
The chained IRQ handler is set during probe, but is only removed during the
driver remove(). If pci_host_probe() fails, the handler and INTx IRQ
domain remain set even though the devm-managed host bridge storage
containing struct altera_pcie will be released, leaving the handler with
a stale data pointer.
Interrupts are also enabled before pci_host_probe() is called. If probe
fails after that point, the controller interrupt source should be disabled
before the chained handler and INTx domain are removed.
So set the chained handler only after the INTx domain has been created.
Disable controller interrupts during IRQ teardown, and tear the IRQ setup
down if pci_host_probe() fails.
Fixes: c63aed7334c2 ("PCI: altera: Use pci_host_probe() to register host")
Signed-off-by: Mahesh Vaidya <mahesh.vaidya@altera.com>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Subhransu S. Prusty <subhransu.sekhar.prusty@altera.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260430204330.3121003-3-mahesh.vaidya@altera.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pcie-altera.c | 28 ++++++++++++++++++++++++++--
1 file changed, 26 insertions(+), 2 deletions(-)
--- a/drivers/pci/controller/pcie-altera.c
+++ b/drivers/pci/controller/pcie-altera.c
@@ -685,8 +685,18 @@ static int altera_pcie_init_irq_domain(s
return 0;
}
+static void altera_pcie_disable_irq(struct altera_pcie *pcie)
+{
+ if (pcie->pcie_data->version == ALTERA_PCIE_V1 ||
+ pcie->pcie_data->version == ALTERA_PCIE_V2) {
+ /* Disable all P2A interrupts */
+ cra_writel(pcie, 0, P2A_INT_ENABLE);
+ }
+}
+
static void altera_pcie_irq_teardown(struct altera_pcie *pcie)
{
+ altera_pcie_disable_irq(pcie);
irq_set_chained_handler_and_data(pcie->irq, NULL, NULL);
irq_domain_remove(pcie->irq_domain);
}
@@ -711,7 +721,6 @@ static int altera_pcie_parse_dt(struct a
if (pcie->irq < 0)
return pcie->irq;
- irq_set_chained_handler_and_data(pcie->irq, altera_pcie_isr, pcie);
return 0;
}
@@ -796,6 +805,12 @@ static int altera_pcie_probe(struct plat
return ret;
}
+ /*
+ * The chained handler uses pcie->irq_domain, so set it only after the
+ * INTx domain has been created.
+ */
+ irq_set_chained_handler_and_data(pcie->irq, altera_pcie_isr, pcie);
+
/* clear all interrupts */
cra_writel(pcie, P2A_INT_STS_ALL, P2A_INT_STATUS);
/* enable all interrupts */
@@ -806,7 +821,16 @@ static int altera_pcie_probe(struct plat
bridge->busnr = pcie->root_bus_nr;
bridge->ops = &altera_pcie_ops;
- return pci_host_probe(bridge);
+ ret = pci_host_probe(bridge);
+ if (ret)
+ goto err_teardown_irq;
+
+ return 0;
+
+err_teardown_irq:
+ altera_pcie_irq_teardown(pcie);
+
+ return ret;
}
static int altera_pcie_remove(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 602/699] media: atomisp: replace boolean comparison of values with bool variables
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (600 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 601/699] PCI: altera: Fix resource leaks on probe failure Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 603/699] media: staging: media: atomisp: Fix sh_css.c brace coding style issues Greg Kroah-Hartman
` (100 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aditya Srivastava,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Srivastava <yashsri421@gmail.com>
[ Upstream commit c606970d4250dfb95869a563975c08bab148137a ]
There are certain expressions in a condition in atomisp, where a boolean
variable is compared with true/false in forms such as (foo == true)
or (false != bar), which does not comply with the coding style rule by
checkpatch.pl (CHK: BOOL_COMPARISON), according to which the boolean
variables should be themselves used in the condition, rather than
comparing with true or false.
E.g. In drivers/staging/media/atomisp/pci/atomisp_compat_css20.c:
if (asd->stream_prepared == false) {
Can be replaced with:
if (!asd->stream_prepared) {
Replace such expressions with boolean variables appropriately.
Link: https://lore.kernel.org/linux-media/20201214132716.28157-1-yashsri421@gmail.com
Signed-off-by: Aditya Srivastava <yashsri421@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/atomisp_compat_css20.c | 2 -
drivers/staging/media/atomisp/pci/runtime/isys/src/virtual_isys.c | 12 +++++-----
drivers/staging/media/atomisp/pci/sh_css.c | 12 +++++-----
3 files changed, 13 insertions(+), 13 deletions(-)
--- a/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_compat_css20.c
@@ -1142,7 +1142,7 @@ int atomisp_css_start(struct atomisp_sub
* Thus the stream created in set_fmt get destroyed and need to be
* recreated in the next stream on.
*/
- if (asd->stream_prepared == false) {
+ if (!asd->stream_prepared) {
if (__create_pipes(asd)) {
dev_err(isp->dev, "create pipe error.\n");
return -EINVAL;
--- a/drivers/staging/media/atomisp/pci/runtime/isys/src/virtual_isys.c
+++ b/drivers/staging/media/atomisp/pci/runtime/isys/src/virtual_isys.c
@@ -179,12 +179,12 @@ ia_css_isys_error_t ia_css_isys_stream_c
isys_stream->linked_isys_stream_id = isys_stream_descr->linked_isys_stream_id;
rc = create_input_system_input_port(isys_stream_descr,
&isys_stream->input_port);
- if (rc == false)
+ if (!rc)
return false;
rc = create_input_system_channel(isys_stream_descr, false,
&isys_stream->channel);
- if (rc == false) {
+ if (!rc) {
destroy_input_system_input_port(&isys_stream->input_port);
return false;
}
@@ -204,7 +204,7 @@ ia_css_isys_error_t ia_css_isys_stream_c
if (isys_stream_descr->metadata.enable) {
rc = create_input_system_channel(isys_stream_descr, true,
&isys_stream->md_channel);
- if (rc == false) {
+ if (!rc) {
destroy_input_system_input_port(&isys_stream->input_port);
destroy_input_system_channel(&isys_stream->channel);
return false;
@@ -248,7 +248,7 @@ ia_css_isys_error_t ia_css_isys_stream_c
isys_stream_descr,
&isys_stream_cfg->channel_cfg,
false);
- if (rc == false)
+ if (!rc)
return false;
/* configure metadata channel */
@@ -260,7 +260,7 @@ ia_css_isys_error_t ia_css_isys_stream_c
isys_stream_descr,
&isys_stream_cfg->md_channel_cfg,
true);
- if (rc == false)
+ if (!rc)
return false;
}
@@ -269,7 +269,7 @@ ia_css_isys_error_t ia_css_isys_stream_c
&isys_stream->input_port,
isys_stream_descr,
&isys_stream_cfg->input_port_cfg);
- if (rc == false)
+ if (!rc)
return false;
isys_stream->valid = 1;
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -1058,7 +1058,7 @@ sh_css_config_input_network(struct ia_cs
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"sh_css_config_input_network() enter 0x%p:\n", stream);
- if (stream->config.continuous == true)
+ if (stream->config.continuous)
{
if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_CAPTURE) {
pipe = stream->last_pipe;
@@ -5622,7 +5622,7 @@ static int load_video_binaries(struct ia
} else {
/* output from main binary is not yuv line. currently this is
* possible only when bci is enabled on vfpp output */
- assert(pipe->config.enable_vfpp_bci == true);
+ assert(pipe->config.enable_vfpp_bci);
ia_css_pipe_get_yuvscaler_binarydesc(pipe, &vf_pp_descr,
&mycs->video_binary.vf_frame_info,
pipe_vf_out_info, NULL, NULL);
@@ -8068,7 +8068,7 @@ create_host_regular_capture_pipeline(str
struct ia_css_frame *tmp_out_frame = NULL;
for (i = 0; i < num_yuv_scaler; i++) {
- if (is_output_stage[i] == true)
+ if (is_output_stage[i])
tmp_out_frame = out_frame;
else
tmp_out_frame = NULL;
@@ -8460,7 +8460,7 @@ sh_css_pipeline_add_acc_stage(struct ia_
/* In QoS case, load_extension already called, so skipping */
int err = 0;
- if (fw->loaded == false)
+ if (!fw->loaded)
err = acc_load_extension(fw);
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -9697,8 +9697,8 @@ ia_css_stream_destroy(struct ia_css_stre
assert(entry);
if (entry) {
/* get the SP thread id */
- if (ia_css_pipeline_get_sp_thread_id(
- ia_css_pipe_get_pipe_num(entry), &sp_thread_id) != true)
+ if (!ia_css_pipeline_get_sp_thread_id(
+ ia_css_pipe_get_pipe_num(entry), &sp_thread_id))
return -EINVAL;
/* get the target input terminal */
sp_pipeline_input_terminal =
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 603/699] media: staging: media: atomisp: Fix sh_css.c brace coding style issues
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (601 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 602/699] media: atomisp: replace boolean comparison of values with bool variables Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 604/699] media: staging: media: atomisp: Fix the rest of sh_css.c brace issues Greg Kroah-Hartman
` (99 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martiros Shakhzadyan, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <vrzh@vrzh.net>
[ Upstream commit 6ceb557604e85c55bce0585216623c21c7a00453 ]
Fix brace coding style issues.
Signed-off-by: Martiros Shakhzadyan <vrzh@vrzh.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 224 +++++++++++------------------
1 file changed, 90 insertions(+), 134 deletions(-)
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -456,15 +456,15 @@ static enum ia_css_frame_format yuv422_c
* by the copy binary given the stream format.
* */
static int
-verify_copy_out_frame_format(struct ia_css_pipe *pipe) {
+verify_copy_out_frame_format(struct ia_css_pipe *pipe)
+{
enum ia_css_frame_format out_fmt = pipe->output_info[0].format;
unsigned int i, found = 0;
assert(pipe);
assert(pipe->stream);
- switch (pipe->stream->config.input_config.format)
- {
+ switch (pipe->stream->config.input_config.format) {
case ATOMISP_INPUT_FORMAT_YUV420_8_LEGACY:
case ATOMISP_INPUT_FORMAT_YUV420_8:
for (i = 0; i < ARRAY_SIZE(yuv420_copy_formats) && !found; i++)
@@ -532,7 +532,8 @@ ia_css_stream_input_format_bits_per_pixe
#if !defined(ISP2401)
static int
-sh_css_config_input_network(struct ia_css_stream *stream) {
+sh_css_config_input_network(struct ia_css_stream *stream)
+{
unsigned int fmt_type;
struct ia_css_pipe *pipe = stream->last_pipe;
struct ia_css_binary *binary = NULL;
@@ -558,8 +559,7 @@ sh_css_config_input_network(struct ia_cs
stream->config.mode);
if ((binary && (binary->online || stream->config.continuous)) ||
- pipe->config.mode == IA_CSS_PIPE_MODE_COPY)
- {
+ pipe->config.mode == IA_CSS_PIPE_MODE_COPY) {
err = ia_css_ifmtr_configure(&stream->config,
binary);
if (err)
@@ -567,8 +567,7 @@ sh_css_config_input_network(struct ia_cs
}
if (stream->config.mode == IA_CSS_INPUT_MODE_TPG ||
- stream->config.mode == IA_CSS_INPUT_MODE_PRBS)
- {
+ stream->config.mode == IA_CSS_INPUT_MODE_PRBS) {
unsigned int hblank_cycles = 100,
vblank_lines = 6,
width,
@@ -723,35 +722,32 @@ static bool sh_css_translate_stream_cfg_
switch (stream_cfg->mode) {
case IA_CSS_INPUT_MODE_TPG:
- if (stream_cfg->source.tpg.id == IA_CSS_TPG_ID0) {
+ if (stream_cfg->source.tpg.id == IA_CSS_TPG_ID0)
isys_stream_descr->input_port_id = INPUT_SYSTEM_PIXELGEN_PORT0_ID;
- } else if (stream_cfg->source.tpg.id == IA_CSS_TPG_ID1) {
+ else if (stream_cfg->source.tpg.id == IA_CSS_TPG_ID1)
isys_stream_descr->input_port_id = INPUT_SYSTEM_PIXELGEN_PORT1_ID;
- } else if (stream_cfg->source.tpg.id == IA_CSS_TPG_ID2) {
+ else if (stream_cfg->source.tpg.id == IA_CSS_TPG_ID2)
isys_stream_descr->input_port_id = INPUT_SYSTEM_PIXELGEN_PORT2_ID;
- }
break;
case IA_CSS_INPUT_MODE_PRBS:
- if (stream_cfg->source.prbs.id == IA_CSS_PRBS_ID0) {
+ if (stream_cfg->source.prbs.id == IA_CSS_PRBS_ID0)
isys_stream_descr->input_port_id = INPUT_SYSTEM_PIXELGEN_PORT0_ID;
- } else if (stream_cfg->source.prbs.id == IA_CSS_PRBS_ID1) {
+ else if (stream_cfg->source.prbs.id == IA_CSS_PRBS_ID1)
isys_stream_descr->input_port_id = INPUT_SYSTEM_PIXELGEN_PORT1_ID;
- } else if (stream_cfg->source.prbs.id == IA_CSS_PRBS_ID2) {
+ else if (stream_cfg->source.prbs.id == IA_CSS_PRBS_ID2)
isys_stream_descr->input_port_id = INPUT_SYSTEM_PIXELGEN_PORT2_ID;
- }
break;
case IA_CSS_INPUT_MODE_BUFFERED_SENSOR:
- if (stream_cfg->source.port.port == MIPI_PORT0_ID) {
+ if (stream_cfg->source.port.port == MIPI_PORT0_ID)
isys_stream_descr->input_port_id = INPUT_SYSTEM_CSI_PORT0_ID;
- } else if (stream_cfg->source.port.port == MIPI_PORT1_ID) {
+ else if (stream_cfg->source.port.port == MIPI_PORT1_ID)
isys_stream_descr->input_port_id = INPUT_SYSTEM_CSI_PORT1_ID;
- } else if (stream_cfg->source.port.port == MIPI_PORT2_ID) {
+ else if (stream_cfg->source.port.port == MIPI_PORT2_ID)
isys_stream_descr->input_port_id = INPUT_SYSTEM_CSI_PORT2_ID;
- }
break;
default:
@@ -804,15 +800,14 @@ static bool sh_css_translate_stream_cfg_
rc = true;
switch (stream_cfg->mode) {
case IA_CSS_INPUT_MODE_TPG:
- if (stream_cfg->source.tpg.mode == IA_CSS_TPG_MODE_RAMP) {
+ if (stream_cfg->source.tpg.mode == IA_CSS_TPG_MODE_RAMP)
isys_stream_descr->tpg_port_attr.mode = PIXELGEN_TPG_MODE_RAMP;
- } else if (stream_cfg->source.tpg.mode == IA_CSS_TPG_MODE_CHECKERBOARD) {
+ else if (stream_cfg->source.tpg.mode == IA_CSS_TPG_MODE_CHECKERBOARD)
isys_stream_descr->tpg_port_attr.mode = PIXELGEN_TPG_MODE_CHBO;
- } else if (stream_cfg->source.tpg.mode == IA_CSS_TPG_MODE_MONO) {
+ else if (stream_cfg->source.tpg.mode == IA_CSS_TPG_MODE_MONO)
isys_stream_descr->tpg_port_attr.mode = PIXELGEN_TPG_MODE_MONO;
- } else {
+ else
rc = false;
- }
/*
* TODO
@@ -951,12 +946,12 @@ static bool sh_css_translate_stream_cfg_
stream_cfg->mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR) &&
stream_cfg->source.port.compression.type != IA_CSS_CSI2_COMPRESSION_TYPE_NONE) {
if (stream_cfg->source.port.compression.uncompressed_bits_per_pixel ==
- UNCOMPRESSED_BITS_PER_PIXEL_10) {
+ UNCOMPRESSED_BITS_PER_PIXEL_10)
fmt_type = ATOMISP_INPUT_FORMAT_RAW_10;
- } else if (stream_cfg->source.port.compression.uncompressed_bits_per_pixel ==
- UNCOMPRESSED_BITS_PER_PIXEL_12) {
+ else if (stream_cfg->source.port.compression.uncompressed_bits_per_pixel ==
+ UNCOMPRESSED_BITS_PER_PIXEL_12)
fmt_type = ATOMISP_INPUT_FORMAT_RAW_12;
- } else
+ else
return false;
}
@@ -1043,7 +1038,8 @@ static bool sh_css_translate_binary_info
}
static int
-sh_css_config_input_network(struct ia_css_stream *stream) {
+sh_css_config_input_network(struct ia_css_stream *stream)
+{
bool rc;
ia_css_isys_descr_t isys_stream_descr;
unsigned int sp_thread_id;
@@ -1058,19 +1054,16 @@ sh_css_config_input_network(struct ia_cs
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"sh_css_config_input_network() enter 0x%p:\n", stream);
- if (stream->config.continuous)
- {
- if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_CAPTURE) {
+ if (stream->config.continuous) {
+ if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_CAPTURE)
pipe = stream->last_pipe;
- } else if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_YUVPP) {
+ else if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_YUVPP)
pipe = stream->last_pipe;
- } else if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_PREVIEW) {
+ else if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_PREVIEW)
pipe = stream->last_pipe->pipe_settings.preview.copy_pipe;
- } else if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_VIDEO) {
+ else if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_VIDEO)
pipe = stream->last_pipe->pipe_settings.video.copy_pipe;
- }
- } else
- {
+ } else {
pipe = stream->last_pipe;
if (stream->last_pipe->config.mode == IA_CSS_PIPE_MODE_CAPTURE) {
/*
@@ -1093,8 +1086,7 @@ sh_css_config_input_network(struct ia_cs
if (pipe->pipeline.stages->binary)
binary = pipe->pipeline.stages->binary;
- if (binary)
- {
+ if (binary) {
/* this was being done in ifmtr in 2400.
* online and cont bypass the init_in_frameinfo_memory_defaults
* so need to do it here
@@ -1208,11 +1200,10 @@ static inline struct ia_css_pipe *stream
struct ia_css_pipe *target_pipe;
/* get the pipe that consumes the stream */
- if (stream->config.continuous) {
+ if (stream->config.continuous)
target_pipe = stream_get_copy_pipe(stream);
- } else {
+ else
target_pipe = stream_get_last_pipe(stream);
- }
return target_pipe;
}
@@ -1386,7 +1377,8 @@ start_binary(struct ia_css_pipe *pipe,
/* start the copy function on the SP */
static int
start_copy_on_sp(struct ia_css_pipe *pipe,
- struct ia_css_frame *out_frame) {
+ struct ia_css_frame *out_frame)
+{
(void)out_frame;
assert(pipe);
assert(pipe->stream);
@@ -1404,8 +1396,7 @@ start_copy_on_sp(struct ia_css_pipe *pip
sh_css_sp_start_binary_copy(ia_css_pipe_get_pipe_num(pipe), out_frame, pipe->stream->config.pixels_per_clock == 2);
#if !defined(ISP2401)
- if (pipe->stream->reconfigure_css_rx)
- {
+ if (pipe->stream->reconfigure_css_rx) {
ia_css_isys_rx_configure(&pipe->stream->csi_rx_config,
pipe->stream->config.mode);
pipe->stream->reconfigure_css_rx = false;
@@ -1594,7 +1585,8 @@ ia_css_reset_defaults(struct sh_css *css
int
ia_css_load_firmware(struct device *dev, const struct ia_css_env *env,
- const struct ia_css_fw *fw) {
+ const struct ia_css_fw *fw)
+{
int err;
if (!env)
@@ -1605,16 +1597,14 @@ ia_css_load_firmware(struct device *dev,
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_load_firmware() enter\n");
/* make sure we initialize my_css */
- if (my_css.flush != env->cpu_mem_env.flush)
- {
+ if (my_css.flush != env->cpu_mem_env.flush) {
ia_css_reset_defaults(&my_css);
my_css.flush = env->cpu_mem_env.flush;
}
ia_css_unload_firmware(); /* in case we are called twice */
err = sh_css_load_firmware(dev, fw->data, fw->bytes);
- if (!err)
- {
+ if (!err) {
err = ia_css_binary_init_infos();
if (!err)
fw_explicitly_loaded = true;
@@ -1628,7 +1618,8 @@ int
ia_css_init(struct device *dev, const struct ia_css_env *env,
const struct ia_css_fw *fw,
u32 mmu_l1_base,
- enum ia_css_irq_type irq_type) {
+ enum ia_css_irq_type irq_type)
+{
int err;
ia_css_spctrl_cfg spctrl_cfg;
@@ -1702,16 +1693,14 @@ ia_css_init(struct device *dev, const st
my_css.flush = flush_func;
err = ia_css_rmgr_init();
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR(err);
return err;
}
IA_CSS_LOG("init: %d", my_css_save_initialized);
- if (!my_css_save_initialized)
- {
+ if (!my_css_save_initialized) {
my_css_save_initialized = true;
my_css_save.mode = sh_css_mode_working;
memset(my_css_save.stream_seeds, 0,
@@ -1739,19 +1728,16 @@ ia_css_init(struct device *dev, const st
gpio_reg_store(GPIO0_ID, _gpio_block_reg_do_0, 0);
err = ia_css_refcount_init(REFCOUNT_SIZE);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR(err);
return err;
}
err = sh_css_params_init();
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR(err);
return err;
}
- if (fw)
- {
+ if (fw) {
ia_css_unload_firmware(); /* in case we already had firmware loaded */
err = sh_css_load_firmware(dev, fw->data, fw->bytes);
if (err) {
@@ -1772,23 +1758,20 @@ ia_css_init(struct device *dev, const st
return -EINVAL;
err = ia_css_spctrl_load_fw(SP0_ID, &spctrl_cfg);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR(err);
return err;
}
#if WITH_PC_MONITORING
- if (!thread_alive)
- {
+ if (!thread_alive) {
thread_alive++;
sh_css_print("PC_MONITORING: %s() -- create thread DISABLED\n",
__func__);
spying_thread_create();
}
#endif
- if (!sh_css_hrt_system_is_idle())
- {
+ if (!sh_css_hrt_system_is_idle()) {
IA_CSS_LEAVE_ERR(-EBUSY);
return -EBUSY;
}
@@ -1821,7 +1804,8 @@ ia_css_init(struct device *dev, const st
}
int
-ia_css_enable_isys_event_queue(bool enable) {
+ia_css_enable_isys_event_queue(bool enable)
+{
if (sh_css_sp_is_running())
return -EBUSY;
sh_css_sp_enable_isys_event_queue(enable);
@@ -1842,7 +1826,8 @@ sh_css_flush(struct ia_css_acc_fw *fw)
* doing it from stream_create since we could run out of sp threads due to
* allocation on inactive pipelines. */
static int
-map_sp_threads(struct ia_css_stream *stream, bool map) {
+map_sp_threads(struct ia_css_stream *stream, bool map)
+{
struct ia_css_pipe *main_pipe = NULL;
struct ia_css_pipe *copy_pipe = NULL;
struct ia_css_pipe *capture_pipe = NULL;
@@ -1854,8 +1839,7 @@ map_sp_threads(struct ia_css_stream *str
IA_CSS_ENTER_PRIVATE("stream = %p, map = %s",
stream, map ? "true" : "false");
- if (!stream)
- {
+ if (!stream) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -1865,8 +1849,7 @@ map_sp_threads(struct ia_css_stream *str
ia_css_pipeline_map(main_pipe->pipe_num, map);
- switch (pipe_id)
- {
+ switch (pipe_id) {
case IA_CSS_PIPE_ID_PREVIEW:
copy_pipe = main_pipe->pipe_settings.preview.copy_pipe;
capture_pipe = main_pipe->pipe_settings.preview.capture_pipe;
@@ -1885,23 +1868,17 @@ map_sp_threads(struct ia_css_stream *str
}
if (acc_pipe)
- {
ia_css_pipeline_map(acc_pipe->pipe_num, map);
- }
if (capture_pipe)
- {
ia_css_pipeline_map(capture_pipe->pipe_num, map);
- }
/* Firmware expects copy pipe to be the last pipe mapped. (if needed) */
if (copy_pipe)
- {
ia_css_pipeline_map(copy_pipe->pipe_num, map);
- }
+
/* DH regular multi pipe - not continuous mode: map the next pipes too */
- if (!stream->config.continuous)
- {
+ if (!stream->config.continuous) {
int i;
for (i = 1; i < stream->num_pipes; i++)
@@ -1915,7 +1892,8 @@ map_sp_threads(struct ia_css_stream *str
/* creates a host pipeline skeleton for all pipes in a stream. Called during
* stream_create. */
static int
-create_host_pipeline_structure(struct ia_css_stream *stream) {
+create_host_pipeline_structure(struct ia_css_stream *stream)
+{
struct ia_css_pipe *copy_pipe = NULL, *capture_pipe = NULL;
struct ia_css_pipe *acc_pipe = NULL;
enum ia_css_pipe_id pipe_id;
@@ -1927,24 +1905,21 @@ create_host_pipeline_structure(struct ia
assert(stream);
IA_CSS_ENTER_PRIVATE("stream = %p", stream);
- if (!stream)
- {
+ if (!stream) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
main_pipe = stream->last_pipe;
assert(main_pipe);
- if (!main_pipe)
- {
+ if (!main_pipe) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
pipe_id = main_pipe->mode;
- switch (pipe_id)
- {
+ switch (pipe_id) {
case IA_CSS_PIPE_ID_PREVIEW:
copy_pipe = main_pipe->pipe_settings.preview.copy_pipe;
copy_pipe_delay = main_pipe->dvs_frame_delay;
@@ -1984,30 +1959,23 @@ create_host_pipeline_structure(struct ia
}
if (!(err) && copy_pipe)
- {
err = ia_css_pipeline_create(©_pipe->pipeline,
copy_pipe->mode,
copy_pipe->pipe_num,
copy_pipe_delay);
- }
if (!(err) && capture_pipe)
- {
err = ia_css_pipeline_create(&capture_pipe->pipeline,
capture_pipe->mode,
capture_pipe->pipe_num,
capture_pipe_delay);
- }
if (!(err) && acc_pipe)
- {
err = ia_css_pipeline_create(&acc_pipe->pipeline, acc_pipe->mode,
acc_pipe->pipe_num, main_pipe->dvs_frame_delay);
- }
/* DH regular multi pipe - not continuous mode: create the next pipelines too */
- if (!stream->config.continuous)
- {
+ if (!stream->config.continuous) {
int i;
for (i = 1; i < stream->num_pipes && 0 == err; i++) {
@@ -2026,7 +1994,8 @@ create_host_pipeline_structure(struct ia
/* creates a host pipeline for all pipes in a stream. Called during
* stream_start. */
static int
-create_host_pipeline(struct ia_css_stream *stream) {
+create_host_pipeline(struct ia_css_stream *stream)
+{
struct ia_css_pipe *copy_pipe = NULL, *capture_pipe = NULL;
struct ia_css_pipe *acc_pipe = NULL;
enum ia_css_pipe_id pipe_id;
@@ -2035,8 +2004,7 @@ create_host_pipeline(struct ia_css_strea
unsigned int max_input_width = 0;
IA_CSS_ENTER_PRIVATE("stream = %p", stream);
- if (!stream)
- {
+ if (!stream) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -2047,8 +2015,7 @@ create_host_pipeline(struct ia_css_strea
/* No continuous frame allocation for capture pipe. It uses the
* "main" pipe's frames. */
if ((pipe_id == IA_CSS_PIPE_ID_PREVIEW) ||
- (pipe_id == IA_CSS_PIPE_ID_VIDEO))
- {
+ (pipe_id == IA_CSS_PIPE_ID_VIDEO)) {
/* About pipe_id == IA_CSS_PIPE_ID_PREVIEW && stream->config.mode != IA_CSS_INPUT_MODE_MEMORY:
* The original condition pipe_id == IA_CSS_PIPE_ID_PREVIEW is too strong. E.g. in SkyCam (with memory
* based input frames) there is no continuous mode and thus no need for allocated continuous frames
@@ -2066,24 +2033,21 @@ create_host_pipeline(struct ia_css_strea
#if !defined(ISP2401)
/* old isys: need to allocate_mipi_frames() even in IA_CSS_PIPE_MODE_COPY */
- if (pipe_id != IA_CSS_PIPE_ID_ACC)
- {
+ if (pipe_id != IA_CSS_PIPE_ID_ACC) {
err = allocate_mipi_frames(main_pipe, &stream->info);
if (err)
goto ERR;
}
#elif defined(ISP2401)
if ((pipe_id != IA_CSS_PIPE_ID_ACC) &&
- (main_pipe->config.mode != IA_CSS_PIPE_MODE_COPY))
- {
+ (main_pipe->config.mode != IA_CSS_PIPE_MODE_COPY)) {
err = allocate_mipi_frames(main_pipe, &stream->info);
if (err)
goto ERR;
}
#endif
- switch (pipe_id)
- {
+ switch (pipe_id) {
case IA_CSS_PIPE_ID_PREVIEW:
copy_pipe = main_pipe->pipe_settings.preview.copy_pipe;
capture_pipe = main_pipe->pipe_settings.preview.capture_pipe;
@@ -2133,31 +2097,27 @@ create_host_pipeline(struct ia_css_strea
if (err)
goto ERR;
- if (copy_pipe)
- {
+ if (copy_pipe) {
err = create_host_copy_pipeline(copy_pipe, max_input_width,
main_pipe->continuous_frames[0]);
if (err)
goto ERR;
}
- if (capture_pipe)
- {
+ if (capture_pipe) {
err = create_host_capture_pipeline(capture_pipe);
if (err)
goto ERR;
}
- if (acc_pipe)
- {
+ if (acc_pipe) {
err = create_host_acc_pipeline(acc_pipe);
if (err)
goto ERR;
}
/* DH regular multi pipe - not continuous mode: create the next pipelines too */
- if (!stream->config.continuous)
- {
+ if (!stream->config.continuous) {
int i;
for (i = 1; i < stream->num_pipes && 0 == err; i++) {
@@ -2199,10 +2159,10 @@ static const struct ia_css_yuvpp_setting
static int
init_pipe_defaults(enum ia_css_pipe_mode mode,
struct ia_css_pipe *pipe,
- bool copy_pipe) {
+ bool copy_pipe)
+{
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_ERROR("NULL pipe parameter");
return -EINVAL;
}
@@ -2211,18 +2171,17 @@ init_pipe_defaults(enum ia_css_pipe_mode
memcpy(pipe, &default_pipe, sizeof(default_pipe));
/* TODO: JB should not be needed, but temporary backward reference */
- switch (mode)
- {
+ switch (mode) {
case IA_CSS_PIPE_MODE_PREVIEW:
pipe->mode = IA_CSS_PIPE_ID_PREVIEW;
memcpy(&pipe->pipe_settings.preview, &preview, sizeof(preview));
break;
case IA_CSS_PIPE_MODE_CAPTURE:
- if (copy_pipe) {
+ if (copy_pipe)
pipe->mode = IA_CSS_PIPE_ID_COPY;
- } else {
+ else
pipe->mode = IA_CSS_PIPE_ID_CAPTURE;
- }
+
memcpy(&pipe->pipe_settings.capture, &capture, sizeof(capture));
break;
case IA_CSS_PIPE_MODE_VIDEO:
@@ -2252,27 +2211,25 @@ pipe_global_init(void)
u8 i;
my_css.pipe_counter = 0;
- for (i = 0; i < IA_CSS_PIPELINE_NUM_MAX; i++) {
+ for (i = 0; i < IA_CSS_PIPELINE_NUM_MAX; i++)
my_css.all_pipes[i] = NULL;
- }
}
static int
pipe_generate_pipe_num(const struct ia_css_pipe *pipe,
- unsigned int *pipe_number) {
+ unsigned int *pipe_number)
+{
const u8 INVALID_PIPE_NUM = (uint8_t)~(0);
u8 pipe_num = INVALID_PIPE_NUM;
u8 i;
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_ERROR("NULL pipe parameter");
return -EINVAL;
}
/* Assign a new pipe_num .... search for empty place */
- for (i = 0; i < IA_CSS_PIPELINE_NUM_MAX; i++)
- {
+ for (i = 0; i < IA_CSS_PIPELINE_NUM_MAX; i++) {
if (!my_css.all_pipes[i]) {
/*position is reserved */
my_css.all_pipes[i] = (struct ia_css_pipe *)pipe;
@@ -2280,8 +2237,7 @@ pipe_generate_pipe_num(const struct ia_c
break;
}
}
- if (pipe_num == INVALID_PIPE_NUM)
- {
+ if (pipe_num == INVALID_PIPE_NUM) {
/* Max number of pipes already allocated */
IA_CSS_ERROR("Max number of pipes already created");
return -ENOSPC;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 604/699] media: staging: media: atomisp: Fix the rest of sh_css.c brace issues
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (602 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 603/699] media: staging: media: atomisp: Fix sh_css.c brace coding style issues Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 605/699] media: staging: media: atomisp: Replace if else clause with a ternary Greg Kroah-Hartman
` (98 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martiros Shakhzadyan, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <vrzh@vrzh.net>
[ Upstream commit 7394bf6d3c1e8316484fcf3a9d71daaab489f211 ]
Fix the remainder of brace coding style issues.
Signed-off-by: Martiros Shakhzadyan <vrzh@vrzh.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 1134 ++++++++++++-----------------
1 file changed, 498 insertions(+), 636 deletions(-)
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -1101,8 +1101,7 @@ sh_css_config_input_network(struct ia_cs
/* get the target input terminal */
sp_pipeline_input_terminal = &sh_css_sp_group.pipe_io[sp_thread_id].input;
- for (i = 0; i < IA_CSS_STREAM_MAX_ISYS_STREAM_PER_CH; i++)
- {
+ for (i = 0; i < IA_CSS_STREAM_MAX_ISYS_STREAM_PER_CH; i++) {
/* initialization */
memset((void *)(&isys_stream_descr), 0, sizeof(ia_css_isys_descr_t));
sp_pipeline_input_terminal->context.virtual_input_system_stream[i].valid = 0;
@@ -2161,7 +2160,6 @@ init_pipe_defaults(enum ia_css_pipe_mode
struct ia_css_pipe *pipe,
bool copy_pipe)
{
-
if (!pipe) {
IA_CSS_ERROR("NULL pipe parameter");
return -EINVAL;
@@ -2263,12 +2261,12 @@ pipe_release_pipe_num(unsigned int pipe_
static int
create_pipe(enum ia_css_pipe_mode mode,
struct ia_css_pipe **pipe,
- bool copy_pipe) {
+ bool copy_pipe)
+{
int err = 0;
struct ia_css_pipe *me;
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_ERROR("NULL pipe parameter");
return -EINVAL;
}
@@ -2278,15 +2276,13 @@ create_pipe(enum ia_css_pipe_mode mode,
return -ENOMEM;
err = init_pipe_defaults(mode, me, copy_pipe);
- if (err)
- {
+ if (err) {
kfree(me);
return err;
}
err = pipe_generate_pipe_num(me, &me->pipe_num);
- if (err)
- {
+ if (err) {
kfree(me);
return err;
}
@@ -2332,26 +2328,24 @@ static void sh_css_pipe_free_acc_binarie
}
int
-ia_css_pipe_destroy(struct ia_css_pipe *pipe) {
+ia_css_pipe_destroy(struct ia_css_pipe *pipe)
+{
int err = 0;
IA_CSS_ENTER("pipe = %p", pipe);
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
- if (pipe->stream)
- {
+ if (pipe->stream) {
IA_CSS_LOG("ia_css_stream_destroy not called!");
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
- switch (pipe->config.mode)
- {
+ switch (pipe->config.mode) {
case IA_CSS_PIPE_MODE_PREVIEW:
/* need to take into account that this function is also called
on the internal copy pipe */
@@ -2415,9 +2409,8 @@ ia_css_pipe_destroy(struct ia_css_pipe *
/* Temporarily, not every sh_css_pipe has an acc_extension. */
if (pipe->config.acc_extension)
- {
ia_css_pipe_unload_extension(pipe, pipe->config.acc_extension);
- }
+
kfree(pipe);
IA_CSS_LEAVE("err = %d", err);
return err;
@@ -2447,9 +2440,9 @@ ia_css_uninit(void)
ifmtr_set_if_blocking_mode_reset = true;
#endif
- if (!fw_explicitly_loaded) {
+ if (!fw_explicitly_loaded)
ia_css_unload_firmware();
- }
+
ia_css_spctrl_unload_fw(SP0_ID);
sh_css_sp_set_sp_running(false);
/* check and free any remaining mipi frames */
@@ -2636,7 +2629,8 @@ static int load_copy_binary(
static int
alloc_continuous_frames(
- struct ia_css_pipe *pipe, bool init_time) {
+ struct ia_css_pipe *pipe, bool init_time)
+{
int err = 0;
struct ia_css_frame_info ref_info;
enum ia_css_pipe_id pipe_id;
@@ -2646,8 +2640,7 @@ alloc_continuous_frames(
IA_CSS_ENTER_PRIVATE("pipe = %p, init_time = %d", pipe, init_time);
- if ((!pipe) || (!pipe->stream))
- {
+ if ((!pipe) || (!pipe->stream)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -2655,26 +2648,22 @@ alloc_continuous_frames(
pipe_id = pipe->mode;
continuous = pipe->stream->config.continuous;
- if (continuous)
- {
+ if (continuous) {
if (init_time) {
num_frames = pipe->stream->config.init_num_cont_raw_buf;
pipe->stream->continuous_pipe = pipe;
- } else
+ } else {
num_frames = pipe->stream->config.target_num_cont_raw_buf;
- } else
- {
+ }
+ } else {
num_frames = NUM_ONLINE_INIT_CONTINUOUS_FRAMES;
}
- if (pipe_id == IA_CSS_PIPE_ID_PREVIEW)
- {
+ if (pipe_id == IA_CSS_PIPE_ID_PREVIEW) {
ref_info = pipe->pipe_settings.preview.preview_binary.in_frame_info;
- } else if (pipe_id == IA_CSS_PIPE_ID_VIDEO)
- {
+ } else if (pipe_id == IA_CSS_PIPE_ID_VIDEO) {
ref_info = pipe->pipe_settings.video.video_binary.in_frame_info;
- } else
- {
+ } else {
/* should not happen */
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
@@ -2690,8 +2679,7 @@ alloc_continuous_frames(
#endif
#if !defined(HAS_NO_PACKED_RAW_PIXELS)
- if (pipe->stream->config.pack_raw_pixels)
- {
+ if (pipe->stream->config.pack_raw_pixels) {
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"alloc_continuous_frames() IA_CSS_FRAME_FORMAT_RAW_PACKED\n");
ref_info.format = IA_CSS_FRAME_FORMAT_RAW_PACKED;
@@ -2720,8 +2708,7 @@ alloc_continuous_frames(
else
idx = pipe->stream->config.init_num_cont_raw_buf;
- for (i = idx; i < NUM_CONTINUOUS_FRAMES; i++)
- {
+ for (i = idx; i < NUM_CONTINUOUS_FRAMES; i++) {
/* free previous frame */
if (pipe->continuous_frames[i]) {
ia_css_frame_free(pipe->continuous_frames[i]);
@@ -2751,14 +2738,16 @@ alloc_continuous_frames(
}
int
-ia_css_alloc_continuous_frame_remain(struct ia_css_stream *stream) {
+ia_css_alloc_continuous_frame_remain(struct ia_css_stream *stream)
+{
if (!stream)
return -EINVAL;
return alloc_continuous_frames(stream->continuous_pipe, false);
}
static int
-load_preview_binaries(struct ia_css_pipe *pipe) {
+load_preview_binaries(struct ia_css_pipe *pipe)
+{
struct ia_css_frame_info prev_in_info,
prev_bds_out_info,
prev_out_info,
@@ -2866,8 +2855,7 @@ load_preview_binaries(struct ia_css_pipe
* then the preview binary selection is done again.
*/
if (need_vf_pp &&
- (mycs->preview_binary.out_frame_info[0].format != IA_CSS_FRAME_FORMAT_YUV_LINE))
- {
+ (mycs->preview_binary.out_frame_info[0].format != IA_CSS_FRAME_FORMAT_YUV_LINE)) {
/* Preview step 2 */
if (pipe->vf_yuv_ds_input_info.res.width)
prev_vf_info = pipe->vf_yuv_ds_input_info;
@@ -2892,8 +2880,7 @@ load_preview_binaries(struct ia_css_pipe
return err;
}
- if (need_vf_pp)
- {
+ if (need_vf_pp) {
struct ia_css_binary_descr vf_pp_descr;
/* Viewfinder post-processing */
@@ -2924,8 +2911,7 @@ load_preview_binaries(struct ia_css_pipe
#endif
/* Copy */
- if (need_isp_copy_binary)
- {
+ if (need_isp_copy_binary) {
err = load_copy_binary(pipe,
&mycs->copy_binary,
&mycs->preview_binary);
@@ -2933,8 +2919,7 @@ load_preview_binaries(struct ia_css_pipe
return err;
}
- if (pipe->shading_table)
- {
+ if (pipe->shading_table) {
ia_css_shading_table_free(pipe->shading_table);
pipe->shading_table = NULL;
}
@@ -2949,11 +2934,11 @@ ia_css_binary_unload(struct ia_css_binar
}
static int
-unload_preview_binaries(struct ia_css_pipe *pipe) {
+unload_preview_binaries(struct ia_css_pipe *pipe)
+{
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || (pipe->mode != IA_CSS_PIPE_ID_PREVIEW))
- {
+ if ((!pipe) || (pipe->mode != IA_CSS_PIPE_ID_PREVIEW)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -3006,15 +2991,15 @@ static int add_firmwares(
struct ia_css_frame *in = NULL;
struct ia_css_frame *vf = NULL;
- if ((fw == last_fw) && (fw->info.isp.sp.enable.out_frame != 0)) {
+ if ((fw == last_fw) && (fw->info.isp.sp.enable.out_frame != 0))
out[0] = out_frame;
- }
- if (fw->info.isp.sp.enable.in_frame != 0) {
+
+ if (fw->info.isp.sp.enable.in_frame != 0)
in = in_frame;
- }
- if (fw->info.isp.sp.enable.out_frame != 0) {
+
+ if (fw->info.isp.sp.enable.out_frame != 0)
vf = vf_frame;
- }
+
ia_css_pipe_get_firmwares_stage_desc(&stage_desc, binary,
out, in, vf, fw, binary_mode);
err = ia_css_pipeline_create_and_add_stage(me,
@@ -3228,7 +3213,8 @@ static void sh_css_setup_queues(void)
static int
init_vf_frameinfo_defaults(struct ia_css_pipe *pipe,
- struct ia_css_frame *vf_frame, unsigned int idx) {
+ struct ia_css_frame *vf_frame, unsigned int idx)
+{
int err = 0;
unsigned int thread_id;
enum sh_css_queue_id queue_id;
@@ -3393,7 +3379,8 @@ ia_css_get_crop_offsets(
static int
init_in_frameinfo_memory_defaults(struct ia_css_pipe *pipe,
- struct ia_css_frame *frame, enum ia_css_frame_format format) {
+ struct ia_css_frame *frame, enum ia_css_frame_format format)
+{
struct ia_css_frame *in_frame;
int err = 0;
unsigned int thread_id;
@@ -3434,7 +3421,8 @@ init_in_frameinfo_memory_defaults(struct
static int
init_out_frameinfo_defaults(struct ia_css_pipe *pipe,
- struct ia_css_frame *out_frame, unsigned int idx) {
+ struct ia_css_frame *out_frame, unsigned int idx)
+{
int err = 0;
unsigned int thread_id;
enum sh_css_queue_id queue_id;
@@ -3665,14 +3653,14 @@ ERR:
}
static int
-create_host_acc_pipeline(struct ia_css_pipe *pipe) {
+create_host_acc_pipeline(struct ia_css_pipe *pipe)
+{
int err = 0;
const struct ia_css_fw_info *fw;
unsigned int i;
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || (!pipe->stream))
- {
+ if ((!pipe) || (!pipe->stream)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -3683,15 +3671,13 @@ create_host_acc_pipeline(struct ia_css_p
pipe->pipeline.pipe_qos_config = 0;
fw = pipe->vf_stage;
- for (i = 0; fw; fw = fw->next)
- {
+ for (i = 0; fw; fw = fw->next) {
err = sh_css_pipeline_add_acc_stage(&pipe->pipeline, fw);
if (err)
goto ERR;
}
- for (i = 0; i < pipe->config.num_acc_stages; i++)
- {
+ for (i = 0; i < pipe->config.num_acc_stages; i++) {
struct ia_css_fw_info *fw = pipe->config.acc_stages[i];
err = sh_css_pipeline_add_acc_stage(&pipe->pipeline, fw);
@@ -3708,7 +3694,8 @@ ERR:
/* Create stages for preview */
static int
-create_host_preview_pipeline(struct ia_css_pipe *pipe) {
+create_host_preview_pipeline(struct ia_css_pipe *pipe)
+{
struct ia_css_pipeline_stage *copy_stage = NULL;
struct ia_css_pipeline_stage *preview_stage = NULL;
struct ia_css_pipeline_stage *vf_pp_stage = NULL;
@@ -3728,8 +3715,7 @@ create_host_preview_pipeline(struct ia_c
#endif
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || (!pipe->stream) || (pipe->mode != IA_CSS_PIPE_ID_PREVIEW))
- {
+ if ((!pipe) || (!pipe->stream) || (pipe->mode != IA_CSS_PIPE_ID_PREVIEW)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -3757,16 +3743,14 @@ create_host_preview_pipeline(struct ia_c
/* Construct in_frame info (only in case we have dynamic input */
need_in_frameinfo_memory = pipe->stream->config.mode == IA_CSS_INPUT_MODE_MEMORY;
#endif
- if (need_in_frameinfo_memory)
- {
+ if (need_in_frameinfo_memory) {
err = init_in_frameinfo_memory_defaults(pipe, &me->in_frame,
IA_CSS_FRAME_FORMAT_RAW);
if (err)
goto ERR;
in_frame = &me->in_frame;
- } else
- {
+ } else {
in_frame = NULL;
}
@@ -3780,8 +3764,7 @@ create_host_preview_pipeline(struct ia_c
if (pipe->pipe_settings.preview.vf_pp_binary.info)
vf_pp_binary = &pipe->pipe_settings.preview.vf_pp_binary;
- if (pipe->pipe_settings.preview.copy_binary.info)
- {
+ if (pipe->pipe_settings.preview.copy_binary.info) {
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
out_frames, NULL, NULL);
@@ -3796,21 +3779,19 @@ create_host_preview_pipeline(struct ia_c
/* When continuous is enabled, configure in_frame with the
* last pipe, which is the copy pipe.
*/
- if (continuous || !online) {
+ if (continuous || !online)
in_frame = pipe->stream->last_pipe->continuous_frames[0];
- }
+
#else
in_frame = pipe->continuous_frames[0];
#endif
}
- if (vf_pp_binary)
- {
+ if (vf_pp_binary) {
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
ia_css_pipe_get_generic_stage_desc(&stage_desc, preview_binary,
out_frames, in_frame, NULL);
- } else
- {
+ } else {
ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
ia_css_pipe_get_generic_stage_desc(&stage_desc, preview_binary,
out_frames, in_frame, NULL);
@@ -3824,14 +3805,12 @@ create_host_preview_pipeline(struct ia_c
preview_stage->args.copy_vf =
preview_binary->info->sp.pipeline.mode == IA_CSS_BINARY_MODE_COPY;
preview_stage->args.copy_output = !preview_stage->args.copy_vf;
- if (preview_stage->args.copy_vf && !preview_stage->args.out_vf_frame)
- {
+ if (preview_stage->args.copy_vf && !preview_stage->args.out_vf_frame) {
/* in case of copy, use the vf frame as output frame */
preview_stage->args.out_vf_frame =
preview_stage->args.out_frame[0];
}
- if (vf_pp_binary)
- {
+ if (vf_pp_binary) {
if (preview_binary->info->sp.pipeline.mode == IA_CSS_BINARY_MODE_COPY)
in_frame = preview_stage->args.out_vf_frame;
else
@@ -3871,7 +3850,8 @@ static void send_raw_frames(struct ia_cs
}
static int
-preview_start(struct ia_css_pipe *pipe) {
+preview_start(struct ia_css_pipe *pipe)
+{
int err = 0;
struct ia_css_pipe *copy_pipe, *capture_pipe;
struct ia_css_pipe *acc_pipe;
@@ -3881,8 +3861,7 @@ preview_start(struct ia_css_pipe *pipe)
const struct ia_css_isp_parameters *params = NULL;
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || (!pipe->stream) || (pipe->mode != IA_CSS_PIPE_ID_PREVIEW))
- {
+ if ((!pipe) || (!pipe->stream) || (pipe->mode != IA_CSS_PIPE_ID_PREVIEW)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -3909,8 +3888,7 @@ preview_start(struct ia_css_pipe *pipe)
ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(pipe), &thread_id);
copy_ovrd = 1 << thread_id;
- if (pipe->stream->cont_capt)
- {
+ if (pipe->stream->cont_capt) {
ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(capture_pipe),
&thread_id);
copy_ovrd |= 1 << thread_id;
@@ -3923,8 +3901,7 @@ preview_start(struct ia_css_pipe *pipe)
}
/* Construct and load the copy pipe */
- if (pipe->stream->config.continuous)
- {
+ if (pipe->stream->config.continuous) {
sh_css_sp_init_pipeline(©_pipe->pipeline,
IA_CSS_PIPE_ID_COPY,
(uint8_t)ia_css_pipe_get_pipe_num(copy_pipe),
@@ -3945,8 +3922,7 @@ preview_start(struct ia_css_pipe *pipe)
}
/* Construct and load the capture pipe */
- if (pipe->stream->cont_capt)
- {
+ if (pipe->stream->cont_capt) {
sh_css_sp_init_pipeline(&capture_pipe->pipeline,
IA_CSS_PIPE_ID_CAPTURE,
(uint8_t)ia_css_pipe_get_pipe_num(capture_pipe),
@@ -3964,8 +3940,7 @@ preview_start(struct ia_css_pipe *pipe)
params);
}
- if (acc_pipe)
- {
+ if (acc_pipe) {
sh_css_sp_init_pipeline(&acc_pipe->pipeline,
IA_CSS_PIPE_ID_ACC,
(uint8_t)ia_css_pipe_get_pipe_num(acc_pipe),
@@ -3991,7 +3966,8 @@ preview_start(struct ia_css_pipe *pipe)
int
ia_css_pipe_enqueue_buffer(struct ia_css_pipe *pipe,
- const struct ia_css_buffer *buffer) {
+ const struct ia_css_buffer *buffer)
+{
int return_err = 0;
unsigned int thread_id;
enum sh_css_queue_id queue_id;
@@ -4006,8 +3982,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
IA_CSS_ENTER("pipe=%p, buffer=%p", pipe, buffer);
- if ((!pipe) || (!buffer))
- {
+ if ((!pipe) || (!buffer)) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
@@ -4016,8 +3991,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
/* following code will be enabled when IA_CSS_BUFFER_TYPE_SEC_OUTPUT_FRAME
is removed */
#if 0
- if (buf_type == IA_CSS_BUFFER_TYPE_OUTPUT_FRAME)
- {
+ if (buf_type == IA_CSS_BUFFER_TYPE_OUTPUT_FRAME) {
bool found_pipe = false;
for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++) {
@@ -4031,8 +4005,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
if (!found_pipe)
return -EINVAL;
}
- if (buf_type == IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME)
- {
+ if (buf_type == IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME) {
bool found_pipe = false;
for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++) {
@@ -4055,34 +4028,29 @@ ia_css_pipe_enqueue_buffer(struct ia_css
assert(buf_type < IA_CSS_NUM_DYNAMIC_BUFFER_TYPE);
if ((buf_type == IA_CSS_BUFFER_TYPE_INVALID) ||
(buf_type >= IA_CSS_NUM_DYNAMIC_BUFFER_TYPE) ||
- (pipe_id >= IA_CSS_PIPE_ID_NUM))
- {
+ (pipe_id >= IA_CSS_PIPE_ID_NUM)) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
ret_err = ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(pipe), &thread_id);
- if (!ret_err)
- {
+ if (!ret_err) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
ret_err = ia_css_query_internal_queue_id(buf_type, thread_id, &queue_id);
- if (!ret_err)
- {
+ if (!ret_err) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
- if ((queue_id <= SH_CSS_INVALID_QUEUE_ID) || (queue_id >= SH_CSS_MAX_NUM_QUEUES))
- {
+ if ((queue_id <= SH_CSS_INVALID_QUEUE_ID) || (queue_id >= SH_CSS_MAX_NUM_QUEUES)) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
- if (!sh_css_sp_is_running())
- {
+ if (!sh_css_sp_is_running()) {
IA_CSS_LOG("SP is not running!");
IA_CSS_LEAVE_ERR(-EBUSY);
/* SP is not running. The queues are not valid */
@@ -4100,24 +4068,21 @@ ia_css_pipe_enqueue_buffer(struct ia_css
ddr_buffer.cookie_ptr = buffer->driver_cookie;
ddr_buffer.timing_data = buffer->timing_data;
- if (buf_type == IA_CSS_BUFFER_TYPE_3A_STATISTICS)
- {
+ if (buf_type == IA_CSS_BUFFER_TYPE_3A_STATISTICS) {
if (!buffer->data.stats_3a) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
ddr_buffer.kernel_ptr = HOST_ADDRESS(buffer->data.stats_3a);
ddr_buffer.payload.s3a = *buffer->data.stats_3a;
- } else if (buf_type == IA_CSS_BUFFER_TYPE_DIS_STATISTICS)
- {
+ } else if (buf_type == IA_CSS_BUFFER_TYPE_DIS_STATISTICS) {
if (!buffer->data.stats_dvs) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
ddr_buffer.kernel_ptr = HOST_ADDRESS(buffer->data.stats_dvs);
ddr_buffer.payload.dis = *buffer->data.stats_dvs;
- } else if (buf_type == IA_CSS_BUFFER_TYPE_METADATA)
- {
+ } else if (buf_type == IA_CSS_BUFFER_TYPE_METADATA) {
if (!buffer->data.metadata) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
@@ -4128,8 +4093,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
|| (buf_type == IA_CSS_BUFFER_TYPE_OUTPUT_FRAME)
|| (buf_type == IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME)
|| (buf_type == IA_CSS_BUFFER_TYPE_SEC_OUTPUT_FRAME)
- || (buf_type == IA_CSS_BUFFER_TYPE_SEC_VF_OUTPUT_FRAME))
- {
+ || (buf_type == IA_CSS_BUFFER_TYPE_SEC_VF_OUTPUT_FRAME)) {
if (!buffer->data.frame) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
@@ -4164,8 +4128,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
assert(h_vbuf);
assert(h_vbuf->vptr != 0x0);
- if ((!h_vbuf) || (h_vbuf->vptr == 0x0))
- {
+ if ((!h_vbuf) || (h_vbuf->vptr == 0x0)) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
@@ -4175,8 +4138,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
sizeof(struct sh_css_hmm_buffer));
if ((buf_type == IA_CSS_BUFFER_TYPE_3A_STATISTICS)
|| (buf_type == IA_CSS_BUFFER_TYPE_DIS_STATISTICS)
- || (buf_type == IA_CSS_BUFFER_TYPE_LACE_STATISTICS))
- {
+ || (buf_type == IA_CSS_BUFFER_TYPE_LACE_STATISTICS)) {
if (!pipeline) {
ia_css_rmgr_rel_vbuf(hmm_buffer_pool, &h_vbuf);
IA_CSS_LOG("pipeline is empty!");
@@ -4199,8 +4161,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
|| (buf_type == IA_CSS_BUFFER_TYPE_VF_OUTPUT_FRAME)
|| (buf_type == IA_CSS_BUFFER_TYPE_SEC_OUTPUT_FRAME)
|| (buf_type == IA_CSS_BUFFER_TYPE_SEC_VF_OUTPUT_FRAME)
- || (buf_type == IA_CSS_BUFFER_TYPE_METADATA))
- {
+ || (buf_type == IA_CSS_BUFFER_TYPE_METADATA)) {
return_err = ia_css_bufq_enqueue_buffer(thread_id,
queue_id,
(uint32_t)h_vbuf->vptr);
@@ -4214,8 +4175,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
#endif
}
- if (!return_err)
- {
+ if (!return_err) {
if (sh_css_hmm_buffer_record_acquire(
h_vbuf, buf_type,
HOST_ADDRESS(ddr_buffer.kernel_ptr))) {
@@ -4230,8 +4190,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
* Tell the SP which queues are not empty,
* by sending the software event.
*/
- if (!return_err)
- {
+ if (!return_err) {
if (!sh_css_sp_is_running()) {
/* SP is not running. The queues are not valid */
IA_CSS_LOG("SP is not running!");
@@ -4243,8 +4202,7 @@ ia_css_pipe_enqueue_buffer(struct ia_css
(uint8_t)thread_id,
queue_id,
0);
- } else
- {
+ } else {
ia_css_rmgr_rel_vbuf(hmm_buffer_pool, &h_vbuf);
IA_CSS_ERROR("buffer not enqueued");
}
@@ -4259,7 +4217,8 @@ ia_css_pipe_enqueue_buffer(struct ia_css
*/
int
ia_css_pipe_dequeue_buffer(struct ia_css_pipe *pipe,
- struct ia_css_buffer *buffer) {
+ struct ia_css_buffer *buffer)
+{
int return_err;
enum sh_css_queue_id queue_id;
ia_css_ptr ddr_buffer_addr = (ia_css_ptr)0;
@@ -4272,8 +4231,7 @@ ia_css_pipe_dequeue_buffer(struct ia_css
IA_CSS_ENTER("pipe=%p, buffer=%p", pipe, buffer);
- if ((!pipe) || (!buffer))
- {
+ if ((!pipe) || (!buffer)) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
@@ -4287,27 +4245,23 @@ ia_css_pipe_dequeue_buffer(struct ia_css
ddr_buffer.kernel_ptr = 0;
ret_err = ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(pipe), &thread_id);
- if (!ret_err)
- {
+ if (!ret_err) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
ret_err = ia_css_query_internal_queue_id(buf_type, thread_id, &queue_id);
- if (!ret_err)
- {
+ if (!ret_err) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
- if ((queue_id <= SH_CSS_INVALID_QUEUE_ID) || (queue_id >= SH_CSS_MAX_NUM_QUEUES))
- {
+ if ((queue_id <= SH_CSS_INVALID_QUEUE_ID) || (queue_id >= SH_CSS_MAX_NUM_QUEUES)) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
- if (!sh_css_sp_is_running())
- {
+ if (!sh_css_sp_is_running()) {
IA_CSS_LOG("SP is not running!");
IA_CSS_LEAVE_ERR(-EBUSY);
/* SP is not running. The queues are not valid */
@@ -4317,8 +4271,7 @@ ia_css_pipe_dequeue_buffer(struct ia_css
return_err = ia_css_bufq_dequeue_buffer(queue_id,
(uint32_t *)&ddr_buffer_addr);
- if (!return_err)
- {
+ if (!return_err) {
struct ia_css_frame *frame;
struct sh_css_hmm_buffer_record *hmm_buffer_record = NULL;
@@ -4460,8 +4413,7 @@ ia_css_pipe_dequeue_buffer(struct ia_css
* Tell the SP which queues are not full,
* by sending the software event.
*/
- if (!return_err)
- {
+ if (!return_err) {
if (!sh_css_sp_is_running()) {
IA_CSS_LOG("SP is not running!");
IA_CSS_LEAVE_ERR(-EBUSY);
@@ -4510,12 +4462,14 @@ static enum ia_css_event_type convert_ev
};
int
-ia_css_dequeue_event(struct ia_css_event *event) {
+ia_css_dequeue_event(struct ia_css_event *event)
+{
return ia_css_dequeue_psys_event(event);
}
int
-ia_css_dequeue_psys_event(struct ia_css_event *event) {
+ia_css_dequeue_psys_event(struct ia_css_event *event)
+{
enum ia_css_pipe_id pipe_id = 0;
u8 payload[4] = {0, 0, 0, 0};
int ret_err;
@@ -4530,11 +4484,9 @@ ia_css_dequeue_psys_event(struct ia_css_
if (!event)
return -EINVAL;
+ /* SP is not running. The queues are not valid */
if (!sh_css_sp_is_running())
- {
- /* SP is not running. The queues are not valid */
return -EBUSY;
- }
/* dequeue the event (if any) from the psys event queue */
ret_err = ia_css_bufq_dequeue_psys_event(payload);
@@ -4561,8 +4513,7 @@ ia_css_dequeue_psys_event(struct ia_css_
event->timer_code = 0;
event->timer_subcode = 0;
- if (event->type == IA_CSS_EVENT_TYPE_TIMER)
- {
+ if (event->type == IA_CSS_EVENT_TYPE_TIMER) {
/* timer event ??? get the 2nd event and decode the data into the event struct */
u32 tmp_data;
/* 1st event: LSB 16-bit timer data and code */
@@ -4586,37 +4537,32 @@ ia_css_dequeue_psys_event(struct ia_css_
tmp_data = ((payload[1] & 0xFF) | ((payload[3] & 0xFF) << 8));
event->timer_data |= (tmp_data << 16);
event->timer_subcode = payload[2];
- }
+ } else {
/* It's a non timer event. So clear first half of the timer event data.
* If the second part of the TIMER event is not received, we discard
* the first half of the timer data and process the non timer event without
* affecting the flow. So the non timer event falls through
* the code. */
- else {
event->timer_data = 0;
event->timer_code = 0;
event->timer_subcode = 0;
IA_CSS_ERROR("Missing 2nd timer event. Timer event discarded");
}
}
- if (event->type == IA_CSS_EVENT_TYPE_PORT_EOF)
- {
+ if (event->type == IA_CSS_EVENT_TYPE_PORT_EOF) {
event->port = (enum mipi_port_id)payload[1];
event->exp_id = payload[3];
- } else if (event->type == IA_CSS_EVENT_TYPE_FW_WARNING)
- {
+ } else if (event->type == IA_CSS_EVENT_TYPE_FW_WARNING) {
event->fw_warning = (enum ia_css_fw_warning)payload[1];
/* exp_id is only available in these warning types */
if (event->fw_warning == IA_CSS_FW_WARNING_EXP_ID_LOCKED ||
event->fw_warning == IA_CSS_FW_WARNING_TAG_EXP_ID_FAILED)
event->exp_id = payload[3];
- } else if (event->type == IA_CSS_EVENT_TYPE_FW_ASSERT)
- {
+ } else if (event->type == IA_CSS_EVENT_TYPE_FW_ASSERT) {
event->fw_assert_module_id = payload[1]; /* module */
event->fw_assert_line_no = (payload[2] << 8) + payload[3];
/* payload[2] is line_no>>8, payload[3] is line_no&0xff */
- } else if (event->type != IA_CSS_EVENT_TYPE_TIMER)
- {
+ } else if (event->type != IA_CSS_EVENT_TYPE_TIMER) {
/* pipe related events.
* payload[1] contains the pipe_num,
* payload[2] contains the pipe_id. These are different. */
@@ -4666,7 +4612,8 @@ ia_css_dequeue_psys_event(struct ia_css_
}
int
-ia_css_dequeue_isys_event(struct ia_css_event *event) {
+ia_css_dequeue_isys_event(struct ia_css_event *event)
+{
u8 payload[4] = {0, 0, 0, 0};
int err = 0;
@@ -4676,11 +4623,9 @@ ia_css_dequeue_isys_event(struct ia_css_
if (!event)
return -EINVAL;
+ /* SP is not running. The queues are not valid */
if (!sh_css_sp_is_running())
- {
- /* SP is not running. The queues are not valid */
return -EBUSY;
- }
err = ia_css_bufq_dequeue_isys_event(payload);
if (err)
@@ -4713,7 +4658,8 @@ acc_start(struct ia_css_pipe *pipe)
}
static int
-sh_css_pipe_start(struct ia_css_stream *stream) {
+sh_css_pipe_start(struct ia_css_stream *stream)
+{
int err = 0;
struct ia_css_pipe *pipe;
@@ -4722,22 +4668,19 @@ sh_css_pipe_start(struct ia_css_stream *
IA_CSS_ENTER_PRIVATE("stream = %p", stream);
- if (!stream)
- {
+ if (!stream) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
pipe = stream->last_pipe;
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
pipe_id = pipe->mode;
- if (stream->started)
- {
+ if (stream->started) {
IA_CSS_WARNING("Cannot start stream that is already started");
IA_CSS_LEAVE_ERR(err);
return err;
@@ -4745,8 +4688,7 @@ sh_css_pipe_start(struct ia_css_stream *
pipe->stop_requested = false;
- switch (pipe_id)
- {
+ switch (pipe_id) {
case IA_CSS_PIPE_ID_PREVIEW:
err = preview_start(pipe);
break;
@@ -4766,8 +4708,7 @@ sh_css_pipe_start(struct ia_css_stream *
err = -EINVAL;
}
/* DH regular multi pipe - not continuous mode: start the next pipes too */
- if (!stream->config.continuous)
- {
+ if (!stream->config.continuous) {
int i;
for (i = 1; i < stream->num_pipes && 0 == err ; i++) {
@@ -4797,8 +4738,7 @@ sh_css_pipe_start(struct ia_css_stream *
}
}
}
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
@@ -4808,8 +4748,7 @@ sh_css_pipe_start(struct ia_css_stream *
* don't use ISP parameters anyway. So this should be okay.
* The SP binary (jpeg) copy does not use any parameters.
*/
- if (!copy_on_sp(pipe))
- {
+ if (!copy_on_sp(pipe)) {
sh_css_invalidate_params(stream);
err = sh_css_param_update_isp_params(pipe,
stream->isp_params_configs, true, NULL);
@@ -4823,8 +4762,7 @@ sh_css_pipe_start(struct ia_css_stream *
ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(pipe), &thread_id);
- if (!sh_css_sp_is_running())
- {
+ if (!sh_css_sp_is_running()) {
IA_CSS_LEAVE_ERR_PRIVATE(-EBUSY);
/* SP is not running. The queues are not valid */
return -EBUSY;
@@ -4833,8 +4771,7 @@ sh_css_pipe_start(struct ia_css_stream *
(uint8_t)thread_id, 0, 0);
/* DH regular multi pipe - not continuous mode: enqueue event to the next pipes too */
- if (!stream->config.continuous)
- {
+ if (!stream->config.continuous) {
int i;
for (i = 1; i < stream->num_pipes; i++) {
@@ -4848,8 +4785,7 @@ sh_css_pipe_start(struct ia_css_stream *
}
/* in case of continuous capture mode, we also start capture thread and copy thread*/
- if (pipe->stream->config.continuous)
- {
+ if (pipe->stream->config.continuous) {
struct ia_css_pipe *copy_pipe = NULL;
if (pipe_id == IA_CSS_PIPE_ID_PREVIEW)
@@ -4868,8 +4804,7 @@ sh_css_pipe_start(struct ia_css_stream *
IA_CSS_PSYS_SW_EVENT_START_STREAM,
(uint8_t)thread_id, 0, 0);
}
- if (pipe->stream->cont_capt)
- {
+ if (pipe->stream->cont_capt) {
struct ia_css_pipe *capture_pipe = NULL;
if (pipe_id == IA_CSS_PIPE_ID_PREVIEW)
@@ -4890,8 +4825,7 @@ sh_css_pipe_start(struct ia_css_stream *
}
/* in case of PREVIEW mode, check whether QOS acc_pipe is available, then start the qos pipe */
- if (pipe_id == IA_CSS_PIPE_ID_PREVIEW)
- {
+ if (pipe_id == IA_CSS_PIPE_ID_PREVIEW) {
struct ia_css_pipe *acc_pipe = NULL;
acc_pipe = pipe->pipe_settings.preview.acc_pipe;
@@ -4942,7 +4876,8 @@ sh_css_continuous_is_enabled(uint8_t pip
/* ISP2400 */
int
ia_css_stream_get_max_buffer_depth(struct ia_css_stream *stream,
- int *buffer_depth) {
+ int *buffer_depth)
+{
if (!buffer_depth)
return -EINVAL;
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_stream_get_max_buffer_depth() enter: void\n");
@@ -4952,7 +4887,8 @@ ia_css_stream_get_max_buffer_depth(struc
}
int
-ia_css_stream_set_buffer_depth(struct ia_css_stream *stream, int buffer_depth) {
+ia_css_stream_set_buffer_depth(struct ia_css_stream *stream, int buffer_depth)
+{
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_stream_set_buffer_depth() enter: num_frames=%d\n", buffer_depth);
(void)stream;
if (buffer_depth > NUM_CONTINUOUS_FRAMES || buffer_depth < 1)
@@ -4966,7 +4902,8 @@ ia_css_stream_set_buffer_depth(struct ia
/* ISP2401 */
int
ia_css_stream_get_buffer_depth(struct ia_css_stream *stream,
- int *buffer_depth) {
+ int *buffer_depth)
+{
if (!buffer_depth)
return -EINVAL;
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_stream_get_buffer_depth() enter: void\n");
@@ -4991,8 +4928,7 @@ sh_css_pipes_stop(struct ia_css_stream *
int i;
assert(stream);
- if (!stream)
- {
+ if (!stream) {
IA_CSS_LOG("stream does NOT exist!");
err = -EINVAL;
goto ERR;
@@ -5000,8 +4936,7 @@ sh_css_pipes_stop(struct ia_css_stream *
main_pipe = stream->last_pipe;
assert(main_pipe);
- if (!main_pipe)
- {
+ if (!main_pipe) {
IA_CSS_LOG("main_pipe does NOT exist!");
err = -EINVAL;
goto ERR;
@@ -5014,8 +4949,7 @@ sh_css_pipes_stop(struct ia_css_stream *
* Stop all "ia_css_pipe" instances in this target
* "ia_css_stream" instance.
*/
- for (i = 0; i < stream->num_pipes; i++)
- {
+ for (i = 0; i < stream->num_pipes; i++) {
/* send the "stop" request to the "ia_css_pipe" instance */
IA_CSS_LOG("Send the stop-request to the pipe: pipe_id=%d",
stream->pipes[i]->pipeline.pipe_id);
@@ -5049,8 +4983,7 @@ sh_css_pipes_stop(struct ia_css_stream *
*
* We need to stop this "Copy Pipe", as well.
*/
- if (main_pipe->stream->config.continuous)
- {
+ if (main_pipe->stream->config.continuous) {
struct ia_css_pipe *copy_pipe = NULL;
/* get the reference to "Copy Pipe" */
@@ -5226,8 +5159,7 @@ sh_css_pipe_get_shading_info(struct ia_c
binary = ia_css_pipe_get_shading_correction_binary(pipe);
- if (binary)
- {
+ if (binary) {
err = ia_css_binary_get_shading_info(binary,
IA_CSS_SHADING_CORRECTION_TYPE_1,
pipe->required_bds_factor,
@@ -5237,8 +5169,7 @@ sh_css_pipe_get_shading_info(struct ia_c
/* Other function calls can be added here when other shading correction types will be added
* in the future.
*/
- } else
- {
+ } else {
/* When the pipe does not have a binary which has the shading
* correction, this function does not need to fill the shading
* information. It is not a error case, and then
@@ -5251,7 +5182,8 @@ sh_css_pipe_get_shading_info(struct ia_c
static int
sh_css_pipe_get_grid_info(struct ia_css_pipe *pipe,
- struct ia_css_grid_info *info) {
+ struct ia_css_grid_info *info)
+{
int err = 0;
struct ia_css_binary *binary = NULL;
@@ -5262,30 +5194,27 @@ sh_css_pipe_get_grid_info(struct ia_css_
binary = ia_css_pipe_get_s3a_binary(pipe);
- if (binary)
- {
+ if (binary) {
err = ia_css_binary_3a_grid_info(binary, info, pipe);
if (err)
goto ERR;
- } else
+ } else {
memset(&info->s3a_grid, 0, sizeof(info->s3a_grid));
+ }
binary = ia_css_pipe_get_sdis_binary(pipe);
- if (binary)
- {
+ if (binary) {
ia_css_binary_dvs_grid_info(binary, info, pipe);
ia_css_binary_dvs_stat_grid_info(binary, info, pipe);
- } else
- {
+ } else {
memset(&info->dvs_grid.dvs_grid_info, 0,
sizeof(info->dvs_grid.dvs_grid_info));
memset(&info->dvs_grid.dvs_stat_grid_info, 0,
sizeof(info->dvs_grid.dvs_stat_grid_info));
}
- if (binary)
- {
+ if (binary) {
/* copy pipe does not have ISP binary*/
info->isp_in_width = binary->internal_frame_info.res.width;
info->isp_in_height = binary->internal_frame_info.res.height;
@@ -5305,7 +5234,8 @@ ERR :
*/
static int
ia_css_pipe_check_format(struct ia_css_pipe *pipe,
- enum ia_css_frame_format format) {
+ enum ia_css_frame_format format)
+{
const enum ia_css_frame_format *supported_formats;
int number_of_formats;
int found = 0;
@@ -5313,8 +5243,7 @@ ia_css_pipe_check_format(struct ia_css_p
IA_CSS_ENTER_PRIVATE("");
- if (NULL == pipe || NULL == pipe->pipe_settings.video.video_binary.info)
- {
+ if (NULL == pipe || NULL == pipe->pipe_settings.video.video_binary.info) {
IA_CSS_ERROR("Pipe or binary info is not set");
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
@@ -5323,15 +5252,13 @@ ia_css_pipe_check_format(struct ia_css_p
supported_formats = pipe->pipe_settings.video.video_binary.info->output_formats;
number_of_formats = sizeof(pipe->pipe_settings.video.video_binary.info->output_formats) / sizeof(enum ia_css_frame_format);
- for (i = 0; i < number_of_formats && !found; i++)
- {
+ for (i = 0; i < number_of_formats && !found; i++) {
if (supported_formats[i] == format) {
found = 1;
break;
}
}
- if (!found)
- {
+ if (!found) {
IA_CSS_ERROR("Requested format is not supported by binary");
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
@@ -5483,10 +5410,10 @@ static int load_video_binaries(struct ia
&mycs->video_binary);
if (err) {
- if (video_vf_info) {
- /* This will do another video binary lookup later for YUV_LINE format*/
+ /* This will do another video binary lookup later for YUV_LINE format*/
+ if (video_vf_info)
need_vf_pp = true;
- } else
+ else
return err;
} else if (video_vf_info) {
/* The first video binary lookup is successful, but we may
@@ -5649,13 +5576,13 @@ static int load_video_binaries(struct ia
}
static int
-unload_video_binaries(struct ia_css_pipe *pipe) {
+unload_video_binaries(struct ia_css_pipe *pipe)
+{
unsigned int i;
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || (pipe->mode != IA_CSS_PIPE_ID_VIDEO))
- {
+ if ((!pipe) || (pipe->mode != IA_CSS_PIPE_ID_VIDEO)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -5805,31 +5732,29 @@ static int
sh_css_pipe_configure_viewfinder(struct ia_css_pipe *pipe, unsigned int width,
unsigned int height, unsigned int min_width,
enum ia_css_frame_format format,
- unsigned int idx) {
+ unsigned int idx)
+{
int err = 0;
IA_CSS_ENTER_PRIVATE("pipe = %p, width = %d, height = %d, min_width = %d, format = %d, idx = %d\n",
pipe, width, height, min_width, format, idx);
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
err = ia_css_util_check_res(width, height);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
if (pipe->vf_output_info[idx].res.width != width ||
pipe->vf_output_info[idx].res.height != height ||
pipe->vf_output_info[idx].format != format)
- {
ia_css_frame_info_init(&pipe->vf_output_info[idx], width, height,
format, min_width);
- }
+
IA_CSS_LEAVE_ERR_PRIVATE(0);
return 0;
}
@@ -6209,7 +6134,8 @@ static int load_primary_binaries(
}
static int
-allocate_delay_frames(struct ia_css_pipe *pipe) {
+allocate_delay_frames(struct ia_css_pipe *pipe)
+{
unsigned int num_delay_frames = 0, i = 0;
unsigned int dvs_frame_delay = 0;
struct ia_css_frame_info ref_info;
@@ -6219,8 +6145,7 @@ allocate_delay_frames(struct ia_css_pipe
IA_CSS_ENTER_PRIVATE("");
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_ERROR("Invalid args - pipe %p", pipe);
return -EINVAL;
}
@@ -6231,8 +6156,7 @@ allocate_delay_frames(struct ia_css_pipe
if (dvs_frame_delay > 0)
num_delay_frames = dvs_frame_delay + 1;
- switch (mode)
- {
+ switch (mode) {
case IA_CSS_PIPE_ID_CAPTURE: {
struct ia_css_capture_settings *mycs_capture = &pipe->pipe_settings.capture;
(void)mycs_capture;
@@ -6284,8 +6208,7 @@ allocate_delay_frames(struct ia_css_pipe
ref_info.raw_bit_depth = SH_CSS_REF_BIT_DEPTH;
assert(num_delay_frames <= MAX_NUM_VIDEO_DELAY_FRAMES);
- for (i = 0; i < num_delay_frames; i++)
- {
+ for (i = 0; i < num_delay_frames; i++) {
err = ia_css_frame_allocate_from_info(&delay_frames[i], &ref_info);
if (err)
return err;
@@ -6295,7 +6218,8 @@ allocate_delay_frames(struct ia_css_pipe
}
static int load_advanced_binaries(
- struct ia_css_pipe *pipe) {
+ struct ia_css_pipe *pipe)
+{
struct ia_css_frame_info pre_in_info, gdc_in_info,
post_in_info, post_out_info,
vf_info, *vf_pp_in_info, *pipe_out_info,
@@ -6412,7 +6336,8 @@ static int load_advanced_binaries(
}
static int load_bayer_isp_binaries(
- struct ia_css_pipe *pipe) {
+ struct ia_css_pipe *pipe)
+{
struct ia_css_frame_info pre_isp_in_info, *pipe_out_info;
int err = 0;
struct ia_css_binary_descr pre_de_descr;
@@ -6441,7 +6366,8 @@ static int load_bayer_isp_binaries(
}
static int load_low_light_binaries(
- struct ia_css_pipe *pipe) {
+ struct ia_css_pipe *pipe)
+{
struct ia_css_frame_info pre_in_info, anr_in_info,
post_in_info, post_out_info,
vf_info, *pipe_vf_out_info, *pipe_out_info,
@@ -6579,7 +6505,8 @@ static bool copy_on_sp(struct ia_css_pip
}
static int load_capture_binaries(
- struct ia_css_pipe *pipe) {
+ struct ia_css_pipe *pipe)
+{
int err = 0;
bool must_be_raw;
@@ -6647,13 +6574,13 @@ static int load_capture_binaries(
}
static int
-unload_capture_binaries(struct ia_css_pipe *pipe) {
+unload_capture_binaries(struct ia_css_pipe *pipe)
+{
unsigned int i;
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || ((pipe->mode != IA_CSS_PIPE_ID_CAPTURE) && (pipe->mode != IA_CSS_PIPE_ID_COPY)))
- {
+ if ((!pipe) || ((pipe->mode != IA_CSS_PIPE_ID_CAPTURE) && (pipe->mode != IA_CSS_PIPE_ID_COPY))) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -6681,7 +6608,8 @@ unload_capture_binaries(struct ia_css_pi
static bool
need_downscaling(const struct ia_css_resolution in_res,
- const struct ia_css_resolution out_res) {
+ const struct ia_css_resolution out_res)
+{
if (in_res.width > out_res.width || in_res.height > out_res.height)
return true;
@@ -6689,7 +6617,8 @@ need_downscaling(const struct ia_css_res
}
static bool
-need_yuv_scaler_stage(const struct ia_css_pipe *pipe) {
+need_yuv_scaler_stage(const struct ia_css_pipe *pipe)
+{
unsigned int i;
struct ia_css_resolution in_res, out_res;
@@ -6731,7 +6660,8 @@ static int ia_css_pipe_create_cas_scaler
struct ia_css_frame_info *cas_scaler_in_info,
struct ia_css_frame_info *cas_scaler_out_info,
struct ia_css_frame_info *cas_scaler_vf_info,
- struct ia_css_cas_binary_descr *descr) {
+ struct ia_css_cas_binary_descr *descr)
+{
unsigned int i;
unsigned int hor_ds_factor = 0, ver_ds_factor = 0;
int err = 0;
@@ -6849,7 +6779,8 @@ ERR:
/* FIXME: merge most of this and single output version */
static int ia_css_pipe_create_cas_scaler_desc(
struct ia_css_pipe *pipe,
- struct ia_css_cas_binary_descr *descr) {
+ struct ia_css_cas_binary_descr *descr)
+{
struct ia_css_frame_info in_info = IA_CSS_BINARY_DEFAULT_FRAME_INFO;
struct ia_css_frame_info *out_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE];
struct ia_css_frame_info *vf_out_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE];
@@ -7005,7 +6936,8 @@ ERR:
}
static void ia_css_pipe_destroy_cas_scaler_desc(struct ia_css_cas_binary_descr
- *descr) {
+ *descr)
+{
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"ia_css_pipe_destroy_cas_scaler_desc() enter:\n");
kfree(descr->in_info);
@@ -7023,7 +6955,8 @@ static void ia_css_pipe_destroy_cas_scal
}
static int
-load_yuvpp_binaries(struct ia_css_pipe *pipe) {
+load_yuvpp_binaries(struct ia_css_pipe *pipe)
+{
int err = 0;
bool need_scaler = false;
struct ia_css_frame_info *vf_pp_in_info[IA_CSS_PIPE_MAX_OUTPUT_STAGE];
@@ -7048,8 +6981,7 @@ load_yuvpp_binaries(struct ia_css_pipe *
mycs = &pipe->pipe_settings.yuvpp;
- for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++)
- {
+ for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++) {
if (pipe->vf_output_info[i].res.width != 0) {
err = ia_css_util_check_vf_out_info(&pipe->output_info[i],
&pipe->vf_output_info[i]);
@@ -7063,8 +6995,7 @@ load_yuvpp_binaries(struct ia_css_pipe *
/* we build up the pipeline starting at the end */
/* Capture post-processing */
- if (need_scaler)
- {
+ if (need_scaler) {
struct ia_css_binary_descr yuv_scaler_descr;
err = ia_css_pipe_create_cas_scaler_desc(pipe,
@@ -7098,18 +7029,14 @@ load_yuvpp_binaries(struct ia_css_pipe *
goto ERR;
}
ia_css_pipe_destroy_cas_scaler_desc(&cas_scaler_descr);
- } else
- {
+ } else {
mycs->num_output = 1;
}
if (need_scaler)
- {
next_binary = &mycs->yuv_scaler_binary[0];
- } else
- {
+ else
next_binary = NULL;
- }
#if defined(ISP2401)
/*
@@ -7135,8 +7062,7 @@ load_yuvpp_binaries(struct ia_css_pipe *
need_isp_copy_binary = true;
#endif /* ISP2401 */
- if (need_isp_copy_binary)
- {
+ if (need_isp_copy_binary) {
err = load_copy_binary(pipe,
&mycs->copy_binary,
next_binary);
@@ -7166,8 +7092,7 @@ load_yuvpp_binaries(struct ia_css_pipe *
}
/* Viewfinder post-processing */
- if (need_scaler)
- {
+ if (need_scaler) {
for (i = 0, j = 0; i < mycs->num_yuv_scaler; i++) {
if (mycs->is_output_stage[i]) {
assert(j < 2);
@@ -7177,19 +7102,17 @@ load_yuvpp_binaries(struct ia_css_pipe *
}
}
mycs->num_vf_pp = j;
- } else
- {
+ } else {
vf_pp_in_info[0] =
&mycs->copy_binary.vf_frame_info;
- for (i = 1; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++) {
+ for (i = 1; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++)
vf_pp_in_info[i] = NULL;
- }
+
mycs->num_vf_pp = 1;
}
mycs->vf_pp_binary = kzalloc(mycs->num_vf_pp * sizeof(struct ia_css_binary),
GFP_KERNEL);
- if (!mycs->vf_pp_binary)
- {
+ if (!mycs->vf_pp_binary) {
err = -ENOMEM;
goto ERR;
}
@@ -7197,8 +7120,7 @@ load_yuvpp_binaries(struct ia_css_pipe *
{
struct ia_css_binary_descr vf_pp_descr;
- for (i = 0; i < mycs->num_vf_pp; i++)
- {
+ for (i = 0; i < mycs->num_vf_pp; i++) {
if (pipe->vf_output_info[i].res.width != 0) {
ia_css_pipe_get_vfpp_binarydesc(pipe,
&vf_pp_descr, vf_pp_in_info[i], &pipe->vf_output_info[i]);
@@ -7214,34 +7136,31 @@ load_yuvpp_binaries(struct ia_css_pipe *
ERR:
if (need_scaler)
- {
ia_css_pipe_destroy_cas_scaler_desc(&cas_scaler_descr);
- }
+
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE, "load_yuvpp_binaries() leave, err=%d\n",
err);
return err;
}
static int
-unload_yuvpp_binaries(struct ia_css_pipe *pipe) {
+unload_yuvpp_binaries(struct ia_css_pipe *pipe)
+{
unsigned int i;
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || (pipe->mode != IA_CSS_PIPE_ID_YUVPP))
- {
+ if ((!pipe) || (pipe->mode != IA_CSS_PIPE_ID_YUVPP)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
ia_css_binary_unload(&pipe->pipe_settings.yuvpp.copy_binary);
for (i = 0; i < pipe->pipe_settings.yuvpp.num_yuv_scaler; i++)
- {
ia_css_binary_unload(&pipe->pipe_settings.yuvpp.yuv_scaler_binary[i]);
- }
+
for (i = 0; i < pipe->pipe_settings.yuvpp.num_vf_pp; i++)
- {
ia_css_binary_unload(&pipe->pipe_settings.yuvpp.vf_pp_binary[i]);
- }
+
kfree(pipe->pipe_settings.yuvpp.is_output_stage);
pipe->pipe_settings.yuvpp.is_output_stage = NULL;
kfree(pipe->pipe_settings.yuvpp.yuv_scaler_binary);
@@ -7291,25 +7210,23 @@ static int yuvpp_start(struct ia_css_pip
}
static int
-sh_css_pipe_unload_binaries(struct ia_css_pipe *pipe) {
+sh_css_pipe_unload_binaries(struct ia_css_pipe *pipe)
+{
int err = 0;
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
/* PIPE_MODE_COPY has no binaries, but has output frames to outside*/
- if (pipe->config.mode == IA_CSS_PIPE_MODE_COPY)
- {
+ if (pipe->config.mode == IA_CSS_PIPE_MODE_COPY) {
IA_CSS_LEAVE_ERR_PRIVATE(0);
return 0;
}
- switch (pipe->mode)
- {
+ switch (pipe->mode) {
case IA_CSS_PIPE_ID_PREVIEW:
err = unload_preview_binaries(pipe);
break;
@@ -7330,7 +7247,8 @@ sh_css_pipe_unload_binaries(struct ia_cs
}
static int
-sh_css_pipe_load_binaries(struct ia_css_pipe *pipe) {
+sh_css_pipe_load_binaries(struct ia_css_pipe *pipe)
+{
int err = 0;
assert(pipe);
@@ -7340,8 +7258,7 @@ sh_css_pipe_load_binaries(struct ia_css_
if (pipe->config.mode == IA_CSS_PIPE_MODE_COPY)
return err;
- switch (pipe->mode)
- {
+ switch (pipe->mode) {
case IA_CSS_PIPE_ID_PREVIEW:
err = load_preview_binaries(pipe);
break;
@@ -7360,8 +7277,7 @@ sh_css_pipe_load_binaries(struct ia_css_
err = -EINVAL;
break;
}
- if (err)
- {
+ if (err) {
if (sh_css_pipe_unload_binaries(pipe)) {
/* currently css does not support multiple error returns in a single function,
* using -EINVAL in this case */
@@ -7372,7 +7288,8 @@ sh_css_pipe_load_binaries(struct ia_css_
}
static int
-create_host_yuvpp_pipeline(struct ia_css_pipe *pipe) {
+create_host_yuvpp_pipeline(struct ia_css_pipe *pipe)
+{
struct ia_css_pipeline *me;
int err = 0;
struct ia_css_pipeline_stage *vf_pp_stage = NULL,
@@ -7399,15 +7316,13 @@ create_host_yuvpp_pipeline(struct ia_css
#endif
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
- if ((!pipe) || (!pipe->stream) || (pipe->mode != IA_CSS_PIPE_ID_YUVPP))
- {
+ if ((!pipe) || (!pipe->stream) || (pipe->mode != IA_CSS_PIPE_ID_YUVPP)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
me = &pipe->pipeline;
ia_css_pipeline_clean(me);
- for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++)
- {
+ for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++) {
out_frame[i] = NULL;
vf_frame[i] = NULL;
}
@@ -7435,8 +7350,7 @@ create_host_yuvpp_pipeline(struct ia_css
/* the input frame can come from:
* a) memory: connect yuvscaler to me->in_frame
* b) sensor, via copy binary: connect yuvscaler to copy binary later on */
- if (need_in_frameinfo_memory)
- {
+ if (need_in_frameinfo_memory) {
/* TODO: improve for different input formats. */
/*
@@ -7485,13 +7399,11 @@ create_host_yuvpp_pipeline(struct ia_css
}
in_frame = &me->in_frame;
- } else
- {
+ } else {
in_frame = NULL;
}
- for (i = 0; i < num_output_stage; i++)
- {
+ for (i = 0; i < num_output_stage; i++) {
assert(i < IA_CSS_PIPE_MAX_OUTPUT_STAGE);
if (pipe->output_info[i].res.width != 0) {
err = init_out_frameinfo_defaults(pipe, &me->out_frame[i], i);
@@ -7518,8 +7430,7 @@ create_host_yuvpp_pipeline(struct ia_css
yuv_scaler_binary = pipe->pipe_settings.yuvpp.yuv_scaler_binary;
need_scaler = need_yuv_scaler_stage(pipe);
- if (pipe->pipe_settings.yuvpp.copy_binary.info)
- {
+ if (pipe->pipe_settings.yuvpp.copy_binary.info) {
struct ia_css_frame *in_frame_local = NULL;
#ifdef ISP2401
@@ -7557,8 +7468,7 @@ create_host_yuvpp_pipeline(struct ia_css
}
}
- if (need_scaler)
- {
+ if (need_scaler) {
struct ia_css_frame *tmp_out_frame = NULL;
struct ia_css_frame *tmp_vf_frame = NULL;
struct ia_css_frame *tmp_in_frame = in_frame;
@@ -7598,8 +7508,7 @@ create_host_yuvpp_pipeline(struct ia_css
j++;
}
}
- } else if (copy_stage)
- {
+ } else if (copy_stage) {
if (vf_frame[0] && vf_frame[0]->info.res.width != 0) {
in_frame = copy_stage->args.out_vf_frame;
err = add_vf_pp_stage(pipe, in_frame, vf_frame[0], &vf_pp_binary[0],
@@ -7621,7 +7530,8 @@ create_host_yuvpp_pipeline(struct ia_css
static int
create_host_copy_pipeline(struct ia_css_pipe *pipe,
unsigned int max_input_width,
- struct ia_css_frame *out_frame) {
+ struct ia_css_frame *out_frame)
+{
struct ia_css_pipeline *me;
int err = 0;
struct ia_css_pipeline_stage_desc stage_desc;
@@ -7638,16 +7548,14 @@ create_host_copy_pipeline(struct ia_css_
out_frame->flash_state = IA_CSS_FRAME_FLASH_STATE_NONE;
if (copy_on_sp(pipe) &&
- pipe->stream->config.input_config.format == ATOMISP_INPUT_FORMAT_BINARY_8)
- {
+ pipe->stream->config.input_config.format == ATOMISP_INPUT_FORMAT_BINARY_8) {
ia_css_frame_info_init(
&out_frame->info,
JPEG_BYTES,
1,
IA_CSS_FRAME_FORMAT_BINARY_8,
0);
- } else if (out_frame->info.format == IA_CSS_FRAME_FORMAT_RAW)
- {
+ } else if (out_frame->info.format == IA_CSS_FRAME_FORMAT_RAW) {
out_frame->info.raw_bit_depth =
ia_css_pipe_util_pipe_input_format_bpp(pipe);
}
@@ -7671,7 +7579,8 @@ create_host_copy_pipeline(struct ia_css_
}
static int
-create_host_isyscopy_capture_pipeline(struct ia_css_pipe *pipe) {
+create_host_isyscopy_capture_pipeline(struct ia_css_pipe *pipe)
+{
struct ia_css_pipeline *me = &pipe->pipeline;
int err = 0;
struct ia_css_pipeline_stage_desc stage_desc;
@@ -7715,7 +7624,8 @@ create_host_isyscopy_capture_pipeline(st
}
static int
-create_host_regular_capture_pipeline(struct ia_css_pipe *pipe) {
+create_host_regular_capture_pipeline(struct ia_css_pipe *pipe)
+{
struct ia_css_pipeline *me;
int err = 0;
enum ia_css_capture_mode mode;
@@ -7779,8 +7689,7 @@ create_host_regular_capture_pipeline(str
/* Construct in_frame info (only in case we have dynamic input */
need_in_frameinfo_memory = pipe->stream->config.mode == IA_CSS_INPUT_MODE_MEMORY;
#endif
- if (need_in_frameinfo_memory)
- {
+ if (need_in_frameinfo_memory) {
err = init_in_frameinfo_memory_defaults(pipe, &me->in_frame,
IA_CSS_FRAME_FORMAT_RAW);
if (err) {
@@ -7789,22 +7698,19 @@ create_host_regular_capture_pipeline(str
}
in_frame = &me->in_frame;
- } else
- {
+ } else {
in_frame = NULL;
}
err = init_out_frameinfo_defaults(pipe, &me->out_frame[0], 0);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
out_frame = &me->out_frame[0];
/* Construct vf_frame info (only in case we have VF) */
- if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0])
- {
+ if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0]) {
if (mode == IA_CSS_CAPTURE_MODE_RAW || mode == IA_CSS_CAPTURE_MODE_BAYER) {
/* These modes don't support viewfinder output */
vf_frame = NULL;
@@ -7812,22 +7718,20 @@ create_host_regular_capture_pipeline(str
init_vf_frameinfo_defaults(pipe, &me->vf_frame[0], 0);
vf_frame = &me->vf_frame[0];
}
- } else
- {
+ } else {
vf_frame = NULL;
}
copy_binary = &pipe->pipe_settings.capture.copy_binary;
num_primary_stage = pipe->pipe_settings.capture.num_primary_stage;
- if ((num_primary_stage == 0) && (mode == IA_CSS_CAPTURE_MODE_PRIMARY))
- {
+ if ((num_primary_stage == 0) && (mode == IA_CSS_CAPTURE_MODE_PRIMARY)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
+
for (i = 0; i < num_primary_stage; i++)
- {
primary_binary[i] = &pipe->pipe_settings.capture.primary_binary[i];
- }
+
vf_pp_binary = &pipe->pipe_settings.capture.vf_pp_binary;
pre_isp_binary = &pipe->pipe_settings.capture.pre_isp_binary;
anr_gdc_binary = &pipe->pipe_settings.capture.anr_gdc_binary;
@@ -7844,8 +7748,7 @@ create_host_regular_capture_pipeline(str
need_yuv_pp = (yuv_scaler_binary && yuv_scaler_binary->info);
need_ldc = (capture_ldc_binary && capture_ldc_binary->info);
- if (pipe->pipe_settings.capture.copy_binary.info)
- {
+ if (pipe->pipe_settings.capture.copy_binary.info) {
if (raw) {
ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
#if defined(ISP2401)
@@ -7874,13 +7777,11 @@ create_host_regular_capture_pipeline(str
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
- } else if (pipe->stream->config.continuous)
- {
+ } else if (pipe->stream->config.continuous) {
in_frame = pipe->stream->last_pipe->continuous_frames[0];
}
- if (mode == IA_CSS_CAPTURE_MODE_PRIMARY)
- {
+ if (mode == IA_CSS_CAPTURE_MODE_PRIMARY) {
struct ia_css_frame *local_in_frame = NULL;
struct ia_css_frame *local_out_frame = NULL;
@@ -7925,8 +7826,7 @@ create_host_regular_capture_pipeline(str
IA_CSS_BINARY_MODE_COPY;
current_stage->args.copy_output = current_stage->args.copy_vf;
} else if (mode == IA_CSS_CAPTURE_MODE_ADVANCED ||
- mode == IA_CSS_CAPTURE_MODE_LOW_LIGHT)
- {
+ mode == IA_CSS_CAPTURE_MODE_LOW_LIGHT) {
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
ia_css_pipe_get_generic_stage_desc(&stage_desc, pre_isp_binary,
out_frames, in_frame, NULL);
@@ -7962,8 +7862,7 @@ create_host_regular_capture_pipeline(str
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
- } else if (mode == IA_CSS_CAPTURE_MODE_BAYER)
- {
+ } else if (mode == IA_CSS_CAPTURE_MODE_BAYER) {
ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
ia_css_pipe_get_generic_stage_desc(&stage_desc, pre_isp_binary,
out_frames, in_frame, NULL);
@@ -7977,8 +7876,7 @@ create_host_regular_capture_pipeline(str
}
#ifndef ISP2401
- if (need_pp && current_stage)
- {
+ if (need_pp && current_stage) {
struct ia_css_frame *local_in_frame = NULL;
local_in_frame = current_stage->args.out_frame[0];
@@ -7996,8 +7894,7 @@ create_host_regular_capture_pipeline(str
need_yuv_pp ? NULL : out_frame,
#else
/* ldc and capture_pp not supported in same pipeline */
- if (need_ldc && current_stage)
- {
+ if (need_ldc && current_stage) {
in_frame = current_stage->args.out_frame[0];
ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
ia_css_pipe_get_generic_stage_desc(&stage_desc, capture_ldc_binary,
@@ -8005,8 +7902,7 @@ create_host_regular_capture_pipeline(str
err = ia_css_pipeline_create_and_add_stage(me,
&stage_desc,
NULL);
- } else if (need_pp && current_stage)
- {
+ } else if (need_pp && current_stage) {
in_frame = current_stage->args.out_frame[0];
err = add_capture_pp_stage(pipe, me, in_frame, need_yuv_pp ? NULL : out_frame,
#endif
@@ -8018,8 +7914,7 @@ create_host_regular_capture_pipeline(str
}
}
- if (need_yuv_pp && current_stage)
- {
+ if (need_yuv_pp && current_stage) {
struct ia_css_frame *tmp_in_frame = current_stage->args.out_frame[0];
struct ia_css_frame *tmp_out_frame = NULL;
@@ -8051,8 +7946,7 @@ create_host_regular_capture_pipeline(str
* should not be considered as a clean solution. Proper
* investigation should be done to come up with the clean solution.
* */
- if (mode != IA_CSS_CAPTURE_MODE_RAW && mode != IA_CSS_CAPTURE_MODE_BAYER && current_stage && vf_frame)
- {
+ if (mode != IA_CSS_CAPTURE_MODE_RAW && mode != IA_CSS_CAPTURE_MODE_BAYER && current_stage && vf_frame) {
in_frame = current_stage->args.out_vf_frame;
err = add_vf_pp_stage(pipe, in_frame, vf_frame, vf_pp_binary,
¤t_stage);
@@ -8070,7 +7964,8 @@ create_host_regular_capture_pipeline(str
}
static int
-create_host_capture_pipeline(struct ia_css_pipe *pipe) {
+create_host_capture_pipeline(struct ia_css_pipe *pipe)
+{
int err = 0;
IA_CSS_ENTER_PRIVATE("pipe = %p", pipe);
@@ -8079,8 +7974,7 @@ create_host_capture_pipeline(struct ia_c
err = create_host_isyscopy_capture_pipeline(pipe);
else
err = create_host_regular_capture_pipeline(pipe);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
@@ -8091,7 +7985,8 @@ create_host_capture_pipeline(struct ia_c
}
static int capture_start(
- struct ia_css_pipe *pipe) {
+ struct ia_css_pipe *pipe)
+{
struct ia_css_pipeline *me;
int err = 0;
@@ -8162,7 +8057,8 @@ static int capture_start(
static int
sh_css_pipe_get_output_frame_info(struct ia_css_pipe *pipe,
struct ia_css_frame_info *info,
- unsigned int idx) {
+ unsigned int idx)
+{
assert(pipe);
assert(info);
@@ -8171,8 +8067,7 @@ sh_css_pipe_get_output_frame_info(struct
*info = pipe->output_info[idx];
if (copy_on_sp(pipe) &&
- pipe->stream->config.input_config.format == ATOMISP_INPUT_FORMAT_BINARY_8)
- {
+ pipe->stream->config.input_config.format == ATOMISP_INPUT_FORMAT_BINARY_8) {
ia_css_frame_info_init(
info,
JPEG_BYTES,
@@ -8180,8 +8075,7 @@ sh_css_pipe_get_output_frame_info(struct
IA_CSS_FRAME_FORMAT_BINARY_8,
0);
} else if (info->format == IA_CSS_FRAME_FORMAT_RAW ||
- info->format == IA_CSS_FRAME_FORMAT_RAW_PACKED)
- {
+ info->format == IA_CSS_FRAME_FORMAT_RAW_PACKED) {
info->raw_bit_depth =
ia_css_pipe_util_pipe_input_format_bpp(pipe);
}
@@ -8195,7 +8089,8 @@ void
ia_css_stream_send_input_frame(const struct ia_css_stream *stream,
const unsigned short *data,
unsigned int width,
- unsigned int height) {
+ unsigned int height)
+{
assert(stream);
ia_css_inputfifo_send_input_frame(
@@ -8206,7 +8101,8 @@ ia_css_stream_send_input_frame(const str
}
void
-ia_css_stream_start_input_frame(const struct ia_css_stream *stream) {
+ia_css_stream_start_input_frame(const struct ia_css_stream *stream)
+{
assert(stream);
ia_css_inputfifo_start_frame(
@@ -8220,7 +8116,8 @@ ia_css_stream_send_input_line(const stru
const unsigned short *data,
unsigned int width,
const unsigned short *data2,
- unsigned int width2) {
+ unsigned int width2)
+{
assert(stream);
ia_css_inputfifo_send_line(stream->config.channel_id,
@@ -8231,7 +8128,8 @@ void
ia_css_stream_send_input_embedded_line(const struct ia_css_stream *stream,
enum atomisp_input_format format,
const unsigned short *data,
- unsigned int width) {
+ unsigned int width)
+{
assert(stream);
if (!data || width == 0)
return;
@@ -8240,14 +8138,16 @@ ia_css_stream_send_input_embedded_line(c
}
void
-ia_css_stream_end_input_frame(const struct ia_css_stream *stream) {
+ia_css_stream_end_input_frame(const struct ia_css_stream *stream)
+{
assert(stream);
ia_css_inputfifo_end_frame(stream->config.channel_id);
}
static void
-append_firmware(struct ia_css_fw_info **l, struct ia_css_fw_info *firmware) {
+append_firmware(struct ia_css_fw_info **l, struct ia_css_fw_info *firmware)
+{
IA_CSS_ENTER_PRIVATE("l = %p, firmware = %p", l, firmware);
if (!l) {
IA_CSS_ERROR("NULL fw_info");
@@ -8262,7 +8162,8 @@ append_firmware(struct ia_css_fw_info **
}
static void
-remove_firmware(struct ia_css_fw_info **l, struct ia_css_fw_info *firmware) {
+remove_firmware(struct ia_css_fw_info **l, struct ia_css_fw_info *firmware)
+{
assert(*l);
assert(firmware);
(void)l;
@@ -8304,12 +8205,12 @@ static int upload_isp_code(struct ia_css
}
static int
-acc_load_extension(struct ia_css_fw_info *firmware) {
+acc_load_extension(struct ia_css_fw_info *firmware)
+{
int err;
struct ia_css_fw_info *hd = firmware;
- while (hd)
- {
+ while (hd) {
err = upload_isp_code(hd);
if (err)
return err;
@@ -8323,7 +8224,8 @@ acc_load_extension(struct ia_css_fw_info
}
static void
-acc_unload_extension(struct ia_css_fw_info *firmware) {
+acc_unload_extension(struct ia_css_fw_info *firmware)
+{
struct ia_css_fw_info *hd = firmware;
struct ia_css_fw_info *hdn = NULL;
@@ -8347,13 +8249,13 @@ acc_unload_extension(struct ia_css_fw_in
/* Load firmware for extension */
static int
ia_css_pipe_load_extension(struct ia_css_pipe *pipe,
- struct ia_css_fw_info *firmware) {
+ struct ia_css_fw_info *firmware)
+{
int err = 0;
IA_CSS_ENTER_PRIVATE("fw = %p pipe = %p", firmware, pipe);
- if ((!firmware) || (!pipe))
- {
+ if ((!firmware) || (!pipe)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -8371,7 +8273,8 @@ ia_css_pipe_load_extension(struct ia_css
/* Unload firmware for extension */
static void
ia_css_pipe_unload_extension(struct ia_css_pipe *pipe,
- struct ia_css_fw_info *firmware) {
+ struct ia_css_fw_info *firmware)
+{
IA_CSS_ENTER_PRIVATE("fw = %p pipe = %p", firmware, pipe);
if ((!firmware) || (!pipe)) {
@@ -8390,7 +8293,8 @@ ia_css_pipe_unload_extension(struct ia_c
}
bool
-ia_css_pipeline_uses_params(struct ia_css_pipeline *me) {
+ia_css_pipeline_uses_params(struct ia_css_pipeline *me)
+{
struct ia_css_pipeline_stage *stage;
assert(me);
@@ -8411,7 +8315,8 @@ ia_css_pipeline_uses_params(struct ia_cs
static int
sh_css_pipeline_add_acc_stage(struct ia_css_pipeline *pipeline,
- const void *acc_fw) {
+ const void *acc_fw)
+{
struct ia_css_fw_info *fw = (struct ia_css_fw_info *)acc_fw;
/* In QoS case, load_extension already called, so skipping */
int err = 0;
@@ -8423,8 +8328,7 @@ sh_css_pipeline_add_acc_stage(struct ia_
"sh_css_pipeline_add_acc_stage() enter: pipeline=%p, acc_fw=%p\n",
pipeline, acc_fw);
- if (!err)
- {
+ if (!err) {
struct ia_css_pipeline_stage_desc stage_desc;
ia_css_pipe_get_acc_stage_desc(&stage_desc, NULL, fw);
@@ -8443,7 +8347,8 @@ sh_css_pipeline_add_acc_stage(struct ia_
* Refer to "sh_css_internal.h" for details.
*/
int ia_css_stream_capture_frame(struct ia_css_stream *stream,
- unsigned int exp_id) {
+ unsigned int exp_id)
+{
struct sh_css_tag_descr tag_descr;
u32 encoded_tag_descr;
int err;
@@ -8485,7 +8390,8 @@ int ia_css_stream_capture(
struct ia_css_stream *stream,
int num_captures,
unsigned int skip,
- int offset) {
+ int offset)
+{
struct sh_css_tag_descr tag_descr;
unsigned int encoded_tag_descr;
int return_err;
@@ -8548,8 +8454,9 @@ void ia_css_stream_request_flash(struct
ia_css_debug_dump_sp_sw_debug_info();
ia_css_debug_dump_debug_info(NULL);
}
- } else
+ } else {
IA_CSS_LOG("SP is not running!");
+ }
#endif
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -8557,7 +8464,8 @@ void ia_css_stream_request_flash(struct
}
static void
-sh_css_init_host_sp_control_vars(void) {
+sh_css_init_host_sp_control_vars(void)
+{
const struct ia_css_fw_info *fw;
unsigned int HIVE_ADDR_ia_css_ispctrl_sp_isp_started;
@@ -8641,7 +8549,8 @@ void ia_css_pipe_config_defaults(struct
void
ia_css_pipe_extra_config_defaults(struct ia_css_pipe_extra_config
- *extra_config) {
+ *extra_config)
+{
if (!extra_config) {
IA_CSS_ERROR("NULL input parameter");
return;
@@ -8671,11 +8580,11 @@ void ia_css_stream_config_defaults(struc
}
static int
-ia_css_acc_pipe_create(struct ia_css_pipe *pipe) {
+ia_css_acc_pipe_create(struct ia_css_pipe *pipe)
+{
int err = 0;
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_ERROR("NULL input parameter");
return -EINVAL;
}
@@ -8685,9 +8594,7 @@ ia_css_acc_pipe_create(struct ia_css_pip
pipe->config.acc_num_execs = 1;
if (pipe->config.acc_extension)
- {
err = ia_css_pipe_load_extension(pipe, pipe->config.acc_extension);
- }
return err;
}
@@ -8706,9 +8613,8 @@ int ia_css_pipe_create(const struct ia_c
err = ia_css_pipe_create_extra(config, NULL, pipe);
- if (err == 0) {
+ if (err == 0)
IA_CSS_LOG("pipe created successfully = %p", *pipe);
- }
IA_CSS_LEAVE_ERR_PRIVATE(err);
@@ -8718,7 +8624,8 @@ int ia_css_pipe_create(const struct ia_c
int
ia_css_pipe_create_extra(const struct ia_css_pipe_config *config,
const struct ia_css_pipe_extra_config *extra_config,
- struct ia_css_pipe **pipe) {
+ struct ia_css_pipe **pipe)
+{
int err = -EINVAL;
struct ia_css_pipe *internal_pipe = NULL;
unsigned int i;
@@ -8726,14 +8633,12 @@ ia_css_pipe_create_extra(const struct ia
IA_CSS_ENTER_PRIVATE("config = %p, extra_config = %p and pipe = %p", config, extra_config, pipe);
/* do not allow to create more than the maximum limit */
- if (my_css.pipe_counter >= IA_CSS_PIPELINE_NUM_MAX)
- {
+ if (my_css.pipe_counter >= IA_CSS_PIPELINE_NUM_MAX) {
IA_CSS_LEAVE_ERR_PRIVATE(-ENOSPC);
return -EINVAL;
}
- if ((!pipe) || (!config))
- {
+ if ((!pipe) || (!config)) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
@@ -8742,8 +8647,7 @@ ia_css_pipe_create_extra(const struct ia
ia_css_debug_dump_pipe_extra_config(extra_config);
err = create_pipe(config->mode, &internal_pipe, false);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
@@ -8755,8 +8659,7 @@ ia_css_pipe_create_extra(const struct ia
else
ia_css_pipe_extra_config_defaults(&internal_pipe->extra_config);
- if (config->mode == IA_CSS_PIPE_MODE_ACC)
- {
+ if (config->mode == IA_CSS_PIPE_MODE_ACC) {
/* Temporary hack to migrate acceleration to CSS 2.0.
* In the future the code for all pipe types should be
* unified. */
@@ -8783,15 +8686,13 @@ ia_css_pipe_create_extra(const struct ia
set bayer_ds_out_res equal to IF output resolution(IF may do cropping on
sensor output) or use default decimation factor 1. */
if (internal_pipe->extra_config.enable_raw_binning &&
- internal_pipe->config.bayer_ds_out_res.width)
- {
+ internal_pipe->config.bayer_ds_out_res.width) {
/* fill some code here, if no code is needed, please remove it during integration */
}
/* YUV downscaling */
if ((internal_pipe->config.vf_pp_in_res.width ||
- internal_pipe->config.capt_pp_in_res.width))
- {
+ internal_pipe->config.capt_pp_in_res.width)) {
enum ia_css_frame_format format;
if (internal_pipe->config.vf_pp_in_res.width) {
@@ -8812,8 +8713,7 @@ ia_css_pipe_create_extra(const struct ia
}
}
if (internal_pipe->config.vf_pp_in_res.width &&
- internal_pipe->config.mode == IA_CSS_PIPE_MODE_PREVIEW)
- {
+ internal_pipe->config.mode == IA_CSS_PIPE_MODE_PREVIEW) {
ia_css_frame_info_init(
&internal_pipe->vf_yuv_ds_input_info,
internal_pipe->config.vf_pp_in_res.width,
@@ -8821,8 +8721,7 @@ ia_css_pipe_create_extra(const struct ia
IA_CSS_FRAME_FORMAT_YUV_LINE, 0);
}
/* handle bayer downscaling output info */
- if (internal_pipe->config.bayer_ds_out_res.width)
- {
+ if (internal_pipe->config.bayer_ds_out_res.width) {
ia_css_frame_info_init(
&internal_pipe->bds_output_info,
internal_pipe->config.bayer_ds_out_res.width,
@@ -8831,8 +8730,7 @@ ia_css_pipe_create_extra(const struct ia
}
/* handle output info, assume always needed */
- for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++)
- {
+ for (i = 0; i < IA_CSS_PIPE_MAX_OUTPUT_STAGE; i++) {
if (internal_pipe->config.output_info[i].res.width) {
err = sh_css_pipe_configure_output(
internal_pipe,
@@ -8868,8 +8766,7 @@ ia_css_pipe_create_extra(const struct ia
}
}
}
- if (internal_pipe->config.acc_extension)
- {
+ if (internal_pipe->config.acc_extension) {
err = ia_css_pipe_load_extension(internal_pipe,
internal_pipe->config.acc_extension);
if (err) {
@@ -8889,18 +8786,18 @@ ia_css_pipe_create_extra(const struct ia
int
ia_css_pipe_get_info(const struct ia_css_pipe *pipe,
- struct ia_css_pipe_info *pipe_info) {
+ struct ia_css_pipe_info *pipe_info)
+{
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
"ia_css_pipe_get_info()\n");
+
assert(pipe_info);
- if (!pipe_info)
- {
+ if (!pipe_info) {
ia_css_debug_dtrace(IA_CSS_DEBUG_ERROR,
"ia_css_pipe_get_info: pipe_info cannot be NULL\n");
return -EINVAL;
}
- if (!pipe || !pipe->stream)
- {
+ if (!pipe || !pipe->stream) {
ia_css_debug_dtrace(IA_CSS_DEBUG_ERROR,
"ia_css_pipe_get_info: ia_css_stream_create needs to be called before ia_css_[stream/pipe]_get_info\n");
return -EINVAL;
@@ -8928,40 +8825,36 @@ bool ia_css_pipe_has_dvs_stats(struct ia
int
ia_css_pipe_override_frame_format(struct ia_css_pipe *pipe,
int pin_index,
- enum ia_css_frame_format new_format) {
+ enum ia_css_frame_format new_format)
+{
int err = 0;
IA_CSS_ENTER_PRIVATE("pipe = %p, pin_index = %d, new_formats = %d", pipe, pin_index, new_format);
- if (!pipe)
- {
+ if (!pipe) {
IA_CSS_ERROR("pipe is not set");
err = -EINVAL;
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
- if (0 != pin_index && 1 != pin_index)
- {
+ if (0 != pin_index && 1 != pin_index) {
IA_CSS_ERROR("pin index is not valid");
err = -EINVAL;
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
- if (new_format != IA_CSS_FRAME_FORMAT_NV12_TILEY)
- {
+ if (new_format != IA_CSS_FRAME_FORMAT_NV12_TILEY) {
IA_CSS_ERROR("new format is not valid");
err = -EINVAL;
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
- } else
- {
+ } else {
err = ia_css_pipe_check_format(pipe, new_format);
if (!err) {
- if (pin_index == 0) {
+ if (pin_index == 0)
pipe->output_info[0].format = new_format;
- } else {
+ else
pipe->vf_output_info[0].format = new_format;
- }
}
}
IA_CSS_LEAVE_ERR_PRIVATE(err);
@@ -8971,7 +8864,8 @@ ia_css_pipe_override_frame_format(struct
#if !defined(ISP2401)
/* Configuration of INPUT_SYSTEM_VERSION_2401 is done on SP */
static int
-ia_css_stream_configure_rx(struct ia_css_stream *stream) {
+ia_css_stream_configure_rx(struct ia_css_stream *stream)
+{
struct ia_css_input_port *config;
assert(stream);
@@ -9000,11 +8894,10 @@ ia_css_stream_configure_rx(struct ia_css
if (config->compression.type == IA_CSS_CSI2_COMPRESSION_TYPE_NONE)
stream->csi_rx_config.comp = MIPI_PREDICTOR_NONE;
else
- {
/* not implemented yet, requires extension of the rx_cfg_t
* struct */
return -EINVAL;
- }
+
stream->csi_rx_config.is_two_ppc = (stream->config.pixels_per_clock == 2);
stream->reconfigure_css_rx = true;
return 0;
@@ -9015,7 +8908,8 @@ static struct ia_css_pipe *
find_pipe(struct ia_css_pipe *pipes[],
unsigned int num_pipes,
enum ia_css_pipe_mode mode,
- bool copy_pipe) {
+ bool copy_pipe)
+{
unsigned int i;
assert(pipes);
@@ -9031,21 +8925,20 @@ find_pipe(struct ia_css_pipe *pipes[],
}
static int
-ia_css_acc_stream_create(struct ia_css_stream *stream) {
+ia_css_acc_stream_create(struct ia_css_stream *stream)
+{
int i;
int err = 0;
assert(stream);
IA_CSS_ENTER_PRIVATE("stream = %p", stream);
- if (!stream)
- {
+ if (!stream) {
IA_CSS_LEAVE_ERR_PRIVATE(-EINVAL);
return -EINVAL;
}
- for (i = 0; i < stream->num_pipes; i++)
- {
+ for (i = 0; i < stream->num_pipes; i++) {
struct ia_css_pipe *pipe = stream->pipes[i];
assert(pipe);
@@ -9059,14 +8952,12 @@ ia_css_acc_stream_create(struct ia_css_s
/* Map SP threads before doing anything. */
err = map_sp_threads(stream, true);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
- for (i = 0; i < stream->num_pipes; i++)
- {
+ for (i = 0; i < stream->num_pipes; i++) {
struct ia_css_pipe *pipe = stream->pipes[i];
assert(pipe);
@@ -9074,8 +8965,7 @@ ia_css_acc_stream_create(struct ia_css_s
}
err = create_host_pipeline_structure(stream);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
@@ -9089,7 +8979,8 @@ ia_css_acc_stream_create(struct ia_css_s
static int
metadata_info_init(const struct ia_css_metadata_config *mdc,
- struct ia_css_metadata_info *md) {
+ struct ia_css_metadata_info *md)
+{
/* Either both width and height should be set or neither */
if ((mdc->resolution.height > 0) ^ (mdc->resolution.width > 0))
return -EINVAL;
@@ -9149,7 +9040,8 @@ int
ia_css_stream_create(const struct ia_css_stream_config *stream_config,
int num_pipes,
struct ia_css_pipe *pipes[],
- struct ia_css_stream **stream) {
+ struct ia_css_stream **stream)
+{
struct ia_css_pipe *curr_pipe;
struct ia_css_stream *curr_stream = NULL;
bool spcopyonly;
@@ -9168,8 +9060,7 @@ ia_css_stream_create(const struct ia_css
/* some checks */
if (num_pipes == 0 ||
!stream ||
- !pipes)
- {
+ !pipes) {
err = -EINVAL;
IA_CSS_LEAVE_ERR(err);
return err;
@@ -9178,8 +9069,7 @@ ia_css_stream_create(const struct ia_css
#if !defined(ISP2401)
/* We don't support metadata for JPEG stream, since they both use str2mem */
if (stream_config->input_config.format == ATOMISP_INPUT_FORMAT_BINARY_8 &&
- stream_config->metadata_config.resolution.height > 0)
- {
+ stream_config->metadata_config.resolution.height > 0) {
err = -EINVAL;
IA_CSS_LEAVE_ERR(err);
return err;
@@ -9187,8 +9077,7 @@ ia_css_stream_create(const struct ia_css
#endif
#ifdef ISP2401
- if (stream_config->online && stream_config->pack_raw_pixels)
- {
+ if (stream_config->online && stream_config->pack_raw_pixels) {
IA_CSS_LOG("online and pack raw is invalid on input system 2401");
err = -EINVAL;
IA_CSS_LEAVE_ERR(err);
@@ -9243,16 +9132,14 @@ ia_css_stream_create(const struct ia_css
/* Currently we only supported metadata up to a certain size. */
err = metadata_info_init(&stream_config->metadata_config, &md_info);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR(err);
return err;
}
/* allocate the stream instance */
curr_stream = kzalloc(sizeof(struct ia_css_stream), GFP_KERNEL);
- if (!curr_stream)
- {
+ if (!curr_stream) {
err = -ENOMEM;
IA_CSS_LEAVE_ERR(err);
return err;
@@ -9263,8 +9150,7 @@ ia_css_stream_create(const struct ia_css
/* allocate pipes */
curr_stream->num_pipes = num_pipes;
curr_stream->pipes = kcalloc(num_pipes, sizeof(struct ia_css_pipe *), GFP_KERNEL);
- if (!curr_stream->pipes)
- {
+ if (!curr_stream->pipes) {
curr_stream->num_pipes = 0;
kfree(curr_stream);
curr_stream = NULL;
@@ -9287,8 +9173,7 @@ ia_css_stream_create(const struct ia_css
#endif
#ifdef ISP2401
- if (curr_stream->config.online)
- {
+ if (curr_stream->config.online) {
curr_stream->config.source.port.num_lanes =
stream_config->source.port.num_lanes;
curr_stream->config.mode = IA_CSS_INPUT_MODE_BUFFERED_SENSOR;
@@ -9306,8 +9191,7 @@ ia_css_stream_create(const struct ia_css
curr_stream->config.lock_all);
/* copy mode specific stuff */
- switch (curr_stream->config.mode)
- {
+ switch (curr_stream->config.mode) {
case IA_CSS_INPUT_MODE_SENSOR:
case IA_CSS_INPUT_MODE_BUFFERED_SENSOR:
#if !defined(ISP2401)
@@ -9349,14 +9233,12 @@ ia_css_stream_create(const struct ia_css
err = aspect_ratio_crop_init(curr_stream,
pipes,
&aspect_ratio_crop_enabled);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR(err);
goto ERR;
}
#endif
- for (i = 0; i < num_pipes; i++)
- {
+ for (i = 0; i < num_pipes; i++) {
struct ia_css_resolution effective_res;
curr_pipe = pipes[i];
@@ -9396,9 +9278,8 @@ ia_css_stream_create(const struct ia_css
if (pipes[i]->config.mode != IA_CSS_PIPE_MODE_ACC &&
pipes[i]->config.mode != IA_CSS_PIPE_MODE_COPY) {
err = check_pipe_resolutions(pipes[i]);
- if (err) {
+ if (err)
goto ERR;
- }
}
}
}
@@ -9408,20 +9289,17 @@ ia_css_stream_create(const struct ia_css
goto ERR;
IA_CSS_LOG("isp_params_configs: %p", curr_stream->isp_params_configs);
- if (num_pipes == 1 && pipes[0]->config.mode == IA_CSS_PIPE_MODE_ACC)
- {
+ if (num_pipes == 1 && pipes[0]->config.mode == IA_CSS_PIPE_MODE_ACC) {
*stream = curr_stream;
err = ia_css_acc_stream_create(curr_stream);
goto ERR;
}
/* sensor binning */
- if (!spcopyonly)
- {
+ if (!spcopyonly) {
sensor_binning_changed =
sh_css_params_set_binning_factor(curr_stream,
curr_stream->config.sensor_binning_factor);
- } else
- {
+ } else {
sensor_binning_changed = false;
}
@@ -9432,8 +9310,7 @@ ia_css_stream_create(const struct ia_css
curr_stream->cont_capt = false;
/* Temporary hack: we give the preview pipe a reference to the capture
* pipe in continuous capture mode. */
- if (curr_stream->config.continuous)
- {
+ if (curr_stream->config.continuous) {
/* Search for the preview pipe and create the copy pipe */
struct ia_css_pipe *preview_pipe;
struct ia_css_pipe *video_pipe;
@@ -9481,9 +9358,9 @@ ia_css_stream_create(const struct ia_css
preview_pipe->pipe_settings.preview.copy_pipe = copy_pipe;
copy_pipe->stream = curr_stream;
}
- if (preview_pipe && curr_stream->cont_capt) {
+ if (preview_pipe && curr_stream->cont_capt)
preview_pipe->pipe_settings.preview.capture_pipe = capture_pipe;
- }
+
if (video_pipe && !video_pipe->pipe_settings.video.copy_pipe) {
err = create_pipe(IA_CSS_PIPE_MODE_CAPTURE, ©_pipe, true);
if (err)
@@ -9492,15 +9369,13 @@ ia_css_stream_create(const struct ia_css
video_pipe->pipe_settings.video.copy_pipe = copy_pipe;
copy_pipe->stream = curr_stream;
}
- if (video_pipe && curr_stream->cont_capt) {
+ if (video_pipe && curr_stream->cont_capt)
video_pipe->pipe_settings.video.capture_pipe = capture_pipe;
- }
- if (preview_pipe && acc_pipe) {
+
+ if (preview_pipe && acc_pipe)
preview_pipe->pipe_settings.preview.acc_pipe = acc_pipe;
- }
}
- for (i = 0; i < num_pipes; i++)
- {
+ for (i = 0; i < num_pipes; i++) {
curr_pipe = pipes[i];
/* set current stream */
curr_pipe->stream = curr_stream;
@@ -9521,8 +9396,7 @@ ia_css_stream_create(const struct ia_css
}
/* now pipes have been configured, info should be available */
- for (i = 0; i < num_pipes; i++)
- {
+ for (i = 0; i < num_pipes; i++) {
struct ia_css_pipe_info *pipe_info = NULL;
curr_pipe = pipes[i];
@@ -9572,22 +9446,19 @@ ia_css_stream_create(const struct ia_css
/* Map SP threads before doing anything. */
err = map_sp_threads(curr_stream, true);
- if (err)
- {
+ if (err) {
IA_CSS_LOG("map_sp_threads: return_err=%d", err);
goto ERR;
}
- for (i = 0; i < num_pipes; i++)
- {
+ for (i = 0; i < num_pipes; i++) {
curr_pipe = pipes[i];
ia_css_pipe_map_queue(curr_pipe, true);
}
/* Create host side pipeline objects without stages */
err = create_host_pipeline_structure(curr_stream);
- if (err)
- {
+ if (err) {
IA_CSS_LOG("create_host_pipeline_structure: return_err=%d", err);
goto ERR;
}
@@ -9625,13 +9496,13 @@ ERR:
}
int
-ia_css_stream_destroy(struct ia_css_stream *stream) {
+ia_css_stream_destroy(struct ia_css_stream *stream)
+{
int i;
int err = 0;
IA_CSS_ENTER_PRIVATE("stream = %p", stream);
- if (!stream)
- {
+ if (!stream) {
err = -EINVAL;
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -9640,8 +9511,7 @@ ia_css_stream_destroy(struct ia_css_stre
ia_css_stream_isp_parameters_uninit(stream);
if ((stream->last_pipe) &&
- ia_css_pipeline_is_mapped(stream->last_pipe->pipe_num))
- {
+ ia_css_pipeline_is_mapped(stream->last_pipe->pipe_num)) {
#if defined(ISP2401)
bool free_mpi;
@@ -9703,8 +9573,7 @@ ia_css_stream_destroy(struct ia_css_stre
}
/* remove references from pipes to stream */
- for (i = 0; i < stream->num_pipes; i++)
- {
+ for (i = 0; i < stream->num_pipes; i++) {
struct ia_css_pipe *entry = stream->pipes[i];
assert(entry);
@@ -9733,8 +9602,7 @@ ia_css_stream_destroy(struct ia_css_stre
/* working mode: take out of the seed list */
if (my_css_save.mode == sh_css_mode_working) {
for (i = 0; i < MAX_ACTIVE_STREAMS; i++) {
- if (my_css_save.stream_seeds[i].stream == stream)
- {
+ if (my_css_save.stream_seeds[i].stream == stream) {
IA_CSS_LOG("took out stream %d", i);
my_css_save.stream_seeds[i].stream = NULL;
break;
@@ -9750,7 +9618,8 @@ ia_css_stream_destroy(struct ia_css_stre
int
ia_css_stream_get_info(const struct ia_css_stream *stream,
- struct ia_css_stream_info *stream_info) {
+ struct ia_css_stream_info *stream_info)
+{
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_stream_get_info: enter/exit\n");
assert(stream);
assert(stream_info);
@@ -9766,15 +9635,15 @@ ia_css_stream_get_info(const struct ia_c
* The stream handle is used to identify the correct entry in the css_save struct
*/
int
-ia_css_stream_load(struct ia_css_stream *stream) {
+ia_css_stream_load(struct ia_css_stream *stream)
+{
if (!IS_ISP2401) {
int i;
int err;
assert(stream);
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_stream_load() enter,\n");
- for (i = 0; i < MAX_ACTIVE_STREAMS; i++)
- {
+ for (i = 0; i < MAX_ACTIVE_STREAMS; i++) {
if (my_css_save.stream_seeds[i].stream == stream) {
int j;
@@ -9813,12 +9682,12 @@ ia_css_stream_load(struct ia_css_stream
}
int
-ia_css_stream_start(struct ia_css_stream *stream) {
+ia_css_stream_start(struct ia_css_stream *stream)
+{
int err = 0;
IA_CSS_ENTER("stream = %p", stream);
- if ((!stream) || (!stream->last_pipe))
- {
+ if ((!stream) || (!stream->last_pipe)) {
IA_CSS_LEAVE_ERR(-EINVAL);
return -EINVAL;
}
@@ -9828,8 +9697,7 @@ ia_css_stream_start(struct ia_css_stream
/* Create host side pipeline. */
err = create_host_pipeline(stream);
- if (err)
- {
+ if (err) {
IA_CSS_LEAVE_ERR(err);
return err;
}
@@ -9842,8 +9710,7 @@ ia_css_stream_start(struct ia_css_stream
#if !defined(ISP2401)
/* Initialize mipi size checks */
- if (stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR)
- {
+ if (stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR) {
unsigned int idx;
unsigned int port = (unsigned int)(stream->config.source.port.port);
@@ -9854,8 +9721,7 @@ ia_css_stream_start(struct ia_css_stream
}
#endif
- if (stream->config.mode != IA_CSS_INPUT_MODE_MEMORY)
- {
+ if (stream->config.mode != IA_CSS_INPUT_MODE_MEMORY) {
err = sh_css_config_input_network(stream);
if (err)
return err;
@@ -9867,7 +9733,8 @@ ia_css_stream_start(struct ia_css_stream
}
int
-ia_css_stream_stop(struct ia_css_stream *stream) {
+ia_css_stream_stop(struct ia_css_stream *stream)
+{
int err = 0;
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_stream_stop() enter/exit\n");
@@ -9878,22 +9745,19 @@ ia_css_stream_stop(struct ia_css_stream
#if !defined(ISP2401)
/* De-initialize mipi size checks */
- if (stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR)
- {
+ if (stream->config.mode == IA_CSS_INPUT_MODE_BUFFERED_SENSOR) {
unsigned int idx;
unsigned int port = (unsigned int)(stream->config.source.port.port);
- for (idx = 0; idx < IA_CSS_MIPI_SIZE_CHECK_MAX_NOF_ENTRIES_PER_PORT; idx++) {
+ for (idx = 0; idx < IA_CSS_MIPI_SIZE_CHECK_MAX_NOF_ENTRIES_PER_PORT; idx++)
sh_css_sp_group.config.mipi_sizes_for_check[port][idx] = 0;
- }
}
#endif
- if (!IS_ISP2401) {
+ if (!IS_ISP2401)
err = ia_css_pipeline_request_stop(&stream->last_pipe->pipeline);
- } else {
+ else
err = sh_css_pipes_stop(stream);
- }
if (err)
return err;
@@ -9906,16 +9770,16 @@ ia_css_stream_stop(struct ia_css_stream
}
bool
-ia_css_stream_has_stopped(struct ia_css_stream *stream) {
+ia_css_stream_has_stopped(struct ia_css_stream *stream)
+{
bool stopped;
assert(stream);
- if (!IS_ISP2401) {
+ if (!IS_ISP2401)
stopped = ia_css_pipeline_has_stopped(&stream->last_pipe->pipeline);
- } else {
+ else
stopped = sh_css_pipes_have_stopped(stream);
- }
return stopped;
}
@@ -9926,7 +9790,8 @@ ia_css_stream_has_stopped(struct ia_css_
* The stream handle is used to identify the correct entry in the css_save struct
*/
int
-ia_css_stream_unload(struct ia_css_stream *stream) {
+ia_css_stream_unload(struct ia_css_stream *stream)
+{
int i;
assert(stream);
@@ -9934,8 +9799,7 @@ ia_css_stream_unload(struct ia_css_strea
/* some checks */
assert(stream);
for (i = 0; i < MAX_ACTIVE_STREAMS; i++)
- if (my_css_save.stream_seeds[i].stream == stream)
- {
+ if (my_css_save.stream_seeds[i].stream == stream) {
int j;
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -9955,7 +9819,8 @@ ia_css_stream_unload(struct ia_css_strea
int
ia_css_temp_pipe_to_pipe_id(const struct ia_css_pipe *pipe,
- enum ia_css_pipe_id *pipe_id) {
+ enum ia_css_pipe_id *pipe_id)
+{
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_temp_pipe_to_pipe_id() enter/exit\n");
if (pipe)
*pipe_id = pipe->mode;
@@ -9966,18 +9831,21 @@ ia_css_temp_pipe_to_pipe_id(const struct
}
enum atomisp_input_format
-ia_css_stream_get_format(const struct ia_css_stream *stream) {
+ia_css_stream_get_format(const struct ia_css_stream *stream)
+{
return stream->config.input_config.format;
}
bool
-ia_css_stream_get_two_pixels_per_clock(const struct ia_css_stream *stream) {
+ia_css_stream_get_two_pixels_per_clock(const struct ia_css_stream *stream)
+{
return (stream->config.pixels_per_clock == 2);
}
struct ia_css_binary *
ia_css_stream_get_shading_correction_binary(const struct ia_css_stream
- *stream) {
+ *stream)
+{
struct ia_css_pipe *pipe;
assert(stream);
@@ -9995,7 +9863,8 @@ ia_css_stream_get_shading_correction_bin
}
struct ia_css_binary *
-ia_css_stream_get_dvs_binary(const struct ia_css_stream *stream) {
+ia_css_stream_get_dvs_binary(const struct ia_css_stream *stream)
+{
int i;
struct ia_css_pipe *video_pipe = NULL;
@@ -10014,7 +9883,8 @@ ia_css_stream_get_dvs_binary(const struc
}
struct ia_css_binary *
-ia_css_stream_get_3a_binary(const struct ia_css_stream *stream) {
+ia_css_stream_get_3a_binary(const struct ia_css_stream *stream)
+{
struct ia_css_pipe *pipe;
struct ia_css_binary *s3a_binary = NULL;
@@ -10036,7 +9906,8 @@ ia_css_stream_get_3a_binary(const struct
int
ia_css_stream_set_output_padded_width(struct ia_css_stream *stream,
- unsigned int output_padded_width) {
+ unsigned int output_padded_width)
+{
struct ia_css_pipe *pipe;
assert(stream);
@@ -10053,7 +9924,8 @@ ia_css_stream_set_output_padded_width(st
}
static struct ia_css_binary *
-ia_css_pipe_get_shading_correction_binary(const struct ia_css_pipe *pipe) {
+ia_css_pipe_get_shading_correction_binary(const struct ia_css_pipe *pipe)
+{
struct ia_css_binary *binary = NULL;
assert(pipe);
@@ -10098,7 +9970,8 @@ ia_css_pipe_get_shading_correction_binar
}
static struct ia_css_binary *
-ia_css_pipe_get_s3a_binary(const struct ia_css_pipe *pipe) {
+ia_css_pipe_get_s3a_binary(const struct ia_css_pipe *pipe)
+{
struct ia_css_binary *binary = NULL;
assert(pipe);
@@ -10121,9 +9994,9 @@ ia_css_pipe_get_s3a_binary(const struct
}
}
} else if (pipe->config.default_capture_config.mode ==
- IA_CSS_CAPTURE_MODE_BAYER)
+ IA_CSS_CAPTURE_MODE_BAYER) {
binary = (struct ia_css_binary *)&pipe->pipe_settings.capture.pre_isp_binary;
- else if (pipe->config.default_capture_config.mode ==
+ } else if (pipe->config.default_capture_config.mode ==
IA_CSS_CAPTURE_MODE_ADVANCED ||
pipe->config.default_capture_config.mode == IA_CSS_CAPTURE_MODE_LOW_LIGHT) {
if (pipe->config.isp_pipe_version == IA_CSS_PIPE_VERSION_1)
@@ -10145,7 +10018,8 @@ ia_css_pipe_get_s3a_binary(const struct
}
static struct ia_css_binary *
-ia_css_pipe_get_sdis_binary(const struct ia_css_pipe *pipe) {
+ia_css_pipe_get_sdis_binary(const struct ia_css_pipe *pipe)
+{
struct ia_css_binary *binary = NULL;
assert(pipe);
@@ -10165,14 +10039,16 @@ ia_css_pipe_get_sdis_binary(const struct
}
struct ia_css_pipeline *
-ia_css_pipe_get_pipeline(const struct ia_css_pipe *pipe) {
+ia_css_pipe_get_pipeline(const struct ia_css_pipe *pipe)
+{
assert(pipe);
return (struct ia_css_pipeline *)&pipe->pipeline;
}
unsigned int
-ia_css_pipe_get_pipe_num(const struct ia_css_pipe *pipe) {
+ia_css_pipe_get_pipe_num(const struct ia_css_pipe *pipe)
+{
assert(pipe);
/* KW was not sure this function was not returning a value
@@ -10189,7 +10065,8 @@ ia_css_pipe_get_pipe_num(const struct ia
}
unsigned int
-ia_css_pipe_get_isp_pipe_version(const struct ia_css_pipe *pipe) {
+ia_css_pipe_get_isp_pipe_version(const struct ia_css_pipe *pipe)
+{
assert(pipe);
return (unsigned int)pipe->config.isp_pipe_version;
@@ -10198,7 +10075,8 @@ ia_css_pipe_get_isp_pipe_version(const s
#define SP_START_TIMEOUT_US 30000000
int
-ia_css_start_sp(void) {
+ia_css_start_sp(void)
+{
unsigned long timeout;
int err = 0;
@@ -10207,13 +10085,11 @@ ia_css_start_sp(void) {
/* waiting for the SP is completely started */
timeout = SP_START_TIMEOUT_US;
- while ((ia_css_spctrl_get_state(SP0_ID) != IA_CSS_SP_SW_INITIALIZED) && timeout)
- {
+ while ((ia_css_spctrl_get_state(SP0_ID) != IA_CSS_SP_SW_INITIALIZED) && timeout) {
timeout--;
udelay(1);
}
- if (timeout == 0)
- {
+ if (timeout == 0) {
IA_CSS_ERROR("timeout during SP initialization");
return -EINVAL;
}
@@ -10241,14 +10117,14 @@ ia_css_start_sp(void) {
#define SP_SHUTDOWN_TIMEOUT_US 200000
int
-ia_css_stop_sp(void) {
+ia_css_stop_sp(void)
+{
unsigned long timeout;
int err = 0;
IA_CSS_ENTER("void");
- if (!sh_css_sp_is_running())
- {
+ if (!sh_css_sp_is_running()) {
err = -EINVAL;
IA_CSS_LEAVE("SP already stopped : return_err=%d", err);
@@ -10260,8 +10136,7 @@ ia_css_stop_sp(void) {
if (!IS_ISP2401) {
sh_css_write_host2sp_command(host2sp_cmd_terminate);
} else {
- if (!sh_css_write_host2sp_command(host2sp_cmd_terminate))
- {
+ if (!sh_css_write_host2sp_command(host2sp_cmd_terminate)) {
IA_CSS_ERROR("Call to 'sh-css_write_host2sp_command()' failed");
ia_css_debug_dump_sp_sw_debug_info();
ia_css_debug_dump_debug_info(NULL);
@@ -10271,27 +10146,23 @@ ia_css_stop_sp(void) {
sh_css_sp_set_sp_running(false);
timeout = SP_SHUTDOWN_TIMEOUT_US;
- while (!ia_css_spctrl_is_idle(SP0_ID) && timeout)
- {
+ while (!ia_css_spctrl_is_idle(SP0_ID) && timeout) {
timeout--;
udelay(1);
}
if ((ia_css_spctrl_get_state(SP0_ID) != IA_CSS_SP_SW_TERMINATED))
IA_CSS_WARNING("SP has not terminated (SW)");
- if (timeout == 0)
- {
+ if (timeout == 0) {
IA_CSS_WARNING("SP is not idle");
ia_css_debug_dump_sp_sw_debug_info();
}
timeout = SP_SHUTDOWN_TIMEOUT_US;
- while (!isp_ctrl_getbit(ISP0_ID, ISP_SC_REG, ISP_IDLE_BIT) && timeout)
- {
+ while (!isp_ctrl_getbit(ISP0_ID, ISP_SC_REG, ISP_IDLE_BIT) && timeout) {
timeout--;
udelay(1);
}
- if (timeout == 0)
- {
+ if (timeout == 0) {
IA_CSS_WARNING("ISP is not idle");
ia_css_debug_dump_sp_sw_debug_info();
}
@@ -10306,7 +10177,8 @@ ia_css_stop_sp(void) {
}
int
-ia_css_update_continuous_frames(struct ia_css_stream *stream) {
+ia_css_update_continuous_frames(struct ia_css_stream *stream)
+{
struct ia_css_pipe *pipe;
unsigned int i;
@@ -10314,8 +10186,7 @@ ia_css_update_continuous_frames(struct i
IA_CSS_DEBUG_TRACE,
"sh_css_update_continuous_frames() enter:\n");
- if (!stream)
- {
+ if (!stream) {
ia_css_debug_dtrace(
IA_CSS_DEBUG_TRACE,
"sh_css_update_continuous_frames() leave: invalid stream, return_void\n");
@@ -10326,10 +10197,9 @@ ia_css_update_continuous_frames(struct i
for (i = stream->config.init_num_cont_raw_buf;
i < stream->config.target_num_cont_raw_buf; i++)
- {
sh_css_update_host2sp_offline_frame(i,
pipe->continuous_frames[i], pipe->cont_md_buffers[i]);
- }
+
sh_css_update_host2sp_cont_num_raw_frames
(stream->config.target_num_cont_raw_buf, true);
ia_css_debug_dtrace(
@@ -10455,7 +10325,8 @@ void ia_css_pipe_map_queue(struct ia_css
#if CONFIG_ON_FRAME_ENQUEUE()
static int set_config_on_frame_enqueue(struct ia_css_frame_info
- *info, struct frame_data_wrapper *frame) {
+ *info, struct frame_data_wrapper *frame)
+{
frame->config_on_frame_enqueue.padded_width = 0;
/* currently we support configuration on frame enqueue only on YUV formats */
@@ -10463,11 +10334,11 @@ static int set_config_on_frame_enqueue(s
switch (info->format) {
case IA_CSS_FRAME_FORMAT_YUV420:
case IA_CSS_FRAME_FORMAT_NV12:
- if (info->padded_width > info->res.width) {
+ if (info->padded_width > info->res.width)
frame->config_on_frame_enqueue.padded_width = info->padded_width;
- } else if ((info->padded_width < info->res.width) && (info->padded_width > 0)) {
+ else if ((info->padded_width < info->res.width) && (info->padded_width > 0))
return -EINVAL;
- }
+
/* nothing to do if width == padded width or padded width is zeroed (the same) */
break;
default:
@@ -10479,22 +10350,21 @@ static int set_config_on_frame_enqueue(s
#endif
int
-ia_css_unlock_raw_frame(struct ia_css_stream *stream, uint32_t exp_id) {
+ia_css_unlock_raw_frame(struct ia_css_stream *stream, uint32_t exp_id)
+{
int ret;
IA_CSS_ENTER("");
/* Only continuous streams have a tagger to which we can send the
* unlock message. */
- if (!stream || !stream->config.continuous)
- {
+ if (!stream || !stream->config.continuous) {
IA_CSS_ERROR("invalid stream pointer");
return -EINVAL;
}
if (exp_id > IA_CSS_ISYS_MAX_EXPOSURE_ID ||
- exp_id < IA_CSS_ISYS_MIN_EXPOSURE_ID)
- {
+ exp_id < IA_CSS_ISYS_MIN_EXPOSURE_ID) {
IA_CSS_ERROR("invalid exposure ID: %d\n", exp_id);
return -EINVAL;
}
@@ -10513,7 +10383,8 @@ ia_css_unlock_raw_frame(struct ia_css_st
*/
int
ia_css_pipe_set_qos_ext_state(struct ia_css_pipe *pipe, uint32_t fw_handle,
- bool enable) {
+ bool enable)
+{
unsigned int thread_id;
struct ia_css_pipeline_stage *stage;
int err = 0;
@@ -10521,20 +10392,16 @@ ia_css_pipe_set_qos_ext_state(struct ia_
IA_CSS_ENTER("");
/* Parameter Check */
- if (!pipe || !pipe->stream)
- {
+ if (!pipe || !pipe->stream) {
IA_CSS_ERROR("Invalid Pipe.");
err = -EINVAL;
- } else if (!(pipe->config.acc_extension))
- {
+ } else if (!(pipe->config.acc_extension)) {
IA_CSS_ERROR("Invalid Pipe(No Extension Firmware)");
err = -EINVAL;
- } else if (!sh_css_sp_is_running())
- {
+ } else if (!sh_css_sp_is_running()) {
IA_CSS_ERROR("Leaving: queue unavailable.");
err = -EBUSY;
- } else
- {
+ } else {
/* Query the threadid and stage_num for the Extension firmware*/
ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(pipe), &thread_id);
err = ia_css_pipeline_get_stage_from_fw(&pipe->pipeline, fw_handle, &stage);
@@ -10562,7 +10429,8 @@ ia_css_pipe_set_qos_ext_state(struct ia_
*/
int
ia_css_pipe_get_qos_ext_state(struct ia_css_pipe *pipe, uint32_t fw_handle,
- bool *enable) {
+ bool *enable)
+{
struct ia_css_pipeline_stage *stage;
unsigned int thread_id;
int err = 0;
@@ -10570,20 +10438,16 @@ ia_css_pipe_get_qos_ext_state(struct ia_
IA_CSS_ENTER("");
/* Parameter Check */
- if (!pipe || !pipe->stream)
- {
+ if (!pipe || !pipe->stream) {
IA_CSS_ERROR("Invalid Pipe.");
err = -EINVAL;
- } else if (!(pipe->config.acc_extension))
- {
+ } else if (!(pipe->config.acc_extension)) {
IA_CSS_ERROR("Invalid Pipe (No Extension Firmware).");
err = -EINVAL;
- } else if (!sh_css_sp_is_running())
- {
+ } else if (!sh_css_sp_is_running()) {
IA_CSS_ERROR("Leaving: queue unavailable.");
err = -EBUSY;
- } else
- {
+ } else {
/* Query the threadid and stage_num corresponding to the Extension firmware*/
ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(pipe), &thread_id);
err = ia_css_pipeline_get_stage_from_fw(&pipe->pipeline, fw_handle, &stage);
@@ -10603,7 +10467,8 @@ int
ia_css_pipe_update_qos_ext_mapped_arg(struct ia_css_pipe *pipe,
u32 fw_handle,
struct ia_css_isp_param_css_segments *css_seg,
- struct ia_css_isp_param_isp_segments *isp_seg) {
+ struct ia_css_isp_param_isp_segments *isp_seg)
+{
unsigned int HIVE_ADDR_sp_group;
static struct sh_css_sp_group sp_group;
static struct sh_css_sp_stage sp_stage;
@@ -10621,20 +10486,16 @@ ia_css_pipe_update_qos_ext_mapped_arg(st
fw = &sh_css_sp_fw;
/* Parameter Check */
- if (!pipe || !pipe->stream)
- {
+ if (!pipe || !pipe->stream) {
IA_CSS_ERROR("Invalid Pipe.");
err = -EINVAL;
- } else if (!(pipe->config.acc_extension))
- {
+ } else if (!(pipe->config.acc_extension)) {
IA_CSS_ERROR("Invalid Pipe (No Extension Firmware).");
err = -EINVAL;
- } else if (!sh_css_sp_is_running())
- {
+ } else if (!sh_css_sp_is_running()) {
IA_CSS_ERROR("Leaving: queue unavailable.");
err = -EBUSY;
- } else
- {
+ } else {
/* Query the thread_id and stage_num corresponding to the Extension firmware */
ia_css_pipeline_get_sp_thread_id(ia_css_pipe_get_pipe_num(pipe), &thread_id);
err = ia_css_pipeline_get_stage_from_fw(&pipe->pipeline, fw_handle, &stage);
@@ -10685,7 +10546,8 @@ ia_css_pipe_update_qos_ext_mapped_arg(st
static int
aspect_ratio_crop_init(struct ia_css_stream *curr_stream,
struct ia_css_pipe *pipes[],
- bool *do_crop_status) {
+ bool *do_crop_status)
+{
int err = 0;
int i;
struct ia_css_pipe *curr_pipe;
@@ -10694,15 +10556,13 @@ aspect_ratio_crop_init(struct ia_css_str
if ((!curr_stream) ||
(curr_stream->num_pipes == 0) ||
(!pipes) ||
- (!do_crop_status))
- {
+ (!do_crop_status)) {
err = -EINVAL;
IA_CSS_LEAVE_ERR(err);
return err;
}
- for (i = 0; i < curr_stream->num_pipes; i++)
- {
+ for (i = 0; i < curr_stream->num_pipes; i++) {
curr_pipe = pipes[i];
pipe_mask |= (1 << curr_pipe->config.mode);
}
@@ -10716,7 +10576,8 @@ aspect_ratio_crop_init(struct ia_css_str
}
static bool
-aspect_ratio_crop_check(bool enabled, struct ia_css_pipe *curr_pipe) {
+aspect_ratio_crop_check(bool enabled, struct ia_css_pipe *curr_pipe)
+{
bool status = false;
if ((curr_pipe) && enabled) {
@@ -10731,7 +10592,8 @@ aspect_ratio_crop_check(bool enabled, st
static int
aspect_ratio_crop(struct ia_css_pipe *curr_pipe,
- struct ia_css_resolution *effective_res) {
+ struct ia_css_resolution *effective_res)
+{
int err = 0;
struct ia_css_resolution crop_res;
struct ia_css_resolution *in_res = NULL;
@@ -10741,8 +10603,7 @@ aspect_ratio_crop(struct ia_css_pipe *cu
bool use_capt_pp_in_res = false;
if ((!curr_pipe) ||
- (!effective_res))
- {
+ (!effective_res)) {
err = -EINVAL;
IA_CSS_LEAVE_ERR(err);
return err;
@@ -10750,8 +10611,7 @@ aspect_ratio_crop(struct ia_css_pipe *cu
if ((curr_pipe->config.mode != IA_CSS_PIPE_MODE_PREVIEW) &&
(curr_pipe->config.mode != IA_CSS_PIPE_MODE_VIDEO) &&
- (curr_pipe->config.mode != IA_CSS_PIPE_MODE_CAPTURE))
- {
+ (curr_pipe->config.mode != IA_CSS_PIPE_MODE_CAPTURE)) {
err = -EINVAL;
IA_CSS_LEAVE_ERR(err);
return err;
@@ -10772,8 +10632,7 @@ aspect_ratio_crop(struct ia_css_pipe *cu
in_res = &curr_pipe->stream->config.input_config.effective_res;
out_res = &curr_pipe->output_info[0].res;
- switch (curr_pipe->config.mode)
- {
+ switch (curr_pipe->config.mode) {
case IA_CSS_PIPE_MODE_PREVIEW:
if (use_bds_output_info)
out_res = &curr_pipe->bds_output_info.res;
@@ -10800,20 +10659,19 @@ aspect_ratio_crop(struct ia_css_pipe *cu
err = ia_css_frame_find_crop_resolution(in_res, out_res, &crop_res);
if (!err)
- {
*effective_res = crop_res;
- } else
- {
+ else
/* in case of error fallback to default
* effective resolution from driver. */
IA_CSS_LOG("ia_css_frame_find_crop_resolution() failed with err(%d)", err);
- }
+
return err;
}
#endif
static void
-sh_css_hmm_buffer_record_init(void) {
+sh_css_hmm_buffer_record_init(void)
+{
int i;
for (i = 0; i < MAX_HMM_BUFFER_NUM; i++)
@@ -10821,7 +10679,8 @@ sh_css_hmm_buffer_record_init(void) {
}
static void
-sh_css_hmm_buffer_record_uninit(void) {
+sh_css_hmm_buffer_record_uninit(void)
+{
int i;
struct sh_css_hmm_buffer_record *buffer_record = NULL;
@@ -10837,7 +10696,8 @@ sh_css_hmm_buffer_record_uninit(void) {
}
static void
-sh_css_hmm_buffer_record_reset(struct sh_css_hmm_buffer_record *buffer_record) {
+sh_css_hmm_buffer_record_reset(struct sh_css_hmm_buffer_record *buffer_record)
+{
assert(buffer_record);
buffer_record->in_use = false;
buffer_record->type = IA_CSS_BUFFER_TYPE_INVALID;
@@ -10848,7 +10708,8 @@ sh_css_hmm_buffer_record_reset(struct sh
static struct sh_css_hmm_buffer_record
*sh_css_hmm_buffer_record_acquire(struct ia_css_rmgr_vbuf_handle *h_vbuf,
enum ia_css_buffer_type type,
- hrt_address kernel_ptr) {
+ hrt_address kernel_ptr)
+{
int i;
struct sh_css_hmm_buffer_record *buffer_record = NULL;
struct sh_css_hmm_buffer_record *out_buffer_record = NULL;
@@ -10876,7 +10737,8 @@ static struct sh_css_hmm_buffer_record
static struct sh_css_hmm_buffer_record
*sh_css_hmm_buffer_record_validate(ia_css_ptr ddr_buffer_addr,
- enum ia_css_buffer_type type) {
+ enum ia_css_buffer_type type)
+{
int i;
struct sh_css_hmm_buffer_record *buffer_record = NULL;
bool found_record = false;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 605/699] media: staging: media: atomisp: Replace if else clause with a ternary
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (603 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 604/699] media: staging: media: atomisp: Fix the rest of sh_css.c brace issues Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 606/699] media: staging: media: atomisp: Fix alignment and line length issues Greg Kroah-Hartman
` (97 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martiros Shakhzadyan, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <vrzh@vrzh.net>
[ Upstream commit d4bc34d18201120b247506b4a6ed17af694dfcf7 ]
Use the ternary operator for conditional variable assignment in
create_host_video_pipeline().
Signed-off-by: Martiros Shakhzadyan <vrzh@vrzh.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -3623,11 +3623,8 @@ static int create_host_video_pipeline(st
struct ia_css_frame *tmp_out_frame = NULL;
for (i = 0; i < num_yuv_scaler; i++) {
- if (is_output_stage[i]) {
- tmp_out_frame = out_frame;
- } else {
- tmp_out_frame = NULL;
- }
+ tmp_out_frame = is_output_stage[i] ? out_frame : NULL;
+
err = add_yuv_scaler_stage(pipe, me, tmp_in_frame, tmp_out_frame,
NULL,
&yuv_scaler_binary[i],
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 606/699] media: staging: media: atomisp: Fix alignment and line length issues
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (604 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 605/699] media: staging: media: atomisp: Replace if else clause with a ternary Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 607/699] staging: media: atomisp: reduce load_primary_binaries() stack usage Greg Kroah-Hartman
` (96 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martiros Shakhzadyan, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martiros Shakhzadyan <vrzh@vrzh.net>
[ Upstream commit 7796e455170efa1823457b17a292b1c65bb8c1e0 ]
Fix alignment style issues and adjacent line length issues in sh_css.c
Signed-off-by: Martiros Shakhzadyan <vrzh@vrzh.net>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Stable-dep-of: f4d51e55dd47 ("staging: media: atomisp: reduce load_primary_binaries() stack usage")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 619 +++++++++++++++--------------
1 file changed, 333 insertions(+), 286 deletions(-)
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -242,8 +242,8 @@ ia_css_reset_defaults(struct sh_css *css
static void
sh_css_init_host_sp_control_vars(void);
-static int set_num_primary_stages(unsigned int *num,
- enum ia_css_pipe_version version);
+static int
+set_num_primary_stages(unsigned int *num, enum ia_css_pipe_version version);
static bool
need_capture_pp(const struct ia_css_pipe *pipe);
@@ -3002,9 +3002,8 @@ static int add_firmwares(
ia_css_pipe_get_firmwares_stage_desc(&stage_desc, binary,
out, in, vf, fw, binary_mode);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- &extra_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ &extra_stage);
if (err)
return err;
if (fw->info.isp.sp.enable.output != 0)
@@ -3112,9 +3111,8 @@ static int add_yuv_scaler_stage(
ia_css_pipe_get_generic_stage_desc(&stage_desc,
yuv_scaler_binary, out_frames, in_frame, vf_frame);
}
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- pre_vf_pp_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ pre_vf_pp_stage);
if (err)
return err;
in_frame = (*pre_vf_pp_stage)->args.out_frame[0];
@@ -3172,9 +3170,8 @@ static int add_capture_pp_stage(
ia_css_pipe_get_generic_stage_desc(&stage_desc,
capture_pp_binary, out_frames, NULL, vf_frame);
}
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- capture_pp_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ capture_pp_stage);
if (err)
return err;
err = add_firmwares(me, capture_pp_binary, pipe->output_stage, last_fw,
@@ -3529,9 +3526,8 @@ static int create_host_video_pipeline(st
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
out_frames, NULL, NULL);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- ©_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ ©_stage);
if (err)
goto ERR;
in_frame = me->stages->args.out_frame[0];
@@ -3558,9 +3554,8 @@ static int create_host_video_pipeline(st
ia_css_pipe_get_generic_stage_desc(&stage_desc, video_binary,
out_frames, in_frame, vf_frame);
}
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- &video_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ &video_stage);
if (err)
goto ERR;
@@ -3625,8 +3620,8 @@ static int create_host_video_pipeline(st
for (i = 0; i < num_yuv_scaler; i++) {
tmp_out_frame = is_output_stage[i] ? out_frame : NULL;
- err = add_yuv_scaler_stage(pipe, me, tmp_in_frame, tmp_out_frame,
- NULL,
+ err = add_yuv_scaler_stage(pipe, me, tmp_in_frame,
+ tmp_out_frame, NULL,
&yuv_scaler_binary[i],
&yuv_scaler_stage);
@@ -3765,9 +3760,8 @@ create_host_preview_pipeline(struct ia_c
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
out_frames, NULL, NULL);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- ©_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ ©_stage);
if (err)
goto ERR;
in_frame = me->stages->args.out_frame[0];
@@ -3793,9 +3787,8 @@ create_host_preview_pipeline(struct ia_c
ia_css_pipe_get_generic_stage_desc(&stage_desc, preview_binary,
out_frames, in_frame, NULL);
}
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- &preview_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ &preview_stage);
if (err)
goto ERR;
/* If we use copy iso preview, the input must be yuv iso raw */
@@ -4131,8 +4124,8 @@ ia_css_pipe_enqueue_buffer(struct ia_css
}
hmm_store(h_vbuf->vptr,
- (void *)(&ddr_buffer),
- sizeof(struct sh_css_hmm_buffer));
+ (void *)(&ddr_buffer),
+ sizeof(struct sh_css_hmm_buffer));
if ((buf_type == IA_CSS_BUFFER_TYPE_3A_STATISTICS)
|| (buf_type == IA_CSS_BUFFER_TYPE_DIS_STATISTICS)
|| (buf_type == IA_CSS_BUFFER_TYPE_LACE_STATISTICS)) {
@@ -4293,8 +4286,8 @@ ia_css_pipe_dequeue_buffer(struct ia_css
}
hmm_load(ddr_buffer_addr,
- &ddr_buffer,
- sizeof(struct sh_css_hmm_buffer));
+ &ddr_buffer,
+ sizeof(struct sh_css_hmm_buffer));
/* if the kernel_ptr is 0 or an invalid, return an error.
* do not access the buffer via the kernal_ptr.
@@ -4949,7 +4942,7 @@ sh_css_pipes_stop(struct ia_css_stream *
for (i = 0; i < stream->num_pipes; i++) {
/* send the "stop" request to the "ia_css_pipe" instance */
IA_CSS_LOG("Send the stop-request to the pipe: pipe_id=%d",
- stream->pipes[i]->pipeline.pipe_id);
+ stream->pipes[i]->pipeline.pipe_id);
err = ia_css_pipeline_request_stop(&stream->pipes[i]->pipeline);
/*
@@ -4999,7 +4992,7 @@ sh_css_pipes_stop(struct ia_css_stream *
/* send the "stop" request to "Copy Pipe" */
IA_CSS_LOG("Send the stop-request to the pipe: pipe_id=%d",
- copy_pipe->pipeline.pipe_id);
+ copy_pipe->pipeline.pipe_id);
err = ia_css_pipeline_request_stop(©_pipe->pipeline);
}
@@ -5832,7 +5825,7 @@ static bool need_capt_ldc(
}
static int set_num_primary_stages(unsigned int *num,
- enum ia_css_pipe_version version)
+ enum ia_css_pipe_version version)
{
int err = 0;
@@ -6032,10 +6025,13 @@ static int load_primary_binaries(
capt_pp_in_info = &prim_out_info;
ia_css_pipe_get_capturepp_binarydesc(pipe,
- &capture_pp_descr, capt_pp_in_info,
- &capt_pp_out_info, &vf_info);
+ &capture_pp_descr,
+ capt_pp_in_info,
+ &capt_pp_out_info,
+ &vf_info);
+
err = ia_css_binary_find(&capture_pp_descr,
- &mycs->capture_pp_binary);
+ &mycs->capture_pp_binary);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -6045,11 +6041,12 @@ static int load_primary_binaries(
struct ia_css_binary_descr capt_ldc_descr;
ia_css_pipe_get_ldc_binarydesc(pipe,
- &capt_ldc_descr, &prim_out_info,
- &capt_ldc_out_info);
+ &capt_ldc_descr,
+ &prim_out_info,
+ &capt_ldc_out_info);
err = ia_css_binary_find(&capt_ldc_descr,
- &mycs->capture_ldc_binary);
+ &mycs->capture_ldc_binary);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -6066,8 +6063,9 @@ static int load_primary_binaries(
if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0] &&
(i == mycs->num_primary_stage - 1))
local_vf_info = &vf_info;
- ia_css_pipe_get_primary_binarydesc(pipe, &prim_descr[i], &prim_in_info,
- &prim_out_info, local_vf_info, i);
+ ia_css_pipe_get_primary_binarydesc(pipe, &prim_descr[i],
+ &prim_in_info, &prim_out_info,
+ local_vf_info, i);
err = ia_css_binary_find(&prim_descr[i], &mycs->primary_binary[i]);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
@@ -6119,8 +6117,8 @@ static int load_primary_binaries(
/* ISP Copy */
if (need_isp_copy_binary) {
err = load_copy_binary(pipe,
- &mycs->copy_binary,
- &mycs->primary_binary[0]);
+ &mycs->copy_binary,
+ &mycs->primary_binary[0]);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -6229,7 +6227,7 @@ static int load_advanced_binaries(
assert(pipe);
assert(pipe->mode == IA_CSS_PIPE_ID_CAPTURE ||
- pipe->mode == IA_CSS_PIPE_ID_COPY);
+ pipe->mode == IA_CSS_PIPE_ID_COPY);
if (pipe->pipe_settings.capture.pre_isp_binary.info)
return 0;
pipe_out_info = &pipe->output_info[0];
@@ -6242,17 +6240,18 @@ static int load_advanced_binaries(
need_pp = need_capture_pp(pipe);
ia_css_frame_info_set_format(&vf_info,
- IA_CSS_FRAME_FORMAT_YUV_LINE);
+ IA_CSS_FRAME_FORMAT_YUV_LINE);
/* we build up the pipeline starting at the end */
/* Capture post-processing */
if (need_pp) {
struct ia_css_binary_descr capture_pp_descr;
- ia_css_pipe_get_capturepp_binarydesc(pipe,
- &capture_pp_descr, &post_out_info, pipe_out_info, &vf_info);
+ ia_css_pipe_get_capturepp_binarydesc(pipe, &capture_pp_descr,
+ &post_out_info,
+ pipe_out_info, &vf_info);
err = ia_css_binary_find(&capture_pp_descr,
- &pipe->pipe_settings.capture.capture_pp_binary);
+ &pipe->pipe_settings.capture.capture_pp_binary);
if (err)
return err;
} else {
@@ -6263,10 +6262,11 @@ static int load_advanced_binaries(
{
struct ia_css_binary_descr post_gdc_descr;
- ia_css_pipe_get_post_gdc_binarydesc(pipe,
- &post_gdc_descr, &post_in_info, &post_out_info, &vf_info);
+ ia_css_pipe_get_post_gdc_binarydesc(pipe, &post_gdc_descr,
+ &post_in_info,
+ &post_out_info, &vf_info);
err = ia_css_binary_find(&post_gdc_descr,
- &pipe->pipe_settings.capture.post_isp_binary);
+ &pipe->pipe_settings.capture.post_isp_binary);
if (err)
return err;
}
@@ -6276,9 +6276,9 @@ static int load_advanced_binaries(
struct ia_css_binary_descr gdc_descr;
ia_css_pipe_get_gdc_binarydesc(pipe, &gdc_descr, &gdc_in_info,
- &pipe->pipe_settings.capture.post_isp_binary.in_frame_info);
+ &pipe->pipe_settings.capture.post_isp_binary.in_frame_info);
err = ia_css_binary_find(&gdc_descr,
- &pipe->pipe_settings.capture.anr_gdc_binary);
+ &pipe->pipe_settings.capture.anr_gdc_binary);
if (err)
return err;
}
@@ -6290,9 +6290,9 @@ static int load_advanced_binaries(
struct ia_css_binary_descr pre_gdc_descr;
ia_css_pipe_get_pre_gdc_binarydesc(pipe, &pre_gdc_descr, &pre_in_info,
- &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info);
+ &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info);
err = ia_css_binary_find(&pre_gdc_descr,
- &pipe->pipe_settings.capture.pre_isp_binary);
+ &pipe->pipe_settings.capture.pre_isp_binary);
if (err)
return err;
}
@@ -6314,7 +6314,7 @@ static int load_advanced_binaries(
ia_css_pipe_get_vfpp_binarydesc(pipe,
&vf_pp_descr, vf_pp_in_info, pipe_vf_out_info);
err = ia_css_binary_find(&vf_pp_descr,
- &pipe->pipe_settings.capture.vf_pp_binary);
+ &pipe->pipe_settings.capture.vf_pp_binary);
if (err)
return err;
}
@@ -6326,8 +6326,8 @@ static int load_advanced_binaries(
#endif
if (need_isp_copy)
load_copy_binary(pipe,
- &pipe->pipe_settings.capture.copy_binary,
- &pipe->pipe_settings.capture.pre_isp_binary);
+ &pipe->pipe_settings.capture.copy_binary,
+ &pipe->pipe_settings.capture.pre_isp_binary);
return err;
}
@@ -6342,7 +6342,7 @@ static int load_bayer_isp_binaries(
IA_CSS_ENTER_PRIVATE("");
assert(pipe);
assert(pipe->mode == IA_CSS_PIPE_ID_CAPTURE ||
- pipe->mode == IA_CSS_PIPE_ID_COPY);
+ pipe->mode == IA_CSS_PIPE_ID_COPY);
pipe_out_info = &pipe->output_info[0];
if (pipe->pipe_settings.capture.pre_isp_binary.info)
@@ -6353,11 +6353,11 @@ static int load_bayer_isp_binaries(
return err;
ia_css_pipe_get_pre_de_binarydesc(pipe, &pre_de_descr,
- &pre_isp_in_info,
- pipe_out_info);
+ &pre_isp_in_info,
+ pipe_out_info);
err = ia_css_binary_find(&pre_de_descr,
- &pipe->pipe_settings.capture.pre_isp_binary);
+ &pipe->pipe_settings.capture.pre_isp_binary);
return err;
}
@@ -6376,7 +6376,7 @@ static int load_low_light_binaries(
IA_CSS_ENTER_PRIVATE("");
assert(pipe);
assert(pipe->mode == IA_CSS_PIPE_ID_CAPTURE ||
- pipe->mode == IA_CSS_PIPE_ID_COPY);
+ pipe->mode == IA_CSS_PIPE_ID_COPY);
if (pipe->pipe_settings.capture.pre_isp_binary.info)
return 0;
@@ -6391,17 +6391,18 @@ static int load_low_light_binaries(
need_pp = need_capture_pp(pipe);
ia_css_frame_info_set_format(&vf_info,
- IA_CSS_FRAME_FORMAT_YUV_LINE);
+ IA_CSS_FRAME_FORMAT_YUV_LINE);
/* we build up the pipeline starting at the end */
/* Capture post-processing */
if (need_pp) {
struct ia_css_binary_descr capture_pp_descr;
- ia_css_pipe_get_capturepp_binarydesc(pipe,
- &capture_pp_descr, &post_out_info, pipe_out_info, &vf_info);
+ ia_css_pipe_get_capturepp_binarydesc(pipe, &capture_pp_descr,
+ &post_out_info,
+ pipe_out_info, &vf_info);
err = ia_css_binary_find(&capture_pp_descr,
- &pipe->pipe_settings.capture.capture_pp_binary);
+ &pipe->pipe_settings.capture.capture_pp_binary);
if (err)
return err;
} else {
@@ -6415,7 +6416,7 @@ static int load_low_light_binaries(
ia_css_pipe_get_post_anr_binarydesc(pipe,
&post_anr_descr, &post_in_info, &post_out_info, &vf_info);
err = ia_css_binary_find(&post_anr_descr,
- &pipe->pipe_settings.capture.post_isp_binary);
+ &pipe->pipe_settings.capture.post_isp_binary);
if (err)
return err;
}
@@ -6425,9 +6426,9 @@ static int load_low_light_binaries(
struct ia_css_binary_descr anr_descr;
ia_css_pipe_get_anr_binarydesc(pipe, &anr_descr, &anr_in_info,
- &pipe->pipe_settings.capture.post_isp_binary.in_frame_info);
+ &pipe->pipe_settings.capture.post_isp_binary.in_frame_info);
err = ia_css_binary_find(&anr_descr,
- &pipe->pipe_settings.capture.anr_gdc_binary);
+ &pipe->pipe_settings.capture.anr_gdc_binary);
if (err)
return err;
}
@@ -6439,9 +6440,9 @@ static int load_low_light_binaries(
struct ia_css_binary_descr pre_anr_descr;
ia_css_pipe_get_pre_anr_binarydesc(pipe, &pre_anr_descr, &pre_in_info,
- &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info);
+ &pipe->pipe_settings.capture.anr_gdc_binary.in_frame_info);
err = ia_css_binary_find(&pre_anr_descr,
- &pipe->pipe_settings.capture.pre_isp_binary);
+ &pipe->pipe_settings.capture.pre_isp_binary);
if (err)
return err;
}
@@ -6460,10 +6461,10 @@ static int load_low_light_binaries(
{
struct ia_css_binary_descr vf_pp_descr;
- ia_css_pipe_get_vfpp_binarydesc(pipe,
- &vf_pp_descr, vf_pp_in_info, pipe_vf_out_info);
+ ia_css_pipe_get_vfpp_binarydesc(pipe, &vf_pp_descr,
+ vf_pp_in_info, pipe_vf_out_info);
err = ia_css_binary_find(&vf_pp_descr,
- &pipe->pipe_settings.capture.vf_pp_binary);
+ &pipe->pipe_settings.capture.vf_pp_binary);
if (err)
return err;
}
@@ -6475,8 +6476,8 @@ static int load_low_light_binaries(
#endif
if (need_isp_copy)
err = load_copy_binary(pipe,
- &pipe->pipe_settings.capture.copy_binary,
- &pipe->pipe_settings.capture.pre_isp_binary);
+ &pipe->pipe_settings.capture.copy_binary,
+ &pipe->pipe_settings.capture.pre_isp_binary);
return err;
}
@@ -6510,7 +6511,7 @@ static int load_capture_binaries(
IA_CSS_ENTER_PRIVATE("");
assert(pipe);
assert(pipe->mode == IA_CSS_PIPE_ID_CAPTURE ||
- pipe->mode == IA_CSS_PIPE_ID_COPY);
+ pipe->mode == IA_CSS_PIPE_ID_COPY);
if (pipe->pipe_settings.capture.primary_binary[0].info) {
IA_CSS_LEAVE_ERR_PRIVATE(0);
@@ -6605,7 +6606,7 @@ unload_capture_binaries(struct ia_css_pi
static bool
need_downscaling(const struct ia_css_resolution in_res,
- const struct ia_css_resolution out_res)
+ const struct ia_css_resolution out_res)
{
if (in_res.width > out_res.width || in_res.height > out_res.height)
return true;
@@ -6676,9 +6677,9 @@ static int ia_css_pipe_create_cas_scaler
descr->num_output_stage = 1;
hor_ds_factor = CEIL_DIV(cas_scaler_in_info->res.width,
- cas_scaler_out_info->res.width);
+ cas_scaler_out_info->res.width);
ver_ds_factor = CEIL_DIV(cas_scaler_in_info->res.height,
- cas_scaler_out_info->res.height);
+ cas_scaler_out_info->res.height);
/* use the same horizontal and vertical downscaling factor for simplicity */
assert(hor_ds_factor == ver_ds_factor);
@@ -6688,31 +6689,36 @@ static int ia_css_pipe_create_cas_scaler
i *= max_scale_factor_per_stage;
}
- descr->in_info = kmalloc(descr->num_stage * sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->in_info = kmalloc(descr->num_stage *
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->in_info) {
err = -ENOMEM;
goto ERR;
}
- descr->internal_out_info = kmalloc(descr->num_stage * sizeof(
- struct ia_css_frame_info), GFP_KERNEL);
+ descr->internal_out_info = kmalloc(descr->num_stage *
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->internal_out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->out_info = kmalloc(descr->num_stage * sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->out_info = kmalloc(descr->num_stage *
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->vf_info = kmalloc(descr->num_stage * sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->vf_info = kmalloc(descr->num_stage *
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->vf_info) {
err = -ENOMEM;
goto ERR;
}
- descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool), GFP_KERNEL);
+ descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool),
+ GFP_KERNEL);
if (!descr->is_output_stage) {
err = -ENOMEM;
goto ERR;
@@ -6756,9 +6762,9 @@ static int ia_css_pipe_create_cas_scaler
max_scale_factor_per_stage;
descr->internal_out_info[i].format = IA_CSS_FRAME_FORMAT_YUV420;
ia_css_frame_info_init(&descr->internal_out_info[i],
- tmp_in_info.res.width / max_scale_factor_per_stage,
- tmp_in_info.res.height / max_scale_factor_per_stage,
- IA_CSS_FRAME_FORMAT_YUV420, 0);
+ tmp_in_info.res.width / max_scale_factor_per_stage,
+ tmp_in_info.res.height / max_scale_factor_per_stage,
+ IA_CSS_FRAME_FORMAT_YUV420, 0);
descr->out_info[i].res.width = 0;
descr->out_info[i].res.height = 0;
descr->vf_info[i].res.width = 0;
@@ -6834,30 +6840,35 @@ static int ia_css_pipe_create_cas_scaler
descr->num_stage = num_stages;
descr->in_info = kmalloc_array(descr->num_stage,
- sizeof(struct ia_css_frame_info), GFP_KERNEL);
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->in_info) {
err = -ENOMEM;
goto ERR;
}
- descr->internal_out_info = kmalloc(descr->num_stage * sizeof(
- struct ia_css_frame_info), GFP_KERNEL);
+ descr->internal_out_info = kmalloc(descr->num_stage *
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->internal_out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->out_info = kmalloc(descr->num_stage * sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->out_info = kmalloc(descr->num_stage *
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->out_info) {
err = -ENOMEM;
goto ERR;
}
- descr->vf_info = kmalloc(descr->num_stage * sizeof(struct ia_css_frame_info),
- GFP_KERNEL);
+ descr->vf_info = kmalloc(descr->num_stage *
+ sizeof(struct ia_css_frame_info),
+ GFP_KERNEL);
if (!descr->vf_info) {
err = -ENOMEM;
goto ERR;
}
- descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool), GFP_KERNEL);
+ descr->is_output_stage = kmalloc(descr->num_stage * sizeof(bool),
+ GFP_KERNEL);
if (!descr->is_output_stage) {
err = -ENOMEM;
goto ERR;
@@ -6867,7 +6878,7 @@ static int ia_css_pipe_create_cas_scaler
if (out_info[i]) {
if (i > 0) {
assert((out_info[i - 1]->res.width >= out_info[i]->res.width) &&
- (out_info[i - 1]->res.height >= out_info[i]->res.height));
+ (out_info[i - 1]->res.height >= out_info[i]->res.height));
}
}
}
@@ -6915,9 +6926,9 @@ static int ia_css_pipe_create_cas_scaler
max_scale_factor_per_stage;
descr->internal_out_info[i].format = IA_CSS_FRAME_FORMAT_YUV420;
ia_css_frame_info_init(&descr->internal_out_info[i],
- tmp_in_info.res.width / max_scale_factor_per_stage,
- tmp_in_info.res.height / max_scale_factor_per_stage,
- IA_CSS_FRAME_FORMAT_YUV420, 0);
+ tmp_in_info.res.width / max_scale_factor_per_stage,
+ tmp_in_info.res.height / max_scale_factor_per_stage,
+ IA_CSS_FRAME_FORMAT_YUV420, 0);
descr->out_info[i].res.width = 0;
descr->out_info[i].res.height = 0;
descr->vf_info[i].res.width = 0;
@@ -6996,13 +7007,14 @@ load_yuvpp_binaries(struct ia_css_pipe *
struct ia_css_binary_descr yuv_scaler_descr;
err = ia_css_pipe_create_cas_scaler_desc(pipe,
- &cas_scaler_descr);
+ &cas_scaler_descr);
if (err)
goto ERR;
mycs->num_output = cas_scaler_descr.num_output_stage;
mycs->num_yuv_scaler = cas_scaler_descr.num_stage;
mycs->yuv_scaler_binary = kzalloc(cas_scaler_descr.num_stage *
- sizeof(struct ia_css_binary), GFP_KERNEL);
+ sizeof(struct ia_css_binary),
+ GFP_KERNEL);
if (!mycs->yuv_scaler_binary) {
err = -ENOMEM;
goto ERR;
@@ -7016,12 +7028,13 @@ load_yuvpp_binaries(struct ia_css_pipe *
for (i = 0; i < cas_scaler_descr.num_stage; i++) {
mycs->is_output_stage[i] = cas_scaler_descr.is_output_stage[i];
ia_css_pipe_get_yuvscaler_binarydesc(pipe,
- &yuv_scaler_descr, &cas_scaler_descr.in_info[i],
- &cas_scaler_descr.out_info[i],
- &cas_scaler_descr.internal_out_info[i],
- &cas_scaler_descr.vf_info[i]);
+ &yuv_scaler_descr,
+ &cas_scaler_descr.in_info[i],
+ &cas_scaler_descr.out_info[i],
+ &cas_scaler_descr.internal_out_info[i],
+ &cas_scaler_descr.vf_info[i]);
err = ia_css_binary_find(&yuv_scaler_descr,
- &mycs->yuv_scaler_binary[i]);
+ &mycs->yuv_scaler_binary[i]);
if (err)
goto ERR;
}
@@ -7061,8 +7074,8 @@ load_yuvpp_binaries(struct ia_css_pipe *
if (need_isp_copy_binary) {
err = load_copy_binary(pipe,
- &mycs->copy_binary,
- next_binary);
+ &mycs->copy_binary,
+ next_binary);
if (err)
goto ERR;
@@ -7107,8 +7120,9 @@ load_yuvpp_binaries(struct ia_css_pipe *
mycs->num_vf_pp = 1;
}
- mycs->vf_pp_binary = kzalloc(mycs->num_vf_pp * sizeof(struct ia_css_binary),
- GFP_KERNEL);
+ mycs->vf_pp_binary = kzalloc(mycs->num_vf_pp *
+ sizeof(struct ia_css_binary),
+ GFP_KERNEL);
if (!mycs->vf_pp_binary) {
err = -ENOMEM;
goto ERR;
@@ -7437,18 +7451,26 @@ create_host_yuvpp_pipeline(struct ia_css
#endif
if (need_scaler) {
- ia_css_pipe_util_set_output_frames(bin_out_frame, 0, NULL);
- ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
- bin_out_frame, in_frame_local, NULL);
+ ia_css_pipe_util_set_output_frames(bin_out_frame,
+ 0, NULL);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ copy_binary,
+ bin_out_frame,
+ in_frame_local,
+ NULL);
} else {
- ia_css_pipe_util_set_output_frames(bin_out_frame, 0, out_frame[0]);
- ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
- bin_out_frame, in_frame_local, NULL);
+ ia_css_pipe_util_set_output_frames(bin_out_frame,
+ 0, out_frame[0]);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ copy_binary,
+ bin_out_frame,
+ in_frame_local,
+ NULL);
}
err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- ©_stage);
+ &stage_desc,
+ ©_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
@@ -7480,10 +7502,11 @@ create_host_yuvpp_pipeline(struct ia_css
tmp_vf_frame = NULL;
}
- err = add_yuv_scaler_stage(pipe, me, tmp_in_frame, tmp_out_frame,
- NULL,
- &yuv_scaler_binary[i],
- &yuv_scaler_stage);
+ err = add_yuv_scaler_stage(pipe, me, tmp_in_frame,
+ tmp_out_frame,
+ NULL,
+ &yuv_scaler_binary[i],
+ &yuv_scaler_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
@@ -7494,8 +7517,10 @@ create_host_yuvpp_pipeline(struct ia_css
if (pipe->pipe_settings.yuvpp.is_output_stage[i]) {
if (tmp_vf_frame && (tmp_vf_frame->info.res.width != 0)) {
in_frame = yuv_scaler_stage->args.out_vf_frame;
- err = add_vf_pp_stage(pipe, in_frame, tmp_vf_frame, &vf_pp_binary[j],
- &vf_pp_stage);
+ err = add_vf_pp_stage(pipe, in_frame,
+ tmp_vf_frame,
+ &vf_pp_binary[j],
+ &vf_pp_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
@@ -7508,8 +7533,8 @@ create_host_yuvpp_pipeline(struct ia_css
} else if (copy_stage) {
if (vf_frame[0] && vf_frame[0]->info.res.width != 0) {
in_frame = copy_stage->args.out_vf_frame;
- err = add_vf_pp_stage(pipe, in_frame, vf_frame[0], &vf_pp_binary[0],
- &vf_pp_stage);
+ err = add_vf_pp_stage(pipe, in_frame, vf_frame[0],
+ &vf_pp_binary[0], &vf_pp_stage);
}
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
@@ -7517,7 +7542,8 @@ create_host_yuvpp_pipeline(struct ia_css
}
}
- ia_css_pipeline_finalize_stages(&pipe->pipeline, pipe->stream->config.continuous);
+ ia_css_pipeline_finalize_stages(&pipe->pipeline,
+ pipe->stream->config.continuous);
IA_CSS_LEAVE_ERR_PRIVATE(0);
@@ -7526,8 +7552,8 @@ create_host_yuvpp_pipeline(struct ia_css
static int
create_host_copy_pipeline(struct ia_css_pipe *pipe,
- unsigned int max_input_width,
- struct ia_css_frame *out_frame)
+ unsigned int max_input_width,
+ struct ia_css_frame *out_frame)
{
struct ia_css_pipeline *me;
int err = 0;
@@ -7546,12 +7572,8 @@ create_host_copy_pipeline(struct ia_css_
if (copy_on_sp(pipe) &&
pipe->stream->config.input_config.format == ATOMISP_INPUT_FORMAT_BINARY_8) {
- ia_css_frame_info_init(
- &out_frame->info,
- JPEG_BYTES,
- 1,
- IA_CSS_FRAME_FORMAT_BINARY_8,
- 0);
+ ia_css_frame_info_init(&out_frame->info, JPEG_BYTES, 1,
+ IA_CSS_FRAME_FORMAT_BINARY_8, 0);
} else if (out_frame->info.format == IA_CSS_FRAME_FORMAT_RAW) {
out_frame->info.raw_bit_depth =
ia_css_pipe_util_pipe_input_format_bpp(pipe);
@@ -7562,12 +7584,12 @@ create_host_copy_pipeline(struct ia_css_
pipe->mode = IA_CSS_PIPE_ID_COPY;
ia_css_pipe_get_sp_func_stage_desc(&stage_desc, out_frame,
- IA_CSS_PIPELINE_RAW_COPY, max_input_width);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- NULL);
+ IA_CSS_PIPELINE_RAW_COPY,
+ max_input_width);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc, NULL);
- ia_css_pipeline_finalize_stages(&pipe->pipeline, pipe->stream->config.continuous);
+ ia_css_pipeline_finalize_stages(&pipe->pipeline,
+ pipe->stream->config.continuous);
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE_PRIVATE,
"create_host_copy_pipeline() leave:\n");
@@ -7606,9 +7628,10 @@ create_host_isyscopy_capture_pipeline(st
me->pipe_id = IA_CSS_PIPE_ID_CAPTURE;
pipe->mode = IA_CSS_PIPE_ID_CAPTURE;
ia_css_pipe_get_sp_func_stage_desc(&stage_desc, out_frame,
- IA_CSS_PIPELINE_ISYS_COPY, max_input_width);
+ IA_CSS_PIPELINE_ISYS_COPY,
+ max_input_width);
err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc, &out_stage);
+ &stage_desc, &out_stage);
if (err)
return err;
@@ -7660,7 +7683,8 @@ create_host_regular_capture_pipeline(str
IA_CSS_ENTER_PRIVATE("");
assert(pipe);
assert(pipe->stream);
- assert(pipe->mode == IA_CSS_PIPE_ID_CAPTURE || pipe->mode == IA_CSS_PIPE_ID_COPY);
+ assert(pipe->mode == IA_CSS_PIPE_ID_CAPTURE ||
+ pipe->mode == IA_CSS_PIPE_ID_COPY);
me = &pipe->pipeline;
mode = pipe->config.default_capture_config.mode;
@@ -7750,26 +7774,37 @@ create_host_regular_capture_pipeline(str
ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
#if defined(ISP2401)
if (!continuous) {
- ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
- out_frames, in_frame, NULL);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ copy_binary,
+ out_frames,
+ in_frame,
+ NULL);
} else {
in_frame = pipe->stream->last_pipe->continuous_frames[0];
- ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
- out_frames, in_frame, NULL);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ copy_binary,
+ out_frames,
+ in_frame,
+ NULL);
}
#else
- ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
- out_frames, NULL, NULL);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ copy_binary,
+ out_frames,
+ NULL, NULL);
#endif
} else {
- ia_css_pipe_util_set_output_frames(out_frames, 0, in_frame);
- ia_css_pipe_get_generic_stage_desc(&stage_desc, copy_binary,
- out_frames, NULL, NULL);
+ ia_css_pipe_util_set_output_frames(out_frames, 0,
+ in_frame);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ copy_binary,
+ out_frames,
+ NULL, NULL);
}
err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- ¤t_stage);
+ &stage_desc,
+ ¤t_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7806,11 +7841,14 @@ create_host_regular_capture_pipeline(str
* Proper investigation should be done to come up with the clean
* solution.
* */
- ia_css_pipe_get_generic_stage_desc(&stage_desc, primary_binary[i],
- out_frames, local_in_frame, NULL);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ primary_binary[i],
+ out_frames,
+ local_in_frame,
+ NULL);
err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- ¤t_stage);
+ &stage_desc,
+ ¤t_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7826,18 +7864,18 @@ create_host_regular_capture_pipeline(str
mode == IA_CSS_CAPTURE_MODE_LOW_LIGHT) {
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
ia_css_pipe_get_generic_stage_desc(&stage_desc, pre_isp_binary,
- out_frames, in_frame, NULL);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc, NULL);
+ out_frames, in_frame, NULL);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ NULL);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
}
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
ia_css_pipe_get_generic_stage_desc(&stage_desc, anr_gdc_binary,
- out_frames, NULL, NULL);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc, NULL);
+ out_frames, NULL, NULL);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ NULL);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7845,16 +7883,21 @@ create_host_regular_capture_pipeline(str
if (need_pp) {
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
- ia_css_pipe_get_generic_stage_desc(&stage_desc, post_isp_binary,
- out_frames, NULL, NULL);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ post_isp_binary,
+ out_frames,
+ NULL, NULL);
} else {
- ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
- ia_css_pipe_get_generic_stage_desc(&stage_desc, post_isp_binary,
- out_frames, NULL, NULL);
+ ia_css_pipe_util_set_output_frames(out_frames, 0,
+ out_frame);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ post_isp_binary,
+ out_frames,
+ NULL, NULL);
}
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc, ¤t_stage);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ ¤t_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7862,10 +7905,9 @@ create_host_regular_capture_pipeline(str
} else if (mode == IA_CSS_CAPTURE_MODE_BAYER) {
ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
ia_css_pipe_get_generic_stage_desc(&stage_desc, pre_isp_binary,
- out_frames, in_frame, NULL);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- NULL);
+ out_frames, in_frame, NULL);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ NULL);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7880,31 +7922,34 @@ create_host_regular_capture_pipeline(str
if (need_ldc) {
ia_css_pipe_util_set_output_frames(out_frames, 0, NULL);
- ia_css_pipe_get_generic_stage_desc(&stage_desc, capture_ldc_binary,
- out_frames, local_in_frame, NULL);
+ ia_css_pipe_get_generic_stage_desc(&stage_desc,
+ capture_ldc_binary,
+ out_frames,
+ local_in_frame,
+ NULL);
err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- ¤t_stage);
+ &stage_desc,
+ ¤t_stage);
local_in_frame = current_stage->args.out_frame[0];
}
err = add_capture_pp_stage(pipe, me, local_in_frame,
- need_yuv_pp ? NULL : out_frame,
+ need_yuv_pp ? NULL : out_frame,
#else
/* ldc and capture_pp not supported in same pipeline */
if (need_ldc && current_stage) {
in_frame = current_stage->args.out_frame[0];
ia_css_pipe_util_set_output_frames(out_frames, 0, out_frame);
ia_css_pipe_get_generic_stage_desc(&stage_desc, capture_ldc_binary,
- out_frames, in_frame, NULL);
- err = ia_css_pipeline_create_and_add_stage(me,
- &stage_desc,
- NULL);
+ out_frames, in_frame, NULL);
+ err = ia_css_pipeline_create_and_add_stage(me, &stage_desc,
+ NULL);
} else if (need_pp && current_stage) {
in_frame = current_stage->args.out_frame[0];
- err = add_capture_pp_stage(pipe, me, in_frame, need_yuv_pp ? NULL : out_frame,
+ err = add_capture_pp_stage(pipe, me, in_frame,
+ need_yuv_pp ? NULL : out_frame,
#endif
- capture_pp_binary,
- ¤t_stage);
+ capture_pp_binary,
+ ¤t_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7921,10 +7966,10 @@ create_host_regular_capture_pipeline(str
else
tmp_out_frame = NULL;
- err = add_yuv_scaler_stage(pipe, me, tmp_in_frame, tmp_out_frame,
- NULL,
- &yuv_scaler_binary[i],
- &yuv_scaler_stage);
+ err = add_yuv_scaler_stage(pipe, me, tmp_in_frame,
+ tmp_out_frame, NULL,
+ &yuv_scaler_binary[i],
+ &yuv_scaler_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7946,7 +7991,7 @@ create_host_regular_capture_pipeline(str
if (mode != IA_CSS_CAPTURE_MODE_RAW && mode != IA_CSS_CAPTURE_MODE_BAYER && current_stage && vf_frame) {
in_frame = current_stage->args.out_vf_frame;
err = add_vf_pp_stage(pipe, in_frame, vf_frame, vf_pp_binary,
- ¤t_stage);
+ ¤t_stage);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
@@ -7998,7 +8043,7 @@ static int capture_start(
me = &pipe->pipeline;
if ((pipe->config.default_capture_config.mode == IA_CSS_CAPTURE_MODE_RAW ||
- pipe->config.default_capture_config.mode == IA_CSS_CAPTURE_MODE_BAYER) &&
+ pipe->config.default_capture_config.mode == IA_CSS_CAPTURE_MODE_BAYER) &&
(pipe->config.mode != IA_CSS_PIPE_MODE_COPY)) {
if (copy_on_sp(pipe)) {
err = start_copy_on_sp(pipe, &me->out_frame[0]);
@@ -8042,7 +8087,7 @@ static int capture_start(
if (pipe->config.mode == IA_CSS_PIPE_MODE_COPY &&
pipe->stream->reconfigure_css_rx) {
ia_css_isys_rx_configure(&pipe->stream->csi_rx_config,
- pipe->stream->config.mode);
+ pipe->stream->config.mode);
pipe->stream->reconfigure_css_rx = false;
}
#endif
@@ -8053,8 +8098,8 @@ static int capture_start(
static int
sh_css_pipe_get_output_frame_info(struct ia_css_pipe *pipe,
- struct ia_css_frame_info *info,
- unsigned int idx)
+ struct ia_css_frame_info *info,
+ unsigned int idx)
{
assert(pipe);
assert(info);
@@ -8072,7 +8117,7 @@ sh_css_pipe_get_output_frame_info(struct
IA_CSS_FRAME_FORMAT_BINARY_8,
0);
} else if (info->format == IA_CSS_FRAME_FORMAT_RAW ||
- info->format == IA_CSS_FRAME_FORMAT_RAW_PACKED) {
+ info->format == IA_CSS_FRAME_FORMAT_RAW_PACKED) {
info->raw_bit_depth =
ia_css_pipe_util_pipe_input_format_bpp(pipe);
}
@@ -8084,9 +8129,9 @@ sh_css_pipe_get_output_frame_info(struct
void
ia_css_stream_send_input_frame(const struct ia_css_stream *stream,
- const unsigned short *data,
- unsigned int width,
- unsigned int height)
+ const unsigned short *data,
+ unsigned int width,
+ unsigned int height)
{
assert(stream);
@@ -8110,22 +8155,22 @@ ia_css_stream_start_input_frame(const st
void
ia_css_stream_send_input_line(const struct ia_css_stream *stream,
- const unsigned short *data,
- unsigned int width,
- const unsigned short *data2,
- unsigned int width2)
+ const unsigned short *data,
+ unsigned int width,
+ const unsigned short *data2,
+ unsigned int width2)
{
assert(stream);
ia_css_inputfifo_send_line(stream->config.channel_id,
- data, width, data2, width2);
+ data, width, data2, width2);
}
void
ia_css_stream_send_input_embedded_line(const struct ia_css_stream *stream,
- enum atomisp_input_format format,
- const unsigned short *data,
- unsigned int width)
+ enum atomisp_input_format format,
+ const unsigned short *data,
+ unsigned int width)
{
assert(stream);
if (!data || width == 0)
@@ -8246,7 +8291,7 @@ acc_unload_extension(struct ia_css_fw_in
/* Load firmware for extension */
static int
ia_css_pipe_load_extension(struct ia_css_pipe *pipe,
- struct ia_css_fw_info *firmware)
+ struct ia_css_fw_info *firmware)
{
int err = 0;
@@ -8270,7 +8315,7 @@ ia_css_pipe_load_extension(struct ia_css
/* Unload firmware for extension */
static void
ia_css_pipe_unload_extension(struct ia_css_pipe *pipe,
- struct ia_css_fw_info *firmware)
+ struct ia_css_fw_info *firmware)
{
IA_CSS_ENTER_PRIVATE("fw = %p pipe = %p", firmware, pipe);
@@ -8312,7 +8357,7 @@ ia_css_pipeline_uses_params(struct ia_cs
static int
sh_css_pipeline_add_acc_stage(struct ia_css_pipeline *pipeline,
- const void *acc_fw)
+ const void *acc_fw)
{
struct ia_css_fw_info *fw = (struct ia_css_fw_info *)acc_fw;
/* In QoS case, load_extension already called, so skipping */
@@ -8330,8 +8375,8 @@ sh_css_pipeline_add_acc_stage(struct ia_
ia_css_pipe_get_acc_stage_desc(&stage_desc, NULL, fw);
err = ia_css_pipeline_create_and_add_stage(pipeline,
- &stage_desc,
- NULL);
+ &stage_desc,
+ NULL);
}
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
@@ -8344,7 +8389,7 @@ sh_css_pipeline_add_acc_stage(struct ia_
* Refer to "sh_css_internal.h" for details.
*/
int ia_css_stream_capture_frame(struct ia_css_stream *stream,
- unsigned int exp_id)
+ unsigned int exp_id)
{
struct sh_css_tag_descr tag_descr;
u32 encoded_tag_descr;
@@ -8503,22 +8548,22 @@ sh_css_init_host_sp_control_vars(void)
(void)HIVE_ADDR_host_sp_com;
sp_dmem_store_uint32(SP0_ID,
- (unsigned int)sp_address_of(ia_css_ispctrl_sp_isp_started),
- (uint32_t)(0));
+ (unsigned int)sp_address_of(ia_css_ispctrl_sp_isp_started),
+ (uint32_t)(0));
sp_dmem_store_uint32(SP0_ID,
- (unsigned int)sp_address_of(host_sp_queues_initialized),
- (uint32_t)(0));
+ (unsigned int)sp_address_of(host_sp_queues_initialized),
+ (uint32_t)(0));
sp_dmem_store_uint32(SP0_ID,
- (unsigned int)sp_address_of(sp_sleep_mode),
- (uint32_t)(0));
+ (unsigned int)sp_address_of(sp_sleep_mode),
+ (uint32_t)(0));
sp_dmem_store_uint32(SP0_ID,
- (unsigned int)sp_address_of(ia_css_dmaproxy_sp_invalidate_tlb),
- (uint32_t)(false));
+ (unsigned int)sp_address_of(ia_css_dmaproxy_sp_invalidate_tlb),
+ (uint32_t)(false));
#ifndef ISP2401
sp_dmem_store_uint32(SP0_ID,
- (unsigned int)sp_address_of(sp_stop_copy_preview),
- my_css.stop_copy_preview ? (uint32_t)(1) : (uint32_t)(0));
+ (unsigned int)sp_address_of(sp_stop_copy_preview),
+ my_css.stop_copy_preview ? (uint32_t)(1) : (uint32_t)(0));
#endif
store_sp_array_uint(host_sp_com, o, host2sp_cmd_ready);
@@ -8545,8 +8590,7 @@ void ia_css_pipe_config_defaults(struct
}
void
-ia_css_pipe_extra_config_defaults(struct ia_css_pipe_extra_config
- *extra_config)
+ia_css_pipe_extra_config_defaults(struct ia_css_pipe_extra_config *extra_config)
{
if (!extra_config) {
IA_CSS_ERROR("NULL input parameter");
@@ -8620,8 +8664,8 @@ int ia_css_pipe_create(const struct ia_c
int
ia_css_pipe_create_extra(const struct ia_css_pipe_config *config,
- const struct ia_css_pipe_extra_config *extra_config,
- struct ia_css_pipe **pipe)
+ const struct ia_css_pipe_extra_config *extra_config,
+ struct ia_css_pipe **pipe)
{
int err = -EINVAL;
struct ia_css_pipe *internal_pipe = NULL;
@@ -8689,7 +8733,7 @@ ia_css_pipe_create_extra(const struct ia
/* YUV downscaling */
if ((internal_pipe->config.vf_pp_in_res.width ||
- internal_pipe->config.capt_pp_in_res.width)) {
+ internal_pipe->config.capt_pp_in_res.width)) {
enum ia_css_frame_format format;
if (internal_pipe->config.vf_pp_in_res.width) {
@@ -8765,7 +8809,7 @@ ia_css_pipe_create_extra(const struct ia
}
if (internal_pipe->config.acc_extension) {
err = ia_css_pipe_load_extension(internal_pipe,
- internal_pipe->config.acc_extension);
+ internal_pipe->config.acc_extension);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
kvfree(internal_pipe);
@@ -8783,7 +8827,7 @@ ia_css_pipe_create_extra(const struct ia
int
ia_css_pipe_get_info(const struct ia_css_pipe *pipe,
- struct ia_css_pipe_info *pipe_info)
+ struct ia_css_pipe_info *pipe_info)
{
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE,
"ia_css_pipe_get_info()\n");
@@ -8821,8 +8865,8 @@ bool ia_css_pipe_has_dvs_stats(struct ia
int
ia_css_pipe_override_frame_format(struct ia_css_pipe *pipe,
- int pin_index,
- enum ia_css_frame_format new_format)
+ int pin_index,
+ enum ia_css_frame_format new_format)
{
int err = 0;
@@ -8902,10 +8946,8 @@ ia_css_stream_configure_rx(struct ia_css
#endif
static struct ia_css_pipe *
-find_pipe(struct ia_css_pipe *pipes[],
- unsigned int num_pipes,
- enum ia_css_pipe_mode mode,
- bool copy_pipe)
+find_pipe(struct ia_css_pipe *pipes[], unsigned int num_pipes,
+ enum ia_css_pipe_mode mode, bool copy_pipe)
{
unsigned int i;
@@ -8976,7 +9018,7 @@ ia_css_acc_stream_create(struct ia_css_s
static int
metadata_info_init(const struct ia_css_metadata_config *mdc,
- struct ia_css_metadata_info *md)
+ struct ia_css_metadata_info *md)
{
/* Either both width and height should be set or neither */
if ((mdc->resolution.height > 0) ^ (mdc->resolution.width > 0))
@@ -9004,7 +9046,7 @@ static int check_pipe_resolutions(const
}
if (ia_css_util_check_res(pipe->config.input_effective_res.width,
- pipe->config.input_effective_res.height) != 0) {
+ pipe->config.input_effective_res.height) != 0) {
IA_CSS_ERROR("effective resolution not supported");
err = -EINVAL;
goto EXIT;
@@ -9012,7 +9054,7 @@ static int check_pipe_resolutions(const
if (!ia_css_util_resolution_is_zero(
pipe->stream->config.input_config.input_res)) {
if (!ia_css_util_res_leq(pipe->config.input_effective_res,
- pipe->stream->config.input_config.input_res)) {
+ pipe->stream->config.input_config.input_res)) {
IA_CSS_ERROR("effective resolution is larger than input resolution");
err = -EINVAL;
goto EXIT;
@@ -9035,9 +9077,9 @@ EXIT:
int
ia_css_stream_create(const struct ia_css_stream_config *stream_config,
- int num_pipes,
- struct ia_css_pipe *pipes[],
- struct ia_css_stream **stream)
+ int num_pipes,
+ struct ia_css_pipe *pipes[],
+ struct ia_css_stream **stream)
{
struct ia_css_pipe *curr_pipe;
struct ia_css_stream *curr_stream = NULL;
@@ -9198,11 +9240,11 @@ ia_css_stream_create(const struct ia_css
case IA_CSS_INPUT_MODE_TPG:
#if !defined(ISP2401)
IA_CSS_LOG("tpg_configuration: x_mask=%d, y_mask=%d, x_delta=%d, y_delta=%d, xy_mask=%d",
- curr_stream->config.source.tpg.x_mask,
- curr_stream->config.source.tpg.y_mask,
- curr_stream->config.source.tpg.x_delta,
- curr_stream->config.source.tpg.y_delta,
- curr_stream->config.source.tpg.xy_mask);
+ curr_stream->config.source.tpg.x_mask,
+ curr_stream->config.source.tpg.y_mask,
+ curr_stream->config.source.tpg.x_delta,
+ curr_stream->config.source.tpg.y_delta,
+ curr_stream->config.source.tpg.xy_mask);
sh_css_sp_configure_tpg(
curr_stream->config.source.tpg.x_mask,
@@ -9227,9 +9269,8 @@ ia_css_stream_create(const struct ia_css
}
#ifdef ISP2401
- err = aspect_ratio_crop_init(curr_stream,
- pipes,
- &aspect_ratio_crop_enabled);
+ err = aspect_ratio_crop_init(curr_stream, pipes,
+ &aspect_ratio_crop_enabled);
if (err) {
IA_CSS_LEAVE_ERR(err);
goto ERR;
@@ -9266,8 +9307,8 @@ ia_css_stream_create(const struct ia_css
curr_pipe->config.input_effective_res = effective_res;
}
IA_CSS_LOG("effective_res=%dx%d",
- effective_res.width,
- effective_res.height);
+ effective_res.width,
+ effective_res.height);
}
if (IS_ISP2401) {
@@ -9295,13 +9336,13 @@ ia_css_stream_create(const struct ia_css
if (!spcopyonly) {
sensor_binning_changed =
sh_css_params_set_binning_factor(curr_stream,
- curr_stream->config.sensor_binning_factor);
+ curr_stream->config.sensor_binning_factor);
} else {
sensor_binning_changed = false;
}
IA_CSS_LOG("sensor_binning=%d, changed=%d",
- curr_stream->config.sensor_binning_factor, sensor_binning_changed);
+ curr_stream->config.sensor_binning_factor, sensor_binning_changed);
/* loop over pipes */
IA_CSS_LOG("num_pipes=%d", num_pipes);
curr_stream->cont_capt = false;
@@ -9325,17 +9366,18 @@ ia_css_stream_create(const struct ia_css
/* Create copy pipe here, since it may not be exposed to the driver */
preview_pipe = find_pipe(pipes, num_pipes,
- IA_CSS_PIPE_MODE_PREVIEW, false);
+ IA_CSS_PIPE_MODE_PREVIEW, false);
video_pipe = find_pipe(pipes, num_pipes,
- IA_CSS_PIPE_MODE_VIDEO, false);
- acc_pipe = find_pipe(pipes, num_pipes,
- IA_CSS_PIPE_MODE_ACC, false);
+ IA_CSS_PIPE_MODE_VIDEO, false);
+ acc_pipe = find_pipe(pipes, num_pipes, IA_CSS_PIPE_MODE_ACC,
+ false);
if (acc_pipe && num_pipes == 2 && curr_stream->cont_capt)
curr_stream->cont_capt =
false; /* preview + QoS case will not need cont_capt switch */
if (curr_stream->cont_capt) {
capture_pipe = find_pipe(pipes, num_pipes,
- IA_CSS_PIPE_MODE_CAPTURE, false);
+ IA_CSS_PIPE_MODE_CAPTURE,
+ false);
if (!capture_pipe) {
err = -EINVAL;
goto ERR;
@@ -9417,10 +9459,12 @@ ia_css_stream_create(const struct ia_css
if (!spcopyonly) {
if (!IS_ISP2401)
err = sh_css_pipe_get_shading_info(curr_pipe,
- &pipe_info->shading_info, NULL);
+ &pipe_info->shading_info,
+ NULL);
else
err = sh_css_pipe_get_shading_info(curr_pipe,
- &pipe_info->shading_info, &curr_pipe->config);
+ &pipe_info->shading_info,
+ &curr_pipe->config);
if (err)
goto ERR;
@@ -9430,7 +9474,8 @@ ia_css_stream_create(const struct ia_css
goto ERR;
for (j = 0; j < IA_CSS_PIPE_MAX_OUTPUT_STAGE; j++) {
sh_css_pipe_get_viewfinder_frame_info(curr_pipe,
- &pipe_info->vf_output_info[j], j);
+ &pipe_info->vf_output_info[j],
+ j);
if (err)
goto ERR;
}
@@ -9615,7 +9660,7 @@ ia_css_stream_destroy(struct ia_css_stre
int
ia_css_stream_get_info(const struct ia_css_stream *stream,
- struct ia_css_stream_info *stream_info)
+ struct ia_css_stream_info *stream_info)
{
ia_css_debug_dtrace(IA_CSS_DEBUG_TRACE, "ia_css_stream_get_info: enter/exit\n");
assert(stream);
@@ -9903,7 +9948,7 @@ ia_css_stream_get_3a_binary(const struct
int
ia_css_stream_set_output_padded_width(struct ia_css_stream *stream,
- unsigned int output_padded_width)
+ unsigned int output_padded_width)
{
struct ia_css_pipe *pipe;
@@ -10380,7 +10425,7 @@ ia_css_unlock_raw_frame(struct ia_css_st
*/
int
ia_css_pipe_set_qos_ext_state(struct ia_css_pipe *pipe, uint32_t fw_handle,
- bool enable)
+ bool enable)
{
unsigned int thread_id;
struct ia_css_pipeline_stage *stage;
@@ -10426,7 +10471,7 @@ ia_css_pipe_set_qos_ext_state(struct ia_
*/
int
ia_css_pipe_get_qos_ext_state(struct ia_css_pipe *pipe, uint32_t fw_handle,
- bool *enable)
+ bool *enable)
{
struct ia_css_pipeline_stage *stage;
unsigned int thread_id;
@@ -10462,9 +10507,9 @@ ia_css_pipe_get_qos_ext_state(struct ia_
/* ISP2401 */
int
ia_css_pipe_update_qos_ext_mapped_arg(struct ia_css_pipe *pipe,
- u32 fw_handle,
- struct ia_css_isp_param_css_segments *css_seg,
- struct ia_css_isp_param_isp_segments *isp_seg)
+ u32 fw_handle,
+ struct ia_css_isp_param_css_segments *css_seg,
+ struct ia_css_isp_param_isp_segments *isp_seg)
{
unsigned int HIVE_ADDR_sp_group;
static struct sh_css_sp_group sp_group;
@@ -10499,7 +10544,7 @@ ia_css_pipe_update_qos_ext_mapped_arg(st
if (!err) {
/* Get the Extension State */
enabled = (SH_CSS_QOS_STAGE_IS_ENABLED(&sh_css_sp_group.pipe[thread_id],
- stage->stage_num)) ? true : false;
+ stage->stage_num)) ? true : false;
/* Update mapped arg only when extension stage is not enabled */
if (enabled) {
IA_CSS_ERROR("Leaving: cannot update when stage is enabled.");
@@ -10509,13 +10554,14 @@ ia_css_pipe_update_qos_ext_mapped_arg(st
HIVE_ADDR_sp_group = fw->info.sp.group;
sp_dmem_load(SP0_ID,
- (unsigned int)sp_address_of(sp_group),
- &sp_group, sizeof(struct sh_css_sp_group));
+ (unsigned int)sp_address_of(sp_group),
+ &sp_group,
+ sizeof(struct sh_css_sp_group));
hmm_load(sp_group.pipe[thread_id].sp_stage_addr[stage_num],
- &sp_stage, sizeof(struct sh_css_sp_stage));
+ &sp_stage, sizeof(struct sh_css_sp_stage));
hmm_load(sp_stage.isp_stage_addr,
- &isp_stage, sizeof(struct sh_css_isp_stage));
+ &isp_stage, sizeof(struct sh_css_isp_stage));
for (mem = 0; mem < N_IA_CSS_ISP_MEMORIES; mem++) {
isp_stage.mem_initializers.params[IA_CSS_PARAM_CLASS_PARAM][mem].address =
@@ -10531,7 +10577,8 @@ ia_css_pipe_update_qos_ext_mapped_arg(st
}
hmm_store(sp_stage.isp_stage_addr,
- &isp_stage, sizeof(struct sh_css_isp_stage));
+ &isp_stage,
+ sizeof(struct sh_css_isp_stage));
}
}
}
@@ -10542,8 +10589,8 @@ ia_css_pipe_update_qos_ext_mapped_arg(st
#ifdef ISP2401
static int
aspect_ratio_crop_init(struct ia_css_stream *curr_stream,
- struct ia_css_pipe *pipes[],
- bool *do_crop_status)
+ struct ia_css_pipe *pipes[],
+ bool *do_crop_status)
{
int err = 0;
int i;
@@ -10589,7 +10636,7 @@ aspect_ratio_crop_check(bool enabled, st
static int
aspect_ratio_crop(struct ia_css_pipe *curr_pipe,
- struct ia_css_resolution *effective_res)
+ struct ia_css_resolution *effective_res)
{
int err = 0;
struct ia_css_resolution crop_res;
@@ -10649,7 +10696,7 @@ aspect_ratio_crop(struct ia_css_pipe *cu
case IA_CSS_PIPE_MODE_YUVPP:
default:
IA_CSS_ERROR("aspect ratio cropping invalid args: mode[%d]\n",
- curr_pipe->config.mode);
+ curr_pipe->config.mode);
assert(0);
break;
}
@@ -10713,7 +10760,7 @@ static struct sh_css_hmm_buffer_record
assert(h_vbuf);
assert((type > IA_CSS_BUFFER_TYPE_INVALID) &&
- (type < IA_CSS_NUM_DYNAMIC_BUFFER_TYPE));
+ (type < IA_CSS_NUM_DYNAMIC_BUFFER_TYPE));
assert(kernel_ptr != 0);
buffer_record = &hmm_buffer_record[0];
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 607/699] staging: media: atomisp: reduce load_primary_binaries() stack usage
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (605 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 606/699] media: staging: media: atomisp: Fix alignment and line length issues Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 608/699] cifs: Create a new shared file holding smb2 pdu definitions Greg Kroah-Hartman
` (95 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Andy Shevchenko,
Sakari Ailus, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit f4d51e55dd47ef467fbe37d8575e20eee41b092d ]
The load_primary_binaries() function is overly complex and has som large
variables on the stack, which can cause warnings depending on CONFIG_FRAME_WARN
setting:
drivers/staging/media/atomisp/pci/sh_css.c: In function 'load_primary_binaries':
drivers/staging/media/atomisp/pci/sh_css.c:5260:1: error: the frame size of 1560 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
Half of the stack usage is for the prim_descr[] array, but only one
member of the array is used at any given time.
Reduce the stack usage by turning the array into a single structure.
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/sh_css.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/staging/media/atomisp/pci/sh_css.c
+++ b/drivers/staging/media/atomisp/pci/sh_css.c
@@ -5870,7 +5870,6 @@ static int load_primary_binaries(
struct ia_css_capture_settings *mycs;
unsigned int i;
bool need_extra_yuv_scaler = false;
- struct ia_css_binary_descr prim_descr[MAX_NUM_PRIMARY_STAGES];
IA_CSS_ENTER_PRIVATE("");
assert(pipe);
@@ -6058,15 +6057,16 @@ static int load_primary_binaries(
/* Primary */
for (i = 0; i < mycs->num_primary_stage; i++) {
+ struct ia_css_binary_descr prim_descr;
struct ia_css_frame_info *local_vf_info = NULL;
if (pipe->enable_viewfinder[IA_CSS_PIPE_OUTPUT_STAGE_0] &&
(i == mycs->num_primary_stage - 1))
local_vf_info = &vf_info;
- ia_css_pipe_get_primary_binarydesc(pipe, &prim_descr[i],
+ ia_css_pipe_get_primary_binarydesc(pipe, &prim_descr,
&prim_in_info, &prim_out_info,
local_vf_info, i);
- err = ia_css_binary_find(&prim_descr[i], &mycs->primary_binary[i]);
+ err = ia_css_binary_find(&prim_descr, &mycs->primary_binary[i]);
if (err) {
IA_CSS_LEAVE_ERR_PRIVATE(err);
return err;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 608/699] cifs: Create a new shared file holding smb2 pdu definitions
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (606 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 607/699] staging: media: atomisp: reduce load_primary_binaries() stack usage Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 609/699] cifs: remove check of list iterator against head past the loop body Greg Kroah-Hartman
` (94 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ronnie Sahlberg, Namjae Jeon,
Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronnie Sahlberg <lsahlber@redhat.com>
[ Upstream commit 0d35e382e4e96a4fd97a1438bc1b11a91d2d85a6 ]
This file will contain all the definitions we need for SMB2 packets
and will follow the naming convention of MS-SMB2.PDF as closely
as possible to make it easier to cross-reference beween the definitions
and the standard.
The content of this file will mostly consist of migration of existing
definitions in the cifs/smb2.pdu.h and ksmbd/smb2pdu.h files
with some additional tweaks as the two files have diverged.
This patch introduces the new smbfs_common/smb2pdu.h file
and migrates the SMB2 header as well as TREE_CONNECT and TREE_DISCONNECT
to the shared file.
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsfs.c | 1
fs/cifs/cifsglob.h | 3
fs/cifs/connect.c | 4
fs/cifs/misc.c | 2
fs/cifs/smb2maperror.c | 16 +-
fs/cifs/smb2misc.c | 43 ++---
fs/cifs/smb2ops.c | 61 +++----
fs/cifs/smb2pdu.c | 106 ++++++-------
fs/cifs/smb2pdu.h | 365 ++++------------------------------------------
fs/cifs/smb2proto.h | 2
fs/cifs/smb2transport.c | 36 ++--
fs/smbfs_common/smb2pdu.h | 318 ++++++++++++++++++++++++++++++++++++++++
12 files changed, 491 insertions(+), 466 deletions(-)
create mode 100644 fs/smbfs_common/smb2pdu.h
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -51,7 +51,6 @@
#include <linux/key-type.h>
#include "cifs_spnego.h"
#include "fscache.h"
-#include "smb2pdu.h"
#ifdef CONFIG_CIFS_DFS_UPCALL
#include "dfs_cache.h"
#endif
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -32,6 +32,7 @@
#include <crypto/internal/hash.h>
#include <linux/scatterlist.h>
#include <uapi/linux/cifs/cifs_mount.h>
+#include "../smbfs_common/smb2pdu.h"
#include "smb2pdu.h"
#include "smb2glob.h"
@@ -866,7 +867,7 @@ revert_current_mid(struct TCP_Server_Inf
static inline void
revert_current_mid_from_hdr(struct TCP_Server_Info *server,
- const struct smb2_sync_hdr *shdr)
+ const struct smb2_hdr *shdr)
{
unsigned int num = le16_to_cpu(shdr->CreditCharge);
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -848,7 +848,7 @@ dequeue_mid(struct mid_q_entry *mid, boo
static unsigned int
smb2_get_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
{
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;
/*
* SMB1 does not use credits.
@@ -1048,7 +1048,7 @@ cifs_handle_standard(struct TCP_Server_I
static void
smb2_add_credits_from_hdr(char *buffer, struct TCP_Server_Info *server)
{
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buffer;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buffer;
/*
* SMB1 does not use credits.
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -164,7 +164,7 @@ cifs_buf_get(void)
* SMB2 header is bigger than CIFS one - no problems to clean some
* more bytes for CIFS.
*/
- size_t buf_size = sizeof(struct smb2_sync_hdr);
+ size_t buf_size = sizeof(struct smb2_hdr);
/*
* We could use negotiated size instead of max_msgsize -
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -2452,14 +2452,16 @@ smb2_print_status(__le32 status)
int
map_smb2_to_linux_error(char *buf, bool log_err)
{
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
unsigned int i;
int rc = -EIO;
__le32 smb2err = shdr->Status;
if (smb2err == 0) {
- trace_smb3_cmd_done(shdr->TreeId, shdr->SessionId,
- le16_to_cpu(shdr->Command), le64_to_cpu(shdr->MessageId));
+ trace_smb3_cmd_done(le32_to_cpu(shdr->Id.SyncId.TreeId),
+ le64_to_cpu(shdr->SessionId),
+ le16_to_cpu(shdr->Command),
+ le64_to_cpu(shdr->MessageId));
return 0;
}
@@ -2483,8 +2485,10 @@ map_smb2_to_linux_error(char *buf, bool
cifs_dbg(FYI, "Mapping SMB2 status code 0x%08x to POSIX err %d\n",
__le32_to_cpu(smb2err), rc);
- trace_smb3_cmd_err(shdr->TreeId, shdr->SessionId,
- le16_to_cpu(shdr->Command),
- le64_to_cpu(shdr->MessageId), le32_to_cpu(smb2err), rc);
+ trace_smb3_cmd_err(le32_to_cpu(shdr->Id.SyncId.TreeId),
+ le64_to_cpu(shdr->SessionId),
+ le16_to_cpu(shdr->Command),
+ le64_to_cpu(shdr->MessageId),
+ le32_to_cpu(smb2err), rc);
return rc;
}
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -21,7 +21,6 @@
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#include <linux/ctype.h>
-#include "smb2pdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "smb2proto.h"
@@ -32,7 +31,7 @@
#include "nterr.h"
static int
-check_smb2_hdr(struct smb2_sync_hdr *shdr, __u64 mid)
+check_smb2_hdr(struct smb2_hdr *shdr, __u64 mid)
{
__u64 wire_mid = le64_to_cpu(shdr->MessageId);
@@ -94,9 +93,9 @@ static const __le16 smb2_rsp_struct_size
/* SMB2_OPLOCK_BREAK */ cpu_to_le16(24)
};
-#define SMB311_NEGPROT_BASE_SIZE (sizeof(struct smb2_sync_hdr) + sizeof(struct smb2_negotiate_rsp))
+#define SMB311_NEGPROT_BASE_SIZE (sizeof(struct smb2_hdr) + sizeof(struct smb2_negotiate_rsp))
-static __u32 get_neg_ctxt_len(struct smb2_sync_hdr *hdr, __u32 len,
+static __u32 get_neg_ctxt_len(struct smb2_hdr *hdr, __u32 len,
__u32 non_ctxlen)
{
__u16 neg_count;
@@ -139,13 +138,13 @@ static __u32 get_neg_ctxt_len(struct smb
int
smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr)
{
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
- struct smb2_sync_pdu *pdu = (struct smb2_sync_pdu *)shdr;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
+ struct smb2_pdu *pdu = (struct smb2_pdu *)shdr;
__u64 mid;
__u32 clc_len; /* calculated length */
int command;
- int pdu_size = sizeof(struct smb2_sync_pdu);
- int hdr_size = sizeof(struct smb2_sync_hdr);
+ int pdu_size = sizeof(struct smb2_pdu);
+ int hdr_size = sizeof(struct smb2_hdr);
/*
* Add function to do table lookup of StructureSize by command
@@ -161,7 +160,7 @@ smb2_check_message(char *buf, unsigned i
spin_lock(&cifs_tcp_ses_lock);
list_for_each(tmp, &srvr->smb_ses_list) {
ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
- if (ses->Suid == thdr->SessionId)
+ if (ses->Suid == le64_to_cpu(thdr->SessionId))
break;
ses = NULL;
@@ -303,7 +302,7 @@ static const bool has_smb2_data_area[NUM
* area and the offset to it (from the beginning of the smb are also returned.
*/
char *
-smb2_get_data_area_len(int *off, int *len, struct smb2_sync_hdr *shdr)
+smb2_get_data_area_len(int *off, int *len, struct smb2_hdr *shdr)
{
const int max_off = 4096;
const int max_len = 128 * 1024;
@@ -402,8 +401,8 @@ smb2_get_data_area_len(int *off, int *le
unsigned int
smb2_calc_size(void *buf, struct TCP_Server_Info *srvr)
{
- struct smb2_sync_pdu *pdu = (struct smb2_sync_pdu *)buf;
- struct smb2_sync_hdr *shdr = &pdu->sync_hdr;
+ struct smb2_pdu *pdu = (struct smb2_pdu *)buf;
+ struct smb2_hdr *shdr = &pdu->hdr;
int offset; /* the offset from the beginning of SMB to data area */
int data_length; /* the length of the variable length data area */
/* Structure Size has already been checked to make sure it is 64 */
@@ -679,7 +678,7 @@ smb2_is_valid_oplock_break(char *buffer,
cifs_dbg(FYI, "Checking for oplock break\n");
- if (rsp->sync_hdr.Command != SMB2_OPLOCK_BREAK)
+ if (rsp->hdr.Command != SMB2_OPLOCK_BREAK)
return false;
if (rsp->StructureSize !=
@@ -832,23 +831,23 @@ smb2_handle_cancelled_close(struct cifs_
int
smb2_handle_cancelled_mid(struct mid_q_entry *mid, struct TCP_Server_Info *server)
{
- struct smb2_sync_hdr *sync_hdr = mid->resp_buf;
+ struct smb2_hdr *hdr = mid->resp_buf;
struct smb2_create_rsp *rsp = mid->resp_buf;
struct cifs_tcon *tcon;
int rc;
- if ((mid->optype & CIFS_CP_CREATE_CLOSE_OP) || sync_hdr->Command != SMB2_CREATE ||
- sync_hdr->Status != STATUS_SUCCESS)
+ if ((mid->optype & CIFS_CP_CREATE_CLOSE_OP) || hdr->Command != SMB2_CREATE ||
+ hdr->Status != STATUS_SUCCESS)
return 0;
- tcon = smb2_find_smb_tcon(server, sync_hdr->SessionId,
- sync_hdr->TreeId);
+ tcon = smb2_find_smb_tcon(server, le64_to_cpu(hdr->SessionId),
+ le32_to_cpu(hdr->Id.SyncId.TreeId));
if (!tcon)
return -ENOENT;
rc = __smb2_handle_cancelled_cmd(tcon,
- le16_to_cpu(sync_hdr->Command),
- le64_to_cpu(sync_hdr->MessageId),
+ le16_to_cpu(hdr->Command),
+ le64_to_cpu(hdr->MessageId),
rsp->PersistentFileId,
rsp->VolatileFileId);
if (rc)
@@ -868,10 +867,10 @@ smb311_update_preauth_hash(struct cifs_s
{
int i, rc;
struct sdesc *d;
- struct smb2_sync_hdr *hdr;
+ struct smb2_hdr *hdr;
struct TCP_Server_Info *server = cifs_ses_server(ses);
- hdr = (struct smb2_sync_hdr *)iov[0].iov_base;
+ hdr = (struct smb2_hdr *)iov[0].iov_base;
/* neg prot are always taken */
if (hdr->Command == SMB2_NEGOTIATE)
goto ok;
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -268,7 +268,7 @@ static struct mid_q_entry *
__smb2_find_mid(struct TCP_Server_Info *server, char *buf, bool dequeue)
{
struct mid_q_entry *mid;
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
__u64 wire_mid = le64_to_cpu(shdr->MessageId);
if (shdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) {
@@ -310,11 +310,11 @@ static void
smb2_dump_detail(void *buf, struct TCP_Server_Info *server)
{
#ifdef CONFIG_CIFS_DEBUG2
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
cifs_server_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n",
shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId,
- shdr->ProcessId);
+ shdr->Id.SyncId.ProcessId);
cifs_server_dbg(VFS, "smb buf %p len %u\n", buf,
server->ops->calc_smb_size(buf, server));
#endif
@@ -817,7 +817,7 @@ int open_shroot(unsigned int xid, struct
oparms.fid->persistent_fid = o_rsp->PersistentFileId;
oparms.fid->volatile_fid = o_rsp->VolatileFileId;
#ifdef CONFIG_CIFS_DEBUG2
- oparms.fid->mid = le64_to_cpu(o_rsp->sync_hdr.MessageId);
+ oparms.fid->mid = le64_to_cpu(o_rsp->hdr.MessageId);
#endif /* CIFS_DEBUG2 */
memcpy(tcon->crfid.fid, pfid, sizeof(struct cifs_fid));
@@ -2318,7 +2318,7 @@ smb2_query_dir_first(const unsigned int
/* If the open failed there is nothing to do */
op_rsp = (struct smb2_create_rsp *)rsp_iov[0].iov_base;
- if (op_rsp == NULL || op_rsp->sync_hdr.Status != STATUS_SUCCESS) {
+ if (op_rsp == NULL || op_rsp->hdr.Status != STATUS_SUCCESS) {
cifs_dbg(FYI, "query_dir_first: open failed rc=%d\n", rc);
goto qdf_free;
}
@@ -2337,7 +2337,7 @@ smb2_query_dir_first(const unsigned int
atomic_inc(&tcon->num_remote_opens);
qd_rsp = (struct smb2_query_directory_rsp *)rsp_iov[1].iov_base;
- if (qd_rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
+ if (qd_rsp->hdr.Status == STATUS_NO_MORE_FILES) {
trace_smb3_query_dir_done(xid, fid->persistent_fid,
tcon->tid, tcon->ses->Suid, 0, 0);
srch_inf->endOfSearch = true;
@@ -2389,7 +2389,7 @@ smb2_close_dir(const unsigned int xid, s
static bool
smb2_is_status_pending(char *buf, struct TCP_Server_Info *server)
{
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
if (shdr->Status != STATUS_PENDING)
return false;
@@ -2407,13 +2407,14 @@ smb2_is_status_pending(char *buf, struct
static bool
smb2_is_session_expired(char *buf)
{
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
if (shdr->Status != STATUS_NETWORK_SESSION_EXPIRED &&
shdr->Status != STATUS_USER_SESSION_DELETED)
return false;
- trace_smb3_ses_expired(shdr->TreeId, shdr->SessionId,
+ trace_smb3_ses_expired(le32_to_cpu(shdr->Id.SyncId.TreeId),
+ le64_to_cpu(shdr->SessionId),
le16_to_cpu(shdr->Command),
le64_to_cpu(shdr->MessageId));
cifs_dbg(FYI, "Session expired or deleted\n");
@@ -2424,7 +2425,7 @@ smb2_is_session_expired(char *buf)
static bool
smb2_is_status_io_timeout(char *buf)
{
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
if (shdr->Status == STATUS_IO_TIMEOUT)
return true;
@@ -2448,9 +2449,9 @@ smb2_oplock_response(struct cifs_tcon *t
void
smb2_set_related(struct smb_rqst *rqst)
{
- struct smb2_sync_hdr *shdr;
+ struct smb2_hdr *shdr;
- shdr = (struct smb2_sync_hdr *)(rqst->rq_iov[0].iov_base);
+ shdr = (struct smb2_hdr *)(rqst->rq_iov[0].iov_base);
if (shdr == NULL) {
cifs_dbg(FYI, "shdr NULL in smb2_set_related\n");
return;
@@ -2463,13 +2464,13 @@ char smb2_padding[7] = {0, 0, 0, 0, 0, 0
void
smb2_set_next_command(struct cifs_tcon *tcon, struct smb_rqst *rqst)
{
- struct smb2_sync_hdr *shdr;
+ struct smb2_hdr *shdr;
struct cifs_ses *ses = tcon->ses;
struct TCP_Server_Info *server = ses->server;
unsigned long len = smb_rqst_len(server, rqst);
int i, num_padding;
- shdr = (struct smb2_sync_hdr *)(rqst->rq_iov[0].iov_base);
+ shdr = (struct smb2_hdr *)(rqst->rq_iov[0].iov_base);
if (shdr == NULL) {
cifs_dbg(FYI, "shdr NULL in smb2_set_next_command\n");
return;
@@ -3018,7 +3019,7 @@ smb2_query_symlink(const unsigned int xi
resp_buftype, rsp_iov);
create_rsp = rsp_iov[0].iov_base;
- if (create_rsp && create_rsp->sync_hdr.Status)
+ if (create_rsp && create_rsp->hdr.Status)
err_iov = rsp_iov[0];
ioctl_rsp = rsp_iov[1].iov_base;
@@ -4183,8 +4184,8 @@ static void
fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len,
struct smb_rqst *old_rq, __le16 cipher_type)
{
- struct smb2_sync_hdr *shdr =
- (struct smb2_sync_hdr *)old_rq->rq_iov[0].iov_base;
+ struct smb2_hdr *shdr =
+ (struct smb2_hdr *)old_rq->rq_iov[0].iov_base;
memset(tr_hdr, 0, sizeof(struct smb2_transform_hdr));
tr_hdr->ProtocolId = SMB2_TRANSFORM_PROTO_NUM;
@@ -4322,7 +4323,7 @@ crypt_message(struct TCP_Server_Info *se
unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
void *creq;
- rc = smb2_get_enc_key(server, tr_hdr->SessionId, enc, key);
+ rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
if (rc) {
cifs_server_dbg(VFS, "%s: Could not get %scryption key\n", __func__,
enc ? "en" : "de");
@@ -4608,7 +4609,7 @@ handle_read_data(struct TCP_Server_Info
unsigned int cur_page_idx;
unsigned int pad_len;
struct cifs_readdata *rdata = mid->callback_data;
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
struct bio_vec *bvec = NULL;
struct iov_iter iter;
struct kvec iov;
@@ -4927,7 +4928,7 @@ receive_encrypted_standard(struct TCP_Se
{
int ret, length;
char *buf = server->smallbuf;
- struct smb2_sync_hdr *shdr;
+ struct smb2_hdr *shdr;
unsigned int pdu_length = server->pdu_size;
unsigned int buf_size;
unsigned int next_cmd;
@@ -4958,7 +4959,7 @@ receive_encrypted_standard(struct TCP_Se
next_is_large = server->large_buf;
one_more:
- shdr = (struct smb2_sync_hdr *)buf;
+ shdr = (struct smb2_hdr *)buf;
next_cmd = le32_to_cpu(shdr->NextCommand);
if (next_cmd) {
if (WARN_ON_ONCE(next_cmd > pdu_length))
@@ -5029,7 +5030,7 @@ smb3_receive_transform(struct TCP_Server
unsigned int orig_len = le32_to_cpu(tr_hdr->OriginalMessageSize);
if (pdu_length < sizeof(struct smb2_transform_hdr) +
- sizeof(struct smb2_sync_hdr)) {
+ sizeof(struct smb2_hdr)) {
cifs_server_dbg(VFS, "Transform message is too small (%u)\n",
pdu_length);
cifs_reconnect(server);
@@ -5062,7 +5063,7 @@ smb3_handle_read_data(struct TCP_Server_
static int
smb2_next_header(char *buf)
{
- struct smb2_sync_hdr *hdr = (struct smb2_sync_hdr *)buf;
+ struct smb2_hdr *hdr = (struct smb2_hdr *)buf;
struct smb2_transform_hdr *t_hdr = (struct smb2_transform_hdr *)buf;
if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM)
@@ -5602,7 +5603,7 @@ struct smb_version_values smb20_values =
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
.shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
- .header_size = sizeof(struct smb2_sync_hdr),
+ .header_size = sizeof(struct smb2_hdr),
.header_preamble_size = 0,
.max_header_size = MAX_SMB2_HDR_SIZE,
.read_rsp_size = sizeof(struct smb2_read_rsp),
@@ -5624,7 +5625,7 @@ struct smb_version_values smb21_values =
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
.shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
- .header_size = sizeof(struct smb2_sync_hdr),
+ .header_size = sizeof(struct smb2_hdr),
.header_preamble_size = 0,
.max_header_size = MAX_SMB2_HDR_SIZE,
.read_rsp_size = sizeof(struct smb2_read_rsp),
@@ -5645,7 +5646,7 @@ struct smb_version_values smb3any_values
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
.shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
- .header_size = sizeof(struct smb2_sync_hdr),
+ .header_size = sizeof(struct smb2_hdr),
.header_preamble_size = 0,
.max_header_size = MAX_SMB2_HDR_SIZE,
.read_rsp_size = sizeof(struct smb2_read_rsp),
@@ -5666,7 +5667,7 @@ struct smb_version_values smbdefault_val
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
.shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
- .header_size = sizeof(struct smb2_sync_hdr),
+ .header_size = sizeof(struct smb2_hdr),
.header_preamble_size = 0,
.max_header_size = MAX_SMB2_HDR_SIZE,
.read_rsp_size = sizeof(struct smb2_read_rsp),
@@ -5687,7 +5688,7 @@ struct smb_version_values smb30_values =
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
.shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
- .header_size = sizeof(struct smb2_sync_hdr),
+ .header_size = sizeof(struct smb2_hdr),
.header_preamble_size = 0,
.max_header_size = MAX_SMB2_HDR_SIZE,
.read_rsp_size = sizeof(struct smb2_read_rsp),
@@ -5708,7 +5709,7 @@ struct smb_version_values smb302_values
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
.shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
- .header_size = sizeof(struct smb2_sync_hdr),
+ .header_size = sizeof(struct smb2_hdr),
.header_preamble_size = 0,
.max_header_size = MAX_SMB2_HDR_SIZE,
.read_rsp_size = sizeof(struct smb2_read_rsp),
@@ -5729,7 +5730,7 @@ struct smb_version_values smb311_values
.exclusive_lock_type = SMB2_LOCKFLAG_EXCLUSIVE_LOCK,
.shared_lock_type = SMB2_LOCKFLAG_SHARED_LOCK,
.unlock_lock_type = SMB2_LOCKFLAG_UNLOCK,
- .header_size = sizeof(struct smb2_sync_hdr),
+ .header_size = sizeof(struct smb2_hdr),
.header_preamble_size = 0,
.max_header_size = MAX_SMB2_HDR_SIZE,
.read_rsp_size = sizeof(struct smb2_read_rsp),
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -36,7 +36,6 @@
#include <linux/uuid.h>
#include <linux/pagemap.h>
#include <linux/xattr.h>
-#include "smb2pdu.h"
#include "cifsglob.h"
#include "cifsacl.h"
#include "cifsproto.h"
@@ -97,7 +96,7 @@ int smb3_encryption_required(const struc
}
static void
-smb2_hdr_assemble(struct smb2_sync_hdr *shdr, __le16 smb2_cmd,
+smb2_hdr_assemble(struct smb2_hdr *shdr, __le16 smb2_cmd,
const struct cifs_tcon *tcon,
struct TCP_Server_Info *server)
{
@@ -117,7 +116,7 @@ smb2_hdr_assemble(struct smb2_sync_hdr *
} else {
shdr->CreditRequest = cpu_to_le16(2);
}
- shdr->ProcessId = cpu_to_le32((__u16)current->tgid);
+ shdr->Id.SyncId.ProcessId = cpu_to_le32((__u16)current->tgid);
if (!tcon)
goto out;
@@ -128,10 +127,10 @@ smb2_hdr_assemble(struct smb2_sync_hdr *
shdr->CreditCharge = cpu_to_le16(1);
/* else CreditCharge MBZ */
- shdr->TreeId = tcon->tid;
+ shdr->Id.SyncId.TreeId = cpu_to_le32(tcon->tid);
/* Uid is not converted */
if (tcon->ses)
- shdr->SessionId = tcon->ses->Suid;
+ shdr->SessionId = cpu_to_le64(tcon->ses->Suid);
/*
* If we would set SMB2_FLAGS_DFS_OPERATIONS on open we also would have
@@ -347,7 +346,7 @@ fill_small_buf(__le16 smb2_command, stru
void *buf,
unsigned int *total_len)
{
- struct smb2_sync_pdu *spdu = (struct smb2_sync_pdu *)buf;
+ struct smb2_pdu *spdu = (struct smb2_pdu *)buf;
/* lookup word count ie StructureSize from table */
__u16 parmsize = smb2_req_struct_sizes[le16_to_cpu(smb2_command)];
@@ -357,10 +356,10 @@ fill_small_buf(__le16 smb2_command, stru
*/
memset(buf, 0, 256);
- smb2_hdr_assemble(&spdu->sync_hdr, smb2_command, tcon, server);
+ smb2_hdr_assemble(&spdu->hdr, smb2_command, tcon, server);
spdu->StructureSize2 = cpu_to_le16(parmsize);
- *total_len = parmsize + sizeof(struct smb2_sync_hdr);
+ *total_len = parmsize + sizeof(struct smb2_hdr);
}
/*
@@ -388,7 +387,7 @@ static int __smb2_plain_req_init(__le16
}
fill_small_buf(smb2_command, tcon, server,
- (struct smb2_sync_hdr *)(*request_buf),
+ (struct smb2_hdr *)(*request_buf),
total_len);
if (tcon != NULL) {
@@ -813,7 +812,7 @@ SMB2_negotiate(const unsigned int xid, s
if (rc)
return rc;
- req->sync_hdr.SessionId = 0;
+ req->hdr.SessionId = 0;
memset(server->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
memset(ses->preauth_sha_hash, 0, SMB2_PREAUTH_HASH_SIZE);
@@ -969,7 +968,7 @@ SMB2_negotiate(const unsigned int xid, s
server->cipher_type = SMB2_ENCRYPTION_AES128_CCM;
security_blob = smb2_get_data_area_len(&blob_offset, &blob_length,
- (struct smb2_sync_hdr *)rsp);
+ (struct smb2_hdr *)rsp);
/*
* See MS-SMB2 section 2.2.4: if no blob, client picks default which
* for us will be
@@ -1206,13 +1205,13 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_
return rc;
if (sess_data->ses->binding) {
- req->sync_hdr.SessionId = sess_data->ses->Suid;
- req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
+ req->hdr.SessionId = cpu_to_le64(sess_data->ses->Suid);
+ req->hdr.Flags |= SMB2_FLAGS_SIGNED;
req->PreviousSessionId = 0;
req->Flags = SMB2_SESSION_REQ_FLAG_BINDING;
} else {
/* First session, not a reauthenticate */
- req->sync_hdr.SessionId = 0;
+ req->hdr.SessionId = 0;
/*
* if reconnect, we need to send previous sess id
* otherwise it is 0
@@ -1222,7 +1221,7 @@ SMB2_sess_alloc_buffer(struct SMB2_sess_
}
/* enough to enable echos and oplocks and one max size write */
- req->sync_hdr.CreditRequest = cpu_to_le16(130);
+ req->hdr.CreditRequest = cpu_to_le16(130);
/* only one of SMB2 signing flags may be set in SMB2 request */
if (server->sign)
@@ -1381,7 +1380,7 @@ SMB2_auth_kerberos(struct SMB2_sess_data
rsp = (struct smb2_sess_setup_rsp *)sess_data->iov[0].iov_base;
/* keep session id and flags if binding */
if (!ses->binding) {
- ses->Suid = rsp->sync_hdr.SessionId;
+ ses->Suid = le64_to_cpu(rsp->hdr.SessionId);
ses->session_flags = le16_to_cpu(rsp->SessionFlags);
}
@@ -1457,7 +1456,7 @@ SMB2_sess_auth_rawntlmssp_negotiate(stru
/* If true, rc here is expected and not an error */
if (sess_data->buf0_type != CIFS_NO_BUFFER &&
- rsp->sync_hdr.Status == STATUS_MORE_PROCESSING_REQUIRED)
+ rsp->hdr.Status == STATUS_MORE_PROCESSING_REQUIRED)
rc = 0;
if (rc)
@@ -1479,7 +1478,7 @@ SMB2_sess_auth_rawntlmssp_negotiate(stru
/* keep existing ses id and flags if binding */
if (!ses->binding) {
- ses->Suid = rsp->sync_hdr.SessionId;
+ ses->Suid = le64_to_cpu(rsp->hdr.SessionId);
ses->session_flags = le16_to_cpu(rsp->SessionFlags);
}
@@ -1514,7 +1513,7 @@ SMB2_sess_auth_rawntlmssp_authenticate(s
goto out;
req = (struct smb2_sess_setup_req *) sess_data->iov[0].iov_base;
- req->sync_hdr.SessionId = ses->Suid;
+ req->hdr.SessionId = cpu_to_le64(ses->Suid);
rc = build_ntlmssp_auth_blob(&ntlmssp_blob, &blob_length, ses,
sess_data->nls_cp);
@@ -1540,7 +1539,7 @@ SMB2_sess_auth_rawntlmssp_authenticate(s
/* keep existing ses id and flags if binding */
if (!ses->binding) {
- ses->Suid = rsp->sync_hdr.SessionId;
+ ses->Suid = le64_to_cpu(rsp->hdr.SessionId);
ses->session_flags = le16_to_cpu(rsp->SessionFlags);
}
@@ -1671,12 +1670,12 @@ SMB2_logoff(const unsigned int xid, stru
return rc;
/* since no tcon, smb2_init can not do this, so do here */
- req->sync_hdr.SessionId = ses->Suid;
+ req->hdr.SessionId = cpu_to_le64(ses->Suid);
if (ses->session_flags & SMB2_SESSION_FLAG_ENCRYPT_DATA)
flags |= CIFS_TRANSFORM_REQ;
else if (server->sign)
- req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
+ req->hdr.Flags |= SMB2_FLAGS_SIGNED;
flags |= CIFS_NO_RSP_BUF;
@@ -1783,14 +1782,14 @@ SMB2_tcon(const unsigned int xid, struct
!(ses->session_flags &
(SMB2_SESSION_FLAG_IS_GUEST|SMB2_SESSION_FLAG_IS_NULL)) &&
((ses->user_name != NULL) || (ses->sectype == Kerberos)))
- req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
+ req->hdr.Flags |= SMB2_FLAGS_SIGNED;
memset(&rqst, 0, sizeof(struct smb_rqst));
rqst.rq_iov = iov;
rqst.rq_nvec = 2;
/* Need 64 for max size write so ask for more in case not there yet */
- req->sync_hdr.CreditRequest = cpu_to_le16(64);
+ req->hdr.CreditRequest = cpu_to_le16(64);
rc = cifs_send_recv(xid, ses, server,
&rqst, &resp_buftype, flags, &rsp_iov);
@@ -1828,7 +1827,7 @@ SMB2_tcon(const unsigned int xid, struct
tcon->maximal_access = le32_to_cpu(rsp->MaximalAccess);
tcon->tidStatus = CifsGood;
tcon->need_reconnect = false;
- tcon->tid = rsp->sync_hdr.TreeId;
+ tcon->tid = le32_to_cpu(rsp->hdr.Id.SyncId.TreeId);
strlcpy(tcon->treeName, tree, sizeof(tcon->treeName));
if ((rsp->Capabilities & SMB2_SHARE_CAP_DFS) &&
@@ -1849,9 +1848,8 @@ tcon_exit:
return rc;
tcon_error_exit:
- if (rsp && rsp->sync_hdr.Status == STATUS_BAD_NETWORK_NAME) {
+ if (rsp && rsp->hdr.Status == STATUS_BAD_NETWORK_NAME)
cifs_tcon_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
- }
goto tcon_exit;
}
@@ -2585,7 +2583,7 @@ int smb311_posix_mkdir(const unsigned in
if (tcon->share_flags & SHI1005_FLAGS_DFS) {
int name_len;
- req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
+ req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
rc = alloc_path_with_tree_prefix(©_path, ©_size,
&name_len,
tcon->treeName, utf16_path);
@@ -2717,7 +2715,7 @@ SMB2_open_init(struct cifs_tcon *tcon, s
if (tcon->share_flags & SHI1005_FLAGS_DFS) {
int name_len;
- req->sync_hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
+ req->hdr.Flags |= SMB2_FLAGS_DFS_OPERATIONS;
rc = alloc_path_with_tree_prefix(©_path, ©_size,
&name_len,
tcon->treeName, path);
@@ -2929,7 +2927,7 @@ SMB2_open(const unsigned int xid, struct
oparms->fid->volatile_fid = rsp->VolatileFileId;
oparms->fid->access = oparms->desired_access;
#ifdef CONFIG_CIFS_DEBUG2
- oparms->fid->mid = le64_to_cpu(rsp->sync_hdr.MessageId);
+ oparms->fid->mid = le64_to_cpu(rsp->hdr.MessageId);
#endif /* CIFS_DEBUG2 */
if (buf) {
@@ -3035,7 +3033,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon,
* response size smaller.
*/
req->MaxOutputResponse = cpu_to_le32(max_response_size);
- req->sync_hdr.CreditCharge =
+ req->hdr.CreditCharge =
cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size),
SMB2_MAX_BUFFER_SIZE));
/* always an FSCTL (for now) */
@@ -3043,7 +3041,7 @@ SMB2_ioctl_init(struct cifs_tcon *tcon,
/* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */
if (opcode == FSCTL_VALIDATE_NEGOTIATE_INFO)
- req->sync_hdr.Flags |= SMB2_FLAGS_SIGNED;
+ req->hdr.Flags |= SMB2_FLAGS_SIGNED;
return 0;
}
@@ -3668,7 +3666,7 @@ smb2_echo_callback(struct mid_q_entry *m
if (mid->mid_state == MID_RESPONSE_RECEIVED
|| mid->mid_state == MID_RESPONSE_MALFORMED) {
- credits.value = le16_to_cpu(rsp->sync_hdr.CreditRequest);
+ credits.value = le16_to_cpu(rsp->hdr.CreditRequest);
credits.instance = server->reconnect_instance;
}
@@ -3768,7 +3766,7 @@ SMB2_echo(struct TCP_Server_Info *server
if (rc)
return rc;
- req->sync_hdr.CreditRequest = cpu_to_le16(1);
+ req->hdr.CreditRequest = cpu_to_le16(1);
iov[0].iov_len = total_len;
iov[0].iov_base = (char *)req;
@@ -3872,7 +3870,7 @@ smb2_new_read_req(void **buf, unsigned i
{
int rc = -EACCES;
struct smb2_read_plain_req *req = NULL;
- struct smb2_sync_hdr *shdr;
+ struct smb2_hdr *shdr;
struct TCP_Server_Info *server = io_parms->server;
rc = smb2_plain_req_init(SMB2_READ, io_parms->tcon, server,
@@ -3883,8 +3881,8 @@ smb2_new_read_req(void **buf, unsigned i
if (server == NULL)
return -ECONNABORTED;
- shdr = &req->sync_hdr;
- shdr->ProcessId = cpu_to_le32(io_parms->pid);
+ shdr = &req->hdr;
+ shdr->Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid);
req->PersistentFileId = io_parms->persistent_fid;
req->VolatileFileId = io_parms->volatile_fid;
@@ -3945,8 +3943,8 @@ smb2_new_read_req(void **buf, unsigned i
* Related requests use info from previous read request
* in chain.
*/
- shdr->SessionId = 0xFFFFFFFFFFFFFFFF;
- shdr->TreeId = 0xFFFFFFFF;
+ shdr->SessionId = cpu_to_le64(0xFFFFFFFFFFFFFFFF);
+ shdr->Id.SyncId.TreeId = cpu_to_le32(0xFFFFFFFF);
req->PersistentFileId = 0xFFFFFFFFFFFFFFFF;
req->VolatileFileId = 0xFFFFFFFFFFFFFFFF;
}
@@ -3966,8 +3964,8 @@ smb2_readv_callback(struct mid_q_entry *
struct cifs_readdata *rdata = mid->callback_data;
struct cifs_tcon *tcon = tlink_tcon(rdata->cfile->tlink);
struct TCP_Server_Info *server = rdata->server;
- struct smb2_sync_hdr *shdr =
- (struct smb2_sync_hdr *)rdata->iov[0].iov_base;
+ struct smb2_hdr *shdr =
+ (struct smb2_hdr *)rdata->iov[0].iov_base;
struct cifs_credits credits = { .value = 0, .instance = 0 };
struct smb_rqst rqst = { .rq_iov = &rdata->iov[1],
.rq_nvec = 1, };
@@ -4056,7 +4054,7 @@ smb2_async_readv(struct cifs_readdata *r
{
int rc, flags = 0;
char *buf;
- struct smb2_sync_hdr *shdr;
+ struct smb2_hdr *shdr;
struct cifs_io_parms io_parms;
struct smb_rqst rqst = { .rq_iov = rdata->iov,
.rq_nvec = 1 };
@@ -4089,7 +4087,7 @@ smb2_async_readv(struct cifs_readdata *r
rdata->iov[0].iov_base = buf;
rdata->iov[0].iov_len = total_len;
- shdr = (struct smb2_sync_hdr *)buf;
+ shdr = (struct smb2_hdr *)buf;
if (rdata->credits.value > 0) {
shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes,
@@ -4222,7 +4220,7 @@ smb2_writev_callback(struct mid_q_entry
switch (mid->mid_state) {
case MID_RESPONSE_RECEIVED:
- credits.value = le16_to_cpu(rsp->sync_hdr.CreditRequest);
+ credits.value = le16_to_cpu(rsp->hdr.CreditRequest);
credits.instance = server->reconnect_instance;
wdata->result = smb2_check_receive(mid, server, 0);
if (wdata->result != 0)
@@ -4248,7 +4246,7 @@ smb2_writev_callback(struct mid_q_entry
wdata->result = -EAGAIN;
break;
case MID_RESPONSE_MALFORMED:
- credits.value = le16_to_cpu(rsp->sync_hdr.CreditRequest);
+ credits.value = le16_to_cpu(rsp->hdr.CreditRequest);
credits.instance = server->reconnect_instance;
fallthrough;
default:
@@ -4295,7 +4293,7 @@ smb2_async_writev(struct cifs_writedata
{
int rc = -EACCES, flags = 0;
struct smb2_write_req *req = NULL;
- struct smb2_sync_hdr *shdr;
+ struct smb2_hdr *shdr;
struct cifs_tcon *tcon = tlink_tcon(wdata->cfile->tlink);
struct TCP_Server_Info *server = wdata->server;
struct kvec iov[1];
@@ -4313,8 +4311,8 @@ smb2_async_writev(struct cifs_writedata
if (smb3_encryption_required(tcon))
flags |= CIFS_TRANSFORM_REQ;
- shdr = (struct smb2_sync_hdr *)req;
- shdr->ProcessId = cpu_to_le32(wdata->cfile->pid);
+ shdr = (struct smb2_hdr *)req;
+ shdr->Id.SyncId.ProcessId = cpu_to_le32(wdata->cfile->pid);
req->PersistentFileId = wdata->cfile->fid.persistent_fid;
req->VolatileFileId = wdata->cfile->fid.volatile_fid;
@@ -4465,7 +4463,7 @@ SMB2_write(const unsigned int xid, struc
if (smb3_encryption_required(io_parms->tcon))
flags |= CIFS_TRANSFORM_REQ;
- req->sync_hdr.ProcessId = cpu_to_le32(io_parms->pid);
+ req->hdr.Id.SyncId.ProcessId = cpu_to_le32(io_parms->pid);
req->PersistentFileId = io_parms->persistent_fid;
req->VolatileFileId = io_parms->volatile_fid;
@@ -4852,7 +4850,7 @@ SMB2_query_directory(const unsigned int
if (rc) {
if (rc == -ENODATA &&
- rsp->sync_hdr.Status == STATUS_NO_MORE_FILES) {
+ rsp->hdr.Status == STATUS_NO_MORE_FILES) {
trace_smb3_query_dir_done(xid, persistent_fid,
tcon->tid, tcon->ses->Suid, index, 0);
srch_inf->endOfSearch = true;
@@ -4900,7 +4898,7 @@ SMB2_set_info_init(struct cifs_tcon *tco
if (rc)
return rc;
- req->sync_hdr.ProcessId = cpu_to_le32(pid);
+ req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid);
req->InfoType = info_type;
req->FileInfoClass = info_class;
req->PersistentFileId = persistent_fid;
@@ -5060,7 +5058,7 @@ SMB2_oplock_break(const unsigned int xid
req->VolatileFid = volatile_fid;
req->PersistentFid = persistent_fid;
req->OplockLevel = oplock_level;
- req->sync_hdr.CreditRequest = cpu_to_le16(1);
+ req->hdr.CreditRequest = cpu_to_le16(1);
flags |= CIFS_NO_RSP_BUF;
@@ -5367,7 +5365,7 @@ smb2_lockv(const unsigned int xid, struc
if (smb3_encryption_required(tcon))
flags |= CIFS_TRANSFORM_REQ;
- req->sync_hdr.ProcessId = cpu_to_le32(pid);
+ req->hdr.Id.SyncId.ProcessId = cpu_to_le32(pid);
req->LockCount = cpu_to_le16(num_lock);
req->PersistentFileId = persist_fid;
@@ -5443,7 +5441,7 @@ SMB2_lease_break(const unsigned int xid,
if (smb3_encryption_required(tcon))
flags |= CIFS_TRANSFORM_REQ;
- req->sync_hdr.CreditRequest = cpu_to_le16(1);
+ req->hdr.CreditRequest = cpu_to_le16(1);
req->StructureSize = cpu_to_le16(36);
total_len += 12;
--- a/fs/cifs/smb2pdu.h
+++ b/fs/cifs/smb2pdu.h
@@ -27,149 +27,12 @@
#include <net/sock.h>
#include <cifsacl.h>
-/*
- * Note that, due to trying to use names similar to the protocol specifications,
- * there are many mixed case field names in the structures below. Although
- * this does not match typical Linux kernel style, it is necessary to be
- * able to match against the protocol specfication.
- *
- * SMB2 commands
- * Some commands have minimal (wct=0,bcc=0), or uninteresting, responses
- * (ie no useful data other than the SMB error code itself) and are marked such.
- * Knowing this helps avoid response buffer allocations and copy in some cases.
- */
-
-/* List of commands in host endian */
-#define SMB2_NEGOTIATE_HE 0x0000
-#define SMB2_SESSION_SETUP_HE 0x0001
-#define SMB2_LOGOFF_HE 0x0002 /* trivial request/resp */
-#define SMB2_TREE_CONNECT_HE 0x0003
-#define SMB2_TREE_DISCONNECT_HE 0x0004 /* trivial req/resp */
-#define SMB2_CREATE_HE 0x0005
-#define SMB2_CLOSE_HE 0x0006
-#define SMB2_FLUSH_HE 0x0007 /* trivial resp */
-#define SMB2_READ_HE 0x0008
-#define SMB2_WRITE_HE 0x0009
-#define SMB2_LOCK_HE 0x000A
-#define SMB2_IOCTL_HE 0x000B
-#define SMB2_CANCEL_HE 0x000C
-#define SMB2_ECHO_HE 0x000D
-#define SMB2_QUERY_DIRECTORY_HE 0x000E
-#define SMB2_CHANGE_NOTIFY_HE 0x000F
-#define SMB2_QUERY_INFO_HE 0x0010
-#define SMB2_SET_INFO_HE 0x0011
-#define SMB2_OPLOCK_BREAK_HE 0x0012
-
-/* The same list in little endian */
-#define SMB2_NEGOTIATE cpu_to_le16(SMB2_NEGOTIATE_HE)
-#define SMB2_SESSION_SETUP cpu_to_le16(SMB2_SESSION_SETUP_HE)
-#define SMB2_LOGOFF cpu_to_le16(SMB2_LOGOFF_HE)
-#define SMB2_TREE_CONNECT cpu_to_le16(SMB2_TREE_CONNECT_HE)
-#define SMB2_TREE_DISCONNECT cpu_to_le16(SMB2_TREE_DISCONNECT_HE)
-#define SMB2_CREATE cpu_to_le16(SMB2_CREATE_HE)
-#define SMB2_CLOSE cpu_to_le16(SMB2_CLOSE_HE)
-#define SMB2_FLUSH cpu_to_le16(SMB2_FLUSH_HE)
-#define SMB2_READ cpu_to_le16(SMB2_READ_HE)
-#define SMB2_WRITE cpu_to_le16(SMB2_WRITE_HE)
-#define SMB2_LOCK cpu_to_le16(SMB2_LOCK_HE)
-#define SMB2_IOCTL cpu_to_le16(SMB2_IOCTL_HE)
-#define SMB2_CANCEL cpu_to_le16(SMB2_CANCEL_HE)
-#define SMB2_ECHO cpu_to_le16(SMB2_ECHO_HE)
-#define SMB2_QUERY_DIRECTORY cpu_to_le16(SMB2_QUERY_DIRECTORY_HE)
-#define SMB2_CHANGE_NOTIFY cpu_to_le16(SMB2_CHANGE_NOTIFY_HE)
-#define SMB2_QUERY_INFO cpu_to_le16(SMB2_QUERY_INFO_HE)
-#define SMB2_SET_INFO cpu_to_le16(SMB2_SET_INFO_HE)
-#define SMB2_OPLOCK_BREAK cpu_to_le16(SMB2_OPLOCK_BREAK_HE)
-
-#define SMB2_INTERNAL_CMD cpu_to_le16(0xFFFF)
-
-#define NUMBER_OF_SMB2_COMMANDS 0x0013
-
/* 52 transform hdr + 64 hdr + 88 create rsp */
#define SMB2_TRANSFORM_HEADER_SIZE 52
#define MAX_SMB2_HDR_SIZE 204
-#define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)
-#define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
-#define SMB2_COMPRESSION_TRANSFORM_ID cpu_to_le32(0x424d53fc)
-
-/*
- * SMB2 Header Definition
- *
- * "MBZ" : Must be Zero
- * "BB" : BugBug, Something to check/review/analyze later
- * "PDU" : "Protocol Data Unit" (ie a network "frame")
- *
- */
-
-#define SMB2_HEADER_STRUCTURE_SIZE cpu_to_le16(64)
-
-struct smb2_sync_hdr {
- __le32 ProtocolId; /* 0xFE 'S' 'M' 'B' */
- __le16 StructureSize; /* 64 */
- __le16 CreditCharge; /* MBZ */
- __le32 Status; /* Error from server */
- __le16 Command;
- __le16 CreditRequest; /* CreditResponse */
- __le32 Flags;
- __le32 NextCommand;
- __le64 MessageId;
- __le32 ProcessId;
- __u32 TreeId; /* opaque - so do not make little endian */
- __u64 SessionId; /* opaque - so do not make little endian */
- __u8 Signature[16];
-} __packed;
-
/* The total header size for SMB2 read and write */
-#define SMB2_READWRITE_PDU_HEADER_SIZE (48 + sizeof(struct smb2_sync_hdr))
-
-struct smb2_sync_pdu {
- struct smb2_sync_hdr sync_hdr;
- __le16 StructureSize2; /* size of wct area (varies, request specific) */
-} __packed;
-
-#define SMB3_AES_CCM_NONCE 11
-#define SMB3_AES_GCM_NONCE 12
-
-/* Transform flags (for 3.0 dialect this flag indicates CCM */
-#define TRANSFORM_FLAG_ENCRYPTED 0x0001
-struct smb2_transform_hdr {
- __le32 ProtocolId; /* 0xFD 'S' 'M' 'B' */
- __u8 Signature[16];
- __u8 Nonce[16];
- __le32 OriginalMessageSize;
- __u16 Reserved1;
- __le16 Flags; /* EncryptionAlgorithm for 3.0, enc enabled for 3.1.1 */
- __u64 SessionId;
-} __packed;
-
-/* See MS-SMB2 2.2.42 */
-struct smb2_compression_transform_hdr {
- __le32 ProtocolId; /* 0xFC 'S' 'M' 'B' */
- __le32 OriginalCompressedSegmentSize;
- __le16 CompressionAlgorithm;
- __le16 Flags;
- __le16 Length; /* if chained it is length, else offset */
-} __packed;
-
-/* See MS-SMB2 2.2.42.1 */
-#define SMB2_COMPRESSION_FLAG_NONE 0x0000
-#define SMB2_COMPRESSION_FLAG_CHAINED 0x0001
-
-struct compression_payload_header {
- __le16 CompressionAlgorithm;
- __le16 Flags;
- __le32 Length; /* length of compressed playload including field below if present */
- /* __le32 OriginalPayloadSize; */ /* optional */
-} __packed;
-
-/* See MS-SMB2 2.2.42.2 */
-struct compression_pattern_payload_v1 {
- __le16 Pattern;
- __le16 Reserved1;
- __le16 Reserved2;
- __le32 Repetitions;
-} __packed;
+#define SMB2_READWRITE_PDU_HEADER_SIZE (48 + sizeof(struct smb2_hdr))
/* See MS-SMB2 2.2.43 */
struct smb2_rdma_transform {
@@ -192,17 +55,6 @@ struct smb2_rdma_encryption_transform {
} __packed;
/*
- * SMB2 flag definitions
- */
-#define SMB2_FLAGS_SERVER_TO_REDIR cpu_to_le32(0x00000001)
-#define SMB2_FLAGS_ASYNC_COMMAND cpu_to_le32(0x00000002)
-#define SMB2_FLAGS_RELATED_OPERATIONS cpu_to_le32(0x00000004)
-#define SMB2_FLAGS_SIGNED cpu_to_le32(0x00000008)
-#define SMB2_FLAGS_PRIORITY_MASK cpu_to_le32(0x00000070) /* SMB3.1.1 */
-#define SMB2_FLAGS_DFS_OPERATIONS cpu_to_le32(0x10000000)
-#define SMB2_FLAGS_REPLAY_OPERATION cpu_to_le32(0x20000000) /* SMB3 & up */
-
-/*
* Definitions for SMB2 Protocol Data Units (network frames)
*
* See MS-SMB2.PDF specification for protocol details.
@@ -216,7 +68,7 @@ struct smb2_rdma_encryption_transform {
#define SMB2_ERROR_STRUCTURE_SIZE2 cpu_to_le16(9)
struct smb2_err_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize;
__le16 Reserved; /* MBZ */
__le32 ByteCount; /* even if zero, at least one byte follows */
@@ -275,7 +127,7 @@ struct share_redirect_error_context_rsp
#define SMB2_CLIENT_GUID_SIZE 16
struct smb2_negotiate_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 36 */
__le16 DialectCount;
__le16 SecurityMode;
@@ -449,7 +301,7 @@ struct smb2_posix_neg_context {
} __packed;
struct smb2_negotiate_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 65 */
__le16 SecurityMode;
__le16 DialectRevision;
@@ -472,7 +324,7 @@ struct smb2_negotiate_rsp {
#define SMB2_SESSION_REQ_FLAG_ENCRYPT_DATA 0x04
struct smb2_sess_setup_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 25 */
__u8 Flags;
__u8 SecurityMode;
@@ -489,7 +341,7 @@ struct smb2_sess_setup_req {
#define SMB2_SESSION_FLAG_IS_NULL 0x0002
#define SMB2_SESSION_FLAG_ENCRYPT_DATA 0x0004
struct smb2_sess_setup_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 9 */
__le16 SessionFlags;
__le16 SecurityBufferOffset;
@@ -498,160 +350,13 @@ struct smb2_sess_setup_rsp {
} __packed;
struct smb2_logoff_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__le16 Reserved;
} __packed;
struct smb2_logoff_rsp {
- struct smb2_sync_hdr sync_hdr;
- __le16 StructureSize; /* Must be 4 */
- __le16 Reserved;
-} __packed;
-
-/* Flags/Reserved for SMB3.1.1 */
-#define SMB2_TREE_CONNECT_FLAG_CLUSTER_RECONNECT cpu_to_le16(0x0001)
-#define SMB2_TREE_CONNECT_FLAG_REDIRECT_TO_OWNER cpu_to_le16(0x0002)
-#define SMB2_TREE_CONNECT_FLAG_EXTENSION_PRESENT cpu_to_le16(0x0004)
-
-struct smb2_tree_connect_req {
- struct smb2_sync_hdr sync_hdr;
- __le16 StructureSize; /* Must be 9 */
- __le16 Flags; /* Reserved MBZ for dialects prior to SMB3.1.1 */
- __le16 PathOffset;
- __le16 PathLength;
- __u8 Buffer[]; /* variable length */
-} __packed;
-
-/* See MS-SMB2 section 2.2.9.2 */
-/* Context Types */
-#define SMB2_RESERVED_TREE_CONNECT_CONTEXT_ID 0x0000
-#define SMB2_REMOTED_IDENTITY_TREE_CONNECT_CONTEXT_ID cpu_to_le16(0x0001)
-
-struct tree_connect_contexts {
- __le16 ContextType;
- __le16 DataLength;
- __le32 Reserved;
- __u8 Data[];
-} __packed;
-
-/* Remoted identity tree connect context structures - see MS-SMB2 2.2.9.2.1 */
-struct smb3_blob_data {
- __le16 BlobSize;
- __u8 BlobData[];
-} __packed;
-
-/* Valid values for Attr */
-#define SE_GROUP_MANDATORY 0x00000001
-#define SE_GROUP_ENABLED_BY_DEFAULT 0x00000002
-#define SE_GROUP_ENABLED 0x00000004
-#define SE_GROUP_OWNER 0x00000008
-#define SE_GROUP_USE_FOR_DENY_ONLY 0x00000010
-#define SE_GROUP_INTEGRITY 0x00000020
-#define SE_GROUP_INTEGRITY_ENABLED 0x00000040
-#define SE_GROUP_RESOURCE 0x20000000
-#define SE_GROUP_LOGON_ID 0xC0000000
-
-/* struct sid_attr_data is SidData array in BlobData format then le32 Attr */
-
-struct sid_array_data {
- __le16 SidAttrCount;
- /* SidAttrList - array of sid_attr_data structs */
-} __packed;
-
-struct luid_attr_data {
-
-} __packed;
-
-/*
- * struct privilege_data is the same as BLOB_DATA - see MS-SMB2 2.2.9.2.1.5
- * but with size of LUID_ATTR_DATA struct and BlobData set to LUID_ATTR DATA
- */
-
-struct privilege_array_data {
- __le16 PrivilegeCount;
- /* array of privilege_data structs */
-} __packed;
-
-struct remoted_identity_tcon_context {
- __le16 TicketType; /* must be 0x0001 */
- __le16 TicketSize; /* total size of this struct */
- __le16 User; /* offset to SID_ATTR_DATA struct with user info */
- __le16 UserName; /* offset to null terminated Unicode username string */
- __le16 Domain; /* offset to null terminated Unicode domain name */
- __le16 Groups; /* offset to SID_ARRAY_DATA struct with group info */
- __le16 RestrictedGroups; /* similar to above */
- __le16 Privileges; /* offset to PRIVILEGE_ARRAY_DATA struct */
- __le16 PrimaryGroup; /* offset to SID_ARRAY_DATA struct */
- __le16 Owner; /* offset to BLOB_DATA struct */
- __le16 DefaultDacl; /* offset to BLOB_DATA struct */
- __le16 DeviceGroups; /* offset to SID_ARRAY_DATA struct */
- __le16 UserClaims; /* offset to BLOB_DATA struct */
- __le16 DeviceClaims; /* offset to BLOB_DATA struct */
- __u8 TicketInfo[]; /* variable length buf - remoted identity data */
-} __packed;
-
-struct smb2_tree_connect_req_extension {
- __le32 TreeConnectContextOffset;
- __le16 TreeConnectContextCount;
- __u8 Reserved[10];
- __u8 PathName[]; /* variable sized array */
- /* followed by array of TreeConnectContexts */
-} __packed;
-
-struct smb2_tree_connect_rsp {
- struct smb2_sync_hdr sync_hdr;
- __le16 StructureSize; /* Must be 16 */
- __u8 ShareType; /* see below */
- __u8 Reserved;
- __le32 ShareFlags; /* see below */
- __le32 Capabilities; /* see below */
- __le32 MaximalAccess;
-} __packed;
-
-/* Possible ShareType values */
-#define SMB2_SHARE_TYPE_DISK 0x01
-#define SMB2_SHARE_TYPE_PIPE 0x02
-#define SMB2_SHARE_TYPE_PRINT 0x03
-
-/*
- * Possible ShareFlags - exactly one and only one of the first 4 caching flags
- * must be set (any of the remaining, SHI1005, flags may be set individually
- * or in combination.
- */
-#define SMB2_SHAREFLAG_MANUAL_CACHING 0x00000000
-#define SMB2_SHAREFLAG_AUTO_CACHING 0x00000010
-#define SMB2_SHAREFLAG_VDO_CACHING 0x00000020
-#define SMB2_SHAREFLAG_NO_CACHING 0x00000030
-#define SHI1005_FLAGS_DFS 0x00000001
-#define SHI1005_FLAGS_DFS_ROOT 0x00000002
-#define SHI1005_FLAGS_RESTRICT_EXCLUSIVE_OPENS 0x00000100
-#define SHI1005_FLAGS_FORCE_SHARED_DELETE 0x00000200
-#define SHI1005_FLAGS_ALLOW_NAMESPACE_CACHING 0x00000400
-#define SHI1005_FLAGS_ACCESS_BASED_DIRECTORY_ENUM 0x00000800
-#define SHI1005_FLAGS_FORCE_LEVELII_OPLOCK 0x00001000
-#define SHI1005_FLAGS_ENABLE_HASH_V1 0x00002000
-#define SHI1005_FLAGS_ENABLE_HASH_V2 0x00004000
-#define SHI1005_FLAGS_ENCRYPT_DATA 0x00008000
-#define SMB2_SHAREFLAG_IDENTITY_REMOTING 0x00040000 /* 3.1.1 */
-#define SHI1005_FLAGS_ALL 0x0004FF33
-
-/* Possible share capabilities */
-#define SMB2_SHARE_CAP_DFS cpu_to_le32(0x00000008) /* all dialects */
-#define SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY cpu_to_le32(0x00000010) /* 3.0 */
-#define SMB2_SHARE_CAP_SCALEOUT cpu_to_le32(0x00000020) /* 3.0 */
-#define SMB2_SHARE_CAP_CLUSTER cpu_to_le32(0x00000040) /* 3.0 */
-#define SMB2_SHARE_CAP_ASYMMETRIC cpu_to_le32(0x00000080) /* 3.02 */
-#define SMB2_SHARE_CAP_REDIRECT_TO_OWNER cpu_to_le32(0x00000100) /* 3.1.1 */
-
-struct smb2_tree_disconnect_req {
- struct smb2_sync_hdr sync_hdr;
- __le16 StructureSize; /* Must be 4 */
- __le16 Reserved;
-} __packed;
-
-struct smb2_tree_disconnect_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__le16 Reserved;
} __packed;
@@ -784,7 +489,7 @@ struct smb2_tree_disconnect_rsp {
#define SMB2_CREATE_IOV_SIZE 8
struct smb2_create_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 57 */
__u8 SecurityFlags;
__u8 RequestedOplockLevel;
@@ -811,7 +516,7 @@ struct smb2_create_req {
#define MAX_SMB2_CREATE_RESPONSE_SIZE 880
struct smb2_create_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 89 */
__u8 OplockLevel;
__u8 Flag; /* 0x01 if reparse point */
@@ -1186,7 +891,7 @@ struct duplicate_extents_to_file {
#define SMB2_IOCTL_IOV_SIZE 2
struct smb2_ioctl_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 57 */
__u16 Reserved;
__le32 CtlCode;
@@ -1204,7 +909,7 @@ struct smb2_ioctl_req {
} __packed;
struct smb2_ioctl_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 57 */
__u16 Reserved;
__le32 CtlCode;
@@ -1222,7 +927,7 @@ struct smb2_ioctl_rsp {
/* Currently defined values for close flags */
#define SMB2_CLOSE_FLAG_POSTQUERY_ATTRIB cpu_to_le16(0x0001)
struct smb2_close_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 24 */
__le16 Flags;
__le32 Reserved;
@@ -1236,7 +941,7 @@ struct smb2_close_req {
#define MAX_SMB2_CLOSE_RESPONSE_SIZE 124
struct smb2_close_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* 60 */
__le16 Flags;
__le32 Reserved;
@@ -1250,7 +955,7 @@ struct smb2_close_rsp {
} __packed;
struct smb2_flush_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 24 */
__le16 Reserved1;
__le32 Reserved2;
@@ -1259,7 +964,7 @@ struct smb2_flush_req {
} __packed;
struct smb2_flush_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize;
__le16 Reserved;
} __packed;
@@ -1276,7 +981,7 @@ struct smb2_flush_rsp {
/* SMB2 read request without RFC1001 length at the beginning */
struct smb2_read_plain_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 49 */
__u8 Padding; /* offset from start of SMB2 header to place read */
__u8 Flags; /* MBZ unless SMB3.02 or later */
@@ -1297,7 +1002,7 @@ struct smb2_read_plain_req {
#define SMB2_READFLAG_RESPONSE_RDMA_TRANSFORM 0x00000001
struct smb2_read_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 17 */
__u8 DataOffset;
__u8 Reserved;
@@ -1312,7 +1017,7 @@ struct smb2_read_rsp {
#define SMB2_WRITEFLAG_WRITE_UNBUFFERED 0x00000002 /* SMB3.02 or later */
struct smb2_write_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 49 */
__le16 DataOffset; /* offset from start of SMB2 header to write data */
__le32 Length;
@@ -1328,7 +1033,7 @@ struct smb2_write_req {
} __packed;
struct smb2_write_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 17 */
__u8 DataOffset;
__u8 Reserved;
@@ -1356,7 +1061,7 @@ struct smb2_write_rsp {
#define FILE_NOTIFY_CHANGE_STREAM_WRITE 0x00000800
struct smb2_change_notify_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize;
__le16 Flags;
__le32 OutputBufferLength;
@@ -1367,7 +1072,7 @@ struct smb2_change_notify_req {
} __packed;
struct smb2_change_notify_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 9 */
__le16 OutputBufferOffset;
__le32 OutputBufferLength;
@@ -1387,7 +1092,7 @@ struct smb2_lock_element {
} __packed;
struct smb2_lock_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 48 */
__le16 LockCount;
__le32 Reserved;
@@ -1401,19 +1106,19 @@ struct smb2_lock_req {
} __packed;
struct smb2_lock_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__le16 Reserved;
} __packed;
struct smb2_echo_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__u16 Reserved;
} __packed;
struct smb2_echo_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 4 */
__u16 Reserved;
} __packed;
@@ -1427,7 +1132,7 @@ struct smb2_echo_rsp {
#define SMB2_QUERY_DIRECTORY_IOV_SIZE 2
struct smb2_query_directory_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 33 */
__u8 FileInformationClass;
__u8 Flags;
@@ -1441,7 +1146,7 @@ struct smb2_query_directory_req {
} __packed;
struct smb2_query_directory_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 9 */
__le16 OutputBufferOffset;
__le32 OutputBufferLength;
@@ -1474,7 +1179,7 @@ struct smb2_query_directory_rsp {
#define SL_INDEX_SPECIFIED 0x00000004
struct smb2_query_info_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 41 */
__u8 InfoType;
__u8 FileInfoClass;
@@ -1490,7 +1195,7 @@ struct smb2_query_info_req {
} __packed;
struct smb2_query_info_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 9 */
__le16 OutputBufferOffset;
__le32 OutputBufferLength;
@@ -1507,7 +1212,7 @@ struct smb2_query_info_rsp {
#define SMB2_SET_INFO_IOV_SIZE 3
struct smb2_set_info_req {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 33 */
__u8 InfoType;
__u8 FileInfoClass;
@@ -1521,12 +1226,12 @@ struct smb2_set_info_req {
} __packed;
struct smb2_set_info_rsp {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 2 */
} __packed;
struct smb2_oplock_break {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 24 */
__u8 OplockLevel;
__u8 Reserved;
@@ -1538,7 +1243,7 @@ struct smb2_oplock_break {
#define SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED cpu_to_le32(0x01)
struct smb2_lease_break {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 44 */
__le16 Epoch;
__le32 Flags;
@@ -1551,7 +1256,7 @@ struct smb2_lease_break {
} __packed;
struct smb2_lease_ack {
- struct smb2_sync_hdr sync_hdr;
+ struct smb2_hdr hdr;
__le16 StructureSize; /* Must be 36 */
__le16 Reserved;
__le32 Flags;
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -38,7 +38,7 @@ extern int smb2_check_message(char *buf,
struct TCP_Server_Info *server);
extern unsigned int smb2_calc_size(void *buf, struct TCP_Server_Info *server);
extern char *smb2_get_data_area_len(int *off, int *len,
- struct smb2_sync_hdr *shdr);
+ struct smb2_hdr *shdr);
extern __le16 *cifs_convert_path_to_utf16(const char *from,
struct cifs_sb_info *cifs_sb);
--- a/fs/cifs/smb2transport.c
+++ b/fs/cifs/smb2transport.c
@@ -33,7 +33,6 @@
#include <linux/highmem.h>
#include <crypto/algapi.h>
#include <crypto/aead.h>
-#include "smb2pdu.h"
#include "cifsglob.h"
#include "cifsproto.h"
#include "smb2proto.h"
@@ -227,14 +226,14 @@ smb2_calc_signature(struct smb_rqst *rqs
unsigned char smb2_signature[SMB2_HMACSHA256_SIZE];
unsigned char *sigptr = smb2_signature;
struct kvec *iov = rqst->rq_iov;
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0].iov_base;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base;
struct cifs_ses *ses;
struct shash_desc *shash;
struct crypto_shash *hash;
struct sdesc *sdesc = NULL;
struct smb_rqst drqst;
- ses = smb2_find_smb_ses(server, shdr->SessionId);
+ ses = smb2_find_smb_ses(server, le64_to_cpu(shdr->SessionId));
if (!ses) {
cifs_server_dbg(VFS, "%s: Could not find session\n", __func__);
return 0;
@@ -563,14 +562,14 @@ smb3_calc_signature(struct smb_rqst *rqs
unsigned char smb3_signature[SMB2_CMACAES_SIZE];
unsigned char *sigptr = smb3_signature;
struct kvec *iov = rqst->rq_iov;
- struct smb2_sync_hdr *shdr = (struct smb2_sync_hdr *)iov[0].iov_base;
+ struct smb2_hdr *shdr = (struct smb2_hdr *)iov[0].iov_base;
struct shash_desc *shash;
struct crypto_shash *hash;
struct sdesc *sdesc = NULL;
struct smb_rqst drqst;
u8 key[SMB3_SIGN_KEY_SIZE];
- rc = smb2_get_sign_key(shdr->SessionId, server, key);
+ rc = smb2_get_sign_key(le64_to_cpu(shdr->SessionId), server, key);
if (rc)
return 0;
@@ -640,12 +639,12 @@ static int
smb2_sign_rqst(struct smb_rqst *rqst, struct TCP_Server_Info *server)
{
int rc = 0;
- struct smb2_sync_hdr *shdr;
+ struct smb2_hdr *shdr;
struct smb2_sess_setup_req *ssr;
bool is_binding;
bool is_signed;
- shdr = (struct smb2_sync_hdr *)rqst->rq_iov[0].iov_base;
+ shdr = (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
ssr = (struct smb2_sess_setup_req *)shdr;
is_binding = shdr->Command == SMB2_SESSION_SETUP &&
@@ -671,8 +670,8 @@ smb2_verify_signature(struct smb_rqst *r
{
unsigned int rc;
char server_response_sig[SMB2_SIGNATURE_SIZE];
- struct smb2_sync_hdr *shdr =
- (struct smb2_sync_hdr *)rqst->rq_iov[0].iov_base;
+ struct smb2_hdr *shdr =
+ (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
if ((shdr->Command == SMB2_NEGOTIATE) ||
(shdr->Command == SMB2_SESSION_SETUP) ||
@@ -719,7 +718,7 @@ smb2_verify_signature(struct smb_rqst *r
*/
static inline void
smb2_seq_num_into_buf(struct TCP_Server_Info *server,
- struct smb2_sync_hdr *shdr)
+ struct smb2_hdr *shdr)
{
unsigned int i, num = le16_to_cpu(shdr->CreditCharge);
@@ -730,7 +729,7 @@ smb2_seq_num_into_buf(struct TCP_Server_
}
static struct mid_q_entry *
-smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr,
+smb2_mid_entry_alloc(const struct smb2_hdr *shdr,
struct TCP_Server_Info *server)
{
struct mid_q_entry *temp;
@@ -762,14 +761,15 @@ smb2_mid_entry_alloc(const struct smb2_s
atomic_inc(&midCount);
temp->mid_state = MID_REQUEST_ALLOCATED;
- trace_smb3_cmd_enter(shdr->TreeId, shdr->SessionId,
- le16_to_cpu(shdr->Command), temp->mid);
+ trace_smb3_cmd_enter(le32_to_cpu(shdr->Id.SyncId.TreeId),
+ le64_to_cpu(shdr->SessionId),
+ le16_to_cpu(shdr->Command), temp->mid);
return temp;
}
static int
smb2_get_mid_entry(struct cifs_ses *ses, struct TCP_Server_Info *server,
- struct smb2_sync_hdr *shdr, struct mid_q_entry **mid)
+ struct smb2_hdr *shdr, struct mid_q_entry **mid)
{
if (server->tcpStatus == CifsExiting)
return -ENOENT;
@@ -837,8 +837,8 @@ smb2_setup_request(struct cifs_ses *ses,
struct smb_rqst *rqst)
{
int rc;
- struct smb2_sync_hdr *shdr =
- (struct smb2_sync_hdr *)rqst->rq_iov[0].iov_base;
+ struct smb2_hdr *shdr =
+ (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
struct mid_q_entry *mid;
smb2_seq_num_into_buf(server, shdr);
@@ -863,8 +863,8 @@ struct mid_q_entry *
smb2_setup_async_request(struct TCP_Server_Info *server, struct smb_rqst *rqst)
{
int rc;
- struct smb2_sync_hdr *shdr =
- (struct smb2_sync_hdr *)rqst->rq_iov[0].iov_base;
+ struct smb2_hdr *shdr =
+ (struct smb2_hdr *)rqst->rq_iov[0].iov_base;
struct mid_q_entry *mid;
if (server->tcpStatus == CifsNeedNegotiate &&
--- /dev/null
+++ b/fs/smbfs_common/smb2pdu.h
@@ -0,0 +1,318 @@
+/* SPDX-License-Identifier: LGPL-2.1 */
+#ifndef _COMMON_SMB2PDU_H
+#define _COMMON_SMB2PDU_H
+
+/*
+ * Note that, due to trying to use names similar to the protocol specifications,
+ * there are many mixed case field names in the structures below. Although
+ * this does not match typical Linux kernel style, it is necessary to be
+ * able to match against the protocol specfication.
+ *
+ * SMB2 commands
+ * Some commands have minimal (wct=0,bcc=0), or uninteresting, responses
+ * (ie no useful data other than the SMB error code itself) and are marked such.
+ * Knowing this helps avoid response buffer allocations and copy in some cases.
+ */
+
+/* List of commands in host endian */
+#define SMB2_NEGOTIATE_HE 0x0000
+#define SMB2_SESSION_SETUP_HE 0x0001
+#define SMB2_LOGOFF_HE 0x0002 /* trivial request/resp */
+#define SMB2_TREE_CONNECT_HE 0x0003
+#define SMB2_TREE_DISCONNECT_HE 0x0004 /* trivial req/resp */
+#define SMB2_CREATE_HE 0x0005
+#define SMB2_CLOSE_HE 0x0006
+#define SMB2_FLUSH_HE 0x0007 /* trivial resp */
+#define SMB2_READ_HE 0x0008
+#define SMB2_WRITE_HE 0x0009
+#define SMB2_LOCK_HE 0x000A
+#define SMB2_IOCTL_HE 0x000B
+#define SMB2_CANCEL_HE 0x000C
+#define SMB2_ECHO_HE 0x000D
+#define SMB2_QUERY_DIRECTORY_HE 0x000E
+#define SMB2_CHANGE_NOTIFY_HE 0x000F
+#define SMB2_QUERY_INFO_HE 0x0010
+#define SMB2_SET_INFO_HE 0x0011
+#define SMB2_OPLOCK_BREAK_HE 0x0012
+
+/* The same list in little endian */
+#define SMB2_NEGOTIATE cpu_to_le16(SMB2_NEGOTIATE_HE)
+#define SMB2_SESSION_SETUP cpu_to_le16(SMB2_SESSION_SETUP_HE)
+#define SMB2_LOGOFF cpu_to_le16(SMB2_LOGOFF_HE)
+#define SMB2_TREE_CONNECT cpu_to_le16(SMB2_TREE_CONNECT_HE)
+#define SMB2_TREE_DISCONNECT cpu_to_le16(SMB2_TREE_DISCONNECT_HE)
+#define SMB2_CREATE cpu_to_le16(SMB2_CREATE_HE)
+#define SMB2_CLOSE cpu_to_le16(SMB2_CLOSE_HE)
+#define SMB2_FLUSH cpu_to_le16(SMB2_FLUSH_HE)
+#define SMB2_READ cpu_to_le16(SMB2_READ_HE)
+#define SMB2_WRITE cpu_to_le16(SMB2_WRITE_HE)
+#define SMB2_LOCK cpu_to_le16(SMB2_LOCK_HE)
+#define SMB2_IOCTL cpu_to_le16(SMB2_IOCTL_HE)
+#define SMB2_CANCEL cpu_to_le16(SMB2_CANCEL_HE)
+#define SMB2_ECHO cpu_to_le16(SMB2_ECHO_HE)
+#define SMB2_QUERY_DIRECTORY cpu_to_le16(SMB2_QUERY_DIRECTORY_HE)
+#define SMB2_CHANGE_NOTIFY cpu_to_le16(SMB2_CHANGE_NOTIFY_HE)
+#define SMB2_QUERY_INFO cpu_to_le16(SMB2_QUERY_INFO_HE)
+#define SMB2_SET_INFO cpu_to_le16(SMB2_SET_INFO_HE)
+#define SMB2_OPLOCK_BREAK cpu_to_le16(SMB2_OPLOCK_BREAK_HE)
+
+#define SMB2_INTERNAL_CMD cpu_to_le16(0xFFFF)
+
+#define NUMBER_OF_SMB2_COMMANDS 0x0013
+
+/*
+ * SMB2 Header Definition
+ *
+ * "MBZ" : Must be Zero
+ * "BB" : BugBug, Something to check/review/analyze later
+ * "PDU" : "Protocol Data Unit" (ie a network "frame")
+ *
+ */
+
+#define __SMB2_HEADER_STRUCTURE_SIZE 64
+#define SMB2_HEADER_STRUCTURE_SIZE \
+ cpu_to_le16(__SMB2_HEADER_STRUCTURE_SIZE)
+
+#define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)
+#define SMB2_TRANSFORM_PROTO_NUM cpu_to_le32(0x424d53fd)
+#define SMB2_COMPRESSION_TRANSFORM_ID cpu_to_le32(0x424d53fc)
+
+/*
+ * SMB2 flag definitions
+ */
+#define SMB2_FLAGS_SERVER_TO_REDIR cpu_to_le32(0x00000001)
+#define SMB2_FLAGS_ASYNC_COMMAND cpu_to_le32(0x00000002)
+#define SMB2_FLAGS_RELATED_OPERATIONS cpu_to_le32(0x00000004)
+#define SMB2_FLAGS_SIGNED cpu_to_le32(0x00000008)
+#define SMB2_FLAGS_PRIORITY_MASK cpu_to_le32(0x00000070) /* SMB3.1.1 */
+#define SMB2_FLAGS_DFS_OPERATIONS cpu_to_le32(0x10000000)
+#define SMB2_FLAGS_REPLAY_OPERATION cpu_to_le32(0x20000000) /* SMB3 & up */
+
+/* See MS-SMB2 section 2.2.1 */
+struct smb2_hdr {
+ __le32 ProtocolId; /* 0xFE 'S' 'M' 'B' */
+ __le16 StructureSize; /* 64 */
+ __le16 CreditCharge; /* MBZ */
+ __le32 Status; /* Error from server */
+ __le16 Command;
+ __le16 CreditRequest; /* CreditResponse */
+ __le32 Flags;
+ __le32 NextCommand;
+ __le64 MessageId;
+ union {
+ struct {
+ __le32 ProcessId;
+ __le32 TreeId;
+ } __packed SyncId;
+ __le64 AsyncId;
+ } __packed Id;
+ __le64 SessionId;
+ __u8 Signature[16];
+} __packed;
+
+struct smb2_pdu {
+ struct smb2_hdr hdr;
+ __le16 StructureSize2; /* size of wct area (varies, request specific) */
+} __packed;
+
+#define SMB3_AES_CCM_NONCE 11
+#define SMB3_AES_GCM_NONCE 12
+
+/* Transform flags (for 3.0 dialect this flag indicates CCM */
+#define TRANSFORM_FLAG_ENCRYPTED 0x0001
+struct smb2_transform_hdr {
+ __le32 ProtocolId; /* 0xFD 'S' 'M' 'B' */
+ __u8 Signature[16];
+ __u8 Nonce[16];
+ __le32 OriginalMessageSize;
+ __u16 Reserved1;
+ __le16 Flags; /* EncryptionAlgorithm for 3.0, enc enabled for 3.1.1 */
+ __le64 SessionId;
+} __packed;
+
+
+/* See MS-SMB2 2.2.42 */
+struct smb2_compression_transform_hdr_unchained {
+ __le32 ProtocolId; /* 0xFC 'S' 'M' 'B' */
+ __le32 OriginalCompressedSegmentSize;
+ __le16 CompressionAlgorithm;
+ __le16 Flags;
+ __le16 Length; /* if chained it is length, else offset */
+} __packed;
+
+/* See MS-SMB2 2.2.42.1 */
+#define SMB2_COMPRESSION_FLAG_NONE 0x0000
+#define SMB2_COMPRESSION_FLAG_CHAINED 0x0001
+
+struct compression_payload_header {
+ __le16 CompressionAlgorithm;
+ __le16 Flags;
+ __le32 Length; /* length of compressed playload including field below if present */
+ /* __le32 OriginalPayloadSize; */ /* optional, present when LZNT1, LZ77, LZ77+Huffman */
+} __packed;
+
+/* See MS-SMB2 2.2.42.2 */
+struct smb2_compression_transform_hdr_chained {
+ __le32 ProtocolId; /* 0xFC 'S' 'M' 'B' */
+ __le32 OriginalCompressedSegmentSize;
+ /* struct compression_payload_header[] */
+} __packed;
+
+/* See MS-SMB2 2.2.42.2.2 */
+struct compression_pattern_payload_v1 {
+ __le16 Pattern;
+ __le16 Reserved1;
+ __le16 Reserved2;
+ __le32 Repetitions;
+} __packed;
+
+/* See MS-SMB2 section 2.2.9.2 */
+/* Context Types */
+#define SMB2_RESERVED_TREE_CONNECT_CONTEXT_ID 0x0000
+#define SMB2_REMOTED_IDENTITY_TREE_CONNECT_CONTEXT_ID cpu_to_le16(0x0001)
+
+struct tree_connect_contexts {
+ __le16 ContextType;
+ __le16 DataLength;
+ __le32 Reserved;
+ __u8 Data[];
+} __packed;
+
+/* Remoted identity tree connect context structures - see MS-SMB2 2.2.9.2.1 */
+struct smb3_blob_data {
+ __le16 BlobSize;
+ __u8 BlobData[];
+} __packed;
+
+/* Valid values for Attr */
+#define SE_GROUP_MANDATORY 0x00000001
+#define SE_GROUP_ENABLED_BY_DEFAULT 0x00000002
+#define SE_GROUP_ENABLED 0x00000004
+#define SE_GROUP_OWNER 0x00000008
+#define SE_GROUP_USE_FOR_DENY_ONLY 0x00000010
+#define SE_GROUP_INTEGRITY 0x00000020
+#define SE_GROUP_INTEGRITY_ENABLED 0x00000040
+#define SE_GROUP_RESOURCE 0x20000000
+#define SE_GROUP_LOGON_ID 0xC0000000
+
+/* struct sid_attr_data is SidData array in BlobData format then le32 Attr */
+
+struct sid_array_data {
+ __le16 SidAttrCount;
+ /* SidAttrList - array of sid_attr_data structs */
+} __packed;
+
+struct luid_attr_data {
+
+} __packed;
+
+/*
+ * struct privilege_data is the same as BLOB_DATA - see MS-SMB2 2.2.9.2.1.5
+ * but with size of LUID_ATTR_DATA struct and BlobData set to LUID_ATTR DATA
+ */
+
+struct privilege_array_data {
+ __le16 PrivilegeCount;
+ /* array of privilege_data structs */
+} __packed;
+
+struct remoted_identity_tcon_context {
+ __le16 TicketType; /* must be 0x0001 */
+ __le16 TicketSize; /* total size of this struct */
+ __le16 User; /* offset to SID_ATTR_DATA struct with user info */
+ __le16 UserName; /* offset to null terminated Unicode username string */
+ __le16 Domain; /* offset to null terminated Unicode domain name */
+ __le16 Groups; /* offset to SID_ARRAY_DATA struct with group info */
+ __le16 RestrictedGroups; /* similar to above */
+ __le16 Privileges; /* offset to PRIVILEGE_ARRAY_DATA struct */
+ __le16 PrimaryGroup; /* offset to SID_ARRAY_DATA struct */
+ __le16 Owner; /* offset to BLOB_DATA struct */
+ __le16 DefaultDacl; /* offset to BLOB_DATA struct */
+ __le16 DeviceGroups; /* offset to SID_ARRAY_DATA struct */
+ __le16 UserClaims; /* offset to BLOB_DATA struct */
+ __le16 DeviceClaims; /* offset to BLOB_DATA struct */
+ __u8 TicketInfo[]; /* variable length buf - remoted identity data */
+} __packed;
+
+struct smb2_tree_connect_req_extension {
+ __le32 TreeConnectContextOffset;
+ __le16 TreeConnectContextCount;
+ __u8 Reserved[10];
+ __u8 PathName[]; /* variable sized array */
+ /* followed by array of TreeConnectContexts */
+} __packed;
+
+/* Flags/Reserved for SMB3.1.1 */
+#define SMB2_TREE_CONNECT_FLAG_CLUSTER_RECONNECT cpu_to_le16(0x0001)
+#define SMB2_TREE_CONNECT_FLAG_REDIRECT_TO_OWNER cpu_to_le16(0x0002)
+#define SMB2_TREE_CONNECT_FLAG_EXTENSION_PRESENT cpu_to_le16(0x0004)
+
+struct smb2_tree_connect_req {
+ struct smb2_hdr hdr;
+ __le16 StructureSize; /* Must be 9 */
+ __le16 Flags; /* Flags in SMB3.1.1 */
+ __le16 PathOffset;
+ __le16 PathLength;
+ __u8 Buffer[]; /* variable length */
+} __packed;
+
+/* Possible ShareType values */
+#define SMB2_SHARE_TYPE_DISK 0x01
+#define SMB2_SHARE_TYPE_PIPE 0x02
+#define SMB2_SHARE_TYPE_PRINT 0x03
+
+/*
+ * Possible ShareFlags - exactly one and only one of the first 4 caching flags
+ * must be set (any of the remaining, SHI1005, flags may be set individually
+ * or in combination.
+ */
+#define SMB2_SHAREFLAG_MANUAL_CACHING 0x00000000
+#define SMB2_SHAREFLAG_AUTO_CACHING 0x00000010
+#define SMB2_SHAREFLAG_VDO_CACHING 0x00000020
+#define SMB2_SHAREFLAG_NO_CACHING 0x00000030
+#define SHI1005_FLAGS_DFS 0x00000001
+#define SHI1005_FLAGS_DFS_ROOT 0x00000002
+#define SHI1005_FLAGS_RESTRICT_EXCLUSIVE_OPENS 0x00000100
+#define SHI1005_FLAGS_FORCE_SHARED_DELETE 0x00000200
+#define SHI1005_FLAGS_ALLOW_NAMESPACE_CACHING 0x00000400
+#define SHI1005_FLAGS_ACCESS_BASED_DIRECTORY_ENUM 0x00000800
+#define SHI1005_FLAGS_FORCE_LEVELII_OPLOCK 0x00001000
+#define SHI1005_FLAGS_ENABLE_HASH_V1 0x00002000
+#define SHI1005_FLAGS_ENABLE_HASH_V2 0x00004000
+#define SHI1005_FLAGS_ENCRYPT_DATA 0x00008000
+#define SMB2_SHAREFLAG_IDENTITY_REMOTING 0x00040000 /* 3.1.1 */
+#define SMB2_SHAREFLAG_COMPRESS_DATA 0x00100000 /* 3.1.1 */
+#define SHI1005_FLAGS_ALL 0x0014FF33
+
+/* Possible share capabilities */
+#define SMB2_SHARE_CAP_DFS cpu_to_le32(0x00000008) /* all dialects */
+#define SMB2_SHARE_CAP_CONTINUOUS_AVAILABILITY cpu_to_le32(0x00000010) /* 3.0 */
+#define SMB2_SHARE_CAP_SCALEOUT cpu_to_le32(0x00000020) /* 3.0 */
+#define SMB2_SHARE_CAP_CLUSTER cpu_to_le32(0x00000040) /* 3.0 */
+#define SMB2_SHARE_CAP_ASYMMETRIC cpu_to_le32(0x00000080) /* 3.02 */
+#define SMB2_SHARE_CAP_REDIRECT_TO_OWNER cpu_to_le32(0x00000100) /* 3.1.1 */
+
+struct smb2_tree_connect_rsp {
+ struct smb2_hdr hdr;
+ __le16 StructureSize; /* Must be 16 */
+ __u8 ShareType; /* see below */
+ __u8 Reserved;
+ __le32 ShareFlags; /* see below */
+ __le32 Capabilities; /* see below */
+ __le32 MaximalAccess;
+} __packed;
+
+struct smb2_tree_disconnect_req {
+ struct smb2_hdr hdr;
+ __le16 StructureSize; /* Must be 4 */
+ __le16 Reserved;
+} __packed;
+
+struct smb2_tree_disconnect_rsp {
+ struct smb2_hdr hdr;
+ __le16 StructureSize; /* Must be 4 */
+ __le16 Reserved;
+} __packed;
+
+
+#endif /* _COMMON_SMB2PDU_H */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 609/699] cifs: remove check of list iterator against head past the loop body
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (607 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 608/699] cifs: Create a new shared file holding smb2 pdu definitions Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 610/699] smb2: small refactor in smb2_check_message() Greg Kroah-Hartman
` (93 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE),
Jakob Koschel, Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakob Koschel <jakobkoschel@gmail.com>
[ Upstream commit 00c796eecba4898194ea549679797ee28f89a92f ]
When list_for_each_entry() completes the iteration over the whole list
without breaking the loop, the iterator value will be a bogus pointer
computed based on the head element.
While it is safe to use the pointer to determine if it was computed
based on the head element, either with list_entry_is_head() or
&pos->member == head, using the iterator variable after the loop should
be avoided.
In preparation to limit the scope of a list iterator to the list
traversal loop, use a dedicated pointer to point to the found element [1].
Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Jakob Koschel <jakobkoschel@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2misc.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -154,19 +154,18 @@ smb2_check_message(char *buf, unsigned i
struct smb2_transform_hdr *thdr =
(struct smb2_transform_hdr *)buf;
struct cifs_ses *ses = NULL;
- struct list_head *tmp;
+ struct cifs_ses *iter;
/* decrypt frame now that it is completely read in */
spin_lock(&cifs_tcp_ses_lock);
- list_for_each(tmp, &srvr->smb_ses_list) {
- ses = list_entry(tmp, struct cifs_ses, smb_ses_list);
- if (ses->Suid == le64_to_cpu(thdr->SessionId))
+ list_for_each_entry(iter, &srvr->smb_ses_list, smb_ses_list) {
+ if (iter->Suid == le64_to_cpu(thdr->SessionId)) {
+ ses = iter;
break;
-
- ses = NULL;
+ }
}
spin_unlock(&cifs_tcp_ses_lock);
- if (ses == NULL) {
+ if (!ses) {
cifs_dbg(VFS, "no decryption - session id not found\n");
return 1;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 610/699] smb2: small refactor in smb2_check_message()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (608 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 609/699] cifs: remove check of list iterator against head past the loop body Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 611/699] cifs: remove unused server parameter from calc_smb_size() Greg Kroah-Hartman
` (92 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Enzo Matsumiya, Steve French,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <ematsumiya@suse.de>
[ Upstream commit da3847894fddc27ca95d5ac0012f444a77a5e0c3 ]
If the command is SMB2_IOCTL, OutputLength and OutputContext are
optional and can be zero, so return early and skip calculated length
check.
Move the mismatched length message to the end of the check, to avoid
unnecessary logs when the check was not a real miscalculation.
Also change the pr_warn_once() to a pr_warn() so we're sure to get a
log for the real mismatches.
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/connect.c | 13 ++++++-------
fs/cifs/smb2misc.c | 47 ++++++++++++++++++++++++++++-------------------
2 files changed, 34 insertions(+), 26 deletions(-)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1012,19 +1012,18 @@ int
cifs_handle_standard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
{
char *buf = server->large_buf ? server->bigbuf : server->smallbuf;
- int length;
+ int rc;
/*
* We know that we received enough to get to the MID as we
* checked the pdu_length earlier. Now check to see
- * if the rest of the header is OK. We borrow the length
- * var for the rest of the loop to avoid a new stack var.
+ * if the rest of the header is OK.
*
* 48 bytes is enough to display the header and a little bit
* into the payload for debugging purposes.
*/
- length = server->ops->check_message(buf, server->total_read, server);
- if (length != 0)
+ rc = server->ops->check_message(buf, server->total_read, server);
+ if (rc)
cifs_dump_mem("Bad SMB: ", buf,
min_t(unsigned int, server->total_read, 48));
@@ -1039,9 +1038,9 @@ cifs_handle_standard(struct TCP_Server_I
return -1;
if (!mid)
- return length;
+ return rc;
- handle_mid(mid, server, buf, length);
+ handle_mid(mid, server, buf, rc);
return 0;
}
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -136,15 +136,15 @@ static __u32 get_neg_ctxt_len(struct smb
}
int
-smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *srvr)
+smb2_check_message(char *buf, unsigned int len, struct TCP_Server_Info *server)
{
struct smb2_hdr *shdr = (struct smb2_hdr *)buf;
struct smb2_pdu *pdu = (struct smb2_pdu *)shdr;
- __u64 mid;
- __u32 clc_len; /* calculated length */
- int command;
- int pdu_size = sizeof(struct smb2_pdu);
int hdr_size = sizeof(struct smb2_hdr);
+ int pdu_size = sizeof(struct smb2_pdu);
+ int command;
+ __u32 calc_len; /* calculated length */
+ __u64 mid;
/*
* Add function to do table lookup of StructureSize by command
@@ -158,7 +158,7 @@ smb2_check_message(char *buf, unsigned i
/* decrypt frame now that it is completely read in */
spin_lock(&cifs_tcp_ses_lock);
- list_for_each_entry(iter, &srvr->smb_ses_list, smb_ses_list) {
+ list_for_each_entry(iter, &server->smb_ses_list, smb_ses_list) {
if (iter->Suid == le64_to_cpu(thdr->SessionId)) {
ses = iter;
break;
@@ -225,30 +225,33 @@ smb2_check_message(char *buf, unsigned i
}
}
- clc_len = smb2_calc_size(buf, srvr);
+ calc_len = smb2_calc_size(buf, server);
+
+ /* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might
+ * be 0, and not a real miscalculation */
+ if (command == SMB2_IOCTL_HE && calc_len == 0)
+ return 0;
- if (shdr->Command == SMB2_NEGOTIATE)
- clc_len += get_neg_ctxt_len(shdr, len, clc_len);
+ if (command == SMB2_NEGOTIATE_HE)
+ calc_len += get_neg_ctxt_len(shdr, len, calc_len);
- if (len != clc_len) {
- cifs_dbg(FYI, "Calculated size %u length %u mismatch mid %llu\n",
- clc_len, len, mid);
+ if (len != calc_len) {
/* create failed on symlink */
if (command == SMB2_CREATE_HE &&
shdr->Status == STATUS_STOPPED_ON_SYMLINK)
return 0;
/* Windows 7 server returns 24 bytes more */
- if (clc_len + 24 == len && command == SMB2_OPLOCK_BREAK_HE)
+ if (calc_len + 24 == len && command == SMB2_OPLOCK_BREAK_HE)
return 0;
/* server can return one byte more due to implied bcc[0] */
- if (clc_len == len + 1)
+ if (calc_len == len + 1)
return 0;
/*
* Some windows servers (win2016) will pad also the final
* PDU in a compound to 8 bytes.
*/
- if (((clc_len + 7) & ~7) == len)
+ if (((calc_len + 7) & ~7) == len)
return 0;
/*
@@ -257,12 +260,18 @@ smb2_check_message(char *buf, unsigned i
* SMB2/SMB3 frame length (header + smb2 response specific data)
* Some windows servers also pad up to 8 bytes when compounding.
*/
- if (clc_len < len)
+ if (calc_len < len)
return 0;
- pr_warn_once(
- "srv rsp too short, len %d not %d. cmd:%d mid:%llu\n",
- len, clc_len, command, mid);
+ /* Only log a message if len was really miscalculated */
+ if (unlikely(cifsFYI))
+ cifs_dbg(FYI, "Server response too short: calculated "
+ "length %u doesn't match read length %u (cmd=%d, mid=%llu)\n",
+ calc_len, len, command, mid);
+ else
+ pr_warn("Server response too short: calculated length "
+ "%u doesn't match read length %u (cmd=%d, mid=%llu)\n",
+ calc_len, len, command, mid);
return 1;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 611/699] cifs: remove unused server parameter from calc_smb_size()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (609 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 610/699] smb2: small refactor in smb2_check_message() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 612/699] smb: client: restrict implied bcc[0] exemption to responses without data area Greg Kroah-Hartman
` (91 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE),
Enzo Matsumiya, Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enzo Matsumiya <ematsumiya@suse.de>
[ Upstream commit 68ed14496b032b0c9ef21b38ee45c6c8f3a18ff1 ]
This parameter is unused by the called function
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Signed-off-by: Enzo Matsumiya <ematsumiya@suse.de>
Signed-off-by: Steve French <stfrench@microsoft.com>
Stable-dep-of: 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifs_debug.c | 2 +-
fs/cifs/cifsglob.h | 2 +-
fs/cifs/cifsproto.h | 2 +-
fs/cifs/misc.c | 2 +-
fs/cifs/netmisc.c | 2 +-
fs/cifs/readdir.c | 6 ++----
fs/cifs/smb2misc.c | 4 ++--
fs/cifs/smb2ops.c | 2 +-
fs/cifs/smb2proto.h | 2 +-
9 files changed, 11 insertions(+), 13 deletions(-)
--- a/fs/cifs/cifs_debug.c
+++ b/fs/cifs/cifs_debug.c
@@ -41,7 +41,7 @@ void cifs_dump_detail(void *buf, struct
smb->Command, smb->Status.CifsError,
smb->Flags, smb->Flags2, smb->Mid, smb->Pid);
cifs_dbg(VFS, "smb buf %p len %u\n", smb,
- server->ops->calc_smb_size(smb, server));
+ server->ops->calc_smb_size(smb));
#endif /* CONFIG_CIFS_DEBUG2 */
}
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -397,7 +397,7 @@ struct smb_version_operations {
int (*close_dir)(const unsigned int, struct cifs_tcon *,
struct cifs_fid *);
/* calculate a size of SMB message */
- unsigned int (*calc_smb_size)(void *buf, struct TCP_Server_Info *ptcpi);
+ unsigned int (*calc_smb_size)(void *buf);
/* check for STATUS_PENDING and process the response if yes */
bool (*is_status_pending)(char *buf, struct TCP_Server_Info *server);
/* check for STATUS_NETWORK_SESSION_EXPIRED */
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -148,7 +148,7 @@ extern int cifs_get_writable_path(struct
extern struct cifsFileInfo *find_readable_file(struct cifsInodeInfo *, bool);
extern int cifs_get_readable_path(struct cifs_tcon *tcon, const char *name,
struct cifsFileInfo **ret_file);
-extern unsigned int smbCalcSize(void *buf, struct TCP_Server_Info *server);
+extern unsigned int smbCalcSize(void *buf);
extern int decode_negTokenInit(unsigned char *security_blob, int length,
struct TCP_Server_Info *server);
extern int cifs_convert_address(struct sockaddr *dst, const char *src, int len);
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -370,7 +370,7 @@ checkSMB(char *buf, unsigned int total_r
/* otherwise, there is enough to get to the BCC */
if (check_smb_hdr(smb))
return -EIO;
- clc_len = smbCalcSize(smb, server);
+ clc_len = smbCalcSize(smb);
if (4 + rfclen != total_read) {
cifs_dbg(VFS, "Length read does not match RFC1001 length %d\n",
--- a/fs/cifs/netmisc.c
+++ b/fs/cifs/netmisc.c
@@ -913,7 +913,7 @@ map_and_check_smb_error(struct mid_q_ent
* portion, the number of word parameters and the data portion of the message
*/
unsigned int
-smbCalcSize(void *buf, struct TCP_Server_Info *server)
+smbCalcSize(void *buf)
{
struct smb_hdr *ptr = (struct smb_hdr *)buf;
return (sizeof(struct smb_hdr) + (2 * ptr->WordCount) +
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -801,8 +801,7 @@ find_cifs_entry(const unsigned int xid,
end_of_smb = cfile->srch_inf.ntwrk_buf_start +
server->ops->calc_smb_size(
- cfile->srch_inf.ntwrk_buf_start,
- server);
+ cfile->srch_inf.ntwrk_buf_start);
cur_ent = cfile->srch_inf.srch_entries_start;
first_entry_in_buffer = cfile->srch_inf.index_of_last_entry
@@ -1000,8 +999,7 @@ int cifs_readdir(struct file *file, stru
cifs_dbg(FYI, "loop through %d times filling dir for net buf %p\n",
num_to_fill, cifsFile->srch_inf.ntwrk_buf_start);
max_len = tcon->ses->server->ops->calc_smb_size(
- cifsFile->srch_inf.ntwrk_buf_start,
- tcon->ses->server);
+ cifsFile->srch_inf.ntwrk_buf_start);
end_of_smb = cifsFile->srch_inf.ntwrk_buf_start + max_len;
tmp_buf = kmalloc(UNICODE_NAME_MAX, GFP_KERNEL);
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -225,7 +225,7 @@ smb2_check_message(char *buf, unsigned i
}
}
- calc_len = smb2_calc_size(buf, server);
+ calc_len = smb2_calc_size(buf);
/* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might
* be 0, and not a real miscalculation */
@@ -407,7 +407,7 @@ smb2_get_data_area_len(int *off, int *le
* portion, the number of word parameters and the data portion of the message.
*/
unsigned int
-smb2_calc_size(void *buf, struct TCP_Server_Info *srvr)
+smb2_calc_size(void *buf)
{
struct smb2_pdu *pdu = (struct smb2_pdu *)buf;
struct smb2_hdr *shdr = &pdu->hdr;
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -316,7 +316,7 @@ smb2_dump_detail(void *buf, struct TCP_S
shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId,
shdr->Id.SyncId.ProcessId);
cifs_server_dbg(VFS, "smb buf %p len %u\n", buf,
- server->ops->calc_smb_size(buf, server));
+ server->ops->calc_smb_size(buf));
#endif
}
--- a/fs/cifs/smb2proto.h
+++ b/fs/cifs/smb2proto.h
@@ -36,7 +36,7 @@ struct smb_rqst;
extern int map_smb2_to_linux_error(char *buf, bool log_err);
extern int smb2_check_message(char *buf, unsigned int length,
struct TCP_Server_Info *server);
-extern unsigned int smb2_calc_size(void *buf, struct TCP_Server_Info *server);
+extern unsigned int smb2_calc_size(void *buf);
extern char *smb2_get_data_area_len(int *off, int *len,
struct smb2_hdr *shdr);
extern __le16 *cifs_convert_path_to_utf16(const char *from,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 612/699] smb: client: restrict implied bcc[0] exemption to responses without data area
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (610 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 611/699] cifs: remove unused server parameter from calc_smb_size() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 613/699] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Greg Kroah-Hartman
` (90 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shoichiro Miyamoto, Steve French,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
[ Upstream commit 53b7c271f06be4dd5cfc8c6ef552a8355c891a7f ]
smb2_check_message() has a long-standing quirk that accepts a response
whose calculated length is one byte larger than the bytes actually
received ("server can return one byte more due to implied bcc[0]").
This was introduced to accommodate servers that omit the trailing bcc[0]
overlap byte when no data area is present.
However, the exemption is applied unconditionally, regardless of whether
the command actually carries a data area (has_smb2_data_area[]). When a
response with a data area is subject to the +1 exemption, the reported
data can extend one byte beyond the bytes actually received, yet
smb2_check_message() still accepts it. The subsequent decoder then reads
past the end of the receive buffer. This is reachable during NEGOTIATE
and SESSION_SETUP, before the session is established.
The resulting out-of-bounds reads are visible under KASAN when mounting
against a non-conforming server; both the SPNEGO/negTokenInit and the
NTLMSSP challenge decoders are affected:
BUG: KASAN: slab-out-of-bounds in asn1_ber_decoder+0x16a7/0x1b00
Read of size 1 at addr ffff8880084d67c0 by task mount.cifs/81
CPU: 1 UID: 0 PID: 81 Comm: mount.cifs Not tainted 7.1.0-rc6 #1
Call Trace:
<TASK>
dump_stack_lvl+0x4e/0x70
print_report+0x157/0x4c9
kasan_report+0xce/0x100
asn1_ber_decoder+0x16a7/0x1b00
decode_negTokenInit+0x19/0x30
SMB2_negotiate+0x31d9/0x4c90
cifs_negotiate_protocol+0x1f2/0x3f0
cifs_get_smb_ses+0x93f/0x17e0
cifs_mount_get_session+0x7f/0x3a0
cifs_mount+0xb4/0xcf0
cifs_smb3_do_mount+0x23a/0x1500
smb3_get_tree+0x3b0/0x630
vfs_get_tree+0x82/0x2d0
fc_mount+0x10/0x1b0
path_mount+0x50d/0x1de0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xee/0x590
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 85:
kmem_cache_alloc_noprof+0x106/0x380
mempool_alloc_noprof+0x116/0x1e0
cifs_small_buf_get+0x31/0x80
allocate_buffers+0x10d/0x2b0
cifs_demultiplex_thread+0x1d5/0x1d50
kthread+0x2c6/0x390
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
The buggy address is located 0 bytes to the right of
allocated 448-byte region [ffff8880084d6600, ffff8880084d67c0)
which belongs to the cache cifs_small_rq of size 448
BUG: KASAN: slab-out-of-bounds in kmemdup_noprof+0x36/0x50
Read of size 329 at addr ffff88800726c678 by task mount.cifs/89
CPU: 0 UID: 0 PID: 89 Comm: mount.cifs Tainted: G B 7.1.0-rc6 #1
Call Trace:
<TASK>
dump_stack_lvl+0x4e/0x70
print_report+0x157/0x4c9
kasan_report+0xce/0x100
kasan_check_range+0x10f/0x1e0
__asan_memcpy+0x23/0x60
kmemdup_noprof+0x36/0x50
decode_ntlmssp_challenge+0x457/0x680
SMB2_sess_auth_rawntlmssp_negotiate+0x6f0/0xcb0
SMB2_sess_setup+0x219/0x4f0
cifs_setup_session+0x248/0xaf0
cifs_get_smb_ses+0xf79/0x17e0
cifs_mount_get_session+0x7f/0x3a0
cifs_mount+0xb4/0xcf0
cifs_smb3_do_mount+0x23a/0x1500
smb3_get_tree+0x3b0/0x630
vfs_get_tree+0x82/0x2d0
fc_mount+0x10/0x1b0
path_mount+0x50d/0x1de0
__x64_sys_mount+0x20b/0x270
do_syscall_64+0xee/0x590
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 93:
kmem_cache_alloc_noprof+0x106/0x380
mempool_alloc_noprof+0x116/0x1e0
cifs_small_buf_get+0x31/0x80
allocate_buffers+0x10d/0x2b0
cifs_demultiplex_thread+0x1d5/0x1d50
kthread+0x2c6/0x390
ret_from_fork+0x36e/0x5a0
ret_from_fork_asm+0x1a/0x30
The buggy address is located 120 bytes inside of
allocated 448-byte region [ffff88800726c600, ffff88800726c7c0)
which belongs to the cache cifs_small_rq of size 448
Restrict the +1 exemption to responses that have no data area, so that
it still covers the bcc[0] omission it was meant for. When a data area
is present, the +1 discrepancy instead means the reported data length
overruns the received buffer, so the response must be rejected.
Fixes: 093b2bdad322 ("CIFS: Make demultiplex_thread work with SMB2 code")
Cc: stable@vger.kernel.org
Signed-off-by: Shoichiro Miyamoto <shoichiro.miyamoto@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2misc.c | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -30,6 +30,8 @@
#include "smb2glob.h"
#include "nterr.h"
+static unsigned int __smb2_calc_size(void *buf, bool *have_data);
+
static int
check_smb2_hdr(struct smb2_hdr *shdr, __u64 mid)
{
@@ -145,6 +147,7 @@ smb2_check_message(char *buf, unsigned i
int command;
__u32 calc_len; /* calculated length */
__u64 mid;
+ bool have_data;
/*
* Add function to do table lookup of StructureSize by command
@@ -225,7 +228,8 @@ smb2_check_message(char *buf, unsigned i
}
}
- calc_len = smb2_calc_size(buf);
+ have_data = false;
+ calc_len = __smb2_calc_size(buf, &have_data);
/* For SMB2_IOCTL, OutputOffset and OutputLength are optional, so might
* be 0, and not a real miscalculation */
@@ -243,8 +247,13 @@ smb2_check_message(char *buf, unsigned i
/* Windows 7 server returns 24 bytes more */
if (calc_len + 24 == len && command == SMB2_OPLOCK_BREAK_HE)
return 0;
- /* server can return one byte more due to implied bcc[0] */
- if (calc_len == len + 1)
+ /*
+ * Server can return one byte more due to implied bcc[0].
+ * Allow it only when there is no data area; if data_length > 0
+ * the +1 gap indicates an overreported data length rather than
+ * the bcc[0] omission.
+ */
+ if (calc_len == len + 1 && !have_data)
return 0;
/*
@@ -405,14 +414,17 @@ smb2_get_data_area_len(int *off, int *le
/*
* Calculate the size of the SMB message based on the fixed header
* portion, the number of word parameters and the data portion of the message.
+ * If have_data is non-NULL, it is set to true when a non-empty data area was
+ * found (data_length > 0), allowing callers to distinguish the implied bcc[0]
+ * case (no data area) from an overreported data length.
*/
-unsigned int
-smb2_calc_size(void *buf)
+static unsigned int
+__smb2_calc_size(void *buf, bool *have_data)
{
struct smb2_pdu *pdu = (struct smb2_pdu *)buf;
struct smb2_hdr *shdr = &pdu->hdr;
int offset; /* the offset from the beginning of SMB to data area */
- int data_length; /* the length of the variable length data area */
+ int data_length = 0; /* the length of the variable length data area */
/* Structure Size has already been checked to make sure it is 64 */
int len = le16_to_cpu(shdr->StructureSize);
@@ -445,9 +457,17 @@ smb2_calc_size(void *buf)
}
calc_size_exit:
cifs_dbg(FYI, "SMB2 len %d\n", len);
+ if (have_data)
+ *have_data = (data_length > 0);
return len;
}
+unsigned int
+smb2_calc_size(void *buf)
+{
+ return __smb2_calc_size(buf, NULL);
+}
+
/* Note: caller must free return buffer */
__le16 *
cifs_convert_path_to_utf16(const char *from, struct cifs_sb_info *cifs_sb)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 613/699] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (611 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 612/699] smb: client: restrict implied bcc[0] exemption to responses without data area Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 614/699] staging: rtl8723bs: split too long line Greg Kroah-Hartman
` (89 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Zhu, Manivannan Sadhasivam,
Bjorn Helgaas, Frank Li, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Zhu <hongxing.zhu@nxp.com>
[ Upstream commit aad953fb4eed0df5486cd54ccad80ac197678e01 ]
The IMX6SX_GPR12_PCIE_TEST_POWERDOWN bit does not control the PCIe
reference clock on i.MX6SX. Instead, it is part of i.MX6SX PCIe core
reset sequence.
Move the IMX6SX_GPR12_PCIE_TEST_POWERDOWN assertion/deassertion into
the core reset functions to properly reflect its purpose. Remove the
.enable_ref_clk() callback for i.MX6SX since it was incorrectly
manipulating this bit.
Fixes: e3c06cd063d6 ("PCI: imx6: Add initial imx6sx support")
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260319090844.444987-1-hongxing.zhu@nxp.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pci-imx6.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -428,9 +428,6 @@ static int imx6_pcie_enable_ref_clk(stru
dev_err(dev, "unable to enable pcie_axi clock\n");
break;
}
-
- regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR12,
- IMX6SX_GPR12_PCIE_TEST_POWERDOWN, 0);
break;
case IMX6QP:
case IMX6Q:
@@ -557,6 +554,8 @@ static void imx6_pcie_deassert_core_rese
imx7d_pcie_wait_for_phy_pll_lock(imx6_pcie);
break;
case IMX6SX:
+ regmap_clear_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR12,
+ IMX6SX_GPR12_PCIE_TEST_POWERDOWN);
regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR5,
IMX6SX_GPR5_PCIE_BTNRST_RESET, 0);
break;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 614/699] staging: rtl8723bs: split too long line
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (612 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 613/699] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 615/699] staging: rtl8723bs: remove commented out RT_ASSERT occurrences Greg Kroah-Hartman
` (88 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Aiuto, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <fabioaiuto83@gmail.com>
[ Upstream commit 98dc120895a9a669e35155ee03b98452723aba95 ]
fix the following post-commit hook checkpatch issue.
WARNING: line length of 103 exceeds 100 columns
30: FILE: drivers/staging/rtl8723bs/core/rtw_mlme_ext.c:711:
+
receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 0);
Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/4e87fb741205b9f314aec739921405a7ebef908a.1618480688.git.fabioaiuto83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -835,7 +835,8 @@ unsigned int OnBeacon(struct adapter *pa
ret = rtw_check_bcn_info(padapter, pframe, len);
if (!ret) {
DBG_871X_LEVEL(_drv_always_, "ap has changed, disconnect now\n ");
- receive_disconnect(padapter, pmlmeinfo->network.MacAddress, 0);
+ receive_disconnect(padapter,
+ pmlmeinfo->network.MacAddress, 0);
return _SUCCESS;
}
/* update WMM, ERP in the beacon */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 615/699] staging: rtl8723bs: remove commented out RT_ASSERT occurrences
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (613 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 614/699] staging: rtl8723bs: split too long line Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 616/699] staging: rtl8723bs: remove all 5Ghz network types Greg Kroah-Hartman
` (87 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Fabio Aiuto,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <fabioaiuto83@gmail.com>
[ Upstream commit 2172a6576388e63958f47923e435c46af8d006ba ]
remove commented out obsoete RT_ASSERT macro occurences.
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/3ee98d7bf1685af627e625f413de355fce58d52d.1619794331.git.fabioaiuto83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_recv.c | 2 --
drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c | 1 -
drivers/staging/rtl8723bs/hal/sdio_halinit.c | 5 -----
3 files changed, 8 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -2165,8 +2165,6 @@ int recv_indicatepkts_in_order(struct ad
/* pTS->RxIndicateState = RXTS_INDICATE_PROCESSING; */
/* Indicate packets */
- /* RT_ASSERT((index<=REORDER_WIN_SIZE), ("RxReorderIndicatePacket(): Rx Reorder buffer full!!\n")); */
-
/* indicate this recv_frame */
/* DbgPrint("recv_indicatepkts_in_order, indicate_seq =%d, seq_num =%d\n", precvpriv->indicate_seq, pattrib->seq_num); */
--- a/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
+++ b/drivers/staging/rtl8723bs/hal/rtl8723b_hal_init.c
@@ -158,7 +158,6 @@ static int _WriteFW(struct adapter *pada
u8 *bufferPtr = buffer;
pageNums = size / MAX_DLFW_PAGE_SIZE;
- /* RT_ASSERT((pageNums <= 4), ("Page numbers should not greater then 4\n")); */
remainSize = size % MAX_DLFW_PAGE_SIZE;
for (page = 0; page < pageNums; page++) {
--- a/drivers/staging/rtl8723bs/hal/sdio_halinit.c
+++ b/drivers/staging/rtl8723bs/hal/sdio_halinit.c
@@ -313,7 +313,6 @@ static void _InitNormalChipOneOutEpPrior
value = QUEUE_NORMAL;
break;
default:
- /* RT_ASSERT(false, ("Shall not reach here!\n")); */
break;
}
@@ -347,7 +346,6 @@ static void _InitNormalChipTwoOutEpPrior
valueLow = QUEUE_NORMAL;
break;
default:
- /* RT_ASSERT(false, ("Shall not reach here!\n")); */
break;
}
@@ -412,7 +410,6 @@ static void _InitQueuePriority(struct ad
_InitNormalChipThreeOutEpPriority(Adapter);
break;
default:
- /* RT_ASSERT(false, ("Shall not reach here!\n")); */
break;
}
@@ -603,7 +600,6 @@ static void _InitOperationMode(struct ad
regBwOpMode = BW_OPMODE_20MHZ;
break;
case WIRELESS_MODE_A:
-/* RT_ASSERT(false, ("Error wireless a mode\n")); */
break;
case WIRELESS_MODE_G:
regBwOpMode = BW_OPMODE_20MHZ;
@@ -617,7 +613,6 @@ static void _InitOperationMode(struct ad
regBwOpMode = BW_OPMODE_20MHZ;
break;
case WIRELESS_MODE_N_5G:
-/* RT_ASSERT(false, ("Error wireless mode")); */
regBwOpMode = BW_OPMODE_5G;
break;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 616/699] staging: rtl8723bs: remove all 5Ghz network types
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (614 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 615/699] staging: rtl8723bs: remove commented out RT_ASSERT occurrences Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 617/699] staging: rtl8723bs: remove 5Ghz code related to channel plan definition Greg Kroah-Hartman
` (86 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Fabio Aiuto,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <fabioaiuto83@gmail.com>
[ Upstream commit 708180a92cd8bff18b3d2ac05172815bcc0b6b9a ]
remove all 5Ghz network types. rtl8723bs works on
802.11bgn standards and on 2.4Ghz band.
So remove all code related to 802.11a and 802.11ac
standards, which the device doesn't support.
Acked-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/7e4644a71d0ba2819370171b3dc78bfc755f6313.1624367071.git.fabioaiuto83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_ap.c | 11 ----
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 22 +-------
drivers/staging/rtl8723bs/core/rtw_mlme.c | 10 ---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 55 ---------------------
drivers/staging/rtl8723bs/core/rtw_wlan_util.c | 14 +----
drivers/staging/rtl8723bs/hal/odm.c | 30 -----------
drivers/staging/rtl8723bs/hal/odm.h | 3 -
drivers/staging/rtl8723bs/hal/odm_EdcaTurboCheck.c | 4 -
drivers/staging/rtl8723bs/hal/sdio_halinit.c | 5 -
drivers/staging/rtl8723bs/include/hal_phy.h | 3 -
drivers/staging/rtl8723bs/include/ieee80211.h | 22 +-------
drivers/staging/rtl8723bs/include/wifi.h | 1
drivers/staging/rtl8723bs/os_dep/os_intfs.c | 2
13 files changed, 14 insertions(+), 168 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_ap.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
@@ -427,11 +427,7 @@ void add_RATid(struct adapter *padapter,
shortGIrate = query_ra_short_GI(psta);
if (pcur_network->Configuration.DSConfig > 14) {
- if (tx_ra_bitmap & 0xffff000)
- sta_band |= WIRELESS_11_5N;
-
- if (tx_ra_bitmap & 0xff0)
- sta_band |= WIRELESS_11A;
+ sta_band |= WIRELESS_INVALID;
} else {
if (tx_ra_bitmap & 0xffff000)
sta_band |= WIRELESS_11_24N;
@@ -503,7 +499,7 @@ void update_bmc_sta(struct adapter *pada
} else if (network_type == WIRELESS_INVALID) { /* error handling */
if (pcur_network->Configuration.DSConfig > 14)
- network_type = WIRELESS_11A;
+ network_type = WIRELESS_INVALID;
else
network_type = WIRELESS_11B;
}
@@ -1254,9 +1250,6 @@ int rtw_check_beacon_data(struct adapter
case WIRELESS_11BG_24N:
pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;
break;
- case WIRELESS_11A:
- pbss_network->NetworkTypeInUse = Ndis802_11OFDM5;
- break;
default:
pbss_network->NetworkTypeInUse = Ndis802_11OFDM24;
break;
--- a/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ieee80211.c
@@ -96,10 +96,7 @@ bool rtw_is_cckratesonly_included(u8 *ra
int rtw_check_network_type(unsigned char *rate, int ratelen, int channel)
{
if (channel > 14) {
- if (rtw_is_cckrates_included(rate))
- return WIRELESS_INVALID;
- else
- return WIRELESS_11A;
+ return WIRELESS_INVALID;
} else { /* could be pure B, pure G, or B/G */
if (rtw_is_cckratesonly_included(rate))
return WIRELESS_11B;
@@ -275,10 +272,6 @@ void rtw_set_supported_rate(u8 *Supporte
break;
case WIRELESS_11G:
- case WIRELESS_11A:
- case WIRELESS_11_5N:
- case WIRELESS_11A_5N:/* Todo: no basic rate for ofdm ? */
- case WIRELESS_11_5AC:
memcpy(SupportedRates, WIFI_OFDMRATES, IEEE80211_NUM_OFDM_RATESLEN);
break;
@@ -336,14 +329,7 @@ int rtw_generate_ie(struct registry_priv
ie = rtw_set_ie(ie, _SSID_IE_, pdev_network->Ssid.SsidLength, pdev_network->Ssid.Ssid, &sz);
/* supported rates */
- if (pregistrypriv->wireless_mode == WIRELESS_11ABGN) {
- if (pdev_network->Configuration.DSConfig > 14)
- wireless_mode = WIRELESS_11A_5N;
- else
- wireless_mode = WIRELESS_11BG_24N;
- } else {
- wireless_mode = pregistrypriv->wireless_mode;
- }
+ wireless_mode = pregistrypriv->wireless_mode;
rtw_set_supported_rate(pdev_network->SupportedRates, wireless_mode);
@@ -368,8 +354,8 @@ int rtw_generate_ie(struct registry_priv
}
/* HT Cap. */
- if (((pregistrypriv->wireless_mode&WIRELESS_11_5N) || (pregistrypriv->wireless_mode&WIRELESS_11_24N))
- && (pregistrypriv->ht_enable == true)) {
+ if ((pregistrypriv->wireless_mode & WIRELESS_11_24N) &&
+ (pregistrypriv->ht_enable == true)) {
/* todo: */
}
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -2438,16 +2438,6 @@ void rtw_update_registrypriv_dev_network
case WIRELESS_11BG_24N:
pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
break;
- case WIRELESS_11A:
- case WIRELESS_11A_5N:
- pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
- break;
- case WIRELESS_11ABGN:
- if (pregistrypriv->channel > 14)
- pdev_network->NetworkTypeInUse = (Ndis802_11OFDM5);
- else
- pdev_network->NetworkTypeInUse = (Ndis802_11OFDM24);
- break;
default:
/* TODO */
break;
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -4918,61 +4918,6 @@ static void process_80211d(struct adapte
}
}
- if (pregistrypriv->wireless_mode & WIRELESS_11A) {
- do {
- if ((i == MAX_CHANNEL_NUM) ||
- (chplan_sta[i].ChannelNum == 0))
- break;
-
- if ((j == chplan_ap.Len) || (chplan_ap.Channel[j] == 0))
- break;
-
- if (chplan_sta[i].ChannelNum == chplan_ap.Channel[j]) {
- chplan_new[k].ChannelNum = chplan_ap.Channel[j];
- chplan_new[k].ScanType = SCAN_ACTIVE;
- i++;
- j++;
- k++;
- } else if (chplan_sta[i].ChannelNum < chplan_ap.Channel[j]) {
- chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
-/* chplan_new[k].ScanType = chplan_sta[i].ScanType; */
- chplan_new[k].ScanType = SCAN_PASSIVE;
- i++;
- k++;
- } else if (chplan_sta[i].ChannelNum > chplan_ap.Channel[j]) {
- chplan_new[k].ChannelNum = chplan_ap.Channel[j];
- chplan_new[k].ScanType = SCAN_ACTIVE;
- j++;
- k++;
- }
- } while (1);
-
- /* change AP not support channel to Passive scan */
- while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
- chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
-/* chplan_new[k].ScanType = chplan_sta[i].ScanType; */
- chplan_new[k].ScanType = SCAN_PASSIVE;
- i++;
- k++;
- }
-
- /* add channel AP supported */
- while ((j < chplan_ap.Len) && (chplan_ap.Channel[j] != 0)) {
- chplan_new[k].ChannelNum = chplan_ap.Channel[j];
- chplan_new[k].ScanType = SCAN_ACTIVE;
- j++;
- k++;
- }
- } else {
- /* keep original STA 5G channel plan */
- while ((i < MAX_CHANNEL_NUM) && (chplan_sta[i].ChannelNum != 0)) {
- chplan_new[k].ChannelNum = chplan_sta[i].ChannelNum;
- chplan_new[k].ScanType = chplan_sta[i].ScanType;
- i++;
- k++;
- }
- }
-
pmlmeext->update_channel_plan_by_ap_done = 1;
#ifdef DEBUG_RTL871X
--- a/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
+++ b/drivers/staging/rtl8723bs/core/rtw_wlan_util.c
@@ -62,9 +62,6 @@ u8 networktype_to_raid_ex(struct adapter
if (cur_rf_type == RF_1T1R) {
rf_type = RF_1T1R;
- } else if (IsSupportedVHT(psta->wireless_mode)) {
- if (psta->ra_mask & 0xffc00000)
- rf_type = RF_2T2R;
} else if (IsSupportedHT(psta->wireless_mode)) {
if (psta->ra_mask & 0xfff00000)
rf_type = RF_2T2R;
@@ -74,7 +71,6 @@ u8 networktype_to_raid_ex(struct adapter
case WIRELESS_11B:
raid = RATEID_IDX_B;
break;
- case WIRELESS_11A:
case WIRELESS_11G:
raid = RATEID_IDX_G;
break;
@@ -82,8 +78,6 @@ u8 networktype_to_raid_ex(struct adapter
raid = RATEID_IDX_BG;
break;
case WIRELESS_11_24N:
- case WIRELESS_11_5N:
- case WIRELESS_11A_5N:
case WIRELESS_11G_24N:
if (rf_type == RF_2T2R)
raid = RATEID_IDX_GN_N2SS;
@@ -810,7 +804,7 @@ void WMMOnAssocRsp(struct adapter *padap
AIFS = aSifsTime + (2 * pmlmeinfo->slotTime);
- if (pmlmeext->cur_wireless_mode & (WIRELESS_11G | WIRELESS_11A)) {
+ if (pmlmeext->cur_wireless_mode & WIRELESS_11G) {
ECWMin = 4;
ECWMax = 10;
} else if (pmlmeext->cur_wireless_mode & WIRELESS_11B) {
@@ -1695,7 +1689,7 @@ void update_capinfo(struct adapter *Adap
pmlmeinfo->slotTime = NON_SHORT_SLOT_TIME;
else {
/* Filen: See 802.11-2007 p.90 */
- if (pmlmeext->cur_wireless_mode & (WIRELESS_11_24N | WIRELESS_11A | WIRELESS_11_5N | WIRELESS_11AC))
+ if (pmlmeext->cur_wireless_mode & (WIRELESS_11_24N))
pmlmeinfo->slotTime = SHORT_SLOT_TIME;
else if (pmlmeext->cur_wireless_mode & (WIRELESS_11G)) {
if ((updateCap & cShortSlotTime) /* && (!(pMgntInfo->pHTInfo->RT2RT_HT_Mode & RT_HT_CAP_USE_LONG_PREAMBLE)) */)
@@ -1724,9 +1718,7 @@ void update_wireless_mode(struct adapter
if ((pmlmeinfo->HT_info_enable) && (pmlmeinfo->HT_caps_enable))
pmlmeinfo->HT_enable = 1;
- if (pmlmeinfo->VHT_enable)
- network_type = WIRELESS_11AC;
- else if (pmlmeinfo->HT_enable)
+ if (pmlmeinfo->HT_enable)
network_type = WIRELESS_11_24N;
if (rtw_is_cckratesonly_included(rate))
--- a/drivers/staging/rtl8723bs/hal/odm.c
+++ b/drivers/staging/rtl8723bs/hal/odm.c
@@ -975,7 +975,6 @@ u32 ODM_Get_Rate_Bitmap(
break;
case (ODM_WM_G):
- case (ODM_WM_A):
if (rssi_level == DM_RATR_STA_HIGH)
rate_bitmap = 0x00000f00;
else
@@ -994,7 +993,6 @@ u32 ODM_Get_Rate_Bitmap(
case (ODM_WM_B|ODM_WM_G|ODM_WM_N24G):
case (ODM_WM_B|ODM_WM_N24G):
case (ODM_WM_G|ODM_WM_N24G):
- case (ODM_WM_A|ODM_WM_N5G):
if (pDM_Odm->RFType == ODM_1T2R || pDM_Odm->RFType == ODM_1T1R) {
if (rssi_level == DM_RATR_STA_HIGH)
rate_bitmap = 0x000f0000;
@@ -1020,34 +1018,6 @@ u32 ODM_Get_Rate_Bitmap(
}
break;
- case (ODM_WM_AC|ODM_WM_G):
- if (rssi_level == 1)
- rate_bitmap = 0xfc3f0000;
- else if (rssi_level == 2)
- rate_bitmap = 0xfffff000;
- else
- rate_bitmap = 0xffffffff;
- break;
-
- case (ODM_WM_AC|ODM_WM_A):
-
- if (pDM_Odm->RFType == RF_1T1R) {
- if (rssi_level == 1) /* add by Gary for ac-series */
- rate_bitmap = 0x003f8000;
- else if (rssi_level == 2)
- rate_bitmap = 0x003ff000;
- else
- rate_bitmap = 0x003ff010;
- } else {
- if (rssi_level == 1) /* add by Gary for ac-series */
- rate_bitmap = 0xfe3f8000; /* VHT 2SS MCS3~9 */
- else if (rssi_level == 2)
- rate_bitmap = 0xfffff000; /* VHT 2SS MCS0~9 */
- else
- rate_bitmap = 0xfffff010; /* All */
- }
- break;
-
default:
if (pDM_Odm->RFType == RF_1T2R)
rate_bitmap = 0x000fffff;
--- a/drivers/staging/rtl8723bs/hal/odm.h
+++ b/drivers/staging/rtl8723bs/hal/odm.h
@@ -541,11 +541,8 @@ typedef enum tag_Wireless_Mode_Definitio
ODM_WM_UNKNOWN = 0x0,
ODM_WM_B = BIT0,
ODM_WM_G = BIT1,
- ODM_WM_A = BIT2,
ODM_WM_N24G = BIT3,
- ODM_WM_N5G = BIT4,
ODM_WM_AUTO = BIT5,
- ODM_WM_AC = BIT6,
} ODM_WIRELESS_MODE_E;
/* ODM_CMNINFO_BAND */
--- a/drivers/staging/rtl8723bs/hal/odm_EdcaTurboCheck.c
+++ b/drivers/staging/rtl8723bs/hal/odm_EdcaTurboCheck.c
@@ -142,12 +142,10 @@ void odm_EdcaTurboCheckCE(void *pDM_VOID
} else if ((iot_peer == HT_IOT_PEER_CISCO) &&
((wirelessmode == ODM_WM_G) ||
(wirelessmode == (ODM_WM_B | ODM_WM_G)) ||
- (wirelessmode == ODM_WM_A) ||
(wirelessmode == ODM_WM_B))) {
EDCA_BE_DL = edca_setting_DL_GMode[iot_peer];
} else if ((iot_peer == HT_IOT_PEER_AIRGO) &&
- ((wirelessmode == ODM_WM_G) ||
- (wirelessmode == ODM_WM_A))) {
+ (wirelessmode == ODM_WM_G)) {
EDCA_BE_DL = 0xa630;
} else if (iot_peer == HT_IOT_PEER_MARVELL) {
EDCA_BE_DL = edca_setting_DL[iot_peer];
--- a/drivers/staging/rtl8723bs/hal/sdio_halinit.c
+++ b/drivers/staging/rtl8723bs/hal/sdio_halinit.c
@@ -599,8 +599,6 @@ static void _InitOperationMode(struct ad
case WIRELESS_MODE_B:
regBwOpMode = BW_OPMODE_20MHZ;
break;
- case WIRELESS_MODE_A:
- break;
case WIRELESS_MODE_G:
regBwOpMode = BW_OPMODE_20MHZ;
break;
@@ -612,9 +610,6 @@ static void _InitOperationMode(struct ad
/* CCK rate will be filtered out only when associated AP does not support it. */
regBwOpMode = BW_OPMODE_20MHZ;
break;
- case WIRELESS_MODE_N_5G:
- regBwOpMode = BW_OPMODE_5G;
- break;
default: /* for MacOSX compiler warning. */
break;
--- a/drivers/staging/rtl8723bs/include/hal_phy.h
+++ b/drivers/staging/rtl8723bs/include/hal_phy.h
@@ -118,13 +118,10 @@ enum HW_BLOCK {
enum WIRELESS_MODE {
WIRELESS_MODE_UNKNOWN = 0x00,
- WIRELESS_MODE_A = 0x01,
WIRELESS_MODE_B = 0x02,
WIRELESS_MODE_G = 0x04,
WIRELESS_MODE_AUTO = 0x08,
WIRELESS_MODE_N_24G = 0x10,
- WIRELESS_MODE_N_5G = 0x20,
- WIRELESS_MODE_AC_5G = 0x40,
WIRELESS_MODE_AC_24G = 0x80,
WIRELESS_MODE_AC_ONLY = 0x100,
};
--- a/drivers/staging/rtl8723bs/include/ieee80211.h
+++ b/drivers/staging/rtl8723bs/include/ieee80211.h
@@ -157,33 +157,20 @@ enum NETWORK_TYPE {
/* Sub-Element */
WIRELESS_11B = BIT(0), /* tx: cck only , rx: cck only, hw: cck */
WIRELESS_11G = BIT(1), /* tx: ofdm only, rx: ofdm & cck, hw: cck & ofdm */
- WIRELESS_11A = BIT(2), /* tx: ofdm only, rx: ofdm only, hw: ofdm only */
WIRELESS_11_24N = BIT(3), /* tx: MCS only, rx: MCS & cck, hw: MCS & cck */
- WIRELESS_11_5N = BIT(4), /* tx: MCS only, rx: MCS & ofdm, hw: ofdm only */
WIRELESS_AUTO = BIT(5),
- WIRELESS_11AC = BIT(6),
/* Combination */
/* Type for current wireless mode */
WIRELESS_11BG = (WIRELESS_11B|WIRELESS_11G), /* tx: cck & ofdm, rx: cck & ofdm & MCS, hw: cck & ofdm */
WIRELESS_11G_24N = (WIRELESS_11G|WIRELESS_11_24N), /* tx: ofdm & MCS, rx: ofdm & cck & MCS, hw: cck & ofdm */
- WIRELESS_11A_5N = (WIRELESS_11A|WIRELESS_11_5N), /* tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only */
WIRELESS_11B_24N = (WIRELESS_11B|WIRELESS_11_24N), /* tx: ofdm & cck & MCS, rx: ofdm & cck & MCS, hw: ofdm & cck */
WIRELESS_11BG_24N = (WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N), /* tx: ofdm & cck & MCS, rx: ofdm & cck & MCS, hw: ofdm & cck */
- WIRELESS_11_24AC = (WIRELESS_11G|WIRELESS_11AC),
- WIRELESS_11_5AC = (WIRELESS_11A|WIRELESS_11AC),
-
-
- /* Type for registry default wireless mode */
- WIRELESS_11AGN = (WIRELESS_11A|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N), /* tx: ofdm & MCS, rx: ofdm & MCS, hw: ofdm only */
- WIRELESS_11ABGN = (WIRELESS_11A|WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N),
- WIRELESS_MODE_24G = (WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11AC),
- WIRELESS_MODE_MAX = (WIRELESS_11A|WIRELESS_11B|WIRELESS_11G|WIRELESS_11_24N|WIRELESS_11_5N|WIRELESS_11AC),
};
#define SUPPORTED_24G_NETTYPE_MSK (WIRELESS_11B | WIRELESS_11G | WIRELESS_11_24N)
-#define IsLegacyOnly(NetType) ((NetType) == ((NetType) & (WIRELESS_11BG|WIRELESS_11A)))
+#define IsLegacyOnly(NetType) ((NetType) == ((NetType) & (WIRELESS_11BG)))
#define IsSupported24G(NetType) ((NetType) & SUPPORTED_24G_NETTYPE_MSK ? true : false)
@@ -195,11 +182,8 @@ enum NETWORK_TYPE {
#define IsSupportedRxHT(NetType) IsEnableHWOFDM(NetType)
#define IsSupportedTxCCK(NetType) (((NetType) & (WIRELESS_11B)) ? true : false)
-#define IsSupportedTxOFDM(NetType) (((NetType) & (WIRELESS_11G|WIRELESS_11A)) ? true : false)
-#define IsSupportedHT(NetType) (((NetType) & (WIRELESS_11_24N|WIRELESS_11_5N)) ? true : false)
-
-#define IsSupportedVHT(NetType) (((NetType) & (WIRELESS_11AC)) ? true : false)
-
+#define IsSupportedTxOFDM(NetType) (((NetType) & (WIRELESS_11G) ? true : false)
+#define IsSupportedHT(NetType) (((NetType) & (WIRELESS_11_24N)) ? true : false)
struct ieee_param {
u32 cmd;
--- a/drivers/staging/rtl8723bs/include/wifi.h
+++ b/drivers/staging/rtl8723bs/include/wifi.h
@@ -457,7 +457,6 @@ static inline int IsFrameTypeCtrl(unsign
#define _PRE_ALLOCICVHDR_ 5
#define _PRE_ALLOCMICHDR_ 6
-#define _SIFSTIME_ ((priv->pmib->dot11BssType.net_work_type&WIRELESS_11A)?16:10)
#define _ACKCTSLNG_ 14 /* 14 bytes long, including crclng */
#define _CRCLNG_ 4
--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
@@ -24,7 +24,7 @@ static int rtw_lbkmode;/* RTL8712_AIR_TR
static int rtw_network_mode = Ndis802_11IBSS;/* Ndis802_11Infrastructure;infra, ad-hoc, auto */
/* struct ndis_802_11_ssid ssid; */
static int rtw_channel = 1;/* ad-hoc support requirement */
-static int rtw_wireless_mode = WIRELESS_MODE_MAX;
+static int rtw_wireless_mode = WIRELESS_11BG_24N;
static int rtw_vrtl_carrier_sense = AUTO_VCS;
static int rtw_vcs_type = RTS_CTS;/* */
static int rtw_rts_thresh = 2347;/* */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 617/699] staging: rtl8723bs: remove 5Ghz code related to channel plan definition
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (615 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 616/699] staging: rtl8723bs: remove all 5Ghz network types Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 618/699] staging: rtl8723bs: remove 5Ghz code blocks Greg Kroah-Hartman
` (85 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Fabio Aiuto,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <fabioaiuto83@gmail.com>
[ Upstream commit ec84d0ae54a6774091b3b7d1e9da32589f48b2f9 ]
remove 5Ghz code related to channel plan definition.
Acked-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/17a707952cec951893748d2cb59d02a294cdd1be.1624367071.git.fabioaiuto83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 210 +++++++++-------------
drivers/staging/rtl8723bs/hal/hal_com_phycfg.c | 34 ---
drivers/staging/rtl8723bs/include/rtw_mlme_ext.h | 6
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 2
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 1
5 files changed, 94 insertions(+), 159 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -123,93 +123,93 @@ static RT_CHANNEL_PLAN_5G RTW_ChannelPla
static RT_CHANNEL_PLAN_MAP RTW_ChannelPlanMap[RT_CHANNEL_DOMAIN_MAX] = {
/* 0x00 ~ 0x1F , Old Define ===== */
- {0x02, 0x20}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
- {0x02, 0x0A}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
- {0x01, 0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
- {0x01, 0x00}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
- {0x01, 0x00}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
- {0x03, 0x00}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
- {0x03, 0x00}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
- {0x01, 0x09}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
- {0x03, 0x09}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
- {0x03, 0x00}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
- {0x00, 0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
- {0x02, 0x0F}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
- {0x01, 0x08}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
- {0x02, 0x06}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
- {0x02, 0x0B}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
- {0x02, 0x09}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
- {0x01, 0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
- {0x02, 0x05}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
- {0x01, 0x21}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
- {0x00, 0x04}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
- {0x02, 0x10}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
- {0x00, 0x21}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
- {0x00, 0x22}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
- {0x03, 0x21}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
- {0x06, 0x08}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
- {0x02, 0x08}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
- {0x00, 0x00}, /* 0x1A, */
- {0x00, 0x00}, /* 0x1B, */
- {0x00, 0x00}, /* 0x1C, */
- {0x00, 0x00}, /* 0x1D, */
- {0x00, 0x00}, /* 0x1E, */
- {0x06, 0x04}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
+ {0x02}, /* 0x00, RT_CHANNEL_DOMAIN_FCC */
+ {0x02}, /* 0x01, RT_CHANNEL_DOMAIN_IC */
+ {0x01}, /* 0x02, RT_CHANNEL_DOMAIN_ETSI */
+ {0x01}, /* 0x03, RT_CHANNEL_DOMAIN_SPAIN */
+ {0x01}, /* 0x04, RT_CHANNEL_DOMAIN_FRANCE */
+ {0x03}, /* 0x05, RT_CHANNEL_DOMAIN_MKK */
+ {0x03}, /* 0x06, RT_CHANNEL_DOMAIN_MKK1 */
+ {0x01}, /* 0x07, RT_CHANNEL_DOMAIN_ISRAEL */
+ {0x03}, /* 0x08, RT_CHANNEL_DOMAIN_TELEC */
+ {0x03}, /* 0x09, RT_CHANNEL_DOMAIN_GLOBAL_DOAMIN */
+ {0x00}, /* 0x0A, RT_CHANNEL_DOMAIN_WORLD_WIDE_13 */
+ {0x02}, /* 0x0B, RT_CHANNEL_DOMAIN_TAIWAN */
+ {0x01}, /* 0x0C, RT_CHANNEL_DOMAIN_CHINA */
+ {0x02}, /* 0x0D, RT_CHANNEL_DOMAIN_SINGAPORE_INDIA_MEXICO */
+ {0x02}, /* 0x0E, RT_CHANNEL_DOMAIN_KOREA */
+ {0x02}, /* 0x0F, RT_CHANNEL_DOMAIN_TURKEY */
+ {0x01}, /* 0x10, RT_CHANNEL_DOMAIN_JAPAN */
+ {0x02}, /* 0x11, RT_CHANNEL_DOMAIN_FCC_NO_DFS */
+ {0x01}, /* 0x12, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
+ {0x00}, /* 0x13, RT_CHANNEL_DOMAIN_WORLD_WIDE_5G */
+ {0x02}, /* 0x14, RT_CHANNEL_DOMAIN_TAIWAN_NO_DFS */
+ {0x00}, /* 0x15, RT_CHANNEL_DOMAIN_ETSI_NO_DFS */
+ {0x00}, /* 0x16, RT_CHANNEL_DOMAIN_KOREA_NO_DFS */
+ {0x03}, /* 0x17, RT_CHANNEL_DOMAIN_JAPAN_NO_DFS */
+ {0x06}, /* 0x18, RT_CHANNEL_DOMAIN_PAKISTAN_NO_DFS */
+ {0x02}, /* 0x19, RT_CHANNEL_DOMAIN_TAIWAN2_NO_DFS */
+ {0x00}, /* 0x1A, */
+ {0x00}, /* 0x1B, */
+ {0x00}, /* 0x1C, */
+ {0x00}, /* 0x1D, */
+ {0x00}, /* 0x1E, */
+ {0x06}, /* 0x1F, RT_CHANNEL_DOMAIN_WORLD_WIDE_ONLY_5G */
/* 0x20 ~ 0x7F , New Define ===== */
- {0x00, 0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
- {0x01, 0x00}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
- {0x02, 0x00}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
- {0x03, 0x00}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
- {0x04, 0x00}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
- {0x02, 0x04}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
- {0x00, 0x01}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
- {0x03, 0x0C}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
- {0x00, 0x0B}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
- {0x00, 0x05}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
- {0x00, 0x00}, /* 0x2A, */
- {0x00, 0x00}, /* 0x2B, */
- {0x00, 0x00}, /* 0x2C, */
- {0x00, 0x00}, /* 0x2D, */
- {0x00, 0x00}, /* 0x2E, */
- {0x00, 0x00}, /* 0x2F, */
- {0x00, 0x06}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
- {0x00, 0x07}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
- {0x00, 0x08}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
- {0x00, 0x09}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
- {0x02, 0x0A}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
- {0x00, 0x02}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
- {0x00, 0x03}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
- {0x03, 0x0D}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
- {0x03, 0x0E}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
- {0x02, 0x0F}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
- {0x00, 0x00}, /* 0x3A, */
- {0x00, 0x00}, /* 0x3B, */
- {0x00, 0x00}, /* 0x3C, */
- {0x00, 0x00}, /* 0x3D, */
- {0x00, 0x00}, /* 0x3E, */
- {0x00, 0x00}, /* 0x3F, */
- {0x02, 0x10}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
- {0x05, 0x00}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */
- {0x01, 0x12}, /* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */
- {0x02, 0x05}, /* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */
- {0x02, 0x11}, /* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */
- {0x00, 0x13}, /* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */
- {0x02, 0x14}, /* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */
- {0x00, 0x15}, /* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */
- {0x00, 0x16}, /* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */
- {0x00, 0x17}, /* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */
- {0x00, 0x18}, /* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */
- {0x00, 0x19}, /* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */
- {0x00, 0x1A}, /* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */
- {0x02, 0x1B}, /* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */
- {0x00, 0x1C}, /* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */
- {0x02, 0x1D}, /* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */
- {0x00, 0x1E}, /* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */
- {0x02, 0x1F}, /* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */
+ {0x00}, /* 0x20, RT_CHANNEL_DOMAIN_WORLD_NULL */
+ {0x01}, /* 0x21, RT_CHANNEL_DOMAIN_ETSI1_NULL */
+ {0x02}, /* 0x22, RT_CHANNEL_DOMAIN_FCC1_NULL */
+ {0x03}, /* 0x23, RT_CHANNEL_DOMAIN_MKK1_NULL */
+ {0x04}, /* 0x24, RT_CHANNEL_DOMAIN_ETSI2_NULL */
+ {0x02}, /* 0x25, RT_CHANNEL_DOMAIN_FCC1_FCC1 */
+ {0x00}, /* 0x26, RT_CHANNEL_DOMAIN_WORLD_ETSI1 */
+ {0x03}, /* 0x27, RT_CHANNEL_DOMAIN_MKK1_MKK1 */
+ {0x00}, /* 0x28, RT_CHANNEL_DOMAIN_WORLD_KCC1 */
+ {0x00}, /* 0x29, RT_CHANNEL_DOMAIN_WORLD_FCC2 */
+ {0x00}, /* 0x2A, */
+ {0x00}, /* 0x2B, */
+ {0x00}, /* 0x2C, */
+ {0x00}, /* 0x2D, */
+ {0x00}, /* 0x2E, */
+ {0x00}, /* 0x2F, */
+ {0x00}, /* 0x30, RT_CHANNEL_DOMAIN_WORLD_FCC3 */
+ {0x00}, /* 0x31, RT_CHANNEL_DOMAIN_WORLD_FCC4 */
+ {0x00}, /* 0x32, RT_CHANNEL_DOMAIN_WORLD_FCC5 */
+ {0x00}, /* 0x33, RT_CHANNEL_DOMAIN_WORLD_FCC6 */
+ {0x02}, /* 0x34, RT_CHANNEL_DOMAIN_FCC1_FCC7 */
+ {0x00}, /* 0x35, RT_CHANNEL_DOMAIN_WORLD_ETSI2 */
+ {0x00}, /* 0x36, RT_CHANNEL_DOMAIN_WORLD_ETSI3 */
+ {0x03}, /* 0x37, RT_CHANNEL_DOMAIN_MKK1_MKK2 */
+ {0x03}, /* 0x38, RT_CHANNEL_DOMAIN_MKK1_MKK3 */
+ {0x02}, /* 0x39, RT_CHANNEL_DOMAIN_FCC1_NCC1 */
+ {0x00}, /* 0x3A, */
+ {0x00}, /* 0x3B, */
+ {0x00}, /* 0x3C, */
+ {0x00}, /* 0x3D, */
+ {0x00}, /* 0x3E, */
+ {0x00}, /* 0x3F, */
+ {0x02}, /* 0x40, RT_CHANNEL_DOMAIN_FCC1_NCC2 */
+ {0x05}, /* 0x41, RT_CHANNEL_DOMAIN_GLOBAL_NULL */
+ {0x01}, /* 0x42, RT_CHANNEL_DOMAIN_ETSI1_ETSI4 */
+ {0x02}, /* 0x43, RT_CHANNEL_DOMAIN_FCC1_FCC2 */
+ {0x02}, /* 0x44, RT_CHANNEL_DOMAIN_FCC1_NCC3 */
+ {0x00}, /* 0x45, RT_CHANNEL_DOMAIN_WORLD_ETSI5 */
+ {0x02}, /* 0x46, RT_CHANNEL_DOMAIN_FCC1_FCC8 */
+ {0x00}, /* 0x47, RT_CHANNEL_DOMAIN_WORLD_ETSI6 */
+ {0x00}, /* 0x48, RT_CHANNEL_DOMAIN_WORLD_ETSI7 */
+ {0x00}, /* 0x49, RT_CHANNEL_DOMAIN_WORLD_ETSI8 */
+ {0x00}, /* 0x50, RT_CHANNEL_DOMAIN_WORLD_ETSI9 */
+ {0x00}, /* 0x51, RT_CHANNEL_DOMAIN_WORLD_ETSI10 */
+ {0x00}, /* 0x52, RT_CHANNEL_DOMAIN_WORLD_ETSI11 */
+ {0x02}, /* 0x53, RT_CHANNEL_DOMAIN_FCC1_NCC4 */
+ {0x00}, /* 0x54, RT_CHANNEL_DOMAIN_WORLD_ETSI12 */
+ {0x02}, /* 0x55, RT_CHANNEL_DOMAIN_FCC1_FCC9 */
+ {0x00}, /* 0x56, RT_CHANNEL_DOMAIN_WORLD_ETSI13 */
+ {0x02}, /* 0x57, RT_CHANNEL_DOMAIN_FCC1_FCC10 */
};
/* use the combination for max channel numbers */
-static RT_CHANNEL_PLAN_MAP RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03, 0x02};
+static RT_CHANNEL_PLAN_MAP RTW_CHANNEL_PLAN_MAP_REALTEK_DEFINE = {0x03};
/* Search the @param ch in given @param ch_set
* @ch_set: the given channel set
@@ -231,23 +231,6 @@ int rtw_ch_set_search_ch(RT_CHANNEL_INFO
return i;
}
-/* Check the @param ch is fit with setband setting of @param adapter
- * @adapter: the given adapter
- * @ch: the given channel number
- *
- * return true when check valid, false not valid
- */
-bool rtw_mlme_band_check(struct adapter *adapter, const u32 ch)
-{
- if (adapter->setband == GHZ24_50 /* 2.4G and 5G */
- || (adapter->setband == GHZ_24 && ch < 35) /* 2.4G only */
- || (adapter->setband == GHZ_50 && ch > 35) /* 5G only */
- ) {
- return true;
- }
- return false;
-}
-
/****************************************************************************
Following are the initialization functions for WiFi MLME
@@ -424,7 +407,6 @@ static u8 init_channel_set(struct adapte
else if ((channel_set[chanset_size].ChannelNum >= 12 && channel_set[chanset_size].ChannelNum <= 14))
channel_set[chanset_size].ScanType = SCAN_PASSIVE;
} else if (RT_CHANNEL_DOMAIN_WORLD_WIDE_13 == ChannelPlan ||
- RT_CHANNEL_DOMAIN_WORLD_WIDE_5G == ChannelPlan ||
RT_CHANNEL_DOMAIN_2G_WORLD == Index2G) { /* channel 12~13, passive scan */
if (channel_set[chanset_size].ChannelNum <= 11)
channel_set[chanset_size].ScanType = SCAN_ACTIVE;
@@ -4938,10 +4920,6 @@ static void process_80211d(struct adapte
while ((i < MAX_CHANNEL_NUM) && (chplan_new[i].ChannelNum != 0)) {
if (chplan_new[i].ChannelNum == channel) {
if (chplan_new[i].ScanType == SCAN_PASSIVE) {
- /* 5G Bnad 2, 3 (DFS) doesn't change to active scan */
- if (channel >= 52 && channel <= 144)
- break;
-
chplan_new[i].ScanType = SCAN_ACTIVE;
RT_TRACE(_module_rtl871x_mlme_c_, _drv_notice_,
("%s: change channel %d scan type from passive to active\n",
@@ -6250,7 +6228,6 @@ static int rtw_scan_ch_decision(struct a
set_idx = rtw_ch_set_search_ch(pmlmeext->channel_set, in[i].hw_value);
if (in[i].hw_value && !(in[i].flags & RTW_IEEE80211_CHAN_DISABLED)
&& set_idx >= 0
- && rtw_mlme_band_check(padapter, in[i].hw_value)
) {
if (j >= out_num) {
DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
@@ -6275,21 +6252,18 @@ static int rtw_scan_ch_decision(struct a
DBG_871X(FUNC_ADPT_FMT" ch:%u\n", FUNC_ADPT_ARG(padapter), pmlmeext->channel_set[i].ChannelNum);
- if (rtw_mlme_band_check(padapter, pmlmeext->channel_set[i].ChannelNum)) {
-
- if (j >= out_num) {
- DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
- FUNC_ADPT_ARG(padapter), out_num);
- break;
- }
+ if (j >= out_num) {
+ DBG_871X_LEVEL(_drv_always_, FUNC_ADPT_FMT" out_num:%u not enough\n",
+ FUNC_ADPT_ARG(padapter), out_num);
+ break;
+ }
- out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;
+ out[j].hw_value = pmlmeext->channel_set[i].ChannelNum;
- if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
- out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
+ if (pmlmeext->channel_set[i].ScanType == SCAN_PASSIVE)
+ out[j].flags |= RTW_IEEE80211_CHAN_PASSIVE_SCAN;
- j++;
- }
+ j++;
}
}
--- a/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
+++ b/drivers/staging/rtl8723bs/hal/hal_com_phycfg.c
@@ -2062,139 +2062,105 @@ void Hal_ChannelPlanToRegulation(struct
break;
case RT_CHANNEL_DOMAIN_FCC1_FCC1:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI1:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_MKK1_MKK1:
pHalData->Regulation2_4G = TXPWR_LMT_MKK;
- pHalData->Regulation5G = TXPWR_LMT_MKK;
break;
case RT_CHANNEL_DOMAIN_WORLD_KCC1:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_MKK;
break;
case RT_CHANNEL_DOMAIN_WORLD_FCC2:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_FCC3:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_FCC4:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_FCC5:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_FCC6:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_FCC1_FCC7:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI2:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI3:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_MKK1_MKK2:
pHalData->Regulation2_4G = TXPWR_LMT_MKK;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_MKK1_MKK3:
pHalData->Regulation2_4G = TXPWR_LMT_MKK;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_FCC1_NCC1:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_FCC1_NCC2:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_GLOBAL_NULL:
pHalData->Regulation2_4G = TXPWR_LMT_WW;
- pHalData->Regulation5G = TXPWR_LMT_WW;
break;
case RT_CHANNEL_DOMAIN_ETSI1_ETSI4:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_FCC1_FCC2:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_FCC1_NCC3:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI5:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_FCC1_FCC8:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI6:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI7:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI8:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI9:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI10:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI11:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_FCC1_NCC4:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI12:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_FCC1_FCC9:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_WORLD_ETSI13:
pHalData->Regulation2_4G = TXPWR_LMT_ETSI;
- pHalData->Regulation5G = TXPWR_LMT_ETSI;
break;
case RT_CHANNEL_DOMAIN_FCC1_FCC10:
pHalData->Regulation2_4G = TXPWR_LMT_FCC;
- pHalData->Regulation5G = TXPWR_LMT_FCC;
break;
case RT_CHANNEL_DOMAIN_REALTEK_DEFINE: /* Realtek Reserve */
pHalData->Regulation2_4G = TXPWR_LMT_WW;
- pHalData->Regulation5G = TXPWR_LMT_WW;
break;
default:
break;
--- a/drivers/staging/rtl8723bs/include/rtw_mlme_ext.h
+++ b/drivers/staging/rtl8723bs/include/rtw_mlme_ext.h
@@ -255,7 +255,6 @@ typedef struct _RT_CHANNEL_PLAN_5G {
typedef struct _RT_CHANNEL_PLAN_MAP {
unsigned char Index2G;
- unsigned char Index5G;
} RT_CHANNEL_PLAN_MAP, *PRT_CHANNEL_PLAN_MAP;
enum Associated_AP {
@@ -360,13 +359,13 @@ struct FW_Sta_Info {
* When the driver scanned RTW_SCAN_NUM_OF_CH channels, it would switch back to AP's operating channel for
* RTW_STAY_AP_CH_MILLISECOND * SURVEY_TO milliseconds.
* Example:
- * For chip supports 2.4G + 5GHz and AP mode is operating in channel 1,
+ * For chip supports 2.4G and AP mode is operating in channel 1,
* RTW_SCAN_NUM_OF_CH is 8, RTW_STAY_AP_CH_MILLISECOND is 3 and SURVEY_TO is 100.
* When it's STA mode gets set_scan command,
* it would
* 1. Doing the scan on channel 1.2.3.4.5.6.7.8
* 2. Back to channel 1 for 300 milliseconds
- * 3. Go through doing site survey on channel 9.10.11.36.40.44.48.52
+ * 3. Go through doing site survey on channel 9.10.11
* 4. Back to channel 1 for 300 milliseconds
* 5. ... and so on, till survey done.
*/
@@ -423,7 +422,6 @@ typedef struct _RT_CHANNEL_INFO {
} RT_CHANNEL_INFO, *PRT_CHANNEL_INFO;
int rtw_ch_set_search_ch(RT_CHANNEL_INFO *ch_set, const u32 ch);
-bool rtw_mlme_band_check(struct adapter *adapter, const u32 ch);
/* P2P_MAX_REG_CLASSES - Maximum number of regulatory classes */
#define P2P_MAX_REG_CLASSES 10
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -77,7 +77,6 @@ static struct ieee80211_rate rtw_rates[]
#define RTW_G_RATES_NUM 12
#define RTW_2G_CHANNELS_NUM 14
-#define RTW_5G_CHANNELS_NUM 37
static struct ieee80211_channel rtw_2ghz_channels[] = {
CHAN2G(1, 2412, 0),
@@ -1422,7 +1421,6 @@ void rtw_cfg80211_surveydone_event_callb
/* report network only if the current channel set contains the channel to which this network belongs */
if (rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >= 0
- && rtw_mlme_band_check(padapter, pnetwork->network.Configuration.DSConfig) == true
&& true == rtw_validate_ssid(&(pnetwork->network.Ssid))
)
{
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -1462,7 +1462,6 @@ static int rtw_wx_get_scan(struct net_de
/* report network only if the current channel set contains the channel to which this network belongs */
if (rtw_ch_set_search_ch(padapter->mlmeextpriv.channel_set, pnetwork->network.Configuration.DSConfig) >= 0
- && rtw_mlme_band_check(padapter, pnetwork->network.Configuration.DSConfig) == true
&& true == rtw_validate_ssid(&(pnetwork->network.Ssid))) {
ev = translate_scan(padapter, a, pnetwork, ev, stop);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 618/699] staging: rtl8723bs: remove 5Ghz code blocks
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (616 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 617/699] staging: rtl8723bs: remove 5Ghz code related to channel plan definition Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 619/699] staging: rtl8723bs: remove commented out condition Greg Kroah-Hartman
` (84 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Aiuto, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <fabioaiuto83@gmail.com>
[ Upstream commit ddd7c8b0033ba01a0ee605697f12a33fd31e6fca ]
remove 5 Ghz code blocks, related to networks
working over channel numbers above 14.
Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/c64443b92ce1a60f568db153842a62e3244a8c3a.1626874164.git.fabioaiuto83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 7 ++-----
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 20 +++-----------------
2 files changed, 5 insertions(+), 22 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -4116,7 +4116,7 @@ static void issue_action_BSSCoexistPacke
p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
if ((p == NULL) || (len == 0)) {/* non-HT */
- if ((pbss_network->Configuration.DSConfig <= 0) || (pbss_network->Configuration.DSConfig > 14))
+ if (pbss_network->Configuration.DSConfig <= 0)
continue;
ICS[0][pbss_network->Configuration.DSConfig] = 1;
@@ -6118,10 +6118,7 @@ u8 join_cmd_hdl(struct adapter *padapter
{
struct HT_info_element *pht_info = (struct HT_info_element *)(pIE->data);
- if (pnetwork->Configuration.DSConfig > 14) {
- if ((pregpriv->bw_mode >> 4) > CHANNEL_WIDTH_20)
- cbw40_enable = 1;
- } else {
+ if (pnetwork->Configuration.DSConfig <= 14) {
if ((pregpriv->bw_mode & 0x0f) > CHANNEL_WIDTH_20)
cbw40_enable = 1;
}
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -135,14 +135,7 @@ static char *translate_scan(struct adapt
else
snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11bg");
} else {
- if (pnetwork->network.Configuration.DSConfig > 14) {
- if (vht_cap)
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11AC");
- else if (ht_cap)
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11an");
- else
- snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11a");
- } else {
+ if (pnetwork->network.Configuration.DSConfig <= 14) {
if (ht_cap)
snprintf(iwe.u.name, IFNAMSIZ, "IEEE 802.11gn");
else
@@ -762,7 +755,7 @@ static int rtw_wx_get_name(struct net_de
struct adapter *padapter = (struct adapter *)rtw_netdev_priv(dev);
u32 ht_ielen = 0;
char *p;
- u8 ht_cap = false, vht_cap = false;
+ u8 ht_cap = false;
struct mlme_priv *pmlmepriv = &(padapter->mlmepriv);
struct wlan_bssid_ex *pcur_bss = &pmlmepriv->cur_network.network;
NDIS_802_11_RATES_EX* prates = NULL;
@@ -788,14 +781,7 @@ static int rtw_wx_get_name(struct net_de
else
snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11bg");
} else {
- if (pcur_bss->Configuration.DSConfig > 14) {
- if (vht_cap)
- snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11AC");
- else if (ht_cap)
- snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11an");
- else
- snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11a");
- } else {
+ if (pcur_bss->Configuration.DSConfig <= 14) {
if (ht_cap)
snprintf(wrqu->name, IFNAMSIZ, "IEEE 802.11gn");
else
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 619/699] staging: rtl8723bs: remove commented out condition
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (617 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 618/699] staging: rtl8723bs: remove 5Ghz code blocks Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 620/699] staging: rtl8723bs: clean up comparsions to NULL Greg Kroah-Hartman
` (83 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Aiuto, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <fabioaiuto83@gmail.com>
[ Upstream commit 2a62ff13132a22a754d042b2230117bbea0af477 ]
remove commented out condition checking channel > 14.
Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/83762719c0c13ac8b78612a32db26e691eef17d1.1626874164.git.fabioaiuto83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -165,7 +165,7 @@ static char *translate_scan(struct adapt
start = iwe_stream_add_event(info, start, stop, &iwe, IW_EV_UINT_LEN);
}
- if (pnetwork->network.Configuration.DSConfig < 1 /*|| pnetwork->network.Configuration.DSConfig > 14*/)
+ if (pnetwork->network.Configuration.DSConfig < 1)
pnetwork->network.Configuration.DSConfig = 1;
/* Add frequency/channel */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 620/699] staging: rtl8723bs: clean up comparsions to NULL
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (618 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 619/699] staging: rtl8723bs: remove commented out condition Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 621/699] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Greg Kroah-Hartman
` (82 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Straube, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Straube <straube.linux@gmail.com>
[ Upstream commit cd1f1450092216b3e39516f8db58869b6fc20575 ]
Clean up comparsions to NULL reported by checkpatch.
x == NULL -> !x
x != NULL -> x
Signed-off-by: Michael Straube <straube.linux@gmail.com>
Link: https://lore.kernel.org/r/20210829154533.11054-1-straube.linux@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: a1fc19d61f66 ("staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_ap.c | 20 ++--
drivers/staging/rtl8723bs/core/rtw_cmd.c | 96 +++++++++++-----------
drivers/staging/rtl8723bs/core/rtw_ioctl_set.c | 4
drivers/staging/rtl8723bs/core/rtw_mlme.c | 6 -
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 56 ++++++------
drivers/staging/rtl8723bs/core/rtw_security.c | 6 -
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 24 ++---
drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 18 ++--
drivers/staging/rtl8723bs/os_dep/os_intfs.c | 4
9 files changed, 117 insertions(+), 117 deletions(-)
--- a/drivers/staging/rtl8723bs/core/rtw_ap.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ap.c
@@ -1033,7 +1033,7 @@ int rtw_check_beacon_data(struct adapter
&ie_len,
(pbss_network->IELength - _BEACON_IE_OFFSET_)
);
- if (p != NULL) {
+ if (p) {
memcpy(supportRate, p + 2, ie_len);
supportRateNum = ie_len;
}
@@ -1045,7 +1045,7 @@ int rtw_check_beacon_data(struct adapter
&ie_len,
pbss_network->IELength - _BEACON_IE_OFFSET_
);
- if (p != NULL) {
+ if (p) {
memcpy(supportRate + supportRateNum, p + 2, ie_len);
supportRateNum += ie_len;
}
@@ -1133,7 +1133,7 @@ int rtw_check_beacon_data(struct adapter
break;
}
- if ((p == NULL) || (ie_len == 0))
+ if (!p || ie_len == 0)
break;
}
@@ -1162,7 +1162,7 @@ int rtw_check_beacon_data(struct adapter
break;
}
- if ((p == NULL) || (ie_len == 0))
+ if (!p || ie_len == 0)
break;
}
}
@@ -1290,7 +1290,7 @@ int rtw_check_beacon_data(struct adapter
psta = rtw_get_stainfo(&padapter->stapriv, pbss_network->MacAddress);
if (!psta) {
psta = rtw_alloc_stainfo(&padapter->stapriv, pbss_network->MacAddress);
- if (psta == NULL)
+ if (!psta)
return _FAIL;
}
@@ -1447,7 +1447,7 @@ u8 rtw_ap_set_pairwise_key(struct adapte
}
psetstakey_para = rtw_zmalloc(sizeof(struct set_stakey_parm));
- if (psetstakey_para == NULL) {
+ if (!psetstakey_para) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1485,12 +1485,12 @@ static int rtw_ap_set_key(
/* DBG_871X("%s\n", __func__); */
pcmd = rtw_zmalloc(sizeof(struct cmd_obj));
- if (pcmd == NULL) {
+ if (!pcmd) {
res = _FAIL;
goto exit;
}
psetkeyparm = rtw_zmalloc(sizeof(struct setkey_parm));
- if (psetkeyparm == NULL) {
+ if (!psetkeyparm) {
kfree(pcmd);
res = _FAIL;
goto exit;
@@ -1662,11 +1662,11 @@ static void update_bcn_wps_ie(struct ada
&wps_ielen
);
- if (pwps_ie == NULL || wps_ielen == 0)
+ if (!pwps_ie || wps_ielen == 0)
return;
pwps_ie_src = pmlmepriv->wps_beacon_ie;
- if (pwps_ie_src == NULL)
+ if (!pwps_ie_src)
return;
wps_offset = (uint)(pwps_ie - ie);
--- a/drivers/staging/rtl8723bs/core/rtw_cmd.c
+++ b/drivers/staging/rtl8723bs/core/rtw_cmd.c
@@ -259,7 +259,7 @@ int _rtw_enqueue_cmd(struct __queue *que
{
_irqL irqL;
- if (obj == NULL)
+ if (!obj)
goto exit;
/* spin_lock_bh(&queue->lock); */
@@ -335,7 +335,7 @@ int rtw_enqueue_cmd(struct cmd_priv *pcm
int res = _FAIL;
struct adapter *padapter = pcmdpriv->padapter;
- if (cmd_obj == NULL) {
+ if (!cmd_obj) {
goto exit;
}
@@ -509,7 +509,7 @@ post_process:
/* call callback function for post-processed */
if (pcmd->cmdcode < ARRAY_SIZE(rtw_cmd_callback)) {
pcmd_callback = rtw_cmd_callback[pcmd->cmdcode].callback;
- if (pcmd_callback == NULL) {
+ if (!pcmd_callback) {
RT_TRACE(_module_rtl871x_cmd_c_, _drv_info_, ("mlme_cmd_hdl(): pcmd_callback = 0x%p, cmdcode = 0x%x\n", pcmd_callback, pcmd->cmdcode));
rtw_free_cmd_obj(pcmd);
} else {
@@ -530,7 +530,7 @@ post_process:
/* free all cmd_obj resources */
do {
pcmd = rtw_dequeue_cmd(pcmdpriv);
- if (pcmd == NULL) {
+ if (!pcmd) {
rtw_unregister_cmd_alive(padapter);
break;
}
@@ -572,11 +572,11 @@ u8 rtw_sitesurvey_cmd(struct adapter *p
}
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL)
+ if (!ph2c)
return _FAIL;
psurveyPara = rtw_zmalloc(sizeof(struct sitesurvey_parm));
- if (psurveyPara == NULL) {
+ if (!psurveyPara) {
kfree(ph2c);
return _FAIL;
}
@@ -640,13 +640,13 @@ u8 rtw_setdatarate_cmd(struct adapter *p
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pbsetdataratepara = rtw_zmalloc(sizeof(struct setdatarate_parm));
- if (pbsetdataratepara == NULL) {
+ if (!pbsetdataratepara) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -683,7 +683,7 @@ u8 rtw_createbss_cmd(struct adapter *pa
}
pcmd = rtw_zmalloc(sizeof(struct cmd_obj));
- if (pcmd == NULL) {
+ if (!pcmd) {
res = _FAIL;
goto exit;
}
@@ -716,7 +716,7 @@ int rtw_startbss_cmd(struct adapter *pa
} else {
/* need enqueue, prepare cmd_obj and enqueue */
pcmd = rtw_zmalloc(sizeof(struct cmd_obj));
- if (pcmd == NULL) {
+ if (!pcmd) {
res = _FAIL;
goto exit;
}
@@ -774,7 +774,7 @@ u8 rtw_joinbss_cmd(struct adapter *pada
}
pcmd = rtw_zmalloc(sizeof(struct cmd_obj));
- if (pcmd == NULL) {
+ if (!pcmd) {
res = _FAIL;
RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("rtw_joinbss_cmd: memory allocate for cmd_obj fail!!!\n"));
goto exit;
@@ -891,7 +891,7 @@ u8 rtw_disassoc_cmd(struct adapter *pada
/* prepare cmd parameter */
param = rtw_zmalloc(sizeof(*param));
- if (param == NULL) {
+ if (!param) {
res = _FAIL;
goto exit;
}
@@ -900,7 +900,7 @@ u8 rtw_disassoc_cmd(struct adapter *pada
if (enqueue) {
/* need enqueue, prepare cmd_obj and enqueue */
cmdobj = rtw_zmalloc(sizeof(*cmdobj));
- if (cmdobj == NULL) {
+ if (!cmdobj) {
res = _FAIL;
kfree(param);
goto exit;
@@ -928,7 +928,7 @@ u8 rtw_setopmode_cmd(struct adapter *pa
psetop = rtw_zmalloc(sizeof(struct setopmode_parm));
- if (psetop == NULL) {
+ if (!psetop) {
res = _FAIL;
goto exit;
}
@@ -936,7 +936,7 @@ u8 rtw_setopmode_cmd(struct adapter *pa
if (enqueue) {
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
kfree(psetop);
res = _FAIL;
goto exit;
@@ -964,7 +964,7 @@ u8 rtw_setstakey_cmd(struct adapter *pad
u8 res = _SUCCESS;
psetstakey_para = rtw_zmalloc(sizeof(struct set_stakey_parm));
- if (psetstakey_para == NULL) {
+ if (!psetstakey_para) {
res = _FAIL;
goto exit;
}
@@ -988,14 +988,14 @@ u8 rtw_setstakey_cmd(struct adapter *pad
if (enqueue) {
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
kfree(psetstakey_para);
res = _FAIL;
goto exit;
}
psetstakey_rsp = rtw_zmalloc(sizeof(struct set_stakey_rsp));
- if (psetstakey_rsp == NULL) {
+ if (!psetstakey_rsp) {
kfree(ph2c);
kfree(psetstakey_para);
res = _FAIL;
@@ -1031,20 +1031,20 @@ u8 rtw_clearstakey_cmd(struct adapter *p
}
} else {
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
psetstakey_para = rtw_zmalloc(sizeof(struct set_stakey_parm));
- if (psetstakey_para == NULL) {
+ if (!psetstakey_para) {
kfree(ph2c);
res = _FAIL;
goto exit;
}
psetstakey_rsp = rtw_zmalloc(sizeof(struct set_stakey_rsp));
- if (psetstakey_rsp == NULL) {
+ if (!psetstakey_rsp) {
kfree(ph2c);
kfree(psetstakey_para);
res = _FAIL;
@@ -1076,13 +1076,13 @@ u8 rtw_addbareq_cmd(struct adapter *pada
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
paddbareq_parm = rtw_zmalloc(sizeof(struct addBaReq_parm));
- if (paddbareq_parm == NULL) {
+ if (!paddbareq_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1110,13 +1110,13 @@ u8 rtw_reset_securitypriv_cmd(struct ada
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1145,13 +1145,13 @@ u8 rtw_free_assoc_resources_cmd(struct a
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1181,13 +1181,13 @@ u8 rtw_dynamic_chk_wk_cmd(struct adapter
/* only primary padapter does this cmd */
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1231,7 +1231,7 @@ u8 rtw_set_chplan_cmd(struct adapter *pa
/* prepare cmd parameter */
setChannelPlan_param = rtw_zmalloc(sizeof(struct SetChannelPlan_param));
- if (setChannelPlan_param == NULL) {
+ if (!setChannelPlan_param) {
res = _FAIL;
goto exit;
}
@@ -1240,7 +1240,7 @@ u8 rtw_set_chplan_cmd(struct adapter *pa
if (enqueue) {
/* need enqueue, prepare cmd_obj and enqueue */
pcmdobj = rtw_zmalloc(sizeof(struct cmd_obj));
- if (pcmdobj == NULL) {
+ if (!pcmdobj) {
kfree(setChannelPlan_param);
res = _FAIL;
goto exit;
@@ -1501,13 +1501,13 @@ u8 rtw_lps_ctrl_wk_cmd(struct adapter *p
if (enqueue) {
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1543,13 +1543,13 @@ u8 rtw_dm_in_lps_wk_cmd(struct adapter *
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1616,13 +1616,13 @@ u8 rtw_dm_ra_mask_wk_cmd(struct adapter
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1651,13 +1651,13 @@ u8 rtw_ps_cmd(struct adapter *padapter)
u8 res = _SUCCESS;
ppscmd = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ppscmd == NULL) {
+ if (!ppscmd) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ppscmd);
res = _FAIL;
goto exit;
@@ -1723,13 +1723,13 @@ u8 rtw_chk_hi_queue_cmd(struct adapter *
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1817,13 +1817,13 @@ u8 rtw_c2h_packet_wk_cmd(struct adapter
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -1852,13 +1852,13 @@ u8 rtw_c2h_wk_cmd(struct adapter *padapt
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));
- if (pdrvextra_cmd_parm == NULL) {
+ if (!pdrvextra_cmd_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -2036,7 +2036,7 @@ void rtw_createbss_cmd_callback(struct a
struct wlan_bssid_ex *pnetwork = (struct wlan_bssid_ex *)pcmd->parmbuf;
struct wlan_network *tgt_network = &(pmlmepriv->cur_network);
- if (pcmd->parmbuf == NULL)
+ if (!pcmd->parmbuf)
goto exit;
if ((pcmd->res != H2C_SUCCESS)) {
@@ -2063,9 +2063,9 @@ void rtw_createbss_cmd_callback(struct a
} else {
pwlan = rtw_alloc_network(pmlmepriv);
spin_lock_bh(&(pmlmepriv->scanned_queue.lock));
- if (pwlan == NULL) {
+ if (!pwlan) {
pwlan = rtw_get_oldest_wlan_network(&pmlmepriv->scanned_queue);
- if (pwlan == NULL) {
+ if (!pwlan) {
RT_TRACE(_module_rtl871x_cmd_c_, _drv_err_, ("\n Error: can't get pwlan in rtw_joinbss_event_callback\n"));
spin_unlock_bh(&(pmlmepriv->scanned_queue.lock));
goto createbss_cmd_fail;
--- a/drivers/staging/rtl8723bs/core/rtw_ioctl_set.c
+++ b/drivers/staging/rtl8723bs/core/rtw_ioctl_set.c
@@ -508,7 +508,7 @@ u8 rtw_set_802_11_bssid_list_scan(struct
RT_TRACE(_module_rtl871x_ioctl_set_c_, _drv_err_, ("+rtw_set_802_11_bssid_list_scan(), fw_state =%x\n", get_fwstate(pmlmepriv)));
- if (padapter == NULL) {
+ if (!padapter) {
res = false;
goto exit;
}
@@ -649,7 +649,7 @@ u16 rtw_get_cur_max_rate(struct adapter
return 0;
psta = rtw_get_stainfo(&adapter->stapriv, get_bssid(pmlmepriv));
- if (psta == NULL)
+ if (!psta)
return 0;
short_GI = query_ra_short_GI(psta);
--- a/drivers/staging/rtl8723bs/core/rtw_mlme.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme.c
@@ -472,7 +472,7 @@ struct wlan_network *rtw_get_oldest_wlan
pwlan = LIST_CONTAINOR(plist, struct wlan_network, list);
if (!pwlan->fixed) {
- if (oldest == NULL || time_after(oldest->last_scanned, pwlan->last_scanned))
+ if (!oldest || time_after(oldest->last_scanned, pwlan->last_scanned))
oldest = pwlan;
}
@@ -603,7 +603,7 @@ void rtw_update_scanned_network(struct a
/* TODO: don't select netowrk in the same ess as oldest if it's new enough*/
}
- if (oldest == NULL || time_after(oldest->last_scanned, pnetwork->last_scanned))
+ if (!oldest || time_after(oldest->last_scanned, pnetwork->last_scanned))
oldest = pnetwork;
plist = get_next(plist);
@@ -2023,7 +2023,7 @@ static int rtw_check_join_candidate(stru
goto exit;
}
- if (*candidate == NULL || (*candidate)->network.Rssi < competitor->network.Rssi) {
+ if (!*candidate || (*candidate)->network.Rssi < competitor->network.Rssi) {
*candidate = competitor;
updated = true;
}
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -934,12 +934,12 @@ unsigned int OnAuth(struct adapter *pada
}
pstat = rtw_get_stainfo(pstapriv, sa);
- if (pstat == NULL) {
+ if (!pstat) {
/* allocate a new one */
DBG_871X("going to alloc stainfo for sa ="MAC_FMT"\n", MAC_ARG(sa));
pstat = rtw_alloc_stainfo(pstapriv, sa);
- if (pstat == NULL) {
+ if (!pstat) {
DBG_871X(" Exceed the upper limit of supported clients...\n");
status = _STATS_UNABLE_HANDLE_STA_;
goto auth_fail;
@@ -1014,7 +1014,7 @@ unsigned int OnAuth(struct adapter *pada
p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&ie_len,
len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
- if ((p == NULL) || (ie_len <= 0)) {
+ if (!p || ie_len <= 0) {
DBG_871X("auth rejected because challenge failure!(1)\n");
status = _STATS_CHALLENGE_FAIL_;
goto auth_fail;
@@ -1255,7 +1255,7 @@ unsigned int OnAssocReq(struct adapter *
/* check if the supported rate is ok */
p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _SUPPORTEDRATES_IE_, &ie_len, pkt_len - WLAN_HDR_A3_LEN - ie_offset);
- if (p == NULL) {
+ if (!p) {
DBG_871X("Rx a sta assoc-req which supported rate is empty!\n");
/* use our own rate set as statoin used */
/* memcpy(supportRate, AP_BSSRATE, AP_BSSRATE_LEN); */
@@ -1272,7 +1272,7 @@ unsigned int OnAssocReq(struct adapter *
p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + ie_offset, _EXT_SUPPORTEDRATES_IE_, &ie_len,
pkt_len - WLAN_HDR_A3_LEN - ie_offset);
- if (p != NULL) {
+ if (p) {
if (supportRateNum + ie_len <= sizeof(supportRate)) {
memcpy(supportRate+supportRateNum, p+2, ie_len);
@@ -1538,7 +1538,7 @@ unsigned int OnAssocReq(struct adapter *
DBG_871X(" old AID %d\n", pstat->aid);
} else {
for (pstat->aid = 1; pstat->aid <= NUM_STA; pstat->aid++)
- if (pstapriv->sta_aid[pstat->aid - 1] == NULL)
+ if (!pstapriv->sta_aid[pstat->aid - 1])
break;
/* if (pstat->aid > NUM_STA) { */
@@ -2226,7 +2226,7 @@ static struct xmit_frame *_alloc_mgtxmit
}
pxmitbuf = rtw_alloc_xmitbuf_ext(pxmitpriv);
- if (pxmitbuf == NULL) {
+ if (!pxmitbuf) {
DBG_871X(FUNC_ADPT_FMT" alloc xmitbuf fail\n", FUNC_ADPT_ARG(pxmitpriv->adapter));
rtw_free_xmitframe(pxmitpriv, pmgntframe);
pmgntframe = NULL;
@@ -2596,7 +2596,7 @@ void issue_probersp(struct adapter *pada
/* DBG_871X("%s\n", __func__); */
- if (da == NULL)
+ if (!da)
return;
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
@@ -2961,7 +2961,7 @@ void issue_auth(struct adapter *padapter
__le16 le_tmp;
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
- if (pmgntframe == NULL)
+ if (!pmgntframe)
return;
/* update attribute */
@@ -3097,7 +3097,7 @@ void issue_asocrsp(struct adapter *padap
DBG_871X("%s\n", __func__);
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
- if (pmgntframe == NULL)
+ if (!pmgntframe)
return;
/* update attribute */
@@ -3185,7 +3185,7 @@ void issue_asocrsp(struct adapter *padap
break;
}
- if ((pbuf == NULL) || (ie_len == 0)) {
+ if (!pbuf || ie_len == 0) {
break;
}
}
@@ -3229,7 +3229,7 @@ void issue_assocreq(struct adapter *pada
u8 vs_ie_length = 0;
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
- if (pmgntframe == NULL)
+ if (!pmgntframe)
goto exit;
/* update attribute */
@@ -3420,7 +3420,7 @@ static int _issue_nulldata(struct adapte
pmlmeinfo = &(pmlmeext->mlmext_info);
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
- if (pmgntframe == NULL)
+ if (!pmgntframe)
goto exit;
/* update attribute */
@@ -3573,7 +3573,7 @@ static int _issue_qos_nulldata(struct ad
DBG_871X("%s\n", __func__);
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
- if (pmgntframe == NULL)
+ if (!pmgntframe)
goto exit;
/* update attribute */
@@ -3698,7 +3698,7 @@ static int _issue_deauth(struct adapter
/* DBG_871X("%s to "MAC_FMT"\n", __func__, MAC_ARG(da)); */
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
- if (pmgntframe == NULL) {
+ if (!pmgntframe) {
goto exit;
}
@@ -4047,7 +4047,7 @@ static void issue_action_BSSCoexistPacke
action = ACT_PUBLIC_BSSCOEXIST;
pmgntframe = alloc_mgtxmitframe(pxmitpriv);
- if (pmgntframe == NULL) {
+ if (!pmgntframe) {
return;
}
@@ -4114,7 +4114,7 @@ static void issue_action_BSSCoexistPacke
pbss_network = (struct wlan_bssid_ex *)&pnetwork->network;
p = rtw_get_ie(pbss_network->IEs + _FIXED_IE_LENGTH_, _HT_CAPABILITY_IE_, &len, pbss_network->IELength - _FIXED_IE_LENGTH_);
- if ((p == NULL) || (len == 0)) {/* non-HT */
+ if (!p || len == 0) {/* non-HT */
if (pbss_network->Configuration.DSConfig <= 0)
continue;
@@ -4177,7 +4177,7 @@ unsigned int send_delba(struct adapter *
return _SUCCESS;
psta = rtw_get_stainfo(pstapriv, addr);
- if (psta == NULL)
+ if (!psta)
return _SUCCESS;
/* DBG_871X("%s:%s\n", __func__, (initiator == 0)?"RX_DIR":"TX_DIR"); */
@@ -5153,13 +5153,13 @@ void report_del_sta_event(struct adapter
struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
- if (pcmd_obj == NULL) {
+ if (!pcmd_obj) {
return;
}
cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));
pevtcmd = rtw_zmalloc(cmdsz);
- if (pevtcmd == NULL) {
+ if (!pevtcmd) {
kfree(pcmd_obj);
return;
}
@@ -5207,12 +5207,12 @@ void report_add_sta_event(struct adapter
struct cmd_priv *pcmdpriv = &padapter->cmdpriv;
pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));
- if (pcmd_obj == NULL)
+ if (!pcmd_obj)
return;
cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));
pevtcmd = rtw_zmalloc(cmdsz);
- if (pevtcmd == NULL) {
+ if (!pevtcmd) {
kfree(pcmd_obj);
return;
}
@@ -5732,12 +5732,12 @@ void survey_timer_hdl(struct timer_list
}
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
goto exit_survey_timer_hdl;
}
psurveyPara = rtw_zmalloc(sizeof(struct sitesurvey_parm));
- if (psurveyPara == NULL) {
+ if (!psurveyPara) {
kfree(ph2c);
goto exit_survey_timer_hdl;
}
@@ -6467,7 +6467,7 @@ u8 chk_bmc_sleepq_cmd(struct adapter *pa
u8 res = _SUCCESS;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
@@ -6491,13 +6491,13 @@ u8 set_tx_beacon_cmd(struct adapter *pad
int len_diff = 0;
ph2c = rtw_zmalloc(sizeof(struct cmd_obj));
- if (ph2c == NULL) {
+ if (!ph2c) {
res = _FAIL;
goto exit;
}
ptxBeacon_parm = rtw_zmalloc(sizeof(struct Tx_Beacon_param));
- if (ptxBeacon_parm == NULL) {
+ if (!ptxBeacon_parm) {
kfree(ph2c);
res = _FAIL;
goto exit;
@@ -6529,7 +6529,7 @@ u8 mlme_evt_hdl(struct adapter *padapter
void (*event_callback)(struct adapter *dev, u8 *pbuf);
struct evt_priv *pevt_priv = &(padapter->evtpriv);
- if (pbuf == NULL)
+ if (!pbuf)
goto _abort_event_;
peventbuf = (uint *)pbuf;
--- a/drivers/staging/rtl8723bs/core/rtw_security.c
+++ b/drivers/staging/rtl8723bs/core/rtw_security.c
@@ -226,7 +226,7 @@ void rtw_wep_encrypt(struct adapter *pad
struct security_priv *psecuritypriv = &padapter->securitypriv;
struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
+ if (!((struct xmit_frame *)pxmitframe)->buf_addr)
return;
hw_hdr_offset = TXDESC_OFFSET;
@@ -669,7 +669,7 @@ u32 rtw_tkip_encrypt(struct adapter *pad
struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
u32 res = _SUCCESS;
- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
+ if (!((struct xmit_frame *)pxmitframe)->buf_addr)
return _FAIL;
hw_hdr_offset = TXDESC_OFFSET;
@@ -1489,7 +1489,7 @@ u32 rtw_aes_encrypt(struct adapter *pada
u32 res = _SUCCESS;
- if (((struct xmit_frame *)pxmitframe)->buf_addr == NULL)
+ if (!((struct xmit_frame *)pxmitframe)->buf_addr)
return _FAIL;
hw_hdr_offset = TXDESC_OFFSET;
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -418,7 +418,7 @@ void rtw_cfg80211_ibss_indicate_connect(
}
else
{
- if (scanned == NULL) {
+ if (!scanned) {
rtw_warn_on(1);
return;
}
@@ -466,7 +466,7 @@ void rtw_cfg80211_indicate_connect(struc
/* DBG_871X(FUNC_ADPT_FMT" BSS not found\n", FUNC_ADPT_ARG(padapter)); */
- if (scanned == NULL) {
+ if (!scanned) {
rtw_warn_on(1);
goto check_bss;
}
@@ -597,7 +597,7 @@ static int rtw_cfg80211_ap_set_encryptio
}
}
- if (strcmp(param->u.crypt.alg, "none") == 0 && (psta == NULL))
+ if (strcmp(param->u.crypt.alg, "none") == 0 && !psta)
{
/* todo:clear default encryption keys */
@@ -607,7 +607,7 @@ static int rtw_cfg80211_ap_set_encryptio
}
- if (strcmp(param->u.crypt.alg, "WEP") == 0 && (psta == NULL))
+ if (strcmp(param->u.crypt.alg, "WEP") == 0 && !psta)
{
DBG_8192C("r871x_set_encryption, crypt.alg = WEP\n");
@@ -1001,7 +1001,7 @@ static int rtw_cfg80211_set_encryption(s
}
pbcmc_sta = rtw_get_bcmc_stainfo(padapter);
- if (pbcmc_sta == NULL)
+ if (!pbcmc_sta)
{
/* DEBUG_ERR(("Set OID_802_11_ADD_KEY: bcmc stainfo is null\n")); */
}
@@ -1050,7 +1050,7 @@ static int cfg80211_rtw_add_key(struct w
param_len = sizeof(struct ieee_param) + params->key_len;
param = rtw_malloc(param_len);
- if (param == NULL)
+ if (!param)
return -1;
memset(param, 0, param_len);
@@ -1214,7 +1214,7 @@ static int cfg80211_rtw_get_station(stru
}
psta = rtw_get_stainfo(pstapriv, (u8 *)mac);
- if (psta == NULL) {
+ if (!psta) {
DBG_8192C("%s, sta_info is null\n", __func__);
ret = -ENOENT;
goto exit;
@@ -1495,7 +1495,7 @@ static int cfg80211_rtw_scan(struct wiph
struct rtw_wdev_priv *pwdev_priv;
struct mlme_priv *pmlmepriv;
- if (ndev == NULL) {
+ if (!ndev) {
ret = -EINVAL;
goto exit;
}
@@ -1783,7 +1783,7 @@ static int rtw_cfg80211_set_wpa_ie(struc
u8 *pwpa, *pwpa2;
u8 null_addr[] = {0, 0, 0, 0, 0, 0};
- if (pie == NULL || !ielen) {
+ if (!pie || !ielen) {
/* Treat this as normal case, but need to clear WIFI_UNDER_WPS */
_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
goto exit;
@@ -1795,7 +1795,7 @@ static int rtw_cfg80211_set_wpa_ie(struc
}
buf = rtw_zmalloc(ielen);
- if (buf == NULL) {
+ if (!buf) {
ret = -ENOMEM;
goto exit;
}
@@ -2138,7 +2138,7 @@ static int cfg80211_rtw_connect(struct w
wep_key_len = wep_key_len <= 5 ? 5 : 13;
wep_total_len = wep_key_len + FIELD_OFFSET(struct ndis_802_11_wep, KeyMaterial);
pwep = rtw_malloc(wep_total_len);
- if (pwep == NULL) {
+ if (!pwep) {
DBG_871X(" wpa_set_encryption: pwep allocate fail !!!\n");
ret = -ENOMEM;
goto exit;
@@ -3073,7 +3073,7 @@ static int cfg80211_rtw_mgmt_tx(struct w
struct adapter *padapter;
struct rtw_wdev_priv *pwdev_priv;
- if (ndev == NULL) {
+ if (!ndev) {
ret = -EINVAL;
goto exit;
}
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
@@ -519,7 +519,7 @@ static int wpa_set_encryption(struct net
if (check_fwstate(pmlmepriv, WIFI_STATION_STATE | WIFI_MP_STATE) == true) { /* sta mode */
psta = rtw_get_stainfo(pstapriv, get_bssid(pmlmepriv));
- if (psta == NULL) {
+ if (!psta) {
/* DEBUG_ERR(("Set wpa_set_encryption: Obtain Sta_info fail\n")); */
} else {
/* Jeff: don't disable ieee8021x_blocked while clearing key */
@@ -578,7 +578,7 @@ static int wpa_set_encryption(struct net
}
pbcmc_sta = rtw_get_bcmc_stainfo(padapter);
- if (pbcmc_sta == NULL) {
+ if (!pbcmc_sta) {
/* DEBUG_ERR(("Set OID_802_11_ADD_KEY: bcmc stainfo is null\n")); */
} else {
/* Jeff: don't disable ieee8021x_blocked while clearing key */
@@ -608,9 +608,9 @@ static int rtw_set_wpa_ie(struct adapter
int ret = 0;
u8 null_addr[] = {0, 0, 0, 0, 0, 0};
- if ((ielen > MAX_WPA_IE_LEN) || (pie == NULL)) {
+ if (ielen > MAX_WPA_IE_LEN || !pie) {
_clr_fwstate_(&padapter->mlmepriv, WIFI_UNDER_WPS);
- if (pie == NULL)
+ if (!pie)
return ret;
else
return -EINVAL;
@@ -618,7 +618,7 @@ static int rtw_set_wpa_ie(struct adapter
if (ielen) {
buf = rtw_zmalloc(ielen);
- if (buf == NULL) {
+ if (!buf) {
ret = -ENOMEM;
goto exit;
}
@@ -3366,7 +3366,7 @@ static int wpa_supplicant_ioctl(struct n
return -EINVAL;
param = rtw_malloc(p->length);
- if (param == NULL)
+ if (!param)
return -ENOMEM;
if (copy_from_user(param, p->pointer, p->length)) {
@@ -3448,7 +3448,7 @@ static int rtw_set_encryption(struct net
}
}
- if (strcmp(param->u.crypt.alg, "none") == 0 && (psta == NULL)) {
+ if (strcmp(param->u.crypt.alg, "none") == 0 && !psta) {
/* todo:clear default encryption keys */
psecuritypriv->dot11AuthAlgrthm = dot11AuthAlgrthm_Open;
@@ -3462,7 +3462,7 @@ static int rtw_set_encryption(struct net
}
- if (strcmp(param->u.crypt.alg, "WEP") == 0 && (psta == NULL)) {
+ if (strcmp(param->u.crypt.alg, "WEP") == 0 && !psta) {
DBG_871X("r871x_set_encryption, crypt.alg = WEP\n");
wep_key_idx = param->u.crypt.idx;
@@ -4187,7 +4187,7 @@ static int rtw_hostapd_ioctl(struct net_
return -EINVAL;
param = rtw_malloc(p->length);
- if (param == NULL)
+ if (!param)
return -ENOMEM;
if (copy_from_user(param, p->pointer, p->length)) {
--- a/drivers/staging/rtl8723bs/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8723bs/os_dep/os_intfs.c
@@ -525,7 +525,7 @@ void rtw_unregister_netdevs(struct dvobj
padapter = dvobj->padapters;
- if (padapter == NULL)
+ if (!padapter)
return;
pnetdev = padapter->pnetdev;
@@ -638,7 +638,7 @@ struct dvobj_priv *devobj_init(void)
struct dvobj_priv *pdvobj = NULL;
pdvobj = rtw_zmalloc(sizeof(*pdvobj));
- if (pdvobj == NULL)
+ if (!pdvobj)
return NULL;
mutex_init(&pdvobj->hw_init_mutex);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 621/699] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (619 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 620/699] staging: rtl8723bs: clean up comparsions to NULL Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 622/699] staging: rtl8723bs: Fix space issues Greg Kroah-Hartman
` (81 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Alexandru Hossu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
[ Upstream commit a1fc19d61f661d47204f095b593de507884849f7 ]
OnAuth() has two bugs in the shared-key authentication path.
When the Privacy bit is set, rtw_wep_decrypt() is called without
verifying that the frame is long enough to contain a valid WEP IV and
ICV. Inside rtw_wep_decrypt(), length is computed as:
length = len - WLAN_HDR_A3_LEN - iv_len
and then passed as (length - 4) to crc32_le(). If len is less than
WLAN_HDR_A3_LEN + iv_len + icv_len (32 bytes), length - 4 is negative
and, after the implicit cast to size_t, causes crc32_le() to read far
beyond the frame buffer. Add a minimum length check before accessing
the IV field and calling the decryption path.
When processing a seq=3 response, rtw_get_ie() stores the Challenge
Text IE length in ie_len, but the subsequent memcmp() always reads 128
bytes regardless of ie_len. IEEE 802.11 mandates a challenge text of
exactly 128 bytes; reject any IE whose length field differs, matching
the check already applied to OnAuthClient().
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004605.1039209-1-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -886,6 +886,9 @@ unsigned int OnAuth(struct adapter *pada
DBG_871X("+OnAuth\n");
+ if (len < WLAN_HDR_A3_LEN)
+ return _FAIL;
+
sa = GetAddr2Ptr(pframe);
auth_mode = psecuritypriv->dot11AuthAlgrthm;
@@ -897,6 +900,9 @@ unsigned int OnAuth(struct adapter *pada
prxattrib->hdrlen = WLAN_HDR_A3_LEN;
prxattrib->encrypt = _WEP40_;
+ if (len < WLAN_HDR_A3_LEN + 8)
+ return _FAIL;
+
iv = pframe+prxattrib->hdrlen;
prxattrib->key_index = ((iv[3]>>6)&0x3);
@@ -1014,7 +1020,7 @@ unsigned int OnAuth(struct adapter *pada
p = rtw_get_ie(pframe + WLAN_HDR_A3_LEN + 4 + _AUTH_IE_OFFSET_, _CHLGETXT_IE_, (int *)&ie_len,
len - WLAN_HDR_A3_LEN - _AUTH_IE_OFFSET_ - 4);
- if (!p || ie_len <= 0) {
+ if (!p || ie_len != 128) {
DBG_871X("auth rejected because challenge failure!(1)\n");
status = _STATS_CHALLENGE_FAIL_;
goto auth_fail;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 622/699] staging: rtl8723bs: Fix space issues
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (620 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 621/699] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 623/699] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Greg Kroah-Hartman
` (80 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Franziska Naepelt, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Franziska Naepelt <franziska.naepelt@googlemail.com>
[ Upstream commit c4b811b9361b0d7ea167a79587f5ec0a13fd8863 ]
Fix the following checkpatch space issues:
- CHECK: spaces preferred around that '*' (ctx:VxV)
- CHECK: spaces preferred around that '+' (ctx:VxV)
- CHECK: spaces preferred around that '-' (ctx:VxV)
- CHECK: spaces preferred around that '|' (ctx:VxV)
- CHECK: No space is necessary after a cast
- WARNING: please, no spaces at the start of a line
Signed-off-by: Franziska Naepelt <franziska.naepelt@googlemail.com>
Link: https://lore.kernel.org/r/20230701102538.5359-1-franziska.naepelt@googlemail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 5a752a616e75 ("staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 84 ++++++++++------------
1 file changed, 40 insertions(+), 44 deletions(-)
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -98,14 +98,14 @@ static struct ieee80211_channel rtw_2ghz
static void rtw_2g_channels_init(struct ieee80211_channel *channels)
{
memcpy((void *)channels, (void *)rtw_2ghz_channels,
- sizeof(struct ieee80211_channel)*RTW_2G_CHANNELS_NUM
+ sizeof(struct ieee80211_channel) * RTW_2G_CHANNELS_NUM
);
}
static void rtw_2g_rates_init(struct ieee80211_rate *rates)
{
memcpy(rates, rtw_g_rates,
- sizeof(struct ieee80211_rate)*RTW_G_RATES_NUM
+ sizeof(struct ieee80211_rate) * RTW_G_RATES_NUM
);
}
@@ -132,8 +132,8 @@ static struct ieee80211_supported_band *
if (!spt_band)
goto exit;
- spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band)+sizeof(struct ieee80211_supported_band));
- spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels)+sizeof(struct ieee80211_channel)*n_channels);
+ spt_band->channels = (struct ieee80211_channel *)(((u8 *)spt_band) + sizeof(struct ieee80211_supported_band));
+ spt_band->bitrates = (struct ieee80211_rate *)(((u8 *)spt_band->channels) + sizeof(struct ieee80211_channel) * n_channels);
spt_band->band = band;
spt_band->n_channels = n_channels;
spt_band->n_bitrates = n_bitrates;
@@ -267,10 +267,10 @@ struct cfg80211_bss *rtw_cfg80211_inform
u32 wpsielen = 0;
u8 *wpsie = NULL;
- wpsie = rtw_get_wps_ie(pnetwork->network.IEs+_FIXED_IE_LENGTH_, pnetwork->network.IELength-_FIXED_IE_LENGTH_, NULL, &wpsielen);
+ wpsie = rtw_get_wps_ie(pnetwork->network.IEs + _FIXED_IE_LENGTH_, pnetwork->network.IELength - _FIXED_IE_LENGTH_, NULL, &wpsielen);
if (wpsie && wpsielen > 0)
- psr = rtw_get_wps_attr_content(wpsie, wpsielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
+ psr = rtw_get_wps_attr_content(wpsie, wpsielen, WPS_ATTR_SELECTED_REGISTRAR, (u8 *)(&sr), NULL);
if (sr != 0)
{
@@ -306,9 +306,9 @@ struct cfg80211_bss *rtw_cfg80211_inform
/* We've set wiphy's signal_type as CFG80211_SIGNAL_TYPE_MBM: signal strength in mBm (100*dBm) */
if (check_fwstate(pmlmepriv, _FW_LINKED) == true &&
is_same_network(&pmlmepriv->cur_network.network, &pnetwork->network, 0)) {
- notify_signal = 100*translate_percentage_to_dbm(padapter->recvpriv.signal_strength);/* dbm */
+ notify_signal = 100 * translate_percentage_to_dbm(padapter->recvpriv.signal_strength);/* dbm */
} else {
- notify_signal = 100*translate_percentage_to_dbm(pnetwork->network.PhyInfo.SignalStrength);/* dbm */
+ notify_signal = 100 * translate_percentage_to_dbm(pnetwork->network.PhyInfo.SignalStrength);/* dbm */
}
buf = kzalloc(MAX_BSSINFO_LEN, GFP_ATOMIC);
@@ -507,22 +507,22 @@ check_bss:
roam_info.channel = notify_channel;
roam_info.bssid = cur_network->network.MacAddress;
roam_info.req_ie =
- pmlmepriv->assoc_req+sizeof(struct ieee80211_hdr_3addr)+2;
+ pmlmepriv->assoc_req + sizeof(struct ieee80211_hdr_3addr) + 2;
roam_info.req_ie_len =
- pmlmepriv->assoc_req_len-sizeof(struct ieee80211_hdr_3addr)-2;
+ pmlmepriv->assoc_req_len - sizeof(struct ieee80211_hdr_3addr) - 2;
roam_info.resp_ie =
- pmlmepriv->assoc_rsp+sizeof(struct ieee80211_hdr_3addr)+6;
+ pmlmepriv->assoc_rsp + sizeof(struct ieee80211_hdr_3addr) + 6;
roam_info.resp_ie_len =
- pmlmepriv->assoc_rsp_len-sizeof(struct ieee80211_hdr_3addr)-6;
+ pmlmepriv->assoc_rsp_len - sizeof(struct ieee80211_hdr_3addr) - 6;
cfg80211_roamed(padapter->pnetdev, &roam_info, GFP_ATOMIC);
}
else
{
cfg80211_connect_result(padapter->pnetdev, cur_network->network.MacAddress
- , pmlmepriv->assoc_req+sizeof(struct ieee80211_hdr_3addr)+2
- , pmlmepriv->assoc_req_len-sizeof(struct ieee80211_hdr_3addr)-2
- , pmlmepriv->assoc_rsp+sizeof(struct ieee80211_hdr_3addr)+6
- , pmlmepriv->assoc_rsp_len-sizeof(struct ieee80211_hdr_3addr)-6
+ , pmlmepriv->assoc_req + sizeof(struct ieee80211_hdr_3addr) + 2
+ , pmlmepriv->assoc_req_len - sizeof(struct ieee80211_hdr_3addr) - 2
+ , pmlmepriv->assoc_rsp + sizeof(struct ieee80211_hdr_3addr) + 6
+ , pmlmepriv->assoc_rsp_len - sizeof(struct ieee80211_hdr_3addr) - 6
, WLAN_STATUS_SUCCESS, GFP_ATOMIC);
}
}
@@ -855,7 +855,7 @@ static int rtw_cfg80211_set_encryption(s
param->u.crypt.err = 0;
param->u.crypt.alg[IEEE_CRYPT_ALG_NAME_LEN - 1] = '\0';
- if (param_len < (u32) ((u8 *) param->u.crypt.key - (u8 *) param) + param->u.crypt.key_len)
+ if (param_len < (u32)((u8 *)param->u.crypt.key - (u8 *)param) + param->u.crypt.key_len)
{
ret = -EINVAL;
goto exit;
@@ -1252,10 +1252,10 @@ static int cfg80211_rtw_get_station(stru
}
/* for Ad-Hoc/AP mode */
- if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE)
- || check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE)
- || check_fwstate(pmlmepriv, WIFI_AP_STATE))
- && check_fwstate(pmlmepriv, _FW_LINKED)
+ if ((check_fwstate(pmlmepriv, WIFI_ADHOC_STATE) ||
+ check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE) ||
+ check_fwstate(pmlmepriv, WIFI_AP_STATE)) &&
+ check_fwstate(pmlmepriv, _FW_LINKED)
)
{
/* TODO: should acquire station info... */
@@ -1518,7 +1518,7 @@ static int cfg80211_rtw_scan(struct wiph
DBG_871X("%s under WIFI_AP_STATE\n", __func__);
#endif
- if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS|_FW_UNDER_SURVEY|_FW_UNDER_LINKING) == true)
+ if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS | _FW_UNDER_SURVEY | _FW_UNDER_LINKING) == true)
{
DBG_8192C("%s, fwstate = 0x%x\n", __func__, pmlmepriv->fw_state);
@@ -1591,7 +1591,7 @@ static int cfg80211_rtw_scan(struct wiph
}
/* parsing channels, n_channels */
- memset(ch, 0, sizeof(struct rtw_ieee80211_channel)*RTW_CHANNEL_SCAN_AMOUNT);
+ memset(ch, 0, sizeof(struct rtw_ieee80211_channel) * RTW_CHANNEL_SCAN_AMOUNT);
for (i = 0; i < request->n_channels && i < RTW_CHANNEL_SCAN_AMOUNT; i++) {
#ifdef DEBUG_CFG80211
DBG_871X(FUNC_ADPT_FMT CHAN_FMT"\n", FUNC_ADPT_ARG(padapter), CHAN_ARG(request->channels[i]));
@@ -1609,7 +1609,7 @@ static int cfg80211_rtw_scan(struct wiph
for (j = request->n_channels - 1; j >= 0; j--)
for (i = 0; i < survey_times; i++)
{
- memcpy(&ch[j*survey_times+i], &ch[j], sizeof(struct rtw_ieee80211_channel));
+ memcpy(&ch[j * survey_times + i], &ch[j], sizeof(struct rtw_ieee80211_channel));
}
_status = rtw_sitesurvey_cmd(padapter, ssid, RTW_SSID_SCAN_AMOUNT, ch, survey_times * request->n_channels);
} else {
@@ -1789,7 +1789,7 @@ static int rtw_cfg80211_set_wpa_ie(struc
goto exit;
}
- if (ielen > MAX_WPA_IE_LEN+MAX_WPS_IE_LEN+MAX_P2P_IE_LEN) {
+ if (ielen > MAX_WPA_IE_LEN + MAX_WPS_IE_LEN + MAX_P2P_IE_LEN) {
ret = -EINVAL;
goto exit;
}
@@ -1817,26 +1817,22 @@ static int rtw_cfg80211_set_wpa_ie(struc
}
pwpa = rtw_get_wpa_ie(buf, &wpa_ielen, ielen);
- if (pwpa && wpa_ielen > 0)
- {
- if (rtw_parse_wpa_ie(pwpa, wpa_ielen+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS)
- {
+ if (pwpa && wpa_ielen > 0) {
+ if (rtw_parse_wpa_ie(pwpa, wpa_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
- memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen+2);
+ memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
DBG_8192C("got wpa_ie, wpa_ielen:%u\n", wpa_ielen);
}
}
pwpa2 = rtw_get_wpa2_ie(buf, &wpa2_ielen, ielen);
- if (pwpa2 && wpa2_ielen > 0)
- {
- if (rtw_parse_wpa2_ie(pwpa2, wpa2_ielen+2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS)
- {
+ if (pwpa2 && wpa2_ielen > 0) {
+ if (rtw_parse_wpa2_ie(pwpa2, wpa2_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
- memcpy(padapter->securitypriv.supplicant_ie, &pwpa2[0], wpa2_ielen+2);
+ memcpy(padapter->securitypriv.supplicant_ie, &pwpa2[0], wpa2_ielen + 2);
DBG_8192C("got wpa2_ie, wpa2_ielen:%u\n", wpa2_ielen);
}
@@ -2303,7 +2299,7 @@ static int cfg80211_rtw_set_pmksa(struct
memcpy(psecuritypriv->PMKIDList[index].PMKID, (u8 *)pmksa->pmkid, WLAN_PMKID_LEN);
psecuritypriv->PMKIDList[index].bUsed = true;
- psecuritypriv->PMKIDIndex = index+1;
+ psecuritypriv->PMKIDIndex = index + 1;
blInserted = true;
break;
}
@@ -2477,8 +2473,8 @@ static netdev_tx_t rtw_cfg80211_monitor_
return _rtw_xmit_entry(skb, padapter->pnetdev);
}
- else if ((frame_control & (IEEE80211_FCTL_FTYPE|IEEE80211_FCTL_STYPE))
- == (IEEE80211_FTYPE_MGMT|IEEE80211_STYPE_ACTION)
+ else if ((frame_control & (IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
+ == (IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION)
)
{
/* only for action frames */
@@ -2616,7 +2612,7 @@ static int rtw_cfg80211_add_monitor_if(s
}
*ndev = pwdev_priv->pmon_ndev = mon_ndev;
- memcpy(pwdev_priv->ifname_mon, name, IFNAMSIZ+1);
+ memcpy(pwdev_priv->ifname_mon, name, IFNAMSIZ + 1);
out:
if (ret && mon_wdev) {
@@ -2719,14 +2715,14 @@ static int rtw_add_beacon(struct adapter
if (head_len < 24)
return -EINVAL;
- pbuf = rtw_zmalloc(head_len+tail_len);
+ pbuf = rtw_zmalloc(head_len + tail_len);
if (!pbuf)
return -ENOMEM;
- memcpy(pbuf, (void *)head+24, head_len-24);/* 24 =beacon header len. */
- memcpy(pbuf+head_len-24, (void *)tail, tail_len);
+ memcpy(pbuf, (void *)head + 24, head_len - 24);/* 24 =beacon header len. */
+ memcpy(pbuf + head_len - 24, (void *)tail, tail_len);
- len = head_len+tail_len-24;
+ len = head_len + tail_len - 24;
/* check wps ie if inclued */
if (rtw_get_wps_ie(pbuf+_FIXED_IE_LENGTH_, len-_FIXED_IE_LENGTH_, NULL, &wps_ielen))
@@ -3082,7 +3078,7 @@ static int cfg80211_rtw_mgmt_tx(struct w
pwdev_priv = adapter_wdev_data(padapter);
/* cookie generation */
- *cookie = (unsigned long) buf;
+ *cookie = (unsigned long)buf;
#ifdef DEBUG_CFG80211
DBG_871X(FUNC_ADPT_FMT" len =%zu, ch =%d"
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 623/699] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (621 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 622/699] staging: rtl8723bs: Fix space issues Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 624/699] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Greg Kroah-Hartman
` (79 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Luka Gejak, Alexandru Hossu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
[ Upstream commit 5a752a616e756844388a1a45404db9fc29fec655 ]
supplicant_ie is a 256-byte array in struct security_priv. The WPA and
WPA2 IE copy paths use:
memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2);
where wpa_ielen is the raw IE length field (u8, 0-255). When a local user
supplies a connect request via nl80211 with a crafted WPA IE of length 255,
wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into
the adjacent last_mic_err_time field.
rtw_parse_wpa_ie() does not prevent this: its length consistency check
compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255
when wpa_ie_len = 257, so the check passes silently.
Add explicit bounds checks for both the WPA and WPA2 paths before the
memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the
supplicant_ie buffer.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-4-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
+++ b/drivers/staging/rtl8723bs/os_dep/ioctl_cfg80211.c
@@ -1818,6 +1818,10 @@ static int rtw_cfg80211_set_wpa_ie(struc
pwpa = rtw_get_wpa_ie(buf, &wpa_ielen, ielen);
if (pwpa && wpa_ielen > 0) {
+ if (wpa_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) {
+ ret = -EINVAL;
+ goto exit;
+ }
if (rtw_parse_wpa_ie(pwpa, wpa_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPAPSK;
@@ -1829,6 +1833,10 @@ static int rtw_cfg80211_set_wpa_ie(struc
pwpa2 = rtw_get_wpa2_ie(buf, &wpa2_ielen, ielen);
if (pwpa2 && wpa2_ielen > 0) {
+ if (wpa2_ielen + 2 > sizeof(padapter->securitypriv.supplicant_ie)) {
+ ret = -EINVAL;
+ goto exit;
+ }
if (rtw_parse_wpa2_ie(pwpa2, wpa2_ielen + 2, &group_cipher, &pairwise_cipher, NULL) == _SUCCESS) {
padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_8021X;
padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeWPA2PSK;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 624/699] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (622 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 623/699] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 625/699] PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() Greg Kroah-Hartman
` (78 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Luka Gejak, Alexandru Hossu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Hossu <hossu.alexandru@gmail.com>
[ Upstream commit ef61d628dfad38fead1fd2e08979ae9126d011d5 ]
Two IE parsing loops are missing the header bounds checks before they
dereference pIE->length:
- issue_assocreq() walks pmlmeinfo->network.ies to build the
association request. If the stored IE data ends with only an
element_id byte and no length byte, pIE->length is read one byte
past the end of the buffer.
- join_cmd_hdl() walks pnetwork->ies during station join and has
the same problem under the same conditions.
Both buffers are filled from AP beacon and probe-response frames, so a
malicious AP that sends a truncated final IE can trigger the issue.
Apply the two-guard pattern established in update_beacon_info():
1. Break if fewer than sizeof(*pIE) bytes remain.
2. Break if the IE's declared data extends past the buffer end.
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Cc: stable <stable@kernel.org>
Reviewed-by: Luka Gejak <luka.gejak@linux.dev>
Signed-off-by: Alexandru Hossu <hossu.alexandru@gmail.com>
Link: https://patch.msgid.link/20260522004531.1038924-3-hossu.alexandru@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ replaced sizeof(*pIE) with literal 2 (5.10's ndis_80211_var_ie still has data[1]) and used pre-rename field names IELength/IEs/ElementID/Length ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_mlme_ext.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
+++ b/drivers/staging/rtl8723bs/core/rtw_mlme_ext.c
@@ -3341,7 +3341,11 @@ void issue_assocreq(struct adapter *pada
/* vendor specific IE, such as WPA, WMM, WPS */
for (i = sizeof(struct ndis_802_11_fix_ie); i < pmlmeinfo->network.IELength;) {
+ if (i + 2 > pmlmeinfo->network.IELength)
+ break;
pIE = (struct ndis_80211_var_ie *)(pmlmeinfo->network.IEs + i);
+ if (i + 2 + pIE->Length > pmlmeinfo->network.IELength)
+ break;
switch (pIE->ElementID) {
case _VENDOR_SPECIFIC_IE_:
@@ -6105,7 +6109,11 @@ u8 join_cmd_hdl(struct adapter *padapter
/* sizeof(struct ndis_802_11_fix_ie) */
for (i = _FIXED_IE_LENGTH_; i < pnetwork->IELength;) {
+ if (i + 2 > pnetwork->IELength)
+ break;
pIE = (struct ndis_80211_var_ie *)(pnetwork->IEs + i);
+ if (i + 2 + pIE->Length > pnetwork->IELength)
+ break;
switch (pIE->ElementID) {
case _VENDOR_SPECIFIC_IE_:/* Get WMM IE. */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 625/699] PCI: controller: Use dev_fwnode() instead of of_fwnode_handle()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (623 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 624/699] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 626/699] PCI: mediatek: Convert bool to single quirks entry and bitmap Greg Kroah-Hartman
` (77 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Bjorn Helgaas,
Sasha Levin, Arnd Bergmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
[ Upstream commit a103d2dede5683dabbac2c3374bc24b6a9434478 ]
All irq_domain functions now accept fwnode instead of of_node. But many
PCI controllers still extract dev to of_node and then of_node to fwnode.
Instead, clean this up and simply use the dev_fwnode() helper to extract
fwnode directly from dev. Internally, it still does dev => of_node =>
fwnode steps, but it's now hidden from the users.
In the case of altera, this also removes an unused 'node' variable that is
only used when CONFIG_OF is enabled:
drivers/pci/controller/pcie-altera.c: In function 'altera_pcie_init_irq_domain':
drivers/pci/controller/pcie-altera.c:855:29: error: unused variable 'node' [-Werror=unused-variable]
855 | struct device_node *node = dev->of_node;
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de> # altera
[bhelgaas: squash together, rebase to precede msi-parent]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20250521163329.2137973-1-arnd@kernel.org
Link: https://patch.msgid.link/20250611104348.192092-16-jirislaby@kernel.org
Link: https://patch.msgid.link/20250723065907.1841758-1-jirislaby@kernel.org
Stable-dep-of: f865a57896bd ("PCI: mediatek: Fix IRQ domain leak when port fails to enable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-designware-host.c | 2 +-
drivers/pci/controller/mobiveil/pcie-mobiveil-host.c | 8 +++-----
drivers/pci/controller/pcie-altera-msi.c | 2 +-
drivers/pci/controller/pcie-altera.c | 3 +--
drivers/pci/controller/pcie-mediatek.c | 2 +-
drivers/pci/controller/pcie-xilinx-nwl.c | 2 +-
6 files changed, 8 insertions(+), 11 deletions(-)
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -233,7 +233,7 @@ static const struct irq_domain_ops dw_pc
int dw_pcie_allocate_domains(struct pcie_port *pp)
{
struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
- struct fwnode_handle *fwnode = of_node_to_fwnode(pci->dev->of_node);
+ struct fwnode_handle *fwnode = dev_fwnode(pci->dev);
pp->irq_domain = irq_domain_create_linear(fwnode, pp->num_vectors,
&dw_pcie_msi_domain_ops, pp);
--- a/drivers/pci/controller/mobiveil/pcie-mobiveil-host.c
+++ b/drivers/pci/controller/mobiveil/pcie-mobiveil-host.c
@@ -452,7 +452,7 @@ static const struct irq_domain_ops msi_d
static int mobiveil_allocate_msi_domains(struct mobiveil_pcie *pcie)
{
struct device *dev = &pcie->pdev->dev;
- struct fwnode_handle *fwnode = of_node_to_fwnode(dev->of_node);
+ struct fwnode_handle *fwnode = dev_fwnode(dev);
struct mobiveil_msi *msi = &pcie->rp.msi;
mutex_init(&msi->lock);
@@ -478,13 +478,11 @@ static int mobiveil_allocate_msi_domains
static int mobiveil_pcie_init_irq_domain(struct mobiveil_pcie *pcie)
{
struct device *dev = &pcie->pdev->dev;
- struct device_node *node = dev->of_node;
struct mobiveil_root_port *rp = &pcie->rp;
/* setup INTx */
- rp->intx_domain = irq_domain_add_linear(node, PCI_NUM_INTX,
- &intx_domain_ops, pcie);
-
+ rp->intx_domain = irq_domain_create_linear(dev_fwnode(dev), PCI_NUM_INTX, &intx_domain_ops,
+ pcie);
if (!rp->intx_domain) {
dev_err(dev, "Failed to get a INTx IRQ domain\n");
return -ENOMEM;
--- a/drivers/pci/controller/pcie-altera-msi.c
+++ b/drivers/pci/controller/pcie-altera-msi.c
@@ -173,7 +173,7 @@ static const struct irq_domain_ops msi_d
static int altera_allocate_domains(struct altera_msi *msi)
{
- struct fwnode_handle *fwnode = of_node_to_fwnode(msi->pdev->dev.of_node);
+ struct fwnode_handle *fwnode = dev_fwnode(&msi->pdev->dev);
msi->inner_domain = irq_domain_add_linear(NULL, msi->num_of_vectors,
&msi_domain_ops, msi);
--- a/drivers/pci/controller/pcie-altera.c
+++ b/drivers/pci/controller/pcie-altera.c
@@ -672,10 +672,9 @@ static void altera_pcie_isr(struct irq_d
static int altera_pcie_init_irq_domain(struct altera_pcie *pcie)
{
struct device *dev = &pcie->pdev->dev;
- struct device_node *node = dev->of_node;
/* Setup INTx */
- pcie->irq_domain = irq_domain_add_linear(node, PCI_NUM_INTX,
+ pcie->irq_domain = irq_domain_create_linear(dev_fwnode(dev), PCI_NUM_INTX,
&intx_domain_ops, pcie);
if (!pcie->irq_domain) {
dev_err(dev, "Failed to get a INTx IRQ domain\n");
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -497,7 +497,7 @@ static struct msi_domain_info mtk_msi_do
static int mtk_pcie_allocate_msi_domains(struct mtk_pcie_port *port)
{
- struct fwnode_handle *fwnode = of_node_to_fwnode(port->pcie->dev->of_node);
+ struct fwnode_handle *fwnode = dev_fwnode(port->pcie->dev);
mutex_init(&port->lock);
--- a/drivers/pci/controller/pcie-xilinx-nwl.c
+++ b/drivers/pci/controller/pcie-xilinx-nwl.c
@@ -515,7 +515,7 @@ static int nwl_pcie_init_msi_irq_domain(
{
#ifdef CONFIG_PCI_MSI
struct device *dev = pcie->dev;
- struct fwnode_handle *fwnode = of_node_to_fwnode(dev->of_node);
+ struct fwnode_handle *fwnode = dev_fwnode(dev);
struct nwl_msi *msi = &pcie->msi;
msi->dev_domain = irq_domain_add_linear(NULL, INT_PCI_MSI_NR,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 626/699] PCI: mediatek: Convert bool to single quirks entry and bitmap
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (624 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 625/699] PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 627/699] PCI: mediatek: Fix IRQ domain leak when port fails to enable Greg Kroah-Hartman
` (76 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Marangi,
Manivannan Sadhasivam, AngeloGioacchino Del Regno, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
[ Upstream commit 04305367fab7ec9c98eeba315ad09c8b20abce93 ]
To clean Mediatek SoC PCIe struct, convert all the bool to a bitmap and
use a single quirks to reference all the values. This permits cleaner
addition of new quirk without having to define a new bool in the struct.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patch.msgid.link/20251020111121.31779-4-ansuelsmth@gmail.com
Stable-dep-of: f865a57896bd ("PCI: mediatek: Fix IRQ domain leak when port fails to enable")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pcie-mediatek.c | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -141,21 +141,29 @@
struct mtk_pcie_port;
/**
+ * enum mtk_pcie_quirks - MTK PCIe quirks
+ * @MTK_PCIE_FIX_CLASS_ID: host's class ID needed to be fixed
+ * @MTK_PCIE_FIX_DEVICE_ID: host's device ID needed to be fixed
+ */
+enum mtk_pcie_quirks {
+ MTK_PCIE_FIX_CLASS_ID = BIT(0),
+ MTK_PCIE_FIX_DEVICE_ID = BIT(1),
+};
+
+/**
* struct mtk_pcie_soc - differentiate between host generations
- * @need_fix_class_id: whether this host's class ID needed to be fixed or not
- * @need_fix_device_id: whether this host's device ID needed to be fixed or not
* @device_id: device ID which this host need to be fixed
* @ops: pointer to configuration access functions
* @startup: pointer to controller setting functions
* @setup_irq: pointer to initialize IRQ functions
+ * @quirks: PCIe device quirks.
*/
struct mtk_pcie_soc {
- bool need_fix_class_id;
- bool need_fix_device_id;
unsigned int device_id;
struct pci_ops *ops;
int (*startup)(struct mtk_pcie_port *port);
int (*setup_irq)(struct mtk_pcie_port *port, struct device_node *node);
+ enum mtk_pcie_quirks quirks;
};
/**
@@ -710,7 +718,7 @@ static int mtk_pcie_startup_port_v2(stru
writel(val, port->base + PCIE_RST_CTRL);
/* Set up vendor ID and class code */
- if (soc->need_fix_class_id) {
+ if (soc->quirks & MTK_PCIE_FIX_CLASS_ID) {
val = PCI_VENDOR_ID_MEDIATEK;
writew(val, port->base + PCIE_CONF_VEND_ID);
@@ -718,7 +726,7 @@ static int mtk_pcie_startup_port_v2(stru
writew(val, port->base + PCIE_CONF_CLASS_ID);
}
- if (soc->need_fix_device_id)
+ if (soc->quirks & MTK_PCIE_FIX_DEVICE_ID)
writew(soc->device_id, port->base + PCIE_CONF_DEVICE_ID);
/* 100ms timeout value should be enough for Gen1/2 training */
@@ -1206,19 +1214,18 @@ static const struct mtk_pcie_soc mtk_pci
};
static const struct mtk_pcie_soc mtk_pcie_soc_mt7622 = {
- .need_fix_class_id = true,
.ops = &mtk_pcie_ops_v2,
.startup = mtk_pcie_startup_port_v2,
.setup_irq = mtk_pcie_setup_irq,
+ .quirks = MTK_PCIE_FIX_CLASS_ID,
};
static const struct mtk_pcie_soc mtk_pcie_soc_mt7629 = {
- .need_fix_class_id = true,
- .need_fix_device_id = true,
.device_id = PCI_DEVICE_ID_MEDIATEK_7629,
.ops = &mtk_pcie_ops_v2,
.startup = mtk_pcie_startup_port_v2,
.setup_irq = mtk_pcie_setup_irq,
+ .quirks = MTK_PCIE_FIX_CLASS_ID | MTK_PCIE_FIX_DEVICE_ID,
};
static const struct of_device_id mtk_pcie_ids[] = {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 627/699] PCI: mediatek: Fix IRQ domain leak when port fails to enable
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (625 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 626/699] PCI: mediatek: Convert bool to single quirks entry and bitmap Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 628/699] staging: rtl8723bs: remove DBG_871X log argument Greg Kroah-Hartman
` (75 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Manivannan Sadhasivam, Caleb James DeLisle, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
[ Upstream commit f865a57896bd92d7662eb2818d8f48872e2cbbc7 ]
When mtk_pcie_enable_port() fails, mtk_pcie_port_free() removes the port
from pcie->ports and frees the port structure. However, the IRQ domains set
up earlier by mtk_pcie_init_irq_domain() are never freed.
Fix this by refactoring mtk_pcie_irq_teardown() into a per-port helper,
mtk_pcie_irq_teardown_port(), and calling it from mtk_pcie_setup() when
mtk_pcie_enable_port() fails. Since the IRQ teardown must only happen in
the probe error path (during resume, child devices may have active MSI
mappings and the NOIRQ context prohibits sleeping locks),
mtk_pcie_enable_port() is changed to return an error code so callers can
distinguish the two paths and act accordingly.
This issue was reported by Sashiko while reviewing the EcoNet EN7528 SoC
support series.
Fixes: b099631df160 ("PCI: mediatek: Add controller support for MT2712 and MT7622")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Cc: stable@vger.kernel.org # 5.10
Cc: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://patch.msgid.link/20260521174617.17692-1-mani@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pcie-mediatek.c | 67 ++++++++++++++++++++-------------
1 file changed, 42 insertions(+), 25 deletions(-)
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -541,25 +541,29 @@ static void mtk_pcie_enable_msi(struct m
writel(val, port->base + PCIE_INT_MASK);
}
-static void mtk_pcie_irq_teardown(struct mtk_pcie *pcie)
+static void mtk_pcie_irq_teardown_port(struct mtk_pcie_port *port)
{
- struct mtk_pcie_port *port, *tmp;
+ irq_set_chained_handler_and_data(port->irq, NULL, NULL);
- list_for_each_entry_safe(port, tmp, &pcie->ports, list) {
- irq_set_chained_handler_and_data(port->irq, NULL, NULL);
+ if (port->irq_domain)
+ irq_domain_remove(port->irq_domain);
- if (port->irq_domain)
- irq_domain_remove(port->irq_domain);
+ if (IS_ENABLED(CONFIG_PCI_MSI)) {
+ if (port->msi_domain)
+ irq_domain_remove(port->msi_domain);
+ if (port->inner_domain)
+ irq_domain_remove(port->inner_domain);
+ }
- if (IS_ENABLED(CONFIG_PCI_MSI)) {
- if (port->msi_domain)
- irq_domain_remove(port->msi_domain);
- if (port->inner_domain)
- irq_domain_remove(port->inner_domain);
- }
+ irq_dispose_mapping(port->irq);
+}
- irq_dispose_mapping(port->irq);
- }
+static void mtk_pcie_irq_teardown(struct mtk_pcie *pcie)
+{
+ struct mtk_pcie_port *port, *tmp;
+
+ list_for_each_entry_safe(port, tmp, &pcie->ports, list)
+ mtk_pcie_irq_teardown_port(port);
}
static int mtk_pcie_intx_map(struct irq_domain *domain, unsigned int irq,
@@ -836,7 +840,7 @@ static int mtk_pcie_startup_port(struct
return 0;
}
-static void mtk_pcie_enable_port(struct mtk_pcie_port *port)
+static int mtk_pcie_enable_port(struct mtk_pcie_port *port)
{
struct mtk_pcie *pcie = port->pcie;
struct device *dev = pcie->dev;
@@ -845,7 +849,7 @@ static void mtk_pcie_enable_port(struct
err = clk_prepare_enable(port->sys_ck);
if (err) {
dev_err(dev, "failed to enable sys_ck%d clock\n", port->slot);
- goto err_sys_clk;
+ return err;
}
err = clk_prepare_enable(port->ahb_ck);
@@ -893,11 +897,15 @@ static void mtk_pcie_enable_port(struct
goto err_phy_on;
}
- if (!pcie->soc->startup(port))
- return;
+ err = pcie->soc->startup(port);
+ if (err) {
+ dev_info(dev, "Port%d link down\n", port->slot);
+ goto err_soc_startup;
+ }
- dev_info(dev, "Port%d link down\n", port->slot);
+ return 0;
+err_soc_startup:
phy_power_off(port->phy);
err_phy_on:
phy_exit(port->phy);
@@ -913,8 +921,8 @@ err_aux_clk:
clk_disable_unprepare(port->ahb_ck);
err_ahb_clk:
clk_disable_unprepare(port->sys_ck);
-err_sys_clk:
- mtk_pcie_port_free(port);
+
+ return err;
}
static int mtk_pcie_parse_port(struct mtk_pcie *pcie,
@@ -1077,8 +1085,13 @@ static int mtk_pcie_setup(struct mtk_pci
return err;
/* enable each port, and then check link status */
- list_for_each_entry_safe(port, tmp, &pcie->ports, list)
- mtk_pcie_enable_port(port);
+ list_for_each_entry_safe(port, tmp, &pcie->ports, list) {
+ err = mtk_pcie_enable_port(port);
+ if (err) {
+ mtk_pcie_irq_teardown_port(port);
+ mtk_pcie_port_free(port);
+ }
+ }
/* power down PCIe subsys if slots are all empty (link down) */
if (list_empty(&pcie->ports))
@@ -1181,14 +1194,18 @@ static int __maybe_unused mtk_pcie_resum
{
struct mtk_pcie *pcie = dev_get_drvdata(dev);
struct mtk_pcie_port *port, *tmp;
+ int err;
if (list_empty(&pcie->ports))
return 0;
clk_prepare_enable(pcie->free_ck);
- list_for_each_entry_safe(port, tmp, &pcie->ports, list)
- mtk_pcie_enable_port(port);
+ list_for_each_entry_safe(port, tmp, &pcie->ports, list) {
+ err = mtk_pcie_enable_port(port);
+ if (err)
+ mtk_pcie_port_free(port);
+ }
/* In case of EP was removed while system suspend. */
if (list_empty(&pcie->ports))
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 628/699] staging: rtl8723bs: remove DBG_871X log argument
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (626 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 627/699] PCI: mediatek: Fix IRQ domain leak when port fails to enable Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 629/699] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() Greg Kroah-Hartman
` (74 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Aiuto, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Aiuto <fabioaiuto83@gmail.com>
[ Upstream commit 42c3243ff23d119331a8ace011e0c18b222a1138 ]
This patch prepares the application of the semantic
patch aimed to remove all DBG_871X logs.
One occurrence of the DBG_871X macro has one
repeated argument, that's not even comma separated
value with the previous one nor a format string
parameter associated.
In normal conditions this worked, for the macro
is usually not expanded (the do nothing behaviour),
but if I try to apply the sempantic patch to remove
all macro occurrences, all macros call after that
abnormal declaration are left untouched (not removed).
Remove all of the DBG_871X logs as they currently
do nothing as they require the code to be modified by
hand in order to be turned on. This obviously has not happened
since the code was merged, so just remove them as they are unused.
Signed-off-by: Fabio Aiuto <fabioaiuto83@gmail.com>
Link: https://lore.kernel.org/r/3473925ae9ee5a3bcd0ab86613dbce80b6d3f33f.1617802415.git.fabioaiuto83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: ed51de4a86e1 ("staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8723bs/core/rtw_recv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/rtl8723bs/core/rtw_recv.c
+++ b/drivers/staging/rtl8723bs/core/rtw_recv.c
@@ -923,7 +923,7 @@ sint ap2sta_data_frame(
#ifdef DBG_RX_DROP_FRAME
DBG_871X("DBG_RX_DROP_FRAME %s BSSID ="MAC_FMT", mybssid ="MAC_FMT"\n",
__func__, MAC_ARG(pattrib->bssid), MAC_ARG(mybssid));
- DBG_871X("this adapter = %d, buddy adapter = %d\n", adapter->adapter_type, adapter->pbuddystruct adapter->adapter_type);
+ DBG_871X("this adapter = %d, buddy adapter = %d\n", adapter->adapter_type, adapter->pbuddystruct);
#endif
if (!bmcast) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 629/699] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (627 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 628/699] staging: rtl8723bs: remove DBG_871X log argument Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 630/699] PCI: Prevent resource tree corruption when BAR resize fails Greg Kroah-Hartman
` (73 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giovanni Cabiddu, Ahsan Atta,
Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit 277281c10c63791067d24d421f7c43a15faa9096 ]
The VF2PF interrupt handler queues PF-side response work that stores a
raw pointer to per-VF state (struct adf_accel_vf_info). Currently,
adf_disable_sriov() destroys per-VF mutexes and frees vf_info without
stopping new VF2PF work or waiting for in-flight workers to complete. A
concurrently scheduled or already queued worker can then dereference
freed memory.
This manifests as a use-after-free when KASAN is enabled:
BUG: KASAN: null-ptr-deref in mutex_lock+0x76/0xe0
Write of size 8 at addr 0000000000000260 by task kworker/24:2/...
Workqueue: qat_pf2vf_resp_wq adf_iov_send_resp [intel_qat]
Call Trace:
kasan_report+0x119/0x140
mutex_lock+0x76/0xe0
adf_gen4_pfvf_send+0xd4/0x1f0 [intel_qat]
adf_recv_and_handle_vf2pf_msg+0x290/0x360 [intel_qat]
adf_iov_send_resp+0x8c/0xe0 [intel_qat]
process_one_work+0x6ac/0xfd0
worker_thread+0x4dd/0xd30
kthread+0x326/0x410
ret_from_fork+0x33b/0x670
Add a PF-local flag, vf2pf_disabled, that gates work queueing, worker
processing, and interrupt re-enabling during teardown. Set this flag
atomically with the hardware interrupt mask inside
adf_disable_all_vf2pf_interrupts(). After masking, synchronize the AE
cluster MSI-X interrupt and flush the PF response workqueue before
tearing down per-VF locks and state so all in-flight work completes
before vf_info is destroyed.
Introduce adf_enable_all_vf2pf_interrupts() to clear the flag and
unmask all VF2PF interrupts under the same lock when SR-IOV is
re-enabled. This ensures the software flag and hardware state transition
atomically on both the enable and disable paths.
Cc: stable@vger.kernel.org
Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qat/qat_common/adf_accel_devices.h | 2 +
drivers/crypto/qat/qat_common/adf_common_drv.h | 4 ++
drivers/crypto/qat/qat_common/adf_isr.c | 18 ++++++++++
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 22 ++++++++++++
drivers/crypto/qat/qat_common/adf_sriov.c | 38 +++++++++++++++++-----
5 files changed, 76 insertions(+), 8 deletions(-)
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -191,6 +191,8 @@ struct adf_accel_dev {
struct adf_accel_pci accel_pci_dev;
union {
struct {
+ /* prevents VF2PF handling from racing with VF state teardown */
+ bool vf2pf_disabled;
/* vf_info is non-zero when SR-IOV is init'ed */
struct adf_accel_vf_info *vf_info;
} pf;
--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
+++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
@@ -125,6 +125,7 @@ void qat_asym_algs_unregister(void);
int adf_isr_resource_alloc(struct adf_accel_dev *accel_dev);
void adf_isr_resource_free(struct adf_accel_dev *accel_dev);
+void adf_isr_sync_ae_cluster(struct adf_accel_dev *accel_dev);
int adf_vf_isr_resource_alloc(struct adf_accel_dev *accel_dev);
void adf_vf_isr_resource_free(struct adf_accel_dev *accel_dev);
@@ -189,6 +190,9 @@ void adf_disable_vf2pf_interrupts(struct
u32 vf_mask);
void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev,
u32 vf_mask);
+void adf_enable_all_vf2pf_interrupts(struct adf_accel_dev *accel_dev,
+ u32 num_vfs);
+void adf_disable_all_vf2pf_interrupts(struct adf_accel_dev *accel_dev);
void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
--- a/drivers/crypto/qat/qat_common/adf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_isr.c
@@ -117,6 +117,24 @@ static irqreturn_t adf_msix_isr_ae(int i
return IRQ_NONE;
}
+void adf_isr_sync_ae_cluster(struct adf_accel_dev *accel_dev)
+{
+ struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
+ struct adf_hw_device_data *hw_data = accel_dev->hw_device;
+ struct msix_entry *msixe = pci_dev_info->msix_entries.entries;
+ u32 num_entries = pci_dev_info->msix_entries.num_entries;
+ u32 irq_idx;
+
+ if (!test_bit(ADF_STATUS_IRQ_ALLOCATED, &accel_dev->status) || !msixe)
+ return;
+
+ irq_idx = num_entries > 1 ? hw_data->num_banks : 0;
+ if (irq_idx >= num_entries)
+ return;
+
+ synchronize_irq(msixe[irq_idx].vector);
+}
+
static int adf_request_irqs(struct adf_accel_dev *accel_dev)
{
struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -40,6 +40,9 @@ void adf_enable_vf2pf_interrupts(struct
void __iomem *pmisc_addr = pmisc->virt_addr;
u32 reg;
+ if (READ_ONCE(accel_dev->pf.vf2pf_disabled))
+ return;
+
/* Enable VF2PF Messaging Ints - VFs 1 through 16 per vf_mask[15:0] */
if (vf_mask & 0xFFFF) {
reg = ADF_CSR_RD(pmisc_addr, ADF_DH895XCC_ERRMSK3);
@@ -55,6 +58,19 @@ void adf_enable_vf2pf_interrupts(struct
}
}
+void adf_enable_all_vf2pf_interrupts(struct adf_accel_dev *accel_dev,
+ u32 num_vfs)
+{
+ u32 vf_mask;
+
+ vf_mask = BIT_ULL(num_vfs) - 1;
+ if (!vf_mask)
+ return;
+
+ WRITE_ONCE(accel_dev->pf.vf2pf_disabled, false);
+ adf_enable_vf2pf_interrupts(accel_dev, vf_mask);
+}
+
void adf_disable_vf2pf_interrupts(struct adf_accel_dev *accel_dev, u32 vf_mask)
{
struct adf_hw_device_data *hw_data = accel_dev->hw_device;
@@ -78,6 +94,12 @@ void adf_disable_vf2pf_interrupts(struct
}
}
+void adf_disable_all_vf2pf_interrupts(struct adf_accel_dev *accel_dev)
+{
+ WRITE_ONCE(accel_dev->pf.vf2pf_disabled, true);
+ adf_disable_vf2pf_interrupts(accel_dev, GENMASK(31, 0));
+}
+
static int __adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
{
struct adf_accel_pci *pci_info = &accel_dev->accel_pci_dev;
--- a/drivers/crypto/qat/qat_common/adf_sriov.c
+++ b/drivers/crypto/qat/qat_common/adf_sriov.c
@@ -44,16 +44,27 @@ static void adf_iov_send_resp(struct wor
{
struct adf_pf2vf_resp *pf2vf_resp =
container_of(work, struct adf_pf2vf_resp, pf2vf_resp_work);
+ struct adf_accel_vf_info *vf_info = pf2vf_resp->vf_info;
+ struct adf_accel_dev *accel_dev = vf_info->accel_dev;
- adf_vf2pf_req_hndl(pf2vf_resp->vf_info);
+ if (READ_ONCE(accel_dev->pf.vf2pf_disabled))
+ goto out;
+
+ adf_vf2pf_req_hndl(vf_info);
+
+out:
kfree(pf2vf_resp);
}
static void adf_vf2pf_bh_handler(void *data)
{
struct adf_accel_vf_info *vf_info = (struct adf_accel_vf_info *)data;
+ struct adf_accel_dev *accel_dev = vf_info->accel_dev;
struct adf_pf2vf_resp *pf2vf_resp;
+ if (READ_ONCE(accel_dev->pf.vf2pf_disabled))
+ return;
+
pf2vf_resp = kzalloc(sizeof(*pf2vf_resp), GFP_ATOMIC);
if (!pf2vf_resp)
return;
@@ -63,6 +74,12 @@ static void adf_vf2pf_bh_handler(void *d
queue_work(pf2vf_resp_wq, &pf2vf_resp->pf2vf_resp_work);
}
+static void adf_flush_pf2vf_resp_wq(void)
+{
+ if (pf2vf_resp_wq)
+ flush_workqueue(pf2vf_resp_wq);
+}
+
static int adf_enable_sriov(struct adf_accel_dev *accel_dev)
{
struct pci_dev *pdev = accel_to_pci_dev(accel_dev);
@@ -105,7 +122,7 @@ static int adf_enable_sriov(struct adf_a
}
/* Enable VF to PF interrupts for all VFs */
- adf_enable_vf2pf_interrupts(accel_dev, GENMASK_ULL(totalvfs - 1, 0));
+ adf_enable_all_vf2pf_interrupts(accel_dev, totalvfs);
/*
* Due to the hardware design, when SR-IOV and the ring arbiter
@@ -142,8 +159,16 @@ void adf_disable_sriov(struct adf_accel_
pci_disable_sriov(accel_to_pci_dev(accel_dev));
- /* Disable VF to PF interrupts */
- adf_disable_vf2pf_interrupts(accel_dev, 0xFFFFFFFF);
+ /* Block VF2PF work and disable VF to PF interrupts */
+ adf_disable_all_vf2pf_interrupts(accel_dev);
+ adf_isr_sync_ae_cluster(accel_dev);
+
+ for (i = 0, vf = accel_dev->pf.vf_info; i < totalvfs; i++, vf++) {
+ tasklet_disable(&vf->vf2pf_bh_tasklet);
+ tasklet_kill(&vf->vf2pf_bh_tasklet);
+ }
+
+ adf_flush_pf2vf_resp_wq();
/* Clear Valid bits in ME Thread to PCIe Function Mapping Group A */
for (i = 0; i < ME2FUNCTION_MAP_A_NUM_REGS; i++) {
@@ -159,11 +184,8 @@ void adf_disable_sriov(struct adf_accel_
WRITE_CSR_ME2FUNCTION_MAP_B(pmisc_addr, i, reg);
}
- for (i = 0, vf = accel_dev->pf.vf_info; i < totalvfs; i++, vf++) {
- tasklet_disable(&vf->vf2pf_bh_tasklet);
- tasklet_kill(&vf->vf2pf_bh_tasklet);
+ for (i = 0, vf = accel_dev->pf.vf_info; i < totalvfs; i++, vf++)
mutex_destroy(&vf->pf2vf_lock);
- }
kfree(accel_dev->pf.vf_info);
accel_dev->pf.vf_info = NULL;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 630/699] PCI: Prevent resource tree corruption when BAR resize fails
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (628 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 629/699] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 631/699] PCI: Free saved list without holding pci_bus_sem Greg Kroah-Hartman
` (72 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Richter, Alex Bennée,
Ilpo Järvinen, Bjorn Helgaas, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 91c4c89db41499eea1b29c56655f79c3bae66e93 ]
pbus_reassign_bridge_resources() saves bridge windows into the saved
list before attempting to adjust resource assignments to perform a BAR
resize operation. If resource adjustments cannot be completed fully,
rollback is attempted by restoring the resource from the saved list.
The rollback, however, does not check whether the resources it restores were
assigned by the partial resize attempt. If restore changes addresses of the
resource, it can result in corrupting the resource tree.
An example of a corrupted resource tree with overlapping addresses:
6200000000000-6203fbfffffff : pciex@620c3c0000000
6200000000000-6203fbff0ffff : PCI Bus 0030:01
6200020000000-62000207fffff : 0030:01:00.0
6200000000000-6203fbff0ffff : PCI Bus 0030:02
A resource that are assigned into the resource tree must remain
unchanged. Thus, release such a resource before attempting to restore
and claim it back.
For simplicity, always do the release and claim back for the resource
even in the cases where it is restored to the same address range.
Note: this fix may "break" some cases where devices "worked" because
the resource tree corruption allowed address space double counting to
fit more resource than what can now be assigned without double
counting. The upcoming changes to BAR resizing should address those
scenarios (to the extent possible).
Fixes: 8bb705e3e79d ("PCI: Add pci_resize_resource() for resizing BARs")
Reported-by: Simon Richter <Simon.Richter@hogyros.de>
Link: https://lore.kernel.org/linux-pci/67840a16-99b4-4d8c-9b5c-4721ab0970a2@hogyros.de/
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Link: https://lore.kernel.org/linux-pci/874irqop6b.fsf@draig.linaro.org/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org> # AVA, AMD GPU
Link: https://patch.msgid.link/20251113162628.5946-2-ilpo.jarvinen@linux.intel.com
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/setup-bus.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2257,6 +2257,11 @@ cleanup:
bridge = dev_res->dev;
i = res - bridge->resource;
+ if (res->parent) {
+ release_child_resources(res);
+ pci_release_resource(bridge, i);
+ }
+
res->start = dev_res->start;
res->end = dev_res->end;
res->flags = dev_res->flags;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 631/699] PCI: Free saved list without holding pci_bus_sem
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (629 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 630/699] PCI: Prevent resource tree corruption when BAR resize fails Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 632/699] PCI: Fix restoring BARs on BAR resize rollback path Greg Kroah-Hartman
` (71 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Bjorn Helgaas,
Sasha Levin, Alex Bennée
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 1d8a0506f69895b7cfd9d5c4546761c508231a8a ]
Freeing the saved list does not require holding pci_bus_sem, so the
critical section can be made shorter.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org> # AVA, AMD GPU
Link: https://patch.msgid.link/20251113162628.5946-6-ilpo.jarvinen@linux.intel.com
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/setup-bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2269,8 +2269,8 @@ cleanup:
pci_claim_resource(bridge, i);
pci_setup_bridge(bridge->subordinate);
}
- free_list(&saved);
up_read(&pci_bus_sem);
+ free_list(&saved);
return ret;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 632/699] PCI: Fix restoring BARs on BAR resize rollback path
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (630 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 631/699] PCI: Free saved list without holding pci_bus_sem Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 633/699] PCI: Add kerneldoc for pci_resize_resource() Greg Kroah-Hartman
` (70 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Richter, Alex Bennée,
Ilpo Järvinen, Bjorn Helgaas, Christian König,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 337b1b566db087347194e4543ddfdfa5645275cc ]
BAR resize operation is implemented in the pci_resize_resource() and
pbus_reassign_bridge_resources() functions. pci_resize_resource() can be
called either from __resource_resize_store() from sysfs or directly by the
driver for the Endpoint Device.
The pci_resize_resource() requires that caller has released the device
resources that share the bridge window with the BAR to be resized as
otherwise the bridge window is pinned in place and cannot be changed.
pbus_reassign_bridge_resources() rolls back resources if the resize
operation fails, but rollback is performed only for the bridge windows.
Because releasing the device resources are done by the caller of the BAR
resize interface, these functions performing the BAR resize do not have
access to the device resources as they were before the resize.
pbus_reassign_bridge_resources() could try __pci_bridge_assign_resources()
after rolling back the bridge windows as they were, however, it will not
guarantee the resource are assigned due to differences in how FW and the
kernel assign the resources (alignment of the start address and tail).
To perform rollback robustly, the BAR resize interface has to be altered to
also release the device resources that share the bridge window with the BAR
to be resized.
Also, remove restoring from the entries failed list as saved list should
now contain both the bridge windows and device resources so the extra
restore is duplicated work.
Some drivers (currently only amdgpu) want to prevent releasing some
resources. Add exclude_bars param to pci_resize_resource() and make amdgpu
pass its register BAR (BAR 2 or 5), which should never be released during
resize operation. Normally 64-bit prefetchable resources do not share a
bridge window with the 32-bit only register BAR, but there are various
fallbacks in the resource assignment logic which may make the resources
share the bridge window in rare cases.
This change (together with the driver side changes) is to counter the
resource releases that had to be done to prevent resource tree corruption
in the ("PCI: Release assigned resource before restoring them") change. As
such, it likely restores functionality in cases where device resources were
released to avoid resource tree conflicts which appeared to be "working"
when such conflicts were not correctly detected by the kernel.
Reported-by: Simon Richter <Simon.Richter@hogyros.de>
Link: https://lore.kernel.org/linux-pci/f9a8c975-f5d3-4dd2-988e-4371a1433a60@hogyros.de/
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Link: https://lore.kernel.org/linux-pci/874irqop6b.fsf@draig.linaro.org/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[bhelgaas: squash amdgpu BAR selection from
https: //lore.kernel.org/r/20251114103053.13778-1-ilpo.jarvinen@linux.intel.com]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org> # AVA, AMD GPU
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patch.msgid.link/20251113162628.5946-7-ilpo.jarvinen@linux.intel.com
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 4 -
drivers/pci/pci.h | 3
drivers/pci/setup-bus.c | 97 +++++++++++++++++++----------
drivers/pci/setup-res.c | 19 +----
include/linux/pci.h | 4 -
5 files changed, 79 insertions(+), 48 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1141,7 +1141,9 @@ int amdgpu_device_resize_fb_bar(struct a
pci_release_resource(adev->pdev, 0);
- r = pci_resize_resource(adev->pdev, 0, rbar_size);
+ r = pci_resize_resource(adev->pdev, 0, rbar_size,
+ (adev->asic_type >= CHIP_BONAIRE) ? 1 << 5
+ : 1 << 2);
if (r == -ENOSPC)
DRM_INFO("Not enough PCI address space for a large BAR.");
else if (r && r != -ENOTSUPP)
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -284,6 +284,9 @@ enum pci_bar_type {
struct device *pci_get_host_bridge_device(struct pci_dev *dev);
void pci_put_host_bridge_device(struct device *dev);
+int pci_do_resource_release_and_resize(struct pci_dev *dev, int resno, int size,
+ int exclude_bars);
+
int pci_configure_extended_tags(struct pci_dev *dev, void *ign);
bool pci_bus_read_dev_vendor_id(struct pci_bus *bus, int devfn, u32 *pl,
int crs_timeout);
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -2166,18 +2166,16 @@ enable_all:
}
EXPORT_SYMBOL_GPL(pci_assign_unassigned_bridge_resources);
-int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type)
+static int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type,
+ struct list_head *saved)
{
struct pci_dev_resource *dev_res;
struct pci_dev *next;
- LIST_HEAD(saved);
LIST_HEAD(added);
LIST_HEAD(failed);
unsigned int i;
int ret;
- down_read(&pci_bus_sem);
-
/* Walk to the root hub, releasing bridge BARs when possible */
next = bridge;
do {
@@ -2193,9 +2191,9 @@ int pci_reassign_bridge_resources(struct
if (res->child)
continue;
- ret = add_to_list(&saved, bridge, res, 0, 0);
+ ret = add_to_list(saved, bridge, res, 0, 0);
if (ret)
- goto cleanup;
+ return ret;
pci_info(bridge, "BAR %d: releasing %pR\n",
i, res);
@@ -2212,67 +2210,104 @@ int pci_reassign_bridge_resources(struct
next = bridge->bus ? bridge->bus->self : NULL;
} while (next);
- if (list_empty(&saved)) {
- up_read(&pci_bus_sem);
+ if (list_empty(saved))
return -ENOENT;
- }
__pci_bus_size_bridges(bridge->subordinate, &added);
__pci_bridge_assign_resources(bridge, &added, &failed);
BUG_ON(!list_empty(&added));
if (!list_empty(&failed)) {
- ret = -ENOSPC;
- goto cleanup;
+ free_list(&failed);
+ return -ENOSPC;
}
- list_for_each_entry(dev_res, &saved, list) {
+ list_for_each_entry(dev_res, saved, list) {
/* Skip the bridge we just assigned resources for */
if (bridge == dev_res->dev)
continue;
+ if (!dev_res->dev->subordinate)
+ continue;
+
bridge = dev_res->dev;
pci_setup_bridge(bridge->subordinate);
}
- free_list(&saved);
- up_read(&pci_bus_sem);
return 0;
+}
-cleanup:
- /* Restore size and flags */
- list_for_each_entry(dev_res, &failed, list) {
- struct resource *res = dev_res->res;
+int pci_do_resource_release_and_resize(struct pci_dev *pdev, int resno, int size,
+ int exclude_bars)
+{
+ struct resource *res = pdev->resource + resno;
+ unsigned long flags = res->flags;
+ struct pci_dev_resource *dev_res;
+ struct pci_bus *bus = pdev->bus;
+ LIST_HEAD(saved);
+ unsigned int i;
+ int ret = 0;
- res->start = dev_res->start;
- res->end = dev_res->end;
- res->flags = dev_res->flags;
+ down_read(&pci_bus_sem);
+
+ for (i = 0; i < PCI_BRIDGE_RESOURCES; i++) {
+ struct resource *r = &pdev->resource[i];
+
+ if (exclude_bars & BIT(i))
+ continue;
+
+ if (!pci_resource_len(pdev, i) || r->flags != flags)
+ continue;
+
+ ret = add_to_list(&saved, pdev, r, 0, 0);
+ if (ret)
+ goto restore;
+ pci_release_resource(pdev, i);
}
- free_list(&failed);
+ res->end = res->start + pci_rebar_size_to_bytes(size) - 1;
+
+ if (!bus->self)
+ goto out;
+
+ ret = pci_reassign_bridge_resources(bus->self, res->flags, &saved);
+ if (ret)
+ goto restore;
+
+out:
+ up_read(&pci_bus_sem);
+ free_list(&saved);
+ return ret;
+
+restore:
/* Revert to the old configuration */
list_for_each_entry(dev_res, &saved, list) {
struct resource *res = dev_res->res;
+ struct pci_dev *dev = dev_res->dev;
- bridge = dev_res->dev;
- i = res - bridge->resource;
+ i = res - dev->resource;
if (res->parent) {
release_child_resources(res);
- pci_release_resource(bridge, i);
+ pci_release_resource(dev, i);
}
res->start = dev_res->start;
res->end = dev_res->end;
res->flags = dev_res->flags;
- pci_claim_resource(bridge, i);
- pci_setup_bridge(bridge->subordinate);
- }
- up_read(&pci_bus_sem);
- free_list(&saved);
+ if (pci_claim_resource(dev, i))
+ continue;
- return ret;
+ if (i < PCI_BRIDGE_RESOURCES) {
+ pci_update_resource(dev, i);
+ pci_info(dev, "BAR %d: old value restored %pR\n",
+ i, res);
+ }
+ if (dev->subordinate)
+ pci_setup_bridge(dev->subordinate);
+ }
+ goto out;
}
void pci_assign_unassigned_bus_resources(struct pci_bus *bus)
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -422,9 +422,9 @@ void pci_release_resource(struct pci_dev
}
EXPORT_SYMBOL(pci_release_resource);
-int pci_resize_resource(struct pci_dev *dev, int resno, int size)
+int pci_resize_resource(struct pci_dev *dev, int resno, int size,
+ int exclude_bars)
{
- struct resource *res = dev->resource + resno;
struct pci_host_bridge *host;
int old, ret;
u32 sizes;
@@ -435,10 +435,6 @@ int pci_resize_resource(struct pci_dev *
if (host->preserve_config)
return -ENOTSUPP;
- /* Make sure the resource isn't assigned before resizing it. */
- if (!(res->flags & IORESOURCE_UNSET))
- return -EBUSY;
-
pci_read_config_word(dev, PCI_COMMAND, &cmd);
if (cmd & PCI_COMMAND_MEMORY)
return -EBUSY;
@@ -458,19 +454,14 @@ int pci_resize_resource(struct pci_dev *
if (ret)
return ret;
- res->end = res->start + pci_rebar_size_to_bytes(size) - 1;
+ ret = pci_do_resource_release_and_resize(dev, resno, size, exclude_bars);
+ if (ret)
+ goto error_resize;
- /* Check if the new config works by trying to assign everything. */
- if (dev->bus->self) {
- ret = pci_reassign_bridge_resources(dev->bus->self, res->flags);
- if (ret)
- goto error_resize;
- }
return 0;
error_resize:
pci_rebar_set_size(dev, resno, old);
- res->end = res->start + pci_rebar_size_to_bytes(old) - 1;
return ret;
}
EXPORT_SYMBOL(pci_resize_resource);
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1257,7 +1257,8 @@ void pci_update_resource(struct pci_dev
int __must_check pci_assign_resource(struct pci_dev *dev, int i);
int __must_check pci_reassign_resource(struct pci_dev *dev, int i, resource_size_t add_size, resource_size_t align);
void pci_release_resource(struct pci_dev *dev, int resno);
-int __must_check pci_resize_resource(struct pci_dev *dev, int i, int size);
+int __must_check pci_resize_resource(struct pci_dev *dev, int i, int size,
+ int exclude_bars);
int pci_select_bars(struct pci_dev *dev, unsigned long flags);
bool pci_device_is_present(struct pci_dev *pdev);
void pci_ignore_hotplug(struct pci_dev *dev);
@@ -1332,7 +1333,6 @@ void pci_assign_unassigned_resources(voi
void pci_assign_unassigned_bridge_resources(struct pci_dev *bridge);
void pci_assign_unassigned_bus_resources(struct pci_bus *bus);
void pci_assign_unassigned_root_bus_resources(struct pci_bus *bus);
-int pci_reassign_bridge_resources(struct pci_dev *bridge, unsigned long type);
void pdev_enable_device(struct pci_dev *);
int pci_enable_resources(struct pci_dev *, int mask);
void pci_assign_irq(struct pci_dev *dev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 633/699] PCI: Add kerneldoc for pci_resize_resource()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (631 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 632/699] PCI: Fix restoring BARs on BAR resize rollback path Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 634/699] PCI: Move Resizable BAR code to rebar.c Greg Kroah-Hartman
` (69 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Bjorn Helgaas,
Sasha Levin, Alex Bennée
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit d787018e2dfdc4c1331538e7a8717690d1b7c9b3 ]
As pci_resize_resource() is meant to be used also outside of PCI core,
document the interface with kerneldoc.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org> # AVA, AMD GPU
Link: https://patch.msgid.link/20251113162628.5946-8-ilpo.jarvinen@linux.intel.com
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/setup-res.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -422,6 +422,26 @@ void pci_release_resource(struct pci_dev
}
EXPORT_SYMBOL(pci_release_resource);
+/**
+ * pci_resize_resource - reconfigure a Resizable BAR and resources
+ * @dev: the PCI device
+ * @resno: index of the BAR to be resized
+ * @size: new size as defined in the spec (0=1MB, 31=128TB)
+ * @exclude_bars: a mask of BARs that should not be released
+ *
+ * Reconfigure @resno to @size and re-run resource assignment algorithm
+ * with the new size.
+ *
+ * Prior to resize, release @dev resources that share a bridge window with
+ * @resno. This unpins the bridge window resource to allow changing it.
+ *
+ * The caller may prevent releasing a particular BAR by providing
+ * @exclude_bars mask, but this may result in the resize operation failing
+ * due to insufficient space.
+ *
+ * Return: 0 on success, or negative on error. In case of an error, the
+ * resources are restored to their original places.
+ */
int pci_resize_resource(struct pci_dev *dev, int resno, int size,
int exclude_bars)
{
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 634/699] PCI: Move Resizable BAR code to rebar.c
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (632 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 633/699] PCI: Add kerneldoc for pci_resize_resource() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 635/699] PCI: Skip Resizable BAR restore on read error Greg Kroah-Hartman
` (68 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Bjorn Helgaas,
Christian König, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 9f71938cd77f32a448f40a288e409eca60e55486 ]
For lack of a better place to put it, Resizable BAR code has been placed
inside pci.c and setup-res.c that do not use it for anything. Upcoming
changes are going to add more Resizable BAR related functions, increasing
the code size.
As pci.c is huge as is, move the Resizable BAR related code and the BAR
resize code from setup-res.c to rebar.c.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patch.msgid.link/20251113180053.27944-2-ilpo.jarvinen@linux.intel.com
Stable-dep-of: ee7471fe968d ("PCI: Skip Resizable BAR restore on read error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/driver-api/pci/pci.rst | 3
drivers/pci/Makefile | 2
drivers/pci/pci.c | 135 ----------------------
drivers/pci/pci.h | 1
drivers/pci/rebar.c | 211 +++++++++++++++++++++++++++++++++++
drivers/pci/setup-res.c | 64 ----------
6 files changed, 216 insertions(+), 200 deletions(-)
create mode 100644 drivers/pci/rebar.c
--- a/Documentation/driver-api/pci/pci.rst
+++ b/Documentation/driver-api/pci/pci.rst
@@ -31,6 +31,9 @@ PCI Support Library
.. kernel-doc:: drivers/pci/slot.c
:export:
+.. kernel-doc:: drivers/pci/rebar.c
+ :export:
+
.. kernel-doc:: drivers/pci/rom.c
:export:
--- a/drivers/pci/Makefile
+++ b/drivers/pci/Makefile
@@ -4,7 +4,7 @@
obj-$(CONFIG_PCI) += access.o bus.o probe.o host-bridge.o \
remove.o pci.o pci-driver.o search.o \
- pci-sysfs.o rom.o setup-res.o irq.o vpd.o \
+ pci-sysfs.o rebar.o rom.o setup-res.o irq.o vpd.o \
setup-bus.o vc.o mmap.o setup-irq.o
obj-$(CONFIG_PCI) += pcie/
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1626,33 +1626,6 @@ static void pci_restore_config_space(str
}
}
-static void pci_restore_rebar_state(struct pci_dev *pdev)
-{
- unsigned int pos, nbars, i;
- u32 ctrl;
-
- pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_REBAR);
- if (!pos)
- return;
-
- pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
- nbars = (ctrl & PCI_REBAR_CTRL_NBAR_MASK) >>
- PCI_REBAR_CTRL_NBAR_SHIFT;
-
- for (i = 0; i < nbars; i++, pos += 8) {
- struct resource *res;
- int bar_idx, size;
-
- pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
- bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
- res = pdev->resource + bar_idx;
- size = ilog2(resource_size(res)) - 20;
- ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE;
- ctrl |= size << PCI_REBAR_CTRL_BAR_SHIFT;
- pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl);
- }
-}
-
/**
* pci_restore_state - Restore the saved state of a PCI device
* @dev: PCI device that we're dealing with
@@ -3558,114 +3531,6 @@ void pci_acs_init(struct pci_dev *dev)
}
/**
- * pci_rebar_find_pos - find position of resize ctrl reg for BAR
- * @pdev: PCI device
- * @bar: BAR to find
- *
- * Helper to find the position of the ctrl register for a BAR.
- * Returns -ENOTSUPP if resizable BARs are not supported at all.
- * Returns -ENOENT if no ctrl register for the BAR could be found.
- */
-static int pci_rebar_find_pos(struct pci_dev *pdev, int bar)
-{
- unsigned int pos, nbars, i;
- u32 ctrl;
-
- pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_REBAR);
- if (!pos)
- return -ENOTSUPP;
-
- pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
- nbars = (ctrl & PCI_REBAR_CTRL_NBAR_MASK) >>
- PCI_REBAR_CTRL_NBAR_SHIFT;
-
- for (i = 0; i < nbars; i++, pos += 8) {
- int bar_idx;
-
- pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
- bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
- if (bar_idx == bar)
- return pos;
- }
-
- return -ENOENT;
-}
-
-/**
- * pci_rebar_get_possible_sizes - get possible sizes for BAR
- * @pdev: PCI device
- * @bar: BAR to query
- *
- * Get the possible sizes of a resizable BAR as bitmask defined in the spec
- * (bit 0=1MB, bit 19=512GB). Returns 0 if BAR isn't resizable.
- */
-u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar)
-{
- int pos;
- u32 cap;
-
- pos = pci_rebar_find_pos(pdev, bar);
- if (pos < 0)
- return 0;
-
- pci_read_config_dword(pdev, pos + PCI_REBAR_CAP, &cap);
- cap &= PCI_REBAR_CAP_SIZES;
-
- /* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */
- if (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x731f &&
- bar == 0 && cap == 0x7000)
- cap = 0x3f000;
-
- return cap >> 4;
-}
-
-/**
- * pci_rebar_get_current_size - get the current size of a BAR
- * @pdev: PCI device
- * @bar: BAR to set size to
- *
- * Read the size of a BAR from the resizable BAR config.
- * Returns size if found or negative error code.
- */
-int pci_rebar_get_current_size(struct pci_dev *pdev, int bar)
-{
- int pos;
- u32 ctrl;
-
- pos = pci_rebar_find_pos(pdev, bar);
- if (pos < 0)
- return pos;
-
- pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
- return (ctrl & PCI_REBAR_CTRL_BAR_SIZE) >> PCI_REBAR_CTRL_BAR_SHIFT;
-}
-
-/**
- * pci_rebar_set_size - set a new size for a BAR
- * @pdev: PCI device
- * @bar: BAR to set size to
- * @size: new size as defined in the spec (0=1MB, 19=512GB)
- *
- * Set the new size of a BAR as defined in the spec.
- * Returns zero if resizing was successful, error code otherwise.
- */
-int pci_rebar_set_size(struct pci_dev *pdev, int bar, int size)
-{
- int pos;
- u32 ctrl;
-
- pos = pci_rebar_find_pos(pdev, bar);
- if (pos < 0)
- return pos;
-
- pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
- ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE;
- ctrl |= size << PCI_REBAR_CTRL_BAR_SHIFT;
- pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl);
- return 0;
-}
-
-/**
* pci_enable_atomic_ops_to_root - enable AtomicOp requests to root port
* @dev: the PCI device
* @cap_mask: mask of desired AtomicOp sizes, including one or more of:
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -629,6 +629,7 @@ static inline int acpi_get_rc_resources(
#endif
u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar);
+void pci_restore_rebar_state(struct pci_dev *pdev);
int pci_rebar_get_current_size(struct pci_dev *pdev, int bar);
int pci_rebar_set_size(struct pci_dev *pdev, int bar, int size);
static inline u64 pci_rebar_size_to_bytes(int size)
--- /dev/null
+++ b/drivers/pci/rebar.c
@@ -0,0 +1,211 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * PCI Resizable BAR Extended Capability handling.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/errno.h>
+#include <linux/export.h>
+#include <linux/ioport.h>
+#include <linux/pci.h>
+#include <linux/types.h>
+
+#include "pci.h"
+
+/**
+ * pci_rebar_find_pos - find position of resize ctrl reg for BAR
+ * @pdev: PCI device
+ * @bar: BAR to find
+ *
+ * Helper to find the position of the ctrl register for a BAR.
+ * Returns -ENOTSUPP if resizable BARs are not supported at all.
+ * Returns -ENOENT if no ctrl register for the BAR could be found.
+ */
+static int pci_rebar_find_pos(struct pci_dev *pdev, int bar)
+{
+ unsigned int pos, nbars, i;
+ u32 ctrl;
+
+ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_REBAR);
+ if (!pos)
+ return -ENOTSUPP;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ nbars = (ctrl & PCI_REBAR_CTRL_NBAR_MASK) >>
+ PCI_REBAR_CTRL_NBAR_SHIFT;
+
+ for (i = 0; i < nbars; i++, pos += 8) {
+ int bar_idx;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
+ if (bar_idx == bar)
+ return pos;
+ }
+
+ return -ENOENT;
+}
+
+/**
+ * pci_rebar_get_possible_sizes - get possible sizes for BAR
+ * @pdev: PCI device
+ * @bar: BAR to query
+ *
+ * Get the possible sizes of a resizable BAR as bitmask defined in the spec
+ * (bit 0=1MB, bit 19=512GB). Returns 0 if BAR isn't resizable.
+ */
+u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar)
+{
+ int pos;
+ u32 cap;
+
+ pos = pci_rebar_find_pos(pdev, bar);
+ if (pos < 0)
+ return 0;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CAP, &cap);
+ cap &= PCI_REBAR_CAP_SIZES;
+
+ /* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */
+ if (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x731f &&
+ bar == 0 && cap == 0x7000)
+ cap = 0x3f000;
+
+ return cap >> 4;
+}
+
+/**
+ * pci_rebar_get_current_size - get the current size of a BAR
+ * @pdev: PCI device
+ * @bar: BAR to set size to
+ *
+ * Read the size of a BAR from the resizable BAR config.
+ * Returns size if found or negative error code.
+ */
+int pci_rebar_get_current_size(struct pci_dev *pdev, int bar)
+{
+ int pos;
+ u32 ctrl;
+
+ pos = pci_rebar_find_pos(pdev, bar);
+ if (pos < 0)
+ return pos;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ return (ctrl & PCI_REBAR_CTRL_BAR_SIZE) >> PCI_REBAR_CTRL_BAR_SHIFT;
+}
+
+/**
+ * pci_rebar_set_size - set a new size for a BAR
+ * @pdev: PCI device
+ * @bar: BAR to set size to
+ * @size: new size as defined in the spec (0=1MB, 19=512GB)
+ *
+ * Set the new size of a BAR as defined in the spec.
+ * Returns zero if resizing was successful, error code otherwise.
+ */
+int pci_rebar_set_size(struct pci_dev *pdev, int bar, int size)
+{
+ int pos;
+ u32 ctrl;
+
+ pos = pci_rebar_find_pos(pdev, bar);
+ if (pos < 0)
+ return pos;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE;
+ ctrl |= size << PCI_REBAR_CTRL_BAR_SHIFT;
+ pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl);
+ return 0;
+}
+
+void pci_restore_rebar_state(struct pci_dev *pdev)
+{
+ unsigned int pos, nbars, i;
+ u32 ctrl;
+
+ pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_REBAR);
+ if (!pos)
+ return;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ nbars = FIELD_GET(PCI_REBAR_CTRL_NBAR_MASK, ctrl);
+
+ for (i = 0; i < nbars; i++, pos += 8) {
+ struct resource *res;
+ int bar_idx, size;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
+ res = pdev->resource + bar_idx;
+ size = ilog2(resource_size(res)) - 20;
+ ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE;
+ ctrl |= size << PCI_REBAR_CTRL_BAR_SHIFT;
+ pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl);
+ }
+}
+
+/**
+ * pci_resize_resource - reconfigure a Resizable BAR and resources
+ * @dev: the PCI device
+ * @resno: index of the BAR to be resized
+ * @size: new size as defined in the spec (0=1MB, 31=128TB)
+ * @exclude_bars: a mask of BARs that should not be released
+ *
+ * Reconfigure @resno to @size and re-run resource assignment algorithm
+ * with the new size.
+ *
+ * Prior to resize, release @dev resources that share a bridge window with
+ * @resno. This unpins the bridge window resource to allow changing it.
+ *
+ * The caller may prevent releasing a particular BAR by providing
+ * @exclude_bars mask, but this may result in the resize operation failing
+ * due to insufficient space.
+ *
+ * Return: 0 on success, or negative on error. In case of an error, the
+ * resources are restored to their original places.
+ */
+int pci_resize_resource(struct pci_dev *dev, int resno, int size,
+ int exclude_bars)
+{
+ struct pci_host_bridge *host;
+ int old, ret;
+ u32 sizes;
+ u16 cmd;
+
+ /* Check if we must preserve the firmware's resource assignment */
+ host = pci_find_host_bridge(dev->bus);
+ if (host->preserve_config)
+ return -ENOTSUPP;
+
+ pci_read_config_word(dev, PCI_COMMAND, &cmd);
+ if (cmd & PCI_COMMAND_MEMORY)
+ return -EBUSY;
+
+ sizes = pci_rebar_get_possible_sizes(dev, resno);
+ if (!sizes)
+ return -ENOTSUPP;
+
+ if (!(sizes & BIT(size)))
+ return -EINVAL;
+
+ old = pci_rebar_get_current_size(dev, resno);
+ if (old < 0)
+ return old;
+
+ ret = pci_rebar_set_size(dev, resno, size);
+ if (ret)
+ return ret;
+
+ ret = pci_do_resource_release_and_resize(dev, resno, size, exclude_bars);
+ if (ret)
+ goto error_resize;
+
+ return 0;
+
+error_resize:
+ pci_rebar_set_size(dev, resno, old);
+ return ret;
+}
+EXPORT_SYMBOL(pci_resize_resource);
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -422,70 +422,6 @@ void pci_release_resource(struct pci_dev
}
EXPORT_SYMBOL(pci_release_resource);
-/**
- * pci_resize_resource - reconfigure a Resizable BAR and resources
- * @dev: the PCI device
- * @resno: index of the BAR to be resized
- * @size: new size as defined in the spec (0=1MB, 31=128TB)
- * @exclude_bars: a mask of BARs that should not be released
- *
- * Reconfigure @resno to @size and re-run resource assignment algorithm
- * with the new size.
- *
- * Prior to resize, release @dev resources that share a bridge window with
- * @resno. This unpins the bridge window resource to allow changing it.
- *
- * The caller may prevent releasing a particular BAR by providing
- * @exclude_bars mask, but this may result in the resize operation failing
- * due to insufficient space.
- *
- * Return: 0 on success, or negative on error. In case of an error, the
- * resources are restored to their original places.
- */
-int pci_resize_resource(struct pci_dev *dev, int resno, int size,
- int exclude_bars)
-{
- struct pci_host_bridge *host;
- int old, ret;
- u32 sizes;
- u16 cmd;
-
- /* Check if we must preserve the firmware's resource assignment */
- host = pci_find_host_bridge(dev->bus);
- if (host->preserve_config)
- return -ENOTSUPP;
-
- pci_read_config_word(dev, PCI_COMMAND, &cmd);
- if (cmd & PCI_COMMAND_MEMORY)
- return -EBUSY;
-
- sizes = pci_rebar_get_possible_sizes(dev, resno);
- if (!sizes)
- return -ENOTSUPP;
-
- if (!(sizes & BIT(size)))
- return -EINVAL;
-
- old = pci_rebar_get_current_size(dev, resno);
- if (old < 0)
- return old;
-
- ret = pci_rebar_set_size(dev, resno, size);
- if (ret)
- return ret;
-
- ret = pci_do_resource_release_and_resize(dev, resno, size, exclude_bars);
- if (ret)
- goto error_resize;
-
- return 0;
-
-error_resize:
- pci_rebar_set_size(dev, resno, old);
- return ret;
-}
-EXPORT_SYMBOL(pci_resize_resource);
-
int pci_enable_resources(struct pci_dev *dev, int mask)
{
u16 cmd, old_cmd;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 635/699] PCI: Skip Resizable BAR restore on read error
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (633 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 634/699] PCI: Move Resizable BAR code to rebar.c Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 636/699] coresight: etb10: restore atomic_t for shared reading state Greg Kroah-Hartman
` (67 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Nenciarini, Bjorn Helgaas,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Nenciarini <mnencia@kcore.it>
[ Upstream commit ee7471fe968d210939be9046089a924cd23c8c3b ]
pci_restore_rebar_state() uses the Resizable BAR Control register to decide
how many BARs to restore (nbars) and which BAR each iteration addresses
(bar_idx).
When a device does not respond, config reads typically return
PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx
both evaluate to 7, past the spec's valid ranges for both fields.
pci_resource_n() then returns an unrelated resource slot, whose size is
used to derive a nonsensical value written back to the Resizable BAR
Control register.
Bail out if any Resizable BAR Control read returns PCI_ERROR_RESPONSE. No
further BARs are touched, which is safe because a config read that returns
PCI_ERROR_RESPONSE indicates the device is unreachable and restoration is
pointless.
Fixes: d3252ace0bc6 ("PCI: Restore resized BAR state on resume")
Signed-off-by: Marco Nenciarini <mnencia@kcore.it>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/666cac19b5daa0ab0e0ab64454e76b4d24465dbd.1776429882.git.mnencia@kcore.it
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/rebar.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/pci/rebar.c
+++ b/drivers/pci/rebar.c
@@ -130,6 +130,9 @@ void pci_restore_rebar_state(struct pci_
return;
pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ if (PCI_POSSIBLE_ERROR(ctrl))
+ return;
+
nbars = FIELD_GET(PCI_REBAR_CTRL_NBAR_MASK, ctrl);
for (i = 0; i < nbars; i++, pos += 8) {
@@ -137,6 +140,9 @@ void pci_restore_rebar_state(struct pci_
int bar_idx, size;
pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ if (PCI_POSSIBLE_ERROR(ctrl))
+ return;
+
bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
res = pdev->resource + bar_idx;
size = ilog2(resource_size(res)) - 20;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 636/699] coresight: etb10: restore atomic_t for shared reading state
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (634 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 635/699] PCI: Skip Resizable BAR restore on read error Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 637/699] netfilter: ebtables: Use vmalloc_array() to improve code Greg Kroah-Hartman
` (66 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, James Clark,
Suzuki K Poulose, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit fa09f08ede3db3050ae16ae1ed92c902d0cada23 ]
The etb10 miscdevice uses drvdata->reading as a shared exclusivity gate
for userspace buffer access. etb_open() claims that gate with
local_cmpxchg(), and etb_release() clears it with local_set().
That gate is shared per-device state rather than CPU-local state. A
running system can reach it whenever /dev/<etb> is opened, closed, and
reopened by different tasks while the device remains registered, so the
same drvdata->reading variable may be claimed on one CPU and later
cleared on another.
This code used to use atomic_t for the same gate, but commit
27b10da8fff2 ("coresight: etb10: moving to local atomic operations")
changed it to local_t even though the access pattern remained cross-task
and cross-CPU. Restore atomic_t together with atomic_cmpxchg() and
atomic_set() so the exclusivity gate again uses a primitive intended
for shared state.
The issue was found on Linux v6.18.21 by our static analysis tool while
scanning surviving local_t-on-shared-state sites, and then manually
reviewed against the live etb10 file-op path.
It was runtime-validated with a reproducible QEMU no-device KCSAN PoC
that kept the same report-local contract:
1. use one shared struct etb_drvdata carrier and its
drvdata->reading gate;
2. call etb_open() and etb_release() sequentially on that gate to
confirm the original claim/clear path;
3. bind the open side to CPU0 and the release side to CPU1 for the
same gate to show cross-CPU ownership;
4. run bound workers that repeatedly race etb_open() and
etb_release() on the same gate until KCSAN reports a target hit.
The harness recorded:
L1 passed open=1 release=1
reading_after_open=1 reading_after_release=0
L2 passed open_cpu=0 release_cpu=1
cross_cpu_release=1 reading_after=0 open_ret=0
Representative KCSAN excerpt from the no-device validation run:
BUG: KCSAN: data-race in etb_open.constprop.0.isra.0 [vuln_msv]
write to 0xffffffffc0003810 of 4 bytes by task 216 on cpu 1:
etb_open.constprop.0.isra.0+0x38/0x80 [vuln_msv]
l3_worker_thread_fn+0x4f/0xf0 [vuln_msv]
kthread+0x17e/0x1c0
ret_from_fork+0x22/0x30
read to 0xffffffffc0003810 of 4 bytes by task 215 on cpu 0:
etb_open.constprop.0.isra.0+0x18/0x80 [vuln_msv]
l3_worker_thread_fn+0x4f/0xf0 [vuln_msv]
kthread+0x17e/0x1c0
ret_from_fork+0x22/0x30
value changed: 0x00000000 -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 215 Comm: etb10_l3_a Tainted: G O 6.1.66 #2
This no-device harness is not a real ETB10 hardware end-to-end run, but
it preserves the same shared drvdata->reading gate and the same
etb_open()/etb_release() claim/clear contract. No real ETB10 hardware
was available for runtime testing.
Build-tested with:
make olddefconfig
make -j"$(nproc)" drivers/hwtracing/coresight/coresight-etb10.o
Fixes: 27b10da8fff2 ("coresight: etb10: moving to local atomic operations")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20260528165201.319452-1-runyu.xiao@seu.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/coresight-etb10.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -86,7 +86,7 @@ struct etb_drvdata {
struct coresight_device *csdev;
struct miscdevice miscdev;
spinlock_t spinlock;
- local_t reading;
+ atomic_t reading;
pid_t pid;
u8 *buf;
u32 mode;
@@ -603,7 +603,7 @@ static int etb_open(struct inode *inode,
struct etb_drvdata *drvdata = container_of(file->private_data,
struct etb_drvdata, miscdev);
- if (local_cmpxchg(&drvdata->reading, 0, 1))
+ if (atomic_cmpxchg(&drvdata->reading, 0, 1))
return -EBUSY;
dev_dbg(&drvdata->csdev->dev, "%s: successfully opened\n", __func__);
@@ -641,7 +641,7 @@ static int etb_release(struct inode *ino
{
struct etb_drvdata *drvdata = container_of(file->private_data,
struct etb_drvdata, miscdev);
- local_set(&drvdata->reading, 0);
+ atomic_set(&drvdata->reading, 0);
dev_dbg(&drvdata->csdev->dev, "%s: released\n", __func__);
return 0;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 637/699] netfilter: ebtables: Use vmalloc_array() to improve code
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (635 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 636/699] coresight: etb10: restore atomic_t for shared reading state Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 638/699] netfilter: ebtables: zero chainstack array Greg Kroah-Hartman
` (65 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit 46015e6b3ea75297b28d4806564f3f692cf11861 ]
Remove array_size() calls and replace vmalloc() with vmalloc_array() to
simplify the code. vmalloc_array() is also optimized better, uses fewer
instructions, and handles overflow more concisely[1].
[1]: https://lore.kernel.org/lkml/abc66ec5-85a4-47e1-9759-2f60ab111971@vivo.com/
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Stable-dep-of: cbfe53599eeb ("netfilter: ebtables: zero chainstack array")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -884,8 +884,8 @@ static int translate_table(struct net *n
* if an error occurs
*/
newinfo->chainstack =
- vmalloc(array_size(nr_cpu_ids,
- sizeof(*(newinfo->chainstack))));
+ vmalloc_array(nr_cpu_ids,
+ sizeof(*(newinfo->chainstack)));
if (!newinfo->chainstack)
return -ENOMEM;
for_each_possible_cpu(i) {
@@ -900,7 +900,7 @@ static int translate_table(struct net *n
}
}
- cl_s = vmalloc(array_size(udc_cnt, sizeof(*cl_s)));
+ cl_s = vmalloc_array(udc_cnt, sizeof(*cl_s));
if (!cl_s)
return -ENOMEM;
i = 0; /* the i'th udc */
@@ -980,8 +980,8 @@ static int do_replace_finish(struct net
* the check on the size is done later, when we have the lock
*/
if (repl->num_counters) {
- unsigned long size = repl->num_counters * sizeof(*counterstmp);
- counterstmp = vmalloc(size);
+ counterstmp = vmalloc_array(repl->num_counters,
+ sizeof(*counterstmp));
if (!counterstmp)
return -ENOMEM;
}
@@ -1276,7 +1276,7 @@ static int do_update_counters(struct net
if (num_counters == 0)
return -EINVAL;
- tmp = vmalloc(array_size(num_counters, sizeof(*tmp)));
+ tmp = vmalloc_array(num_counters, sizeof(*tmp));
if (!tmp)
return -ENOMEM;
@@ -1417,7 +1417,7 @@ static int copy_counters_to_user(struct
if (num_counters != nentries)
return -EINVAL;
- counterstmp = vmalloc(array_size(nentries, sizeof(*counterstmp)));
+ counterstmp = vmalloc_array(nentries, sizeof(*counterstmp));
if (!counterstmp)
return -ENOMEM;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 638/699] netfilter: ebtables: zero chainstack array
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (636 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 637/699] netfilter: ebtables: Use vmalloc_array() to improve code Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 639/699] Bluetooth: L2CAP: Fix not tracking outstanding TX ident Greg Kroah-Hartman
` (64 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit cbfe53599eebffd188938ab6774cc41794f6f9d5 ]
sashiko reports:
looking at ebtables table
translation, could a sparse cpu_possible_mask lead to an uninitialized pointer
free?
If cpu_possible_mask is sparse (for example, CPU 0 and CPU 2 are possible,
but CPU 1 is not), the allocation loop skips CPU 1. If vmalloc_node() fails at
CPU 2, the cleanup loop will blindly decrement and call vfree() on
newinfo->chainstack[1].
Not a real-world bug, such allocation isn't expected to fail
in the first place.
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bridge/netfilter/ebtables.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -884,8 +884,7 @@ static int translate_table(struct net *n
* if an error occurs
*/
newinfo->chainstack =
- vmalloc_array(nr_cpu_ids,
- sizeof(*(newinfo->chainstack)));
+ vcalloc(nr_cpu_ids, sizeof(*(newinfo->chainstack)));
if (!newinfo->chainstack)
return -ENOMEM;
for_each_possible_cpu(i) {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 639/699] Bluetooth: L2CAP: Fix not tracking outstanding TX ident
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (637 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 638/699] netfilter: ebtables: zero chainstack array Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 640/699] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Greg Kroah-Hartman
` (63 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Paul Menzel,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 6c3ea155e5ee3e56606233acde8309afda66d483 ]
This attempts to proper track outstanding request by using struct ida
and allocating from it in l2cap_get_ident using ida_alloc_range which
would reuse ids as they are free, then upon completion release
the id using ida_free.
This fixes the qualification test case L2CAP/COS/CED/BI-29-C which
attempts to check if the host stack is able to work after 256 attempts
to connect which requires Ident field to use the full range of possible
values in order to pass the test.
Link: https://github.com/bluez/bluez/issues/1829
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Stable-dep-of: 2641a9e0a1dd ("Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/bluetooth/l2cap.h | 3 --
net/bluetooth/l2cap_core.c | 53 ++++++++++++++++++++++++++++++------------
2 files changed, 40 insertions(+), 16 deletions(-)
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -690,8 +690,7 @@ struct l2cap_conn {
struct sk_buff *rx_skb;
__u32 rx_len;
- __u8 tx_ident;
- struct mutex ident_lock;
+ struct ida tx_ida;
struct sk_buff_head pending_rx;
struct work_struct pending_rx_work;
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -939,26 +939,18 @@ int l2cap_chan_check_security(struct l2c
initiator);
}
-static u8 l2cap_get_ident(struct l2cap_conn *conn)
+static int l2cap_get_ident(struct l2cap_conn *conn)
{
- u8 id;
+ /* LE link does not support tools like l2ping so use the full range */
+ if (conn->hcon->type == LE_LINK)
+ return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
/* Get next available identificator.
* 1 - 128 are used by kernel.
* 129 - 199 are reserved.
* 200 - 254 are used by utilities like l2ping, etc.
*/
-
- mutex_lock(&conn->ident_lock);
-
- if (++conn->tx_ident > 128)
- conn->tx_ident = 1;
-
- id = conn->tx_ident;
-
- mutex_unlock(&conn->ident_lock);
-
- return id;
+ return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
}
static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
@@ -1917,6 +1909,8 @@ static void l2cap_conn_del(struct hci_co
if (work_pending(&conn->pending_rx_work))
cancel_work_sync(&conn->pending_rx_work);
+ ida_destroy(&conn->tx_ida);
+
if (work_pending(&conn->id_addr_update_work))
cancel_work_sync(&conn->id_addr_update_work);
@@ -5788,12 +5782,41 @@ unlock:
return err;
}
+static void l2cap_put_ident(struct l2cap_conn *conn, u8 code, u8 id)
+{
+ int ret;
+
+ switch (code) {
+ case L2CAP_COMMAND_REJ:
+ case L2CAP_CONN_RSP:
+ case L2CAP_CONF_RSP:
+ case L2CAP_DISCONN_RSP:
+ case L2CAP_ECHO_RSP:
+ case L2CAP_INFO_RSP:
+ case L2CAP_CONN_PARAM_UPDATE_RSP:
+ case L2CAP_ECRED_CONN_RSP:
+ case L2CAP_ECRED_RECONF_RSP:
+ /* The remote may send bogus ids that would make ida_free
+ * generate warnings, so only free ids that are actually
+ * allocated: probing the exact id returns -ENOSPC when it
+ * is in use, otherwise the probe allocated it and freeing
+ * is safe either way. Only on -ENOMEM is the id known to
+ * be unallocated and the free must be skipped.
+ */
+ ret = ida_alloc_range(&conn->tx_ida, id, id, GFP_ATOMIC);
+ if (ret >= 0 || ret == -ENOSPC)
+ ida_free(&conn->tx_ida, id);
+ }
+}
+
static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
struct l2cap_cmd_hdr *cmd, u16 cmd_len,
u8 *data)
{
int err = 0;
+ l2cap_put_ident(conn, cmd->code, cmd->ident);
+
switch (cmd->code) {
case L2CAP_COMMAND_REJ:
l2cap_command_rej(conn, cmd, cmd_len, data);
@@ -6532,6 +6555,8 @@ static inline int l2cap_le_sig_cmd(struc
{
int err = 0;
+ l2cap_put_ident(conn, cmd->code, cmd->ident);
+
switch (cmd->code) {
case L2CAP_COMMAND_REJ:
l2cap_le_command_rej(conn, cmd, cmd_len, data);
@@ -8085,13 +8110,13 @@ static struct l2cap_conn *l2cap_conn_add
hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
- mutex_init(&conn->ident_lock);
mutex_init(&conn->chan_lock);
INIT_LIST_HEAD(&conn->chan_l);
INIT_LIST_HEAD(&conn->users);
INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
+ ida_init(&conn->tx_ida);
skb_queue_head_init(&conn->pending_rx);
INIT_WORK(&conn->pending_rx_work, process_pending_rx);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 640/699] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (638 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 639/699] Bluetooth: L2CAP: Fix not tracking outstanding TX ident Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 641/699] Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Greg Kroah-Hartman
` (62 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 00fdebbbc557a2fc21321ff2eaa22fd70c078608 ]
l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer
and id_addr_timer while holding conn->lock. However, the work functions
l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire
conn->lock, creating a potential AB-BA deadlock if the work is already
executing when l2cap_conn_del() takes the lock.
Move the work cancellations before acquiring conn->lock and use
disable_delayed_work_sync() to additionally prevent the works from
being rearmed after cancellation, consistent with the pattern used in
hci_conn_del().
Fixes: ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Stable-dep-of: 2641a9e0a1dd ("Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1898,6 +1898,9 @@ static void l2cap_conn_del(struct hci_co
BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
+ cancel_delayed_work_sync(&conn->info_timer);
+ cancel_work_sync(&conn->id_addr_update_work);
+
kfree_skb(conn->rx_skb);
skb_queue_purge(&conn->pending_rx);
@@ -1911,9 +1914,6 @@ static void l2cap_conn_del(struct hci_co
ida_destroy(&conn->tx_ida);
- if (work_pending(&conn->id_addr_update_work))
- cancel_work_sync(&conn->id_addr_update_work);
-
l2cap_unregister_all_users(conn);
/* Force the connection to be immediately dropped */
@@ -1938,9 +1938,6 @@ static void l2cap_conn_del(struct hci_co
hci_chan_del(conn->hchan);
- if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
- cancel_delayed_work_sync(&conn->info_timer);
-
hcon->l2cap_data = NULL;
conn->hchan = NULL;
l2cap_conn_put(conn);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 641/699] Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (639 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 640/699] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 642/699] smb: client: Fix next buffer leak in receive_encrypted_standard() Greg Kroah-Hartman
` (61 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
[ Upstream commit 2641a9e0a1dd4af2e21995470a21d55dd35e5203 ]
l2cap_conn_del() takes conn->lock and then calls cancel_work_sync() for
pending_rx_work. process_pending_rx() takes the same mutex, so teardown
can deadlock against the worker it is flushing.
This issue was found by our static analysis tool and then manually
reviewed against the current tree.
The grounded PoC kept the l2cap_conn_ready() -> queue_work(...,
&conn->pending_rx_work) submit path, the l2cap_conn_del() ->
cancel_work_sync(&conn->pending_rx_work) teardown path, and the
process_pending_rx() -> mutex_lock(&conn->lock) worker edge. Lockdep
reported:
WARNING: possible circular locking dependency detected
process_pending_rx+0x21/0x2a [vuln_msv]
l2cap_conn_del.constprop.0+0x3f/0x4e [vuln_msv]
*** DEADLOCK ***
Cancel pending_rx_work before taking conn->lock, matching the existing
lock-before-drain ordering used for the two delayed works in the same
teardown path. The pending_rx queue is still purged after the work has
been cancelled and conn->lock has been acquired.
Fixes: 7ab56c3a6ecc ("Bluetooth: Fix deadlock in l2cap_conn_del()")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1901,17 +1901,11 @@ static void l2cap_conn_del(struct hci_co
cancel_delayed_work_sync(&conn->info_timer);
cancel_work_sync(&conn->id_addr_update_work);
+ cancel_work_sync(&conn->pending_rx_work);
+
kfree_skb(conn->rx_skb);
skb_queue_purge(&conn->pending_rx);
-
- /* We can not call flush_work(&conn->pending_rx_work) here since we
- * might block if we are running on a worker from the same workqueue
- * pending_rx_work is waiting on.
- */
- if (work_pending(&conn->pending_rx_work))
- cancel_work_sync(&conn->pending_rx_work);
-
ida_destroy(&conn->tx_ida);
l2cap_unregister_all_users(conn);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 642/699] smb: client: Fix next buffer leak in receive_encrypted_standard()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (640 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 641/699] Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 643/699] smb: client: mask server-provided mode to 07777 in modefromsid Greg Kroah-Hartman
` (60 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Steve French,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
[ Upstream commit 1c6267a1d5cf4c73b656f8181b310cbbb3e4767b ]
receive_encrypted_standard() allocates next_buffer before checking
whether the number of compound PDUs already reached MAX_COMPOUND. If
the limit check fails, the function returns immediately and the newly
allocated next_buffer is not assigned to server->smallbuf/server->bigbuf,
making it leaked.
Move the MAX_COMPOUND check before allocating next_buffer.
Fixes: b24df3e30cbf ("cifs: update receive_encrypted_standard to handle compounded responses")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2ops.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -4961,6 +4961,12 @@ receive_encrypted_standard(struct TCP_Se
one_more:
shdr = (struct smb2_hdr *)buf;
next_cmd = le32_to_cpu(shdr->NextCommand);
+
+ if (*num_mids >= MAX_COMPOUND) {
+ cifs_server_dbg(VFS, "too many PDUs in compound\n");
+ return -1;
+ }
+
if (next_cmd) {
if (WARN_ON_ONCE(next_cmd > pdu_length))
return -1;
@@ -4984,10 +4990,6 @@ one_more:
mid_entry->resp_buf_size = server->pdu_size;
}
- if (*num_mids >= MAX_COMPOUND) {
- cifs_server_dbg(VFS, "too many PDUs in compound\n");
- return -1;
- }
bufs[*num_mids] = buf;
mids[(*num_mids)++] = mid_entry;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 643/699] smb: client: mask server-provided mode to 07777 in modefromsid
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (641 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 642/699] smb: client: Fix next buffer leak in receive_encrypted_standard() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 644/699] smb: client: use unaligned reads in parse_posix_ctxt() Greg Kroah-Hartman
` (59 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Norbert Manthey, Steve French,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Manthey <nmanthey@amazon.de>
[ Upstream commit e3d9c7160d483fc8f9e225aafad8ecbbc43f3151 ]
When modefromsid is active, parse_dacl() applies the server-provided
sub_auth[2] value from the NFS mode SID to cf_mode without masking to
07777. Apply the correct masking, same as in the read path.
Fixes: e2f8fbfb8d09c ("cifs: get mode bits from special sid on stat")
Signed-off-by: Norbert Manthey <nmanthey@amazon.de>
Assisted-by: Kiro:claude-opus-4.6
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsacl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -767,7 +767,7 @@ static void parse_dacl(struct cifs_acl *
*/
fattr->cf_mode &= ~07777;
fattr->cf_mode |=
- le32_to_cpu(ppace[i]->sid.sub_auth[2]);
+ le32_to_cpu(ppace[i]->sid.sub_auth[2]) & 07777;
break;
} else if (compare_sids(&(ppace[i]->sid), pownersid) == 0)
access_flags_to_mode(ppace[i]->access_req,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 644/699] smb: client: use unaligned reads in parse_posix_ctxt()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (642 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 643/699] smb: client: mask server-provided mode to 07777 in modefromsid Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 645/699] smb: client: harden POSIX SID length parsing Greg Kroah-Hartman
` (58 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zihan Xi, Ren Wei, Steve French,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <xizh2024@lzu.edu.cn>
[ Upstream commit b86467cd2691192ad4809a5a6e922fc24b8e9839 ]
The server controls create-context DataOffset, so the POSIX context data
pointer may be misaligned on strict-alignment architectures. Use
get_unaligned_le32() when reading nlink, reparse_tag, and mode.
Fixes: 69dda3059e7a ("cifs: add SMB2_open() arg to return POSIX data")
Cc: stable@vger.kernel.org
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2pdu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1973,9 +1973,9 @@ parse_posix_ctxt(struct create_context *
memset(posix, 0, sizeof(*posix));
- posix->nlink = le32_to_cpu(*(__le32 *)(beg + 0));
- posix->reparse_tag = le32_to_cpu(*(__le32 *)(beg + 4));
- posix->mode = le32_to_cpu(*(__le32 *)(beg + 8));
+ posix->nlink = get_unaligned_le32(beg);
+ posix->reparse_tag = get_unaligned_le32(beg + 4);
+ posix->mode = get_unaligned_le32(beg + 8);
sid = beg + 12;
sid_len = posix_info_sid_size(sid, end);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 645/699] smb: client: harden POSIX SID length parsing
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (643 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 644/699] smb: client: use unaligned reads in parse_posix_ctxt() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 646/699] writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() Greg Kroah-Hartman
` (57 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Tan, Yifan Wu, Juefei Pu,
Xin Liu, Zihan Xi, Ren Wei, Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zihan Xi <xizh2024@lzu.edu.cn>
[ Upstream commit 7ad2bcf2441430bb2e918fb3ef9a90d775a6e422 ]
posix_info_sid_size() reads sid[1] to obtain the subauthority count,
but its existing boundary check still accepts buffers with only one
remaining byte. Require two bytes before reading sid[1] so all client
paths that reuse the helper reject truncated POSIX SIDs safely.
Fixes: 349e13ad30b4 ("cifs: add smb2 POSIX info level")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:gpt-5.4
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/smb2pdu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -4518,7 +4518,7 @@ int posix_info_sid_size(const void *beg,
size_t subauth;
int total;
- if (beg + 1 > end)
+ if (beg + 2 > end)
return -1;
subauth = *(u8 *)(beg+1);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 646/699] writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (644 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 645/699] smb: client: harden POSIX SID length parsing Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 647/699] X.509: Fix validation of ASN.1 certificate header Greg Kroah-Hartman
` (56 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Baokun Li, Tejun Heo,
Christian Brauner (Amutable), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun@linux.alibaba.com>
[ Upstream commit cba38ec4cbd3a7b8b942a8d52531a05be8a9ff0d ]
When a container exits, the following BUG_ON() is occasionally triggered:
==================================================================
VFS: Busy inodes after unmount of sdb (ext4)
------------[ cut here ]------------
kernel BUG at fs/super.c:695!
CPU: 3 PID: 6 Comm: containerd-shim Tainted: G OE K 6.6 #1
pstate: 63400009 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : generic_shutdown_super+0xf0/0x100
lr : generic_shutdown_super+0xf0/0x100
Call trace:
generic_shutdown_super+0xf0/0x100
kill_block_super+0x20/0x48
ext4_kill_sb+0x28/0x60
deactivate_locked_super+0x54/0x130
deactivate_super+0x84/0xa0
cleanup_mnt+0xa4/0x140
__cleanup_mnt+0x18/0x28
task_work_run+0x78/0xe0
do_notify_resume+0x204/0x240
==================================================================
The root cause is a race between cgroup_writeback_umount() and
inode_switch_wbs()/cleanup_offline_cgwb(). There is a window between
inode_prepare_wbs_switch() returning true and the subsequent
wb_queue_isw() call. Following is the process that triggers the issue:
CPU A (umount) | CPU B (writeback)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
inode_switch_wbs/cleanup_offline_cgwb
atomic_inc(&isw_nr_in_flight)
inode_prepare_wbs_switch
-> passes SB_ACTIVE check
__iget(inode)
generic_shutdown_super
sb->s_flags &= ~SB_ACTIVE
cgroup_writeback_umount(sb)
smp_mb()
atomic_read(&isw_nr_in_flight)
rcu_barrier()
-> no pending RCU callbacks
flush_workqueue(isw_wq)
-> nothing queued, returns
evict_inodes(sb)
-> Inode skipped as isw still holds a ref.
sop->put_super(sb)
/* destroys percpu counters */
-> VFS: Busy inodes after unmount!
wb_queue_isw()
queue_work(isw_wq, ...)
/* later in work function */
inode_switch_wbs_work_fn
process_inode_switch_wbs
iput() -> evict
percpu_counter_dec() // UAF!
Fix this by extending the RCU read-side critical section in
inode_switch_wbs() and cleanup_offline_cgwb() to cover from
inode_prepare_wbs_switch() through wb_queue_isw(). Since there is
no sleep in this window, rcu_read_lock() can be used. Then add a
synchronize_rcu() in cgroup_writeback_umount() before the existing
rcu_barrier(), so that all in-flight switchers that have passed the
SB_ACTIVE check have completed queue_work() before flush_workqueue()
is called.
The existing rcu_barrier() is intentionally retained so this fix can
be backported unchanged to stable kernels (5.10.y, 6.6.y, ...) that
still queue switches via queue_rcu_work(). It is a no-op on current
mainline (since commit e1b849cfa6b6 ("writeback: Avoid contention on
wb->list_lock when switching inodes")) and is removed in a follow-up
patch.
Fixes: a1a0e23e4903 ("writeback: flush inode cgroup wb switches instead of pinning super_block")
Cc: stable@vger.kernel.org
Suggested-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/all/mxnjq2l6guusfchvauxr3v7c4bwjasybxlleqbbh4efloeqspz@iqylk76ohufz
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20260521095016.2791354-2-libaokun@linux.alibaba.com
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -507,12 +507,18 @@ static void inode_switch_wbs(struct inod
atomic_inc(&isw_nr_in_flight);
- /* find and pin the new wb */
+ /*
+ * Paired with synchronize_rcu() in cgroup_writeback_umount():
+ * holding rcu_read_lock across the SB_ACTIVE check, the inode
+ * grab and call_rcu() ensures synchronize_rcu() cannot return
+ * until the switch is queued, so the subsequent rcu_barrier()
+ * and flush_workqueue() will wait for the switch.
+ */
rcu_read_lock();
+ /* find and pin the new wb */
memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
if (memcg_css && !css_tryget(memcg_css))
memcg_css = NULL;
- rcu_read_unlock();
if (!memcg_css)
goto out_free;
@@ -542,9 +548,11 @@ static void inode_switch_wbs(struct inod
* Let's continue after I_WB_SWITCH is guaranteed to be visible.
*/
call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn);
+ rcu_read_unlock();
return;
out_free:
+ rcu_read_unlock();
atomic_dec(&isw_nr_in_flight);
if (isw->new_wb)
wb_put(isw->new_wb);
@@ -1011,6 +1019,14 @@ void cgroup_writeback_umount(void)
{
if (atomic_read(&isw_nr_in_flight)) {
/*
+ * Paired with rcu_read_lock() in inode_switch_wbs().
+ * synchronize_rcu() waits for any in-flight switcher that
+ * already passed the SB_ACTIVE check to finish calling
+ * call_rcu(), so the rcu_barrier() and flush_workqueue()
+ * below will then drain it.
+ */
+ synchronize_rcu();
+ /*
* Use rcu_barrier() to wait for all pending callbacks to
* ensure that all in-flight wb switches are in the workqueue.
*/
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 647/699] X.509: Fix validation of ASN.1 certificate header
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (645 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 646/699] writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 648/699] proc: use generic setattr() for /proc/$PID/net Greg Kroah-Hartman
` (55 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sashiko, Lukas Wunner,
Ignat Korchagin, Alistair Francis, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
[ Upstream commit 3b626ba431c4501512ad07549310685e07fe4706 ]
x509_load_certificate_list() seeks to enforce that a certificate starts
with 0x30 0x82 (ASN.1 SEQUENCE tag followed by a length of more than 256
and less than 65535 bytes).
But it only enforces that *either* of those two byte values are present,
instead of checking for the *conjunction* of the two values. Fix it.
Fixes: 631cc66eb9ea ("MODSIGN: Provide module signing public keys to the kernel")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260508033917.B5873C2BCB0@smtp.kernel.org/
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.7+
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
certs/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/certs/common.c
+++ b/certs/common.c
@@ -20,7 +20,7 @@ int load_certificate_list(const u8 cert_
*/
if (end - p < 4)
goto dodgy_cert;
- if (p[0] != 0x30 &&
+ if (p[0] != 0x30 ||
p[1] != 0x82)
goto dodgy_cert;
plen = (p[2] << 8) | p[3];
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 648/699] proc: use generic setattr() for /proc/$PID/net
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (646 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 647/699] X.509: Fix validation of ASN.1 certificate header Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 649/699] proc: rename proc_setattr to proc_nochmod_setattr Greg Kroah-Hartman
` (54 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh, Zhangjin Wu,
Willy Tarreau, Christian Brauner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <linux@weissschuh.net>
[ Upstream commit 18e66ae67673f2c8df6f02428798b1355691f2a9 ]
All other files in /proc/$PID/ use proc_setattr().
Not using it allows the usage of chmod() on /proc/$PID/net, even on
other processes owned by the same user.
The same would probably also be true for other attributes to be changed.
As this technically represents an ABI change it is not marked for
stable so any unlikely regressions are caught during a full release cycle.
Fixes: e9720acd728a ("[NET]: Make /proc/net a symlink on /proc/self/net (v3)")
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://lore.kernel.org/lkml/d0d111ef-edae-4760-83fb-36db84278da1@t-8ch.de/
Fixes: b4844fa0bdb4 ("selftests/nolibc: implement a few tests for various syscalls")
Tested-by: Zhangjin Wu <falcon@tinylab.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Message-Id: <20230624-proc-net-setattr-v1-2-73176812adee@weissschuh.net>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 6255da28d4bb ("proc: protect ptrace_may_access() with exec_update_lock (FD links)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/proc_net.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -310,6 +310,7 @@ static int proc_tgid_net_getattr(const s
const struct inode_operations proc_net_inode_operations = {
.lookup = proc_tgid_net_lookup,
.getattr = proc_tgid_net_getattr,
+ .setattr = proc_setattr,
};
static int proc_tgid_net_readdir(struct file *file, struct dir_context *ctx)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 649/699] proc: rename proc_setattr to proc_nochmod_setattr
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (647 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 648/699] proc: use generic setattr() for /proc/$PID/net Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 650/699] proc: protect ptrace_may_access() with exec_update_lock (FD links) Greg Kroah-Hartman
` (53 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Jan Kara,
Christian Brauner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 690005b0b1e6b567c88b7790e6d90d4d6c9e09cc ]
What is currently proc_setattr is a special version added after the more
general procfs ->seattr in commit 6d76fa58b050 ("Don't allow chmod() on
the /proc/<pid>/ files"). Give it a name that reflects that to free the
proc_setattr name and better describe what is doing.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260325063711.3298685-5-hch@lst.de
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 6255da28d4bb ("proc: protect ptrace_may_access() with exec_update_lock (FD links)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/base.c | 22 +++++++++++-----------
fs/proc/fd.c | 4 ++--
fs/proc/internal.h | 2 +-
fs/proc/namespaces.c | 4 ++--
fs/proc/proc_net.c | 2 +-
5 files changed, 17 insertions(+), 17 deletions(-)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -720,7 +720,7 @@ static int proc_fd_access_allowed(struct
return allowed;
}
-int proc_setattr(struct dentry *dentry, struct iattr *attr)
+int proc_nochmod_setattr(struct dentry *dentry, struct iattr *attr)
{
int error;
struct inode *inode = d_inode(dentry);
@@ -792,7 +792,7 @@ static int proc_pid_permission(struct in
static const struct inode_operations proc_def_inode_operations = {
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
static int proc_single_show(struct seq_file *m, void *v)
@@ -1863,7 +1863,7 @@ out:
const struct inode_operations proc_pid_link_inode_operations = {
.readlink = proc_pid_readlink,
.get_link = proc_pid_get_link,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
@@ -2311,7 +2311,7 @@ proc_map_files_get_link(struct dentry *d
static const struct inode_operations proc_map_files_link_inode_operations = {
.readlink = proc_pid_readlink,
.get_link = proc_map_files_get_link,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
static struct dentry *
@@ -2390,7 +2390,7 @@ out:
static const struct inode_operations proc_map_files_inode_operations = {
.lookup = proc_map_files_lookup,
.permission = proc_fd_permission,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
static int
@@ -2882,7 +2882,7 @@ static struct dentry *proc_##LSM##_attr_
static const struct inode_operations proc_##LSM##_attr_dir_inode_ops = { \
.lookup = proc_##LSM##_attr_dir_lookup, \
.getattr = pid_getattr, \
- .setattr = proc_setattr, \
+ .setattr = proc_nochmod_setattr, \
}
#ifdef CONFIG_SECURITY_SMACK
@@ -2941,7 +2941,7 @@ static struct dentry *proc_attr_dir_look
static const struct inode_operations proc_attr_dir_inode_operations = {
.lookup = proc_attr_dir_lookup,
.getattr = pid_getattr,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
#endif
@@ -3395,7 +3395,7 @@ static struct dentry *proc_tgid_base_loo
static const struct inode_operations proc_tgid_base_inode_operations = {
.lookup = proc_tgid_base_lookup,
.getattr = pid_getattr,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
.permission = proc_pid_permission,
};
@@ -3594,7 +3594,7 @@ static int proc_tid_comm_permission(stru
}
static const struct inode_operations proc_tid_comm_inode_operations = {
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
.permission = proc_tid_comm_permission,
};
@@ -3718,7 +3718,7 @@ static const struct file_operations proc
static const struct inode_operations proc_tid_base_inode_operations = {
.lookup = proc_tid_base_lookup,
.getattr = pid_getattr,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
static struct dentry *proc_task_instantiate(struct dentry *dentry,
@@ -3913,7 +3913,7 @@ static int proc_task_getattr(const struc
static const struct inode_operations proc_task_inode_operations = {
.lookup = proc_task_lookup,
.getattr = proc_task_getattr,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
.permission = proc_pid_permission,
};
--- a/fs/proc/fd.c
+++ b/fs/proc/fd.c
@@ -297,7 +297,7 @@ int proc_fd_permission(struct inode *ino
const struct inode_operations proc_fd_inode_operations = {
.lookup = proc_lookupfd,
.permission = proc_fd_permission,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
static struct dentry *proc_fdinfo_instantiate(struct dentry *dentry,
@@ -335,7 +335,7 @@ static int proc_readfdinfo(struct file *
const struct inode_operations proc_fdinfo_inode_operations = {
.lookup = proc_lookupfdinfo,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
const struct file_operations proc_fdinfo_operations = {
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -177,7 +177,7 @@ extern int proc_pid_statm(struct seq_fil
*/
extern const struct dentry_operations pid_dentry_operations;
extern int pid_getattr(const struct path *, struct kstat *, u32, unsigned int);
-extern int proc_setattr(struct dentry *, struct iattr *);
+int proc_nochmod_setattr(struct dentry *dentry, struct iattr *attr);
extern void proc_pid_evict_inode(struct proc_inode *);
extern struct inode *proc_pid_make_inode(struct super_block *, struct task_struct *, umode_t);
extern void pid_update_inode(struct task_struct *, struct inode *);
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -92,7 +92,7 @@ static int proc_ns_readlink(struct dentr
static const struct inode_operations proc_ns_link_inode_operations = {
.readlink = proc_ns_readlink,
.get_link = proc_ns_get_link,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
static struct dentry *proc_ns_instantiate(struct dentry *dentry,
@@ -179,5 +179,5 @@ out_no_task:
const struct inode_operations proc_ns_dir_inode_operations = {
.lookup = proc_ns_dir_lookup,
.getattr = pid_getattr,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
--- a/fs/proc/proc_net.c
+++ b/fs/proc/proc_net.c
@@ -310,7 +310,7 @@ static int proc_tgid_net_getattr(const s
const struct inode_operations proc_net_inode_operations = {
.lookup = proc_tgid_net_lookup,
.getattr = proc_tgid_net_getattr,
- .setattr = proc_setattr,
+ .setattr = proc_nochmod_setattr,
};
static int proc_tgid_net_readdir(struct file *file, struct dir_context *ctx)
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 650/699] proc: protect ptrace_may_access() with exec_update_lock (FD links)
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (648 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 649/699] proc: rename proc_setattr to proc_nochmod_setattr Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 651/699] HID: add haptics page defines Greg Kroah-Hartman
` (52 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jann Horn,
Christian Brauner (Amutable), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
[ Upstream commit 6255da28d4bb5349fe18e84cb043ccd394eba75d ]
proc_pid_get_link() and proc_pid_readlink() currently look up the task from
the pid once, then do the ptrace access check on that task, then look up
the task from the pid a second time to do the actual access.
That's racy in several ways.
To fix it, pass the task to the ->proc_get_link() handler, and instead of
proc_fd_access_allowed(), introduce a new helper call_proc_get_link() that
looks up and locks the task, does the access check, and calls
->proc_get_link().
Fixes: 778c1144771f ("[PATCH] proc: Use sane permission checks on the /proc/<pid>/fd/ symlinks")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://patch.msgid.link/20260518-procfs-lockfix-part1-v1-2-5c3d20e0ac33@google.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/base.c | 119 ++++++++++++++++++++---------------------------------
fs/proc/fd.c | 25 ++++-------
fs/proc/internal.h | 2
3 files changed, 58 insertions(+), 88 deletions(-)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -217,33 +217,24 @@ static int get_task_root(struct task_str
return result;
}
-static int proc_cwd_link(struct dentry *dentry, struct path *path)
+static int proc_cwd_link(struct dentry *dentry, struct path *path,
+ struct task_struct *task)
{
- struct task_struct *task = get_proc_task(d_inode(dentry));
int result = -ENOENT;
- if (task) {
- task_lock(task);
- if (task->fs) {
- get_fs_pwd(task->fs, path);
- result = 0;
- }
- task_unlock(task);
- put_task_struct(task);
+ task_lock(task);
+ if (task->fs) {
+ get_fs_pwd(task->fs, path);
+ result = 0;
}
+ task_unlock(task);
return result;
}
-static int proc_root_link(struct dentry *dentry, struct path *path)
+static int proc_root_link(struct dentry *dentry, struct path *path,
+ struct task_struct *task)
{
- struct task_struct *task = get_proc_task(d_inode(dentry));
- int result = -ENOENT;
-
- if (task) {
- result = get_task_root(task, path);
- put_task_struct(task);
- }
- return result;
+ return get_task_root(task, path);
}
/*
@@ -703,23 +694,6 @@ static int proc_pid_syscall(struct seq_f
/* Here the fs part begins */
/************************************************************************/
-/* permission checks */
-static int proc_fd_access_allowed(struct inode *inode)
-{
- struct task_struct *task;
- int allowed = 0;
- /* Allow access to a task's file descriptors if it is us or we
- * may use ptrace attach to the process and find out that
- * information.
- */
- task = get_proc_task(inode);
- if (task) {
- allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
- put_task_struct(task);
- }
- return allowed;
-}
-
int proc_nochmod_setattr(struct dentry *dentry, struct iattr *attr)
{
int error;
@@ -1774,16 +1748,12 @@ static const struct file_operations proc
.release = single_release,
};
-static int proc_exe_link(struct dentry *dentry, struct path *exe_path)
+static int proc_exe_link(struct dentry *dentry, struct path *exe_path,
+ struct task_struct *task)
{
- struct task_struct *task;
struct file *exe_file;
- task = get_proc_task(d_inode(dentry));
- if (!task)
- return -ENOENT;
exe_file = get_task_exe_file(task);
- put_task_struct(task);
if (exe_file) {
*exe_path = exe_file->f_path;
path_get(&exe_file->f_path);
@@ -1793,26 +1763,42 @@ static int proc_exe_link(struct dentry *
return -ENOENT;
}
+static int call_proc_get_link(struct dentry *dentry, struct inode *inode, struct path *path_out)
+{
+ struct task_struct *task;
+ int ret;
+
+ task = get_proc_task(inode);
+ if (!task)
+ return -ENOENT;
+ ret = down_read_killable(&task->signal->exec_update_lock);
+ if (ret)
+ goto out_put_task;
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
+ ret = -EACCES;
+ goto out;
+ }
+ ret = PROC_I(inode)->op.proc_get_link(dentry, path_out, task);
+
+out:
+ up_read(&task->signal->exec_update_lock);
+out_put_task:
+ put_task_struct(task);
+ return ret;
+}
+
static const char *proc_pid_get_link(struct dentry *dentry,
struct inode *inode,
struct delayed_call *done)
{
struct path path;
- int error = -EACCES;
+ int error;
if (!dentry)
return ERR_PTR(-ECHILD);
-
- /* Are we allowed to snoop on the tasks file descriptors? */
- if (!proc_fd_access_allowed(inode))
- goto out;
-
- error = PROC_I(inode)->op.proc_get_link(dentry, &path);
- if (error)
- goto out;
-
- error = nd_jump_link(&path);
-out:
+ error = call_proc_get_link(dentry, inode, &path);
+ if (!error)
+ error = nd_jump_link(&path);
return ERR_PTR(error);
}
@@ -1846,17 +1832,11 @@ static int proc_pid_readlink(struct dent
struct inode *inode = d_inode(dentry);
struct path path;
- /* Are we allowed to snoop on the tasks file descriptors? */
- if (!proc_fd_access_allowed(inode))
- goto out;
-
- error = PROC_I(inode)->op.proc_get_link(dentry, &path);
- if (error)
- goto out;
-
- error = do_proc_readlink(&path, buffer, buflen);
- path_put(&path);
-out:
+ error = call_proc_get_link(dentry, inode, &path);
+ if (!error) {
+ error = do_proc_readlink(&path, buffer, buflen);
+ path_put(&path);
+ }
return error;
}
@@ -2242,21 +2222,16 @@ static const struct dentry_operations ti
.d_delete = pid_delete_dentry,
};
-static int map_files_get_link(struct dentry *dentry, struct path *path)
+static int map_files_get_link(struct dentry *dentry, struct path *path,
+ struct task_struct *task)
{
unsigned long vm_start, vm_end;
struct vm_area_struct *vma;
- struct task_struct *task;
struct mm_struct *mm;
int rc;
rc = -ENOENT;
- task = get_proc_task(d_inode(dentry));
- if (!task)
- goto out;
-
mm = get_task_mm(task);
- put_task_struct(task);
if (!mm)
goto out;
--- a/fs/proc/fd.c
+++ b/fs/proc/fd.c
@@ -140,24 +140,19 @@ static const struct dentry_operations ti
.d_delete = pid_delete_dentry,
};
-static int proc_fd_link(struct dentry *dentry, struct path *path)
+static int proc_fd_link(struct dentry *dentry, struct path *path,
+ struct task_struct *task)
{
- struct task_struct *task;
int ret = -ENOENT;
+ unsigned int fd = proc_fd(d_inode(dentry));
+ struct file *fd_file;
- task = get_proc_task(d_inode(dentry));
- if (task) {
- unsigned int fd = proc_fd(d_inode(dentry));
- struct file *fd_file;
-
- fd_file = fget_task(task, fd);
- if (fd_file) {
- *path = fd_file->f_path;
- path_get(&fd_file->f_path);
- ret = 0;
- fput(fd_file);
- }
- put_task_struct(task);
+ fd_file = fget_task(task, fd);
+ if (fd_file) {
+ *path = fd_file->f_path;
+ path_get(&fd_file->f_path);
+ ret = 0;
+ fput(fd_file);
}
return ret;
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -97,7 +97,7 @@ extern struct kmem_cache *proc_dir_entry
void pde_free(struct proc_dir_entry *pde);
union proc_op {
- int (*proc_get_link)(struct dentry *, struct path *);
+ int (*proc_get_link)(struct dentry *, struct path *, struct task_struct *);
int (*proc_show)(struct seq_file *m,
struct pid_namespace *ns, struct pid *pid,
struct task_struct *task);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 651/699] HID: add haptics page defines
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (649 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 650/699] proc: protect ptrace_may_access() with exec_update_lock (FD links) Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 652/699] HID: multitouch: fix out-of-bounds bit access on mt_io_flags Greg Kroah-Hartman
` (51 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Angela Czubak, Jonathan Denose,
Benjamin Tissoires, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Angela Czubak <aczubak@google.com>
[ Upstream commit 5e0ae59159e3a07391a35865bb79ff335473fa79 ]
Introduce haptic usages as defined in HID Usage Tables specification.
Add HID units for newton and gram.
Signed-off-by: Angela Czubak <aczubak@google.com>
Co-developed-by: Jonathan Denose <jdenose@google.com>
Signed-off-by: Jonathan Denose <jdenose@google.com>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Stable-dep-of: 8813b0612275 ("HID: multitouch: fix out-of-bounds bit access on mt_io_flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/hid.h | 29 +++++++++++++++++++++++++++++
1 file changed, 29 insertions(+)
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -152,6 +152,7 @@ struct hid_item {
#define HID_UP_TELEPHONY 0x000b0000
#define HID_UP_CONSUMER 0x000c0000
#define HID_UP_DIGITIZER 0x000d0000
+#define HID_UP_HAPTIC 0x000e0000
#define HID_UP_PID 0x000f0000
#define HID_UP_HPVENDOR 0xff7f0000
#define HID_UP_HPVENDOR2 0xff010000
@@ -299,6 +300,28 @@ struct hid_item {
#define HID_DG_TOOLSERIALNUMBER 0x000d005b
#define HID_DG_LATENCYMODE 0x000d0060
+#define HID_HP_SIMPLECONTROLLER 0x000e0001
+#define HID_HP_WAVEFORMLIST 0x000e0010
+#define HID_HP_DURATIONLIST 0x000e0011
+#define HID_HP_AUTOTRIGGER 0x000e0020
+#define HID_HP_MANUALTRIGGER 0x000e0021
+#define HID_HP_AUTOTRIGGERASSOCIATEDCONTROL 0x000e0022
+#define HID_HP_INTENSITY 0x000e0023
+#define HID_HP_REPEATCOUNT 0x000e0024
+#define HID_HP_RETRIGGERPERIOD 0x000e0025
+#define HID_HP_WAVEFORMVENDORPAGE 0x000e0026
+#define HID_HP_WAVEFORMVENDORID 0x000e0027
+#define HID_HP_WAVEFORMCUTOFFTIME 0x000e0028
+#define HID_HP_WAVEFORMNONE 0x000e1001
+#define HID_HP_WAVEFORMSTOP 0x000e1002
+#define HID_HP_WAVEFORMCLICK 0x000e1003
+#define HID_HP_WAVEFORMBUZZCONTINUOUS 0x000e1004
+#define HID_HP_WAVEFORMRUMBLECONTINUOUS 0x000e1005
+#define HID_HP_WAVEFORMPRESS 0x000e1006
+#define HID_HP_WAVEFORMRELEASE 0x000e1007
+#define HID_HP_VENDORWAVEFORMMIN 0x000e2001
+#define HID_HP_VENDORWAVEFORMMAX 0x000e2fff
+
#define HID_VD_ASUS_CUSTOM_MEDIA_KEYS 0xff310076
/*
* HID report types --- Ouch! HID spec says 1 2 3!
@@ -385,6 +408,12 @@ struct hid_item {
#define HID_BOOT_PROTOCOL 0
/*
+ * HID units
+ */
+#define HID_UNIT_GRAM 0x0101
+#define HID_UNIT_NEWTON 0xe111
+
+/*
* This is the global environment of the parser. This information is
* persistent for main-items. The global environment can be saved and
* restored with PUSH/POP statements.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 652/699] HID: multitouch: fix out-of-bounds bit access on mt_io_flags
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (650 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 651/699] HID: add haptics page defines Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 653/699] cpufreq: intel_pstate: Sync policy->cur during CPU offline Greg Kroah-Hartman
` (50 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Trung Nguyen, Benjamin Tissoires,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trung Nguyen <trungnh@cystack.net>
[ Upstream commit 8813b0612275cc61fe9e6603d0ee019247ade6be ]
mt_io_flags is a single unsigned long, but mt_process_slot(),
mt_release_pending_palms() and mt_release_contacts() use it as a
per-slot bitmap indexed by the slot number. That slot number is only
bounded by td->maxcontacts, which is taken from the device's
ContactCountMaximum feature report and can be up to 255, not by
BITS_PER_LONG.
As a result, a multitouch device that advertises a large contact count
makes set_bit()/clear_bit() operate past the mt_io_flags word and
corrupt the adjacent members of struct mt_device. The sticky-fingers
release timer is the easiest way to reach this. mt_release_contacts()
runs
for (i = 0; i < mt->num_slots; i++)
clear_bit(i, &td->mt_io_flags);
with num_slots == maxcontacts. For maxcontacts around 250 the loop
clears the bits that overlap td->applications.next, zeroing that list
head, and the list_for_each_entry() that immediately follows then
dereferences NULL. The kernel panics from timer (softirq) context. On a
KASAN build this shows up as a general protection fault in
mt_release_contacts() with a null-ptr-deref at offset 0x58, which is
offsetof(struct mt_application, num_received).
The state is reachable from an untrusted USB or Bluetooth HID
multitouch device; no local privileges are required.
Store the per-slot active state in a separately allocated bitmap sized
for maxcontacts, the same pattern already used for pending_palm_slots,
and keep only MT_IO_FLAGS_RUNNING in mt_io_flags. The two
"mt_io_flags & MT_IO_SLOTS_MASK" arming checks become
bitmap_empty(td->active_slots, td->maxcontacts).
Move MT_IO_FLAGS_RUNNING back to bit 0. It was bumped to bit 32 by the
same commit to leave the low byte for the slot bits; with the slot bits
gone it fits in bit 0 again, which also keeps it within the unsigned
long on 32-bit.
Fixes: 46f781e0d151 ("HID: multitouch: fix sticky fingers")
Cc: stable@vger.kernel.org
Signed-off-by: Trung Nguyen <trungnh@cystack.net>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-multitouch.c | 32 ++++++++++++++++++++------------
1 file changed, 20 insertions(+), 12 deletions(-)
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -31,6 +31,7 @@
* [1] https://gitlab.freedesktop.org/libevdev/hid-tools
*/
+#include <linux/bitmap.h>
#include <linux/device.h>
#include <linux/hid.h>
#include <linux/module.h>
@@ -81,8 +82,7 @@ enum latency_mode {
HID_LATENCY_HIGH = 1,
};
-#define MT_IO_SLOTS_MASK GENMASK(7, 0) /* reserve first 8 bits for slot tracking */
-#define MT_IO_FLAGS_RUNNING 32
+#define MT_IO_FLAGS_RUNNING 0
static const bool mtrue = true; /* default for true */
static const bool mfalse; /* default for false */
@@ -158,10 +158,9 @@ struct mt_device {
struct mt_class mtclass; /* our mt device class */
struct timer_list release_timer; /* to release sticky fingers */
struct hid_device *hdev; /* hid_device we're attached to */
- unsigned long mt_io_flags; /* mt flags (MT_IO_FLAGS_RUNNING)
- * first 8 bits are reserved for keeping the slot
- * states, this is fine because we only support up
- * to 250 slots (MT_MAX_MAXCONTACT)
+ unsigned long mt_io_flags; /* mt flags (MT_IO_FLAGS_RUNNING) */
+ unsigned long *active_slots; /* bitmap of slots with an active
+ * contact, sized for maxcontacts
*/
__u8 inputmode_value; /* InputMode HID feature value */
__u8 maxcontacts;
@@ -915,7 +914,7 @@ static void mt_release_pending_palms(str
for_each_set_bit(slotnum, app->pending_palm_slots, td->maxcontacts) {
clear_bit(slotnum, app->pending_palm_slots);
- clear_bit(slotnum, &td->mt_io_flags);
+ clear_bit(slotnum, td->active_slots);
input_mt_slot(input, slotnum);
input_mt_report_slot_inactive(input);
@@ -1100,9 +1099,9 @@ static int mt_process_slot(struct mt_dev
input_event(input, EV_ABS, ABS_MT_TOUCH_MAJOR, major);
input_event(input, EV_ABS, ABS_MT_TOUCH_MINOR, minor);
- set_bit(slotnum, &td->mt_io_flags);
+ set_bit(slotnum, td->active_slots);
} else {
- clear_bit(slotnum, &td->mt_io_flags);
+ clear_bit(slotnum, td->active_slots);
}
return 0;
@@ -1237,7 +1236,7 @@ static void mt_touch_report(struct hid_d
* defect.
*/
if (app->quirks & MT_QUIRK_STICKY_FINGERS) {
- if (td->mt_io_flags & MT_IO_SLOTS_MASK)
+ if (!bitmap_empty(td->active_slots, td->maxcontacts))
mod_timer(&td->release_timer,
jiffies + msecs_to_jiffies(100));
else
@@ -1277,6 +1276,15 @@ static int mt_touch_input_configured(str
if (td->is_buttonpad)
__set_bit(INPUT_PROP_BUTTONPAD, input->propbit);
+ if (!td->active_slots) {
+ td->active_slots = devm_kcalloc(&td->hdev->dev,
+ BITS_TO_LONGS(td->maxcontacts),
+ sizeof(long),
+ GFP_KERNEL);
+ if (!td->active_slots)
+ return -ENOMEM;
+ }
+
app->pending_palm_slots = devm_kcalloc(&hi->input->dev,
BITS_TO_LONGS(td->maxcontacts),
sizeof(long),
@@ -1655,7 +1663,7 @@ static void mt_release_contacts(struct h
for (i = 0; i < mt->num_slots; i++) {
input_mt_slot(input_dev, i);
input_mt_report_slot_inactive(input_dev);
- clear_bit(i, &td->mt_io_flags);
+ clear_bit(i, td->active_slots);
}
input_mt_sync_frame(input_dev);
input_sync(input_dev);
@@ -1678,7 +1686,7 @@ static void mt_expired_timeout(struct ti
*/
if (test_and_set_bit_lock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags))
return;
- if (td->mt_io_flags & MT_IO_SLOTS_MASK)
+ if (!bitmap_empty(td->active_slots, td->maxcontacts))
mt_release_contacts(hdev);
clear_bit_unlock(MT_IO_FLAGS_RUNNING, &td->mt_io_flags);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 653/699] cpufreq: intel_pstate: Sync policy->cur during CPU offline
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (651 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 652/699] HID: multitouch: fix out-of-bounds bit access on mt_io_flags Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 654/699] proc: protect ptrace_may_access() with exec_update_lock (part 1) Greg Kroah-Hartman
` (49 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada, Fushuai Wang,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fushuai Wang <wangfushuai@baidu.com>
[ Upstream commit bcbdaa1086c25a8a5d48e04e1b82fdfb0682b681 ]
When a CPU goes offline with HWP disabled, intel_pstate_set_min_pstate()
sets the MSR_IA32_PERF_CTL to minimum frequency to prevent SMT siblings
from being restricted. However, the policy->cur value was not updated,
leaving it at the previous value.
When the CPU comes back online, governor->limits() checks if target_freq
equals policy->cur and skips the frequency adjustment if they match. Since
policy->cur still holds the previous value, the governor does not call
cpufreq_driver->target to update MSR_IA32_PERF_CTL.
Fix this by synchronizing policy->cur with the hardware state when setting
minimum pstate during CPU offline.
Fixes: bb18008f8086 ("intel_pstate: Set core to min P state during core offline")
Cc: stable@vger.kernel.org # 3.15+
Suggested-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
[ rjw: Subject refinement ]
Link: https://patch.msgid.link/20260520032119.30615-1-fushuai.wang@linux.dev
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ replaced `cpu->pstate.min_freq` with `cpu->pstate.min_pstate * cpu->pstate.scaling` since 5.10 lacks the min_freq field ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/intel_pstate.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -2355,10 +2355,12 @@ static int intel_pstate_cpu_offline(stru
* from getting to lower performance levels, so force the minimum
* performance on CPU offline to prevent that from happening.
*/
- if (hwp_active)
+ if (hwp_active) {
intel_pstate_hwp_offline(cpu);
- else
+ } else {
intel_pstate_set_min_pstate(cpu);
+ policy->cur = cpu->pstate.min_pstate * cpu->pstate.scaling;
+ }
intel_pstate_exit_perf_limits(policy);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 654/699] proc: protect ptrace_may_access() with exec_update_lock (part 1)
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (652 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 653/699] cpufreq: intel_pstate: Sync policy->cur during CPU offline Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 655/699] HID: appleir: fix UAF on pending key_up_timer in remove() Greg Kroah-Hartman
` (48 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jann Horn,
Christian Brauner (Amutable), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
[ Upstream commit 6650527444dadc63d84aa939d14ecba4fadb2f69 ]
Fix the easy cases where procfs currently calls ptrace_may_access() without
exec_update_lock protection, where the fix is to simply add the extra lock
or use mm_access():
- do_task_stat(): grab exec_update_lock
- proc_pid_wchan(): grab exec_update_lock
- proc_map_files_lookup(): use mm_access() instead of get_task_mm()
- proc_map_files_readdir(): use mm_access() instead of get_task_mm()
- proc_ns_get_link(): grab exec_update_lock
- proc_ns_readlink(): grab exec_update_lock
Fixes: f83ce3e6b02d ("proc: avoid information leaks to non-privileged processes")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://patch.msgid.link/20260518-procfs-lockfix-part1-v1-1-5c3d20e0ac33@google.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
[ converted NULL return from mm_access() to ERR_PTR(-ESRCH) at call sites since 5.15's mm_access() returns NULL when the task has no mm ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/array.c | 6 ++++++
fs/proc/base.c | 41 ++++++++++++++++++++++++-----------------
fs/proc/namespaces.c | 12 ++++++++++++
3 files changed, 42 insertions(+), 17 deletions(-)
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -449,6 +449,11 @@ static int do_task_stat(struct seq_file
unsigned long flags;
struct signal_struct *sig = task->signal;
unsigned int seq = 1;
+ int ret;
+
+ ret = down_read_killable(&task->signal->exec_update_lock);
+ if (ret)
+ return ret;
state = *get_task_state(task);
vsize = eip = esp = 0;
@@ -626,6 +631,7 @@ static int do_task_stat(struct seq_file
seq_puts(m, " 0");
seq_putc(m, '\n');
+ up_read(&task->signal->exec_update_lock);
if (mm)
mmput(mm);
return 0;
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -413,18 +413,24 @@ static int proc_pid_wchan(struct seq_fil
{
unsigned long wchan;
char symname[KSYM_NAME_LEN];
+ int err;
+ err = down_read_killable(&task->signal->exec_update_lock);
+ if (err)
+ return err;
if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
goto print0;
wchan = get_wchan(task);
if (wchan && !lookup_symbol_name(wchan, symname)) {
seq_puts(m, symname);
+ up_read(&task->signal->exec_update_lock);
return 0;
}
print0:
seq_putc(m, '0');
+ up_read(&task->signal->exec_update_lock);
return 0;
}
#endif /* CONFIG_KALLSYMS */
@@ -2327,17 +2333,17 @@ static struct dentry *proc_map_files_loo
if (!task)
goto out;
- result = ERR_PTR(-EACCES);
- if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
- goto out_put_task;
-
result = ERR_PTR(-ENOENT);
if (dname_to_vma_addr(dentry, &vm_start, &vm_end))
goto out_put_task;
- mm = get_task_mm(task);
+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
if (!mm)
+ mm = ERR_PTR(-ESRCH);
+ if (IS_ERR(mm)) {
+ result = ERR_CAST(mm);
goto out_put_task;
+ }
result = ERR_PTR(-EINTR);
if (mmap_read_lock_killable(mm))
@@ -2386,23 +2392,24 @@ proc_map_files_readdir(struct file *file
if (!task)
goto out;
- ret = -EACCES;
- if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
- goto out_put_task;
-
ret = 0;
if (!dir_emit_dots(file, ctx))
goto out_put_task;
- mm = get_task_mm(task);
+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
if (!mm)
+ mm = ERR_PTR(-ESRCH);
+ if (IS_ERR(mm)) {
+ ret = PTR_ERR(mm);
+ /* if the task has no mm, the directory should just be empty */
+ if (ret == -ESRCH)
+ ret = 0;
goto out_put_task;
+ }
ret = mmap_read_lock_killable(mm);
- if (ret) {
- mmput(mm);
- goto out_put_task;
- }
+ if (ret)
+ goto out_put_mm;
nr_files = 0;
@@ -2426,8 +2433,7 @@ proc_map_files_readdir(struct file *file
if (!p) {
ret = -ENOMEM;
mmap_read_unlock(mm);
- mmput(mm);
- goto out_put_task;
+ goto out_put_mm;
}
p->start = vma->vm_start;
@@ -2435,7 +2441,6 @@ proc_map_files_readdir(struct file *file
p->mode = vma->vm_file->f_mode;
}
mmap_read_unlock(mm);
- mmput(mm);
for (i = 0; i < nr_files; i++) {
char buf[4 * sizeof(long) + 2]; /* max: %lx-%lx\0 */
@@ -2452,6 +2457,8 @@ proc_map_files_readdir(struct file *file
ctx->pos++;
}
+out_put_mm:
+ mmput(mm);
out_put_task:
put_task_struct(task);
out:
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -55,6 +55,10 @@ static const char *proc_ns_get_link(stru
if (!task)
return ERR_PTR(-EACCES);
+ error = down_read_killable(&task->signal->exec_update_lock);
+ if (error)
+ goto out_put_task;
+
if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
goto out;
@@ -64,6 +68,8 @@ static const char *proc_ns_get_link(stru
error = nd_jump_link(&ns_path);
out:
+ up_read(&task->signal->exec_update_lock);
+out_put_task:
put_task_struct(task);
return ERR_PTR(error);
}
@@ -80,11 +86,17 @@ static int proc_ns_readlink(struct dentr
if (!task)
return res;
+ res = down_read_killable(&task->signal->exec_update_lock);
+ if (res)
+ goto out_put_task;
+
if (ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
res = ns_get_name(name, sizeof(name), task, ns_ops);
if (res >= 0)
res = readlink_copy(buffer, buflen, name);
}
+ up_read(&task->signal->exec_update_lock);
+out_put_task:
put_task_struct(task);
return res;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 655/699] HID: appleir: fix UAF on pending key_up_timer in remove()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (653 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 654/699] proc: protect ptrace_may_access() with exec_update_lock (part 1) Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 656/699] serial: 8250_mid: Remove 8250_pci usage Greg Kroah-Hartman
` (47 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Manish Khadka, Jiri Kosina,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Khadka <maskmemanish@gmail.com>
[ Upstream commit 75fe87e19d8aff81eb2c64d15d244ab8da4de945 ]
appleir_remove() runs hid_hw_stop() before timer_delete_sync().
hid_hw_stop() synchronously unregisters the HID input device via
hid_disconnect() -> hidinput_disconnect() -> input_unregister_device(),
which drops the last reference and frees the underlying input_dev when
no userspace handle holds it open.
key_up_tick() reads appleir->input_dev and calls input_report_key() /
input_sync() on it. The timer is armed from appleir_raw_event() with
a HZ/8 (~125 ms) timeout on every keydown and key-repeat report. If a
key was pressed shortly before the device is disconnected, the timer
can fire after hid_hw_stop() has freed input_dev but before the
teardown drains it.
A simple reorder is not sufficient. Putting the timer drain first
still leaves a window where a USB URB completion (raw_event) running
during hid_hw_stop() can call mod_timer() and re-arm the timer, which
then fires after hidinput_disconnect() has freed input_dev. The same
URB-completion window also lets raw_event() reach key_up(), key_down()
and battery_flat() directly, all of which dereference
appleir->input_dev.
Introduce a 'removing' flag on struct appleir, gated by the existing
spinlock. appleir_remove() sets the flag under the lock and then
shuts down the timer with timer_shutdown_sync(), which both drains any
in-flight callback and permanently disables further mod_timer() calls.
appleir_raw_event() and key_up_tick() bail out early if the flag is
set, so no path can arm or run the timer, or dereference
appleir->input_dev, after remove() has started tearing down.
The keyrepeat and flatbattery branches of appleir_raw_event()
previously called into the input layer without holding the spinlock;
take it now so the flag check is well-defined. This incidentally
closes a pre-existing read-side race on appleir->current_key in the
keyrepeat branch.
This bug is structurally a sibling of commit 4db2af929279 ("HID:
appletb-kbd: fix UAF in inactivity-timer cleanup path") and has been
present since the driver was introduced.
Fixes: 9a4a5574ce42 ("HID: appleir: add support for Apple ir devices")
Cc: stable@vger.kernel.org
Signed-off-by: Manish Khadka <maskmemanish@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-appleir.c | 45 +++++++++++++++++++++++++++++++++++----------
1 file changed, 35 insertions(+), 10 deletions(-)
--- a/drivers/hid/hid-appleir.c
+++ b/drivers/hid/hid-appleir.c
@@ -109,9 +109,10 @@ struct appleir {
struct hid_device *hid;
unsigned short keymap[ARRAY_SIZE(appleir_key_table)];
struct timer_list key_up_timer; /* timer for key up */
- spinlock_t lock; /* protects .current_key */
+ spinlock_t lock; /* protects .current_key, .removing */
int current_key; /* the currently pressed key */
int prev_key_idx; /* key index in a 2 packets message */
+ bool removing; /* set during teardown; gates input_dev access */
};
static int get_key(int data)
@@ -172,7 +173,7 @@ static void key_up_tick(struct timer_lis
unsigned long flags;
spin_lock_irqsave(&appleir->lock, flags);
- if (appleir->current_key) {
+ if (!appleir->removing && appleir->current_key) {
key_up(hid, appleir, appleir->current_key);
appleir->current_key = 0;
}
@@ -195,6 +196,10 @@ static int appleir_raw_event(struct hid_
int index;
spin_lock_irqsave(&appleir->lock, flags);
+ if (appleir->removing) {
+ spin_unlock_irqrestore(&appleir->lock, flags);
+ goto out;
+ }
/*
* If we already have a key down, take it up before marking
* this one down
@@ -229,17 +234,25 @@ static int appleir_raw_event(struct hid_
appleir->prev_key_idx = 0;
if (!memcmp(data, keyrepeat, sizeof(keyrepeat))) {
- key_down(hid, appleir, appleir->current_key);
- /*
- * Remote doesn't do key up, either pull them up, in the test
- * above, or here set a timer which pulls them up after 1/8 s
- */
- mod_timer(&appleir->key_up_timer, jiffies + HZ / 8);
+ spin_lock_irqsave(&appleir->lock, flags);
+ if (!appleir->removing) {
+ key_down(hid, appleir, appleir->current_key);
+ /*
+ * Remote doesn't do key up, either pull them up, in
+ * the test above, or here set a timer which pulls them
+ * up after 1/8 s
+ */
+ mod_timer(&appleir->key_up_timer, jiffies + HZ / 8);
+ }
+ spin_unlock_irqrestore(&appleir->lock, flags);
goto out;
}
if (!memcmp(data, flatbattery, sizeof(flatbattery))) {
- battery_flat(appleir);
+ spin_lock_irqsave(&appleir->lock, flags);
+ if (!appleir->removing)
+ battery_flat(appleir);
+ spin_unlock_irqrestore(&appleir->lock, flags);
/* Fall through */
}
@@ -318,8 +331,20 @@ fail:
static void appleir_remove(struct hid_device *hid)
{
struct appleir *appleir = hid_get_drvdata(hid);
+ unsigned long flags;
+
+ /*
+ * Mark the driver as tearing down so that any concurrent raw_event
+ * (e.g. from a USB URB completion that hid_hw_stop() has not yet
+ * killed) and the key_up_timer softirq stop touching input_dev
+ * before hid_hw_stop() frees it via hidinput_disconnect().
+ */
+ spin_lock_irqsave(&appleir->lock, flags);
+ appleir->removing = true;
+ spin_unlock_irqrestore(&appleir->lock, flags);
+
+ timer_delete_sync(&appleir->key_up_timer);
hid_hw_stop(hid);
- del_timer_sync(&appleir->key_up_timer);
}
static const struct hid_device_id appleir_devices[] = {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 656/699] serial: 8250_mid: Remove 8250_pci usage
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (654 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 655/699] HID: appleir: fix UAF on pending key_up_timer in remove() Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 657/699] serial: 8250_mid: Disable DMA for selected platforms Greg Kroah-Hartman
` (46 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit a136abd7e7abe0f1247f8ffde6cc7c8ab09f985b ]
8250_mid uses FL_*BASE* from linux/8250_pci.h and nothing else. The
code can be simplified by directly defining BARs within the driver
instead.
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20230915094336.13278-1-ilpo.jarvinen@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_mid.c | 18 +++++++-----------
1 file changed, 7 insertions(+), 11 deletions(-)
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -12,7 +12,6 @@
#include <linux/rational.h>
#include <linux/dma/hsu.h>
-#include <linux/8250_pci.h>
#include "8250.h"
@@ -32,9 +31,9 @@
struct mid8250;
struct mid8250_board {
- unsigned int flags;
unsigned long freq;
unsigned int base_baud;
+ unsigned int bar;
int (*setup)(struct mid8250 *, struct uart_port *p);
void (*exit)(struct mid8250 *);
};
@@ -169,7 +168,6 @@ static int dnv_setup(struct mid8250 *mid
{
struct hsu_dma_chip *chip = &mid->dma_chip;
struct pci_dev *pdev = to_pci_dev(p->dev);
- unsigned int bar = FL_GET_BASE(mid->board->flags);
int ret;
pci_set_master(pdev);
@@ -183,7 +181,7 @@ static int dnv_setup(struct mid8250 *mid
chip->dev = &pdev->dev;
chip->irq = pci_irq_vector(pdev, 0);
chip->regs = p->membase;
- chip->length = pci_resource_len(pdev, bar);
+ chip->length = pci_resource_len(pdev, mid->board->bar);
chip->offset = DNV_DMA_CHAN_OFFSET;
/* Falling back to PIO mode if DMA probing fails */
@@ -292,7 +290,6 @@ static int mid8250_probe(struct pci_dev
{
struct uart_8250_port uart;
struct mid8250 *mid;
- unsigned int bar;
int ret;
ret = pcim_enable_device(pdev);
@@ -304,7 +301,6 @@ static int mid8250_probe(struct pci_dev
return -ENOMEM;
mid->board = (struct mid8250_board *)id->driver_data;
- bar = FL_GET_BASE(mid->board->flags);
memset(&uart, 0, sizeof(struct uart_8250_port));
@@ -317,8 +313,8 @@ static int mid8250_probe(struct pci_dev
uart.port.flags = UPF_SHARE_IRQ | UPF_FIXED_PORT | UPF_FIXED_TYPE;
uart.port.set_termios = mid8250_set_termios;
- uart.port.mapbase = pci_resource_start(pdev, bar);
- uart.port.membase = pcim_iomap(pdev, bar, 0);
+ uart.port.mapbase = pci_resource_start(pdev, mid->board->bar);
+ uart.port.membase = pcim_iomap(pdev, mid->board->bar, 0);
if (!uart.port.membase)
return -ENOMEM;
@@ -356,25 +352,25 @@ static void mid8250_remove(struct pci_de
}
static const struct mid8250_board pnw_board = {
- .flags = FL_BASE0,
.freq = 50000000,
.base_baud = 115200,
+ .bar = 0,
.setup = pnw_setup,
.exit = pnw_exit,
};
static const struct mid8250_board tng_board = {
- .flags = FL_BASE0,
.freq = 38400000,
.base_baud = 1843200,
+ .bar = 0,
.setup = tng_setup,
.exit = tng_exit,
};
static const struct mid8250_board dnv_board = {
- .flags = FL_BASE1,
.freq = 133333333,
.base_baud = 115200,
+ .bar = 1,
.setup = dnv_setup,
.exit = dnv_exit,
};
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 657/699] serial: 8250_mid: Disable DMA for selected platforms
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (655 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 656/699] serial: 8250_mid: Remove 8250_pci usage Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 658/699] xfs: reflect sb features in xfs_mount Greg Kroah-Hartman
` (45 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, micas-opensource, stable,
Andy Shevchenko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit b1b4efea05a56c0995e4702a86d6624b4fdff32f ]
In accordance with Errata (specification updates)
HSUART May Stop Functioning when DMA is Active.
- Denverton document #572409, rev 3.4, DNV60
- Ice Lake Xeon D document #714070, ICXD65
- Snowridge document #731931, SNR44
For a quick fix just disable the respective callbacks during the device probe.
Depending on the future development we might remove them completely.
Reported-by: micas-opensource <zjianan156@gmail.com>
Closes: https://lore.kernel.org/linux-serial/20250625031409.2404219-1-opensource@ruijie.com.cn/
Fixes: 6ede6dcd87aa ("serial: 8250_mid: add support for DMA engine handling from UART MMIO")
Cc: stable <stable@kernel.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20260626094937.561776-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_mid.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -10,6 +10,7 @@
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/rational.h>
+#include <linux/util_macros.h>
#include <linux/dma/hsu.h>
@@ -371,8 +372,16 @@ static const struct mid8250_board dnv_bo
.freq = 133333333,
.base_baud = 115200,
.bar = 1,
- .setup = dnv_setup,
- .exit = dnv_exit,
+ /*
+ * Errata:
+ * HSUART May Stop Functioning when DMA is Active.
+ *
+ * - Denverton document #572409, rev 3.4, DNV60
+ * - Ice Lake Xeon D document #714070, ICXD65
+ * - Snowridge document #731931, SNR44
+ */
+ .setup = PTR_IF(false, dnv_setup),
+ .exit = PTR_IF(false, dnv_exit),
};
#define MID_DEVICE(id, board) { PCI_VDEVICE(INTEL, id), (kernel_ulong_t)&board }
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 658/699] xfs: reflect sb features in xfs_mount
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (656 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 657/699] serial: 8250_mid: Disable DMA for selected platforms Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 659/699] xfs: fix unreachable BIGTIME check in dquot flush validation Greg Kroah-Hartman
` (44 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Chinner, Christoph Hellwig,
Darrick J. Wong, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Chinner <dchinner@redhat.com>
[ Upstream commit a1d86e8dec8c1325d301c9d5594bb794bc428fc3 ]
Currently on-disk feature checks require decoding the superblock
fileds and so can be non-trivial. We have almost 400 hundred
individual feature checks in the XFS code, so this is a significant
amount of code. To reduce runtime check overhead, pre-process all
the version flags into a features field in the xfs_mount at mount
time so we can convert all the feature checks to a simple flag
check.
There is also a need to convert the dynamic feature flags to update
the m_features field. This is required for attr, attr2 and quota
features. New xfs_mount based wrappers are added for this.
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Stable-dep-of: 03866d130ed3 ("xfs: fix unreachable BIGTIME check in dquot flush validation")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/libxfs/xfs_format.h | 2 -
fs/xfs/libxfs/xfs_sb.c | 64 ++++++++++++++++++++++++++++++++++++++
fs/xfs/libxfs/xfs_sb.h | 1
fs/xfs/xfs_dquot.c | 2 -
fs/xfs/xfs_log_recover.c | 1
fs/xfs/xfs_mount.c | 1
fs/xfs/xfs_mount.h | 75 +++++++++++++++++++++++++++++++++++++++++++++
fs/xfs/xfs_rtalloc.c | 3 +
8 files changed, 147 insertions(+), 2 deletions(-)
--- a/fs/xfs/libxfs/xfs_format.h
+++ b/fs/xfs/libxfs/xfs_format.h
@@ -412,7 +412,7 @@ static inline bool xfs_sb_version_haspro
(sbp->sb_features2 & XFS_SB_VERSION2_PROJID32BIT));
}
-static inline void xfs_sb_version_addprojid32bit(struct xfs_sb *sbp)
+static inline void xfs_sb_version_addprojid32(struct xfs_sb *sbp)
{
sbp->sb_versionnum |= XFS_SB_VERSION_MOREBITSBIT;
sbp->sb_features2 |= XFS_SB_VERSION2_PROJID32BIT;
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -91,6 +91,70 @@ xfs_perag_put(
trace_xfs_perag_put(pag->pag_mount, pag->pag_agno, ref, _RET_IP_);
}
+uint64_t
+xfs_sb_version_to_features(
+ struct xfs_sb *sbp)
+{
+ uint64_t features = 0;
+
+ /* optional V4 features */
+ if (sbp->sb_rblocks > 0)
+ features |= XFS_FEAT_REALTIME;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_ATTRBIT)
+ features |= XFS_FEAT_ATTR;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_QUOTABIT)
+ features |= XFS_FEAT_QUOTA;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_ALIGNBIT)
+ features |= XFS_FEAT_ALIGN;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_LOGV2BIT)
+ features |= XFS_FEAT_LOGV2;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_DALIGNBIT)
+ features |= XFS_FEAT_DALIGN;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_EXTFLGBIT)
+ features |= XFS_FEAT_EXTFLG;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_SECTORBIT)
+ features |= XFS_FEAT_SECTOR;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_BORGBIT)
+ features |= XFS_FEAT_ASCIICI;
+ if (sbp->sb_versionnum & XFS_SB_VERSION_MOREBITSBIT) {
+ if (sbp->sb_features2 & XFS_SB_VERSION2_LAZYSBCOUNTBIT)
+ features |= XFS_FEAT_LAZYSBCOUNT;
+ if (sbp->sb_features2 & XFS_SB_VERSION2_ATTR2BIT)
+ features |= XFS_FEAT_ATTR2;
+ if (sbp->sb_features2 & XFS_SB_VERSION2_PROJID32BIT)
+ features |= XFS_FEAT_PROJID32;
+ if (sbp->sb_features2 & XFS_SB_VERSION2_FTYPE)
+ features |= XFS_FEAT_FTYPE;
+ }
+
+ if (XFS_SB_VERSION_NUM(sbp) != XFS_SB_VERSION_5)
+ return features;
+
+ /* Always on V5 features */
+ features |= XFS_FEAT_ALIGN | XFS_FEAT_LOGV2 | XFS_FEAT_EXTFLG |
+ XFS_FEAT_LAZYSBCOUNT | XFS_FEAT_ATTR2 | XFS_FEAT_PROJID32 |
+ XFS_FEAT_V3INODES | XFS_FEAT_CRC | XFS_FEAT_PQUOTINO;
+
+ /* Optional V5 features */
+ if (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_FINOBT)
+ features |= XFS_FEAT_FINOBT;
+ if (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_RMAPBT)
+ features |= XFS_FEAT_RMAPBT;
+ if (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_REFLINK)
+ features |= XFS_FEAT_REFLINK;
+ if (sbp->sb_features_ro_compat & XFS_SB_FEAT_RO_COMPAT_INOBTCNT)
+ features |= XFS_FEAT_INOBTCNT;
+ if (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_FTYPE)
+ features |= XFS_FEAT_FTYPE;
+ if (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_SPINODES)
+ features |= XFS_FEAT_SPINODES;
+ if (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_META_UUID)
+ features |= XFS_FEAT_META_UUID;
+ if (sbp->sb_features_incompat & XFS_SB_FEAT_INCOMPAT_BIGTIME)
+ features |= XFS_FEAT_BIGTIME;
+ return features;
+}
+
/* Check all the superblock fields we care about when reading one in. */
STATIC int
xfs_validate_sb_read(
--- a/fs/xfs/libxfs/xfs_sb.h
+++ b/fs/xfs/libxfs/xfs_sb.h
@@ -29,6 +29,7 @@ extern void xfs_sb_mount_common(struct x
extern void xfs_sb_from_disk(struct xfs_sb *to, struct xfs_dsb *from);
extern void xfs_sb_to_disk(struct xfs_dsb *to, struct xfs_sb *from);
extern void xfs_sb_quota_from_disk(struct xfs_sb *sbp);
+extern uint64_t xfs_sb_version_to_features(struct xfs_sb *sbp);
extern int xfs_update_secondary_sbs(struct xfs_mount *mp);
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -1218,7 +1218,7 @@ xfs_qm_dqflush_check(
/* bigtime flag should never be set on root dquots */
if (dqp->q_type & XFS_DQTYPE_BIGTIME) {
- if (!xfs_sb_version_hasbigtime(&dqp->q_mount->m_sb))
+ if (!xfs_has_bigtime(dqp->q_mount))
return __this_address;
if (dqp->q_id == 0)
return __this_address;
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -3325,6 +3325,7 @@ xlog_do_recover(
xfs_buf_relse(bp);
/* re-initialise in-core superblock and geometry structures */
+ mp->m_features |= xfs_sb_version_to_features(sbp);
xfs_reinit_percpu_counters(mp);
error = xfs_initialize_perag(mp, sbp->sb_agcount, &mp->m_maxagi);
if (error) {
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -345,6 +345,7 @@ reread:
goto reread;
}
+ mp->m_features |= xfs_sb_version_to_features(sbp);
xfs_reinit_percpu_counters(mp);
/* no need to be quiet anymore, so reset the buf ops */
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -131,6 +131,7 @@ typedef struct xfs_mount {
int m_fixedfsid[2]; /* unchanged for life of FS */
uint m_qflags; /* quota status flags */
uint64_t m_flags; /* global mount flags */
+ uint64_t m_features; /* active filesystem features */
int64_t m_low_space[XFS_LOWSP_MAX];
struct xfs_ino_geometry m_ino_geo; /* inode geometry */
struct xfs_trans_resv m_resv; /* precomputed res values */
@@ -222,6 +223,80 @@ typedef struct xfs_mount {
#define M_IGEO(mp) (&(mp)->m_ino_geo)
/*
+ * Flags for m_features.
+ *
+ * These are all the active features in the filesystem, regardless of how
+ * they are configured.
+ */
+#define XFS_FEAT_ATTR (1ULL << 0) /* xattrs present in fs */
+#define XFS_FEAT_NLINK (1ULL << 1) /* 32 bit link counts */
+#define XFS_FEAT_QUOTA (1ULL << 2) /* quota active */
+#define XFS_FEAT_ALIGN (1ULL << 3) /* inode alignment */
+#define XFS_FEAT_DALIGN (1ULL << 4) /* data alignment */
+#define XFS_FEAT_LOGV2 (1ULL << 5) /* version 2 logs */
+#define XFS_FEAT_SECTOR (1ULL << 6) /* sector size > 512 bytes */
+#define XFS_FEAT_EXTFLG (1ULL << 7) /* unwritten extents */
+#define XFS_FEAT_ASCIICI (1ULL << 8) /* ASCII only case-insens. */
+#define XFS_FEAT_LAZYSBCOUNT (1ULL << 9) /* Superblk counters */
+#define XFS_FEAT_ATTR2 (1ULL << 10) /* dynamic attr fork */
+#define XFS_FEAT_PARENT (1ULL << 11) /* parent pointers */
+#define XFS_FEAT_PROJID32 (1ULL << 12) /* 32 bit project id */
+#define XFS_FEAT_CRC (1ULL << 13) /* metadata CRCs */
+#define XFS_FEAT_V3INODES (1ULL << 14) /* Version 3 inodes */
+#define XFS_FEAT_PQUOTINO (1ULL << 15) /* non-shared proj/grp quotas */
+#define XFS_FEAT_FTYPE (1ULL << 16) /* inode type in dir */
+#define XFS_FEAT_FINOBT (1ULL << 17) /* free inode btree */
+#define XFS_FEAT_RMAPBT (1ULL << 18) /* reverse map btree */
+#define XFS_FEAT_REFLINK (1ULL << 19) /* reflinked files */
+#define XFS_FEAT_SPINODES (1ULL << 20) /* sparse inode chunks */
+#define XFS_FEAT_META_UUID (1ULL << 21) /* metadata UUID */
+#define XFS_FEAT_REALTIME (1ULL << 22) /* realtime device present */
+#define XFS_FEAT_INOBTCNT (1ULL << 23) /* inobt block counts */
+#define XFS_FEAT_BIGTIME (1ULL << 24) /* large timestamps */
+#define XFS_FEAT_NEEDSREPAIR (1ULL << 25) /* needs xfs_repair */
+
+#define __XFS_HAS_FEAT(name, NAME) \
+static inline bool xfs_has_ ## name (struct xfs_mount *mp) \
+{ \
+ return mp->m_features & XFS_FEAT_ ## NAME; \
+}
+
+/* Some features can be added dynamically so they need a set wrapper, too. */
+#define __XFS_ADD_FEAT(name, NAME) \
+ __XFS_HAS_FEAT(name, NAME); \
+static inline void xfs_add_ ## name (struct xfs_mount *mp) \
+{ \
+ mp->m_features |= XFS_FEAT_ ## NAME; \
+ xfs_sb_version_add ## name(&mp->m_sb); \
+}
+
+__XFS_HAS_FEAT(nlink, NLINK)
+__XFS_ADD_FEAT(quota, QUOTA)
+__XFS_HAS_FEAT(align, ALIGN)
+__XFS_HAS_FEAT(dalign, DALIGN)
+__XFS_HAS_FEAT(logv2, LOGV2)
+__XFS_HAS_FEAT(sector, SECTOR)
+__XFS_HAS_FEAT(extflg, EXTFLG)
+__XFS_HAS_FEAT(asciici, ASCIICI)
+__XFS_HAS_FEAT(lazysbcount, LAZYSBCOUNT)
+__XFS_ADD_FEAT(attr2, ATTR2)
+__XFS_HAS_FEAT(parent, PARENT)
+__XFS_ADD_FEAT(projid32, PROJID32)
+__XFS_HAS_FEAT(crc, CRC)
+__XFS_HAS_FEAT(v3inodes, V3INODES)
+__XFS_HAS_FEAT(pquotino, PQUOTINO)
+__XFS_HAS_FEAT(ftype, FTYPE)
+__XFS_HAS_FEAT(finobt, FINOBT)
+__XFS_HAS_FEAT(rmapbt, RMAPBT)
+__XFS_HAS_FEAT(reflink, REFLINK)
+__XFS_HAS_FEAT(sparseinodes, SPINODES)
+__XFS_HAS_FEAT(metauuid, META_UUID)
+__XFS_HAS_FEAT(realtime, REALTIME)
+__XFS_HAS_FEAT(inobtcounts, INOBTCNT)
+__XFS_HAS_FEAT(bigtime, BIGTIME)
+__XFS_HAS_FEAT(needsrepair, NEEDSREPAIR)
+
+/*
* Flags for m_flags.
*/
#define XFS_MOUNT_WSYNC (1ULL << 0) /* for nfs - all metadata ops
--- a/fs/xfs/xfs_rtalloc.c
+++ b/fs/xfs/xfs_rtalloc.c
@@ -1101,6 +1101,9 @@ error_cancel:
error = xfs_trans_commit(tp);
if (error)
break;
+
+ /* Ensure the mount RT feature flag is now set. */
+ mp->m_features |= XFS_FEAT_REALTIME;
}
if (error)
goto out_free;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 659/699] xfs: fix unreachable BIGTIME check in dquot flush validation
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (657 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 658/699] xfs: reflect sb features in xfs_mount Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 660/699] xfs: use null daddr for unset first bad log block Greg Kroah-Hartman
` (43 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Nepomnyashih, Darrick J. Wong,
Allison Henderson, Carlos Maiolino, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Nepomnyashih <sdl@nppct.ru>
[ Upstream commit 03866d130ed33ab68cc7faaf4bf2c4abef96d42e ]
The dqp->q_id == 0 check inside the XFS_DQTYPE_BIGTIME block is
unreachable because root dquots return successfully earlier. Reject root
dquots with XFS_DQTYPE_BIGTIME before that early return, preserving the
intended validation and removing the unreachable condition.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 4ea1ff3b4968 ("xfs: widen ondisk quota expiration timestamps to handle y2038+")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Allison Henderson <achender@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_dquot.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/fs/xfs/xfs_dquot.c
+++ b/fs/xfs/xfs_dquot.c
@@ -1201,6 +1201,14 @@ xfs_qm_dqflush_check(
type != XFS_DQTYPE_PROJ)
return __this_address;
+ /* bigtime flag should never be set on root dquots */
+ if (dqp->q_type & XFS_DQTYPE_BIGTIME) {
+ if (!xfs_has_bigtime(dqp->q_mount))
+ return __this_address;
+ if (dqp->q_id == 0)
+ return __this_address;
+ }
+
if (dqp->q_id == 0)
return NULL;
@@ -1216,14 +1224,6 @@ xfs_qm_dqflush_check(
!dqp->q_rtb.timer)
return __this_address;
- /* bigtime flag should never be set on root dquots */
- if (dqp->q_type & XFS_DQTYPE_BIGTIME) {
- if (!xfs_has_bigtime(dqp->q_mount))
- return __this_address;
- if (dqp->q_id == 0)
- return __this_address;
- }
-
return NULL;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 660/699] xfs: use null daddr for unset first bad log block
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (658 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 659/699] xfs: fix unreachable BIGTIME check in dquot flush validation Greg Kroah-Hartman
@ 2026-07-21 15:26 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 661/699] hfs/hfsplus: prevent getting negative values of offset/length Greg Kroah-Hartman
` (42 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong,
syzbot+b7dfbed0c6c2b5e9fd34, Yousef Alhouseen, Carlos Maiolino,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yousef Alhouseen <alhouseenyousef@gmail.com>
[ Upstream commit cc9af5e461ea5f6e37738f3f1e41c45a9b7f45d6 ]
xlog_do_recovery_pass() may return before setting first_bad. The caller
must distinguish that case from an error at a valid log block, including
block zero after the log wraps.
Initialize first_bad to XFS_BUF_DADDR_NULL and test it explicitly before
treating the error as a torn write.
Fixes: 7088c4136fa1 ("xfs: detect and trim torn writes during log recovery")
Suggested-by: Darrick J. Wong <djwong@kernel.org>
Reported-by: syzbot+b7dfbed0c6c2b5e9fd34@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b7dfbed0c6c2b5e9fd34
Cc: stable@vger.kernel.org # v4.5
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
[ adjusted hunk offsets for context drift and dropped an inapplicable whitespace-only end-of-file hunk whose context doesn't exist in 5.10 ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_log_recover.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -1034,7 +1034,7 @@ xlog_verify_head(
{
struct xlog_rec_header *tmp_rhead;
char *tmp_buffer;
- xfs_daddr_t first_bad;
+ xfs_daddr_t first_bad = XFS_BUF_DADDR_NULL;
xfs_daddr_t tmp_rhead_blk;
int found;
int error;
@@ -1063,7 +1063,8 @@ xlog_verify_head(
*/
error = xlog_do_recovery_pass(log, *head_blk, tmp_rhead_blk,
XLOG_RECOVER_CRCPASS, &first_bad);
- if ((error == -EFSBADCRC || error == -EFSCORRUPTED) && first_bad) {
+ if ((error == -EFSBADCRC || error == -EFSCORRUPTED) &&
+ first_bad != XFS_BUF_DADDR_NULL) {
/*
* We've hit a potential torn write. Reset the error and warn
* about it.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 661/699] hfs/hfsplus: prevent getting negative values of offset/length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (659 preceding siblings ...)
2026-07-21 15:26 ` [PATCH 5.10 660/699] xfs: use null daddr for unset first bad log block Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 662/699] hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Greg Kroah-Hartman
` (41 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viacheslav Dubeyko,
John Paul Adrian Glaubitz, Yangtao Li, linux-fsdevel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <slava@dubeyko.com>
[ Upstream commit 00c14a09a70e10ae18eb3707d0059291425c04bd ]
The syzbot reported KASAN out-of-bounds issue in
hfs_bnode_move():
[ 45.588165][ T9821] hfs: dst 14, src 65536, len -65536
[ 45.588895][ T9821] ==================================================================
[ 45.590114][ T9821] BUG: KASAN: out-of-bounds in hfs_bnode_move+0xfd/0x140
[ 45.591127][ T9821] Read of size 18446744073709486080 at addr ffff888035935400 by task repro/9821
[ 45.592207][ T9821]
[ 45.592420][ T9821] CPU: 0 UID: 0 PID: 9821 Comm: repro Not tainted 6.16.0-rc7-dirty #42 PREEMPT(full)
[ 45.592428][ T9821] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 45.592431][ T9821] Call Trace:
[ 45.592434][ T9821] <TASK>
[ 45.592437][ T9821] dump_stack_lvl+0x1c1/0x2a0
[ 45.592446][ T9821] ? __virt_addr_valid+0x1c8/0x5c0
[ 45.592454][ T9821] ? __pfx_dump_stack_lvl+0x10/0x10
[ 45.592461][ T9821] ? rcu_is_watching+0x15/0xb0
[ 45.592469][ T9821] ? lock_release+0x4b/0x3e0
[ 45.592476][ T9821] ? __virt_addr_valid+0x1c8/0x5c0
[ 45.592483][ T9821] ? __virt_addr_valid+0x4a5/0x5c0
[ 45.592491][ T9821] print_report+0x17e/0x7c0
[ 45.592497][ T9821] ? __virt_addr_valid+0x1c8/0x5c0
[ 45.592504][ T9821] ? __virt_addr_valid+0x4a5/0x5c0
[ 45.592511][ T9821] ? __phys_addr+0xd3/0x180
[ 45.592519][ T9821] ? hfs_bnode_move+0xfd/0x140
[ 45.592526][ T9821] kasan_report+0x147/0x180
[ 45.592531][ T9821] ? _printk+0xcf/0x120
[ 45.592537][ T9821] ? hfs_bnode_move+0xfd/0x140
[ 45.592544][ T9821] ? hfs_bnode_move+0xfd/0x140
[ 45.592552][ T9821] kasan_check_range+0x2b0/0x2c0
[ 45.592557][ T9821] ? hfs_bnode_move+0xfd/0x140
[ 45.592565][ T9821] __asan_memmove+0x29/0x70
[ 45.592572][ T9821] hfs_bnode_move+0xfd/0x140
[ 45.592580][ T9821] hfs_brec_remove+0x473/0x560
[ 45.592589][ T9821] hfs_cat_move+0x6fb/0x960
[ 45.592598][ T9821] ? __pfx_hfs_cat_move+0x10/0x10
[ 45.592607][ T9821] ? seqcount_lockdep_reader_access+0x122/0x1c0
[ 45.592614][ T9821] ? lockdep_hardirqs_on+0x9c/0x150
[ 45.592631][ T9821] ? __lock_acquire+0xaec/0xd80
[ 45.592641][ T9821] hfs_rename+0x1dc/0x2d0
[ 45.592649][ T9821] ? __pfx_hfs_rename+0x10/0x10
[ 45.592657][ T9821] vfs_rename+0xac6/0xed0
[ 45.592664][ T9821] ? __pfx_vfs_rename+0x10/0x10
[ 45.592670][ T9821] ? d_alloc+0x144/0x190
[ 45.592677][ T9821] ? bpf_lsm_path_rename+0x9/0x20
[ 45.592683][ T9821] ? security_path_rename+0x17d/0x490
[ 45.592691][ T9821] do_renameat2+0x890/0xc50
[ 45.592699][ T9821] ? __pfx_do_renameat2+0x10/0x10
[ 45.592707][ T9821] ? getname_flags+0x1e5/0x540
[ 45.592714][ T9821] __x64_sys_rename+0x82/0x90
[ 45.592720][ T9821] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 45.592725][ T9821] do_syscall_64+0xf3/0x3a0
[ 45.592741][ T9821] ? exc_page_fault+0x9f/0xf0
[ 45.592748][ T9821] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 45.592754][ T9821] RIP: 0033:0x7f7f73fe3fc9
[ 45.592760][ T9821] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48
[ 45.592765][ T9821] RSP: 002b:00007ffc7e116cf8 EFLAGS: 00000283 ORIG_RAX: 0000000000000052
[ 45.592772][ T9821] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7f73fe3fc9
[ 45.592776][ T9821] RDX: 0000200000000871 RSI: 0000200000000780 RDI: 00002000000003c0
[ 45.592781][ T9821] RBP: 00007ffc7e116d00 R08: 0000000000000000 R09: 00007ffc7e116d30
[ 45.592784][ T9821] R10: fffffffffffffff0 R11: 0000000000000283 R12: 00005557e81f8250
[ 45.592788][ T9821] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 45.592795][ T9821] </TASK>
[ 45.592797][ T9821]
[ 45.619721][ T9821] The buggy address belongs to the physical page:
[ 45.620300][ T9821] page: refcount:1 mapcount:1 mapping:0000000000000000 index:0x559a88174 pfn:0x35935
[ 45.621150][ T9821] memcg:ffff88810a1d5b00
[ 45.621531][ T9821] anon flags: 0xfff60000020838(uptodate|dirty|lru|owner_2|swapbacked|node=0|zone=1|lastcpupid=0x7ff)
[ 45.622496][ T9821] raw: 00fff60000020838 ffffea0000d64d88 ffff888021753e10 ffff888029da0771
[ 45.623260][ T9821] raw: 0000000559a88174 0000000000000000 0000000100000000 ffff88810a1d5b00
[ 45.624030][ T9821] page dumped because: kasan: bad access detected
[ 45.624602][ T9821] page_owner tracks the page as allocated
[ 45.625115][ T9821] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_ZERO0
[ 45.626685][ T9821] post_alloc_hook+0x240/0x2a0
[ 45.627127][ T9821] get_page_from_freelist+0x2101/0x21e0
[ 45.627628][ T9821] __alloc_frozen_pages_noprof+0x274/0x380
[ 45.628154][ T9821] alloc_pages_mpol+0x241/0x4b0
[ 45.628593][ T9821] vma_alloc_folio_noprof+0xe4/0x210
[ 45.629066][ T9821] folio_prealloc+0x30/0x180
[ 45.629487][ T9821] __handle_mm_fault+0x34bd/0x5640
[ 45.629957][ T9821] handle_mm_fault+0x40e/0x8e0
[ 45.630392][ T9821] do_user_addr_fault+0xa81/0x1390
[ 45.630862][ T9821] exc_page_fault+0x76/0xf0
[ 45.631273][ T9821] asm_exc_page_fault+0x26/0x30
[ 45.631712][ T9821] page last free pid 5269 tgid 5269 stack trace:
[ 45.632281][ T9821] free_unref_folios+0xc73/0x14c0
[ 45.632740][ T9821] folios_put_refs+0x55b/0x640
[ 45.633177][ T9821] free_pages_and_swap_cache+0x26d/0x510
[ 45.633685][ T9821] tlb_flush_mmu+0x3a0/0x680
[ 45.634105][ T9821] tlb_finish_mmu+0xd4/0x200
[ 45.634525][ T9821] exit_mmap+0x44c/0xb70
[ 45.634914][ T9821] __mmput+0x118/0x420
[ 45.635286][ T9821] exit_mm+0x1da/0x2c0
[ 45.635659][ T9821] do_exit+0x652/0x2330
[ 45.636039][ T9821] do_group_exit+0x21c/0x2d0
[ 45.636457][ T9821] __x64_sys_exit_group+0x3f/0x40
[ 45.636915][ T9821] x64_sys_call+0x21ba/0x21c0
[ 45.637342][ T9821] do_syscall_64+0xf3/0x3a0
[ 45.637756][ T9821] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 45.638290][ T9821] page has been migrated, last migrate reason: numa_misplaced
[ 45.638956][ T9821]
[ 45.639173][ T9821] Memory state around the buggy address:
[ 45.639677][ T9821] ffff888035935300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 45.640397][ T9821] ffff888035935380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 45.641117][ T9821] >ffff888035935400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 45.641837][ T9821] ^
[ 45.642207][ T9821] ffff888035935480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 45.642929][ T9821] ffff888035935500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 45.643650][ T9821] ==================================================================
This commit [1] fixes the issue if an offset inside of b-tree node
or length of the request is bigger than b-tree node. However,
this fix is still not ready for negative values
of the offset or length. Moreover, negative values of
the offset or length doesn't make sense for b-tree's
operations. Because we could try to access the memory address
outside of the beginning of memory page's addresses range.
Also, using of negative values make logic very complicated,
unpredictable, and we could access the wrong item(s)
in the b-tree node.
This patch changes b-tree interface by means of converting
signed integer arguments of offset and length on u32 type.
Such conversion has goal to prevent of using negative values
unintentionally or by mistake in b-tree operations.
[1] 'commit a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")'
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/20251002200020.2578311-1-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Stable-dep-of: 966cb76fb285 ("hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/hfs/bfind.c | 2 -
fs/hfs/bnode.c | 52 +++++++++++++++---------------
fs/hfs/brec.c | 2 -
fs/hfs/btree.c | 2 -
fs/hfs/btree.h | 71 ++++++++++++++++++++---------------------
fs/hfs/hfs_fs.h | 83 ++++++++++++++++++++++++++++--------------------
fs/hfs/inode.c | 2 -
fs/hfsplus/bfind.c | 2 -
fs/hfsplus/bnode.c | 60 +++++++++++++++++-----------------
fs/hfsplus/brec.c | 2 -
fs/hfsplus/btree.c | 2 -
fs/hfsplus/hfsplus_fs.h | 38 ++++++++++-----------
12 files changed, 167 insertions(+), 151 deletions(-)
--- a/fs/hfs/bfind.c
+++ b/fs/hfs/bfind.c
@@ -164,7 +164,7 @@ release:
return res;
}
-int hfs_brec_read(struct hfs_find_data *fd, void *rec, int rec_len)
+int hfs_brec_read(struct hfs_find_data *fd, void *rec, u32 rec_len)
{
int res;
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -16,14 +16,14 @@
#include "btree.h"
static inline
-bool is_bnode_offset_valid(struct hfs_bnode *node, int off)
+bool is_bnode_offset_valid(struct hfs_bnode *node, u32 off)
{
bool is_valid = off < node->tree->node_size;
if (!is_valid) {
pr_err("requested invalid offset: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d\n",
+ "node_size %u, offset %u\n",
node->this, node->type, node->height,
node->tree->node_size, off);
}
@@ -32,7 +32,7 @@ bool is_bnode_offset_valid(struct hfs_bn
}
static inline
-int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len)
+u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
{
unsigned int node_size;
@@ -42,12 +42,12 @@ int check_and_correct_requested_length(s
node_size = node->tree->node_size;
if ((off + len) > node_size) {
- int new_len = (int)node_size - off;
+ u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, "
- "requested_len %d, corrected_len %d\n",
+ "node_size %u, offset %u, "
+ "requested_len %u, corrected_len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len, new_len);
@@ -57,12 +57,12 @@ int check_and_correct_requested_length(s
return len;
}
-void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
+void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len)
{
struct page *page;
- int pagenum;
- int bytes_read;
- int bytes_to_read;
+ u32 pagenum;
+ u32 bytes_read;
+ u32 bytes_to_read;
void *vaddr;
memset(buf, 0, len);
@@ -73,7 +73,7 @@ void hfs_bnode_read(struct hfs_bnode *no
if (len == 0) {
pr_err("requested zero length: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, len %d\n",
+ "node_size %u, offset %u, len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len);
return;
@@ -89,7 +89,7 @@ void hfs_bnode_read(struct hfs_bnode *no
if (pagenum >= node->tree->pages_per_bnode)
break;
page = node->page[pagenum];
- bytes_to_read = min_t(int, len - bytes_read, PAGE_SIZE - off);
+ bytes_to_read = min_t(u32, len - bytes_read, PAGE_SIZE - off);
vaddr = kmap_atomic(page);
memcpy(buf + bytes_read, vaddr + off, bytes_to_read);
@@ -100,7 +100,7 @@ void hfs_bnode_read(struct hfs_bnode *no
}
}
-u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
+u16 hfs_bnode_read_u16(struct hfs_bnode *node, u32 off)
{
__be16 data;
// optimize later...
@@ -108,7 +108,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode
return be16_to_cpu(data);
}
-u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off)
+u8 hfs_bnode_read_u8(struct hfs_bnode *node, u32 off)
{
u8 data;
// optimize later...
@@ -116,10 +116,10 @@ u8 hfs_bnode_read_u8(struct hfs_bnode *n
return data;
}
-void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
+void hfs_bnode_read_key(struct hfs_bnode *node, void *key, u32 off)
{
struct hfs_btree *tree;
- int key_len;
+ u32 key_len;
tree = node->tree;
if (node->type == HFS_NODE_LEAF ||
@@ -130,14 +130,14 @@ void hfs_bnode_read_key(struct hfs_bnode
if (key_len > sizeof(hfs_btree_key) || key_len < 1) {
memset(key, 0, sizeof(hfs_btree_key));
- pr_err("hfs: Invalid key length: %d\n", key_len);
+ pr_err("hfs: Invalid key length: %u\n", key_len);
return;
}
hfs_bnode_read(node, key, off, key_len);
}
-void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)
+void hfs_bnode_write(struct hfs_bnode *node, void *buf, u32 off, u32 len)
{
struct page *page;
@@ -147,7 +147,7 @@ void hfs_bnode_write(struct hfs_bnode *n
if (len == 0) {
pr_err("requested zero length: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, len %d\n",
+ "node_size %u, offset %u, len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len);
return;
@@ -163,20 +163,20 @@ void hfs_bnode_write(struct hfs_bnode *n
set_page_dirty(page);
}
-void hfs_bnode_write_u16(struct hfs_bnode *node, int off, u16 data)
+void hfs_bnode_write_u16(struct hfs_bnode *node, u32 off, u16 data)
{
__be16 v = cpu_to_be16(data);
// optimize later...
hfs_bnode_write(node, &v, off, 2);
}
-void hfs_bnode_write_u8(struct hfs_bnode *node, int off, u8 data)
+void hfs_bnode_write_u8(struct hfs_bnode *node, u32 off, u8 data)
{
// optimize later...
hfs_bnode_write(node, &data, off, 1);
}
-void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)
+void hfs_bnode_clear(struct hfs_bnode *node, u32 off, u32 len)
{
struct page *page;
@@ -186,7 +186,7 @@ void hfs_bnode_clear(struct hfs_bnode *n
if (len == 0) {
pr_err("requested zero length: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, len %d\n",
+ "node_size %u, offset %u, len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len);
return;
@@ -202,8 +202,8 @@ void hfs_bnode_clear(struct hfs_bnode *n
set_page_dirty(page);
}
-void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,
- struct hfs_bnode *src_node, int src, int len)
+void hfs_bnode_copy(struct hfs_bnode *dst_node, u32 dst,
+ struct hfs_bnode *src_node, u32 src, u32 len)
{
struct page *src_page, *dst_page;
@@ -225,7 +225,7 @@ void hfs_bnode_copy(struct hfs_bnode *ds
set_page_dirty(dst_page);
}
-void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)
+void hfs_bnode_move(struct hfs_bnode *node, u32 dst, u32 src, u32 len)
{
struct page *page;
void *ptr;
--- a/fs/hfs/brec.c
+++ b/fs/hfs/brec.c
@@ -62,7 +62,7 @@ u16 hfs_brec_keylen(struct hfs_bnode *no
return retval;
}
-int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len)
+int hfs_brec_insert(struct hfs_find_data *fd, void *entry, u32 entry_len)
{
struct hfs_btree *tree;
struct hfs_bnode *node, *new_node;
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -221,7 +221,7 @@ static struct hfs_bnode *hfs_bmap_new_bm
}
/* Make sure @tree has enough space for the @rsvd_nodes */
-int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
+int hfs_bmap_reserve(struct hfs_btree *tree, u32 rsvd_nodes)
{
struct inode *inode = tree->inode;
u32 count;
--- a/fs/hfs/btree.h
+++ b/fs/hfs/btree.h
@@ -86,48 +86,49 @@ struct hfs_find_data {
/* btree.c */
-extern struct hfs_btree *hfs_btree_open(struct super_block *, u32, btree_keycmp);
-extern void hfs_btree_close(struct hfs_btree *);
-extern void hfs_btree_write(struct hfs_btree *);
-extern int hfs_bmap_reserve(struct hfs_btree *, int);
-extern struct hfs_bnode * hfs_bmap_alloc(struct hfs_btree *);
+extern struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id,
+ btree_keycmp keycmp);
+extern void hfs_btree_close(struct hfs_btree *tree);
+extern void hfs_btree_write(struct hfs_btree *tree);
+extern int hfs_bmap_reserve(struct hfs_btree *tree, u32 rsvd_nodes);
+extern struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree);
extern void hfs_bmap_free(struct hfs_bnode *node);
/* bnode.c */
-extern void hfs_bnode_read(struct hfs_bnode *, void *, int, int);
-extern u16 hfs_bnode_read_u16(struct hfs_bnode *, int);
-extern u8 hfs_bnode_read_u8(struct hfs_bnode *, int);
-extern void hfs_bnode_read_key(struct hfs_bnode *, void *, int);
-extern void hfs_bnode_write(struct hfs_bnode *, void *, int, int);
-extern void hfs_bnode_write_u16(struct hfs_bnode *, int, u16);
-extern void hfs_bnode_write_u8(struct hfs_bnode *, int, u8);
-extern void hfs_bnode_clear(struct hfs_bnode *, int, int);
-extern void hfs_bnode_copy(struct hfs_bnode *, int,
- struct hfs_bnode *, int, int);
-extern void hfs_bnode_move(struct hfs_bnode *, int, int, int);
-extern void hfs_bnode_dump(struct hfs_bnode *);
-extern void hfs_bnode_unlink(struct hfs_bnode *);
-extern struct hfs_bnode *hfs_bnode_findhash(struct hfs_btree *, u32);
-extern struct hfs_bnode *hfs_bnode_find(struct hfs_btree *, u32);
-extern void hfs_bnode_unhash(struct hfs_bnode *);
-extern void hfs_bnode_free(struct hfs_bnode *);
-extern struct hfs_bnode *hfs_bnode_create(struct hfs_btree *, u32);
-extern void hfs_bnode_get(struct hfs_bnode *);
-extern void hfs_bnode_put(struct hfs_bnode *);
+extern void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len);
+extern u16 hfs_bnode_read_u16(struct hfs_bnode *node, u32 off);
+extern u8 hfs_bnode_read_u8(struct hfs_bnode *node, u32 off);
+extern void hfs_bnode_read_key(struct hfs_bnode *node, void *key, u32 off);
+extern void hfs_bnode_write(struct hfs_bnode *node, void *buf, u32 off, u32 len);
+extern void hfs_bnode_write_u16(struct hfs_bnode *node, u32 off, u16 data);
+extern void hfs_bnode_write_u8(struct hfs_bnode *node, u32 off, u8 data);
+extern void hfs_bnode_clear(struct hfs_bnode *node, u32 off, u32 len);
+extern void hfs_bnode_copy(struct hfs_bnode *dst_node, u32 dst,
+ struct hfs_bnode *src_node, u32 src, u32 len);
+extern void hfs_bnode_move(struct hfs_bnode *node, u32 dst, u32 src, u32 len);
+extern void hfs_bnode_dump(struct hfs_bnode *node);
+extern void hfs_bnode_unlink(struct hfs_bnode *node);
+extern struct hfs_bnode *hfs_bnode_findhash(struct hfs_btree *tree, u32 cnid);
+extern struct hfs_bnode *hfs_bnode_find(struct hfs_btree *tree, u32 num);
+extern void hfs_bnode_unhash(struct hfs_bnode *node);
+extern void hfs_bnode_free(struct hfs_bnode *node);
+extern struct hfs_bnode *hfs_bnode_create(struct hfs_btree *tree, u32 num);
+extern void hfs_bnode_get(struct hfs_bnode *node);
+extern void hfs_bnode_put(struct hfs_bnode *node);
/* brec.c */
-extern u16 hfs_brec_lenoff(struct hfs_bnode *, u16, u16 *);
-extern u16 hfs_brec_keylen(struct hfs_bnode *, u16);
-extern int hfs_brec_insert(struct hfs_find_data *, void *, int);
-extern int hfs_brec_remove(struct hfs_find_data *);
+extern u16 hfs_brec_lenoff(struct hfs_bnode *node, u16 rec, u16 *off);
+extern u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec);
+extern int hfs_brec_insert(struct hfs_find_data *fd, void *entry, u32 entry_len);
+extern int hfs_brec_remove(struct hfs_find_data *fd);
/* bfind.c */
-extern int hfs_find_init(struct hfs_btree *, struct hfs_find_data *);
-extern void hfs_find_exit(struct hfs_find_data *);
-extern int __hfs_brec_find(struct hfs_bnode *, struct hfs_find_data *);
-extern int hfs_brec_find(struct hfs_find_data *);
-extern int hfs_brec_read(struct hfs_find_data *, void *, int);
-extern int hfs_brec_goto(struct hfs_find_data *, int);
+extern int hfs_find_init(struct hfs_btree *tree, struct hfs_find_data *fd);
+extern void hfs_find_exit(struct hfs_find_data *fd);
+extern int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd);
+extern int hfs_brec_find(struct hfs_find_data *fd);
+extern int hfs_brec_read(struct hfs_find_data *fd, void *rec, u32 rec_len);
+extern int hfs_brec_goto(struct hfs_find_data *fd, int cnt);
struct hfs_bnode_desc {
--- a/fs/hfs/hfs_fs.h
+++ b/fs/hfs/hfs_fs.h
@@ -171,70 +171,85 @@ struct hfs_sb_info {
#define HFS_FLG_ALT_MDB_DIRTY 2
/* bitmap.c */
-extern u32 hfs_vbm_search_free(struct super_block *, u32, u32 *);
-extern int hfs_clear_vbm_bits(struct super_block *, u16, u16);
+extern u32 hfs_vbm_search_free(struct super_block *sb, u32 goal, u32 *num_bits);
+extern int hfs_clear_vbm_bits(struct super_block *sb, u16 start, u16 count);
/* catalog.c */
-extern int hfs_cat_keycmp(const btree_key *, const btree_key *);
+extern int hfs_cat_keycmp(const btree_key *key1, const btree_key *key2);
struct hfs_find_data;
-extern int hfs_cat_find_brec(struct super_block *, u32, struct hfs_find_data *);
-extern int hfs_cat_create(u32, struct inode *, const struct qstr *, struct inode *);
-extern int hfs_cat_delete(u32, struct inode *, const struct qstr *);
-extern int hfs_cat_move(u32, struct inode *, const struct qstr *,
- struct inode *, const struct qstr *);
-extern void hfs_cat_build_key(struct super_block *, btree_key *, u32, const struct qstr *);
+extern int hfs_cat_find_brec(struct super_block *sb, u32 cnid,
+ struct hfs_find_data *fd);
+extern int hfs_cat_create(u32 cnid, struct inode *dir,
+ const struct qstr *str, struct inode *inode);
+extern int hfs_cat_delete(u32 cnid, struct inode *dir, const struct qstr *str);
+extern int hfs_cat_move(u32 cnid, struct inode *src_dir,
+ const struct qstr *src_name,
+ struct inode *dst_dir,
+ const struct qstr *dst_name);
+extern void hfs_cat_build_key(struct super_block *sb, btree_key *key,
+ u32 parent, const struct qstr *name);
/* dir.c */
extern const struct file_operations hfs_dir_operations;
extern const struct inode_operations hfs_dir_inode_operations;
/* extent.c */
-extern int hfs_ext_keycmp(const btree_key *, const btree_key *);
-extern int hfs_free_fork(struct super_block *, struct hfs_cat_file *, int);
-extern int hfs_ext_write_extent(struct inode *);
-extern int hfs_extend_file(struct inode *);
-extern void hfs_file_truncate(struct inode *);
+extern int hfs_ext_keycmp(const btree_key *key1, const btree_key *key2);
+extern int hfs_free_fork(struct super_block *sb,
+ struct hfs_cat_file *file, int type);
+extern int hfs_ext_write_extent(struct inode *inode);
+extern int hfs_extend_file(struct inode *inode);
+extern void hfs_file_truncate(struct inode *inode);
-extern int hfs_get_block(struct inode *, sector_t, struct buffer_head *, int);
+extern int hfs_get_block(struct inode *inode, sector_t block,
+ struct buffer_head *bh_result, int create);
/* inode.c */
extern const struct address_space_operations hfs_aops;
extern const struct address_space_operations hfs_btree_aops;
-extern struct inode *hfs_new_inode(struct inode *, const struct qstr *, umode_t);
-extern void hfs_inode_write_fork(struct inode *, struct hfs_extent *, __be32 *, __be32 *);
-extern int hfs_write_inode(struct inode *, struct writeback_control *);
-extern int hfs_inode_setattr(struct dentry *, struct iattr *);
+extern struct inode *hfs_new_inode(struct inode *dir, const struct qstr *name,
+ umode_t mode);
+extern void hfs_inode_write_fork(struct inode *inode, struct hfs_extent *ext,
+ __be32 *log_size, __be32 *phys_size);
+extern int hfs_write_inode(struct inode *inode, struct writeback_control *wbc);
+extern int hfs_inode_setattr(struct dentry *dentry, struct iattr *attr);
extern void hfs_inode_read_fork(struct inode *inode, struct hfs_extent *ext,
- __be32 log_size, __be32 phys_size, u32 clump_size);
-extern struct inode *hfs_iget(struct super_block *, struct hfs_cat_key *, hfs_cat_rec *);
-extern void hfs_evict_inode(struct inode *);
-extern void hfs_delete_inode(struct inode *);
+ __be32 __log_size, __be32 phys_size,
+ u32 clump_size);
+extern struct inode *hfs_iget(struct super_block *sb, struct hfs_cat_key *key,
+ hfs_cat_rec *rec);
+extern void hfs_evict_inode(struct inode *inode);
+extern void hfs_delete_inode(struct inode *inode);
/* attr.c */
extern const struct xattr_handler *hfs_xattr_handlers[];
/* mdb.c */
-extern int hfs_mdb_get(struct super_block *);
-extern void hfs_mdb_commit(struct super_block *);
-extern void hfs_mdb_close(struct super_block *);
-extern void hfs_mdb_put(struct super_block *);
+extern int hfs_mdb_get(struct super_block *sb);
+extern void hfs_mdb_commit(struct super_block *sb);
+extern void hfs_mdb_close(struct super_block *sb);
+extern void hfs_mdb_put(struct super_block *sb);
/* part_tbl.c */
-extern int hfs_part_find(struct super_block *, sector_t *, sector_t *);
+extern int hfs_part_find(struct super_block *sb,
+ sector_t *part_start, sector_t *part_size);
/* string.c */
extern const struct dentry_operations hfs_dentry_operations;
-extern int hfs_hash_dentry(const struct dentry *, struct qstr *);
-extern int hfs_strcmp(const unsigned char *, unsigned int,
- const unsigned char *, unsigned int);
+extern int hfs_hash_dentry(const struct dentry *dentry, struct qstr *this);
+extern int hfs_strcmp(const unsigned char *s1, unsigned int len1,
+ const unsigned char *s2, unsigned int len2);
extern int hfs_compare_dentry(const struct dentry *dentry,
- unsigned int len, const char *str, const struct qstr *name);
+ unsigned int len, const char *str,
+ const struct qstr *name);
/* trans.c */
-extern void hfs_asc2mac(struct super_block *, struct hfs_name *, const struct qstr *);
-extern int hfs_mac2asc(struct super_block *, char *, const struct hfs_name *);
+extern void hfs_asc2mac(struct super_block *sb,
+ struct hfs_name *out, const struct qstr *in);
+extern int hfs_mac2asc(struct super_block *sb,
+ char *out, const struct hfs_name *in);
/* super.c */
extern void hfs_mark_mdb_dirty(struct super_block *sb);
--- a/fs/hfs/inode.c
+++ b/fs/hfs/inode.c
@@ -50,7 +50,7 @@ static void hfs_write_failed(struct addr
}
static int hfs_write_begin(struct file *file, struct address_space *mapping,
- loff_t pos, unsigned len, unsigned flags,
+ loff_t pos, unsigned int len, unsigned flags,
struct page **pagep, void **fsdata)
{
int ret;
--- a/fs/hfsplus/bfind.c
+++ b/fs/hfsplus/bfind.c
@@ -210,7 +210,7 @@ release:
return res;
}
-int hfs_brec_read(struct hfs_find_data *fd, void *rec, int rec_len)
+int hfs_brec_read(struct hfs_find_data *fd, void *rec, u32 rec_len)
{
int res;
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -20,10 +20,10 @@
/* Copy a specified range of bytes from the raw data of a node */
-void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len)
+void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len)
{
struct page **pagep;
- int l;
+ u32 l;
memset(buf, 0, len);
@@ -33,7 +33,7 @@ void hfs_bnode_read(struct hfs_bnode *no
if (len == 0) {
pr_err("requested zero length: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, len %d\n",
+ "node_size %u, offset %u, len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len);
return;
@@ -45,19 +45,19 @@ void hfs_bnode_read(struct hfs_bnode *no
pagep = node->page + (off >> PAGE_SHIFT);
off &= ~PAGE_MASK;
- l = min_t(int, len, PAGE_SIZE - off);
+ l = min_t(u32, len, PAGE_SIZE - off);
memcpy(buf, kmap(*pagep) + off, l);
kunmap(*pagep);
while ((len -= l) != 0) {
buf += l;
- l = min_t(int, len, PAGE_SIZE);
+ l = min_t(u32, len, PAGE_SIZE);
memcpy(buf, kmap(*++pagep), l);
kunmap(*pagep);
}
}
-u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off)
+u16 hfs_bnode_read_u16(struct hfs_bnode *node, u32 off)
{
__be16 data;
/* TODO: optimize later... */
@@ -65,7 +65,7 @@ u16 hfs_bnode_read_u16(struct hfs_bnode
return be16_to_cpu(data);
}
-u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off)
+u8 hfs_bnode_read_u8(struct hfs_bnode *node, u32 off)
{
u8 data;
/* TODO: optimize later... */
@@ -73,10 +73,10 @@ u8 hfs_bnode_read_u8(struct hfs_bnode *n
return data;
}
-void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off)
+void hfs_bnode_read_key(struct hfs_bnode *node, void *key, u32 off)
{
struct hfs_btree *tree;
- int key_len;
+ u32 key_len;
tree = node->tree;
if (node->type == HFS_NODE_LEAF ||
@@ -88,17 +88,17 @@ void hfs_bnode_read_key(struct hfs_bnode
if (key_len > sizeof(hfsplus_btree_key) || key_len < 1) {
memset(key, 0, sizeof(hfsplus_btree_key));
- pr_err("hfsplus: Invalid key length: %d\n", key_len);
+ pr_err("hfsplus: Invalid key length: %u\n", key_len);
return;
}
hfs_bnode_read(node, key, off, key_len);
}
-void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len)
+void hfs_bnode_write(struct hfs_bnode *node, void *buf, u32 off, u32 len)
{
struct page **pagep;
- int l;
+ u32 l;
if (!is_bnode_offset_valid(node, off))
return;
@@ -106,7 +106,7 @@ void hfs_bnode_write(struct hfs_bnode *n
if (len == 0) {
pr_err("requested zero length: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, len %d\n",
+ "node_size %u, offset %u, len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len);
return;
@@ -118,31 +118,31 @@ void hfs_bnode_write(struct hfs_bnode *n
pagep = node->page + (off >> PAGE_SHIFT);
off &= ~PAGE_MASK;
- l = min_t(int, len, PAGE_SIZE - off);
+ l = min_t(u32, len, PAGE_SIZE - off);
memcpy(kmap(*pagep) + off, buf, l);
set_page_dirty(*pagep);
kunmap(*pagep);
while ((len -= l) != 0) {
buf += l;
- l = min_t(int, len, PAGE_SIZE);
+ l = min_t(u32, len, PAGE_SIZE);
memcpy(kmap(*++pagep), buf, l);
set_page_dirty(*pagep);
kunmap(*pagep);
}
}
-void hfs_bnode_write_u16(struct hfs_bnode *node, int off, u16 data)
+void hfs_bnode_write_u16(struct hfs_bnode *node, u32 off, u16 data)
{
__be16 v = cpu_to_be16(data);
/* TODO: optimize later... */
hfs_bnode_write(node, &v, off, 2);
}
-void hfs_bnode_clear(struct hfs_bnode *node, int off, int len)
+void hfs_bnode_clear(struct hfs_bnode *node, u32 off, u32 len)
{
struct page **pagep;
- int l;
+ u32 l;
if (!is_bnode_offset_valid(node, off))
return;
@@ -150,7 +150,7 @@ void hfs_bnode_clear(struct hfs_bnode *n
if (len == 0) {
pr_err("requested zero length: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, len %d\n",
+ "node_size %u, offset %u, len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len);
return;
@@ -162,24 +162,24 @@ void hfs_bnode_clear(struct hfs_bnode *n
pagep = node->page + (off >> PAGE_SHIFT);
off &= ~PAGE_MASK;
- l = min_t(int, len, PAGE_SIZE - off);
+ l = min_t(u32, len, PAGE_SIZE - off);
memset(kmap(*pagep) + off, 0, l);
set_page_dirty(*pagep);
kunmap(*pagep);
while ((len -= l) != 0) {
- l = min_t(int, len, PAGE_SIZE);
+ l = min_t(u32, len, PAGE_SIZE);
memset(kmap(*++pagep), 0, l);
set_page_dirty(*pagep);
kunmap(*pagep);
}
}
-void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,
- struct hfs_bnode *src_node, int src, int len)
+void hfs_bnode_copy(struct hfs_bnode *dst_node, u32 dst,
+ struct hfs_bnode *src_node, u32 src, u32 len)
{
struct page **src_page, **dst_page;
- int l;
+ u32 l;
hfs_dbg(BNODE_MOD, "copybytes: %u,%u,%u\n", dst, src, len);
if (!len)
@@ -196,14 +196,14 @@ void hfs_bnode_copy(struct hfs_bnode *ds
dst &= ~PAGE_MASK;
if (src == dst) {
- l = min_t(int, len, PAGE_SIZE - src);
+ l = min_t(u32, len, PAGE_SIZE - src);
memcpy(kmap(*dst_page) + src, kmap(*src_page) + src, l);
kunmap(*src_page);
set_page_dirty(*dst_page);
kunmap(*dst_page);
while ((len -= l) != 0) {
- l = min_t(int, len, PAGE_SIZE);
+ l = min_t(u32, len, PAGE_SIZE);
memcpy(kmap(*++dst_page), kmap(*++src_page), l);
kunmap(*src_page);
set_page_dirty(*dst_page);
@@ -237,10 +237,10 @@ void hfs_bnode_copy(struct hfs_bnode *ds
}
}
-void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len)
+void hfs_bnode_move(struct hfs_bnode *node, u32 dst, u32 src, u32 len)
{
struct page **src_page, **dst_page;
- int l;
+ u32 l;
hfs_dbg(BNODE_MOD, "movebytes: %u,%u,%u\n", dst, src, len);
if (!len)
@@ -309,7 +309,7 @@ void hfs_bnode_move(struct hfs_bnode *no
dst &= ~PAGE_MASK;
if (src == dst) {
- l = min_t(int, len, PAGE_SIZE - src);
+ l = min_t(u32, len, PAGE_SIZE - src);
memmove(kmap(*dst_page) + src,
kmap(*src_page) + src, l);
kunmap(*src_page);
@@ -317,7 +317,7 @@ void hfs_bnode_move(struct hfs_bnode *no
kunmap(*dst_page);
while ((len -= l) != 0) {
- l = min_t(int, len, PAGE_SIZE);
+ l = min_t(u32, len, PAGE_SIZE);
memmove(kmap(*++dst_page),
kmap(*++src_page), l);
kunmap(*src_page);
--- a/fs/hfsplus/brec.c
+++ b/fs/hfsplus/brec.c
@@ -60,7 +60,7 @@ u16 hfs_brec_keylen(struct hfs_bnode *no
return retval;
}
-int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len)
+int hfs_brec_insert(struct hfs_find_data *fd, void *entry, u32 entry_len)
{
struct hfs_btree *tree;
struct hfs_bnode *node, *new_node;
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -343,7 +343,7 @@ static struct hfs_bnode *hfs_bmap_new_bm
}
/* Make sure @tree has enough space for the @rsvd_nodes */
-int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes)
+int hfs_bmap_reserve(struct hfs_btree *tree, u32 rsvd_nodes)
{
struct inode *inode = tree->inode;
struct hfsplus_inode_info *hip = HFSPLUS_I(inode);
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -399,21 +399,21 @@ u32 hfsplus_calc_btree_clump_size(u32 bl
struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id);
void hfs_btree_close(struct hfs_btree *tree);
int hfs_btree_write(struct hfs_btree *tree);
-int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes);
+int hfs_bmap_reserve(struct hfs_btree *tree, u32 rsvd_nodes);
struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree);
void hfs_bmap_free(struct hfs_bnode *node);
/* bnode.c */
-void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len);
-u16 hfs_bnode_read_u16(struct hfs_bnode *node, int off);
-u8 hfs_bnode_read_u8(struct hfs_bnode *node, int off);
-void hfs_bnode_read_key(struct hfs_bnode *node, void *key, int off);
-void hfs_bnode_write(struct hfs_bnode *node, void *buf, int off, int len);
-void hfs_bnode_write_u16(struct hfs_bnode *node, int off, u16 data);
-void hfs_bnode_clear(struct hfs_bnode *node, int off, int len);
-void hfs_bnode_copy(struct hfs_bnode *dst_node, int dst,
- struct hfs_bnode *src_node, int src, int len);
-void hfs_bnode_move(struct hfs_bnode *node, int dst, int src, int len);
+void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len);
+u16 hfs_bnode_read_u16(struct hfs_bnode *node, u32 off);
+u8 hfs_bnode_read_u8(struct hfs_bnode *node, u32 off);
+void hfs_bnode_read_key(struct hfs_bnode *node, void *key, u32 off);
+void hfs_bnode_write(struct hfs_bnode *node, void *buf, u32 off, u32 len);
+void hfs_bnode_write_u16(struct hfs_bnode *node, u32 off, u16 data);
+void hfs_bnode_clear(struct hfs_bnode *node, u32 off, u32 len);
+void hfs_bnode_copy(struct hfs_bnode *dst_node, u32 dst,
+ struct hfs_bnode *src_node, u32 src, u32 len);
+void hfs_bnode_move(struct hfs_bnode *node, u32 dst, u32 src, u32 len);
void hfs_bnode_dump(struct hfs_bnode *node);
void hfs_bnode_unlink(struct hfs_bnode *node);
struct hfs_bnode *hfs_bnode_findhash(struct hfs_btree *tree, u32 cnid);
@@ -428,7 +428,7 @@ bool hfs_bnode_need_zeroout(struct hfs_b
/* brec.c */
u16 hfs_brec_lenoff(struct hfs_bnode *node, u16 rec, u16 *off);
u16 hfs_brec_keylen(struct hfs_bnode *node, u16 rec);
-int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len);
+int hfs_brec_insert(struct hfs_find_data *fd, void *entry, u32 entry_len);
int hfs_brec_remove(struct hfs_find_data *fd);
/* bfind.c */
@@ -441,7 +441,7 @@ int hfs_find_rec_by_key(struct hfs_bnode
int __hfs_brec_find(struct hfs_bnode *bnode, struct hfs_find_data *fd,
search_strategy_t rec_found);
int hfs_brec_find(struct hfs_find_data *fd, search_strategy_t do_key_compare);
-int hfs_brec_read(struct hfs_find_data *fd, void *rec, int rec_len);
+int hfs_brec_read(struct hfs_find_data *fd, void *rec, u32 rec_len);
int hfs_brec_goto(struct hfs_find_data *fd, int cnt);
/* catalog.c */
@@ -589,14 +589,14 @@ hfsplus_btree_lock_class(struct hfs_btre
}
static inline
-bool is_bnode_offset_valid(struct hfs_bnode *node, int off)
+bool is_bnode_offset_valid(struct hfs_bnode *node, u32 off)
{
bool is_valid = off < node->tree->node_size;
if (!is_valid) {
pr_err("requested invalid offset: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d\n",
+ "node_size %u, offset %u\n",
node->this, node->type, node->height,
node->tree->node_size, off);
}
@@ -605,7 +605,7 @@ bool is_bnode_offset_valid(struct hfs_bn
}
static inline
-int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len)
+u32 check_and_correct_requested_length(struct hfs_bnode *node, u32 off, u32 len)
{
unsigned int node_size;
@@ -615,12 +615,12 @@ int check_and_correct_requested_length(s
node_size = node->tree->node_size;
if ((off + len) > node_size) {
- int new_len = (int)node_size - off;
+ u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
"NODE: id %u, type %#x, height %u, "
- "node_size %u, offset %d, "
- "requested_len %d, corrected_len %d\n",
+ "node_size %u, offset %u, "
+ "requested_len %u, corrected_len %u\n",
node->this, node->type, node->height,
node->tree->node_size, off, len, new_len);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 662/699] hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (660 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 661/699] hfs/hfsplus: prevent getting negative values of offset/length Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 663/699] usb: gadget: function: Simplify diagnostic messaging in printer Greg Kroah-Hartman
` (40 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+6df204b70bf3261691c5,
syzbot+e76bf3d19b85350571ac, Tristan Madani, Viacheslav Dubeyko,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Madani <tristan@talencesecurity.com>
[ Upstream commit 966cb76fb2857a4242cab6ea2ea17acf818a3da7 ]
check_and_correct_requested_length() compares (off + len) against
node_size using u32 arithmetic. When the caller passes a large len
value (e.g. from an underflowed subtraction in hfs_brec_remove()),
off + len can wrap past 2^32 and produce a small result, causing the
bounds check to pass when it should fail.
For example, with off=14 and len=0xFFFFFFF2 (underflowed from
data_off - keyoffset - size in hfs_brec_remove), off + len wraps to 6,
which is less than a typical node_size of 512, so the check passes and
the subsequent memmove reads ~4GB past the node buffer.
Fix this by widening the addition to u64 before comparing against
node_size. This prevents the u32 wrap while keeping the logic
straightforward.
Reported-by: syzbot+6df204b70bf3261691c5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6df204b70bf3261691c5
Tested-by: syzbot+6df204b70bf3261691c5@syzkaller.appspotmail.com
Reported-by: syzbot+e76bf3d19b85350571ac@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e76bf3d19b85350571ac
Tested-by: syzbot+e76bf3d19b85350571ac@syzkaller.appspotmail.com
Fixes: a431930c9bac ("hfs: fix slab-out-of-bounds in hfs_bnode_read()")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20260505111300.3592757-2-tristmd@gmail.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/hfs/bnode.c | 2 +-
fs/hfsplus/hfsplus_fs.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/fs/hfs/bnode.c
+++ b/fs/hfs/bnode.c
@@ -41,7 +41,7 @@ u32 check_and_correct_requested_length(s
node_size = node->tree->node_size;
- if ((off + len) > node_size) {
+ if ((u64)off + len > node_size) {
u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -614,7 +614,7 @@ u32 check_and_correct_requested_length(s
node_size = node->tree->node_size;
- if ((off + len) > node_size) {
+ if ((u64)off + len > node_size) {
u32 new_len = node_size - off;
pr_err("requested length has been corrected: "
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 663/699] usb: gadget: function: Simplify diagnostic messaging in printer
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (661 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 662/699] hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 664/699] usb: gadget: f_printer: take kref only for successful open Greg Kroah-Hartman
` (39 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrzej Pietrasiewicz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
[ Upstream commit 57b7b733b1a7aeab25bc2670afff608214284863 ]
Don't issue messages which can be easily achieved with ftrace.
In case of printer_open() the return code is propagated to other layers
so the user will know about -EBUSY anyway.
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@collabora.com>
Link: https://lore.kernel.org/r/20221123110746.59611-1-andrzej.p@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 30adce93d5c4 ("usb: gadget: f_printer: take kref only for successful open")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_printer.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -363,7 +363,7 @@ printer_open(struct inode *inode, struct
spin_unlock_irqrestore(&dev->lock, flags);
kref_get(&dev->kref);
- DBG(dev, "printer_open returned %x\n", ret);
+
return ret;
}
@@ -381,7 +381,6 @@ printer_close(struct inode *inode, struc
spin_unlock_irqrestore(&dev->lock, flags);
kref_put(&dev->kref, printer_dev_free);
- DBG(dev, "printer_close\n");
return 0;
}
@@ -867,8 +866,6 @@ static void printer_reset_interface(stru
if (dev->interface < 0)
return;
- DBG(dev, "%s\n", __func__);
-
if (dev->in_ep->desc)
usb_ep_disable(dev->in_ep);
@@ -906,8 +903,6 @@ static void printer_soft_reset(struct pr
{
struct usb_request *req;
- INFO(dev, "Received Printer Reset Request\n");
-
if (usb_ep_disable(dev->in_ep))
DBG(dev, "Failed to disable USB in_ep\n");
if (usb_ep_disable(dev->out_ep))
@@ -1204,8 +1199,6 @@ static void printer_func_disable(struct
{
struct printer_dev *dev = func_to_printer(f);
- DBG(dev, "%s\n", __func__);
-
printer_reset_interface(dev);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 664/699] usb: gadget: f_printer: take kref only for successful open
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (662 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 663/699] usb: gadget: function: Simplify diagnostic messaging in printer Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 665/699] usb: free iso schedules on failed submit Greg Kroah-Hartman
` (38 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Xu Rao, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
[ Upstream commit 30adce93d5c4a5a1ec29d9249e3fdfcc391d406b ]
printer_open() returns -EBUSY when the character device is already
open, but it increments dev->kref regardless of the return value. VFS
does not call ->release() for a failed open, so every rejected second
open permanently leaks one reference.
Move kref_get() into the successful-open branch.
Fixes: e8d5f92b8d30 ("usb: gadget: function: printer: fix use-after-free in __lock_acquire")
Cc: stable <stable@kernel.org>
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Link: https://patch.msgid.link/80295742B820DA9B+20260626064617.4090626-1-raoxu@uniontech.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_printer.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/gadget/function/f_printer.c
+++ b/drivers/usb/gadget/function/f_printer.c
@@ -358,12 +358,11 @@ printer_open(struct inode *inode, struct
ret = 0;
/* Change the printer status to show that it's on-line. */
dev->printer_status |= PRINTER_SELECTED;
+ kref_get(&dev->kref);
}
spin_unlock_irqrestore(&dev->lock, flags);
- kref_get(&dev->kref);
-
return ret;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 665/699] usb: free iso schedules on failed submit
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (663 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 664/699] usb: gadget: f_printer: take kref only for successful open Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 666/699] usb: iowarrior: remove inherent race with minor number Greg Kroah-Hartman
` (37 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Dawei Feng, Alan Stern,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dawei Feng <dawei.feng@seu.edu.cn>
[ Upstream commit b9399d25fbb34a05bbe76eeedd730f62ff2670e9 ]
EHCI and FOTG210 isochronous submits build an ehci_iso_sched before
linking the URB to the endpoint queue, and keep the staged schedule in
urb->hcpriv until iso_stream_schedule() and the link helpers consume it.
If the controller is no longer accessible, or usb_hcd_link_urb_to_ep()
fails, submit jumps to done_not_linked before that handoff happens and
leaks the staged schedule still attached to urb->hcpriv.
Free the staged schedule from done_not_linked when submit fails before
the URB is linked and clear urb->hcpriv after the free.
The bug was first flagged by an experimental analysis tool we are
developing for kernel memory-management bugs while analyzing
v6.13-rc1. The tool is still under development and is not yet publicly
available. Manual inspection confirms that the bug is still
present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings. As we do not have an
EHCI host controller with a USB isochronous device to test with, no
runtime testing was able to be performed.
Fixes: 8de98402652c ("[PATCH] USB: Fix USB suspend/resume crasher (#2)")
Fixes: e9df41c5c589 ("USB: make HCDs responsible for managing endpoint queues")
Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Dawei Feng <dawei.feng@seu.edu.cn>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260630071419.349161-1-dawei.feng@seu.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-sched.c | 11 +++++++++--
drivers/usb/host/fotg210-hcd.c | 6 ++++--
2 files changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -1613,6 +1613,7 @@ iso_stream_schedule(
status = 1; /* and give it back immediately */
iso_sched_free(stream, sched);
sched = NULL;
+ urb->hcpriv = NULL;
}
}
urb->error_count = skip / period;
@@ -1643,8 +1644,6 @@ iso_stream_schedule(
return status;
fail:
- iso_sched_free(stream, sched);
- urb->hcpriv = NULL;
return status;
}
@@ -1956,6 +1955,10 @@ static int itd_submit(struct ehci_hcd *e
usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
}
done_not_linked:
+ if (status < 0) {
+ iso_sched_free(stream, urb->hcpriv);
+ urb->hcpriv = NULL;
+ }
spin_unlock_irqrestore(&ehci->lock, flags);
done:
return status;
@@ -2333,6 +2336,10 @@ static int sitd_submit(struct ehci_hcd *
usb_hcd_unlink_urb_from_ep(ehci_to_hcd(ehci), urb);
}
done_not_linked:
+ if (status < 0) {
+ iso_sched_free(stream, urb->hcpriv);
+ urb->hcpriv = NULL;
+ }
spin_unlock_irqrestore(&ehci->lock, flags);
done:
return status;
--- a/drivers/usb/host/fotg210-hcd.c
+++ b/drivers/usb/host/fotg210-hcd.c
@@ -4271,8 +4271,6 @@ static int iso_stream_schedule(struct fo
return 0;
fail:
- iso_sched_free(stream, sched);
- urb->hcpriv = NULL;
return status;
}
@@ -4566,6 +4564,10 @@ static int itd_submit(struct fotg210_hcd
else
usb_hcd_unlink_urb_from_ep(fotg210_to_hcd(fotg210), urb);
done_not_linked:
+ if (status < 0) {
+ iso_sched_free(stream, urb->hcpriv);
+ urb->hcpriv = NULL;
+ }
spin_unlock_irqrestore(&fotg210->lock, flags);
done:
return status;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 666/699] usb: iowarrior: remove inherent race with minor number
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (664 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 665/699] usb: free iso schedules on failed submit Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 667/699] USB: serial: digi_acceleport: fix write buffer corruption Greg Kroah-Hartman
` (36 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit 56dd29088c9d9510c48a8ebad2465248fde36551 ]
The driver saves the minor number it gets upon registration
in its descriptor for debugging purposes. However, there is
inevitably a window between registration and saving the correct
minor in a descriptor. During this window the debugging output
will be wrong.
As wrong debug output is worse than no debug output, just
remove it.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20260312094619.1590556-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: c602254ba4c1 ("USB: iowarrior: fix use-after-free on disconnect race")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/iowarrior.c | 17 +++--------------
1 file changed, 3 insertions(+), 14 deletions(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -74,7 +74,6 @@ struct iowarrior {
struct mutex mutex; /* locks this structure */
struct usb_device *udev; /* save off the usb device pointer */
struct usb_interface *interface; /* the interface for this device */
- unsigned char minor; /* the starting minor number for this device */
struct usb_endpoint_descriptor *int_out_endpoint; /* endpoint for reading (needed for IOW56 only) */
struct usb_endpoint_descriptor *int_in_endpoint; /* endpoint for reading */
struct urb *int_in_urb; /* the urb for reading data */
@@ -246,7 +245,6 @@ static void iowarrior_write_callback(str
*/
static inline void iowarrior_delete(struct iowarrior *dev)
{
- dev_dbg(&dev->interface->dev, "minor %d\n", dev->minor);
kfree(dev->int_in_buffer);
usb_free_urb(dev->int_in_urb);
kfree(dev->read_queue);
@@ -297,9 +295,6 @@ static ssize_t iowarrior_read(struct fil
goto exit;
}
- dev_dbg(&dev->interface->dev, "minor %d, count = %zd\n",
- dev->minor, count);
-
/* read count must be packet size (+ time stamp) */
if ((count != dev->report_size)
&& (count != (dev->report_size + 1))) {
@@ -379,8 +374,6 @@ static ssize_t iowarrior_write(struct fi
retval = -ENODEV;
goto exit;
}
- dev_dbg(&dev->interface->dev, "minor %d, count = %zd\n",
- dev->minor, count);
/* if count is 0 we're already done */
if (count == 0) {
retval = 0;
@@ -526,9 +519,6 @@ static long iowarrior_ioctl(struct file
goto error_out;
}
- dev_dbg(&dev->interface->dev, "minor %d, cmd 0x%.4x, arg %ld\n",
- dev->minor, cmd, arg);
-
retval = 0;
io_res = 0;
switch (cmd) {
@@ -675,8 +665,6 @@ static int iowarrior_release(struct inod
if (!dev)
return -ENODEV;
- dev_dbg(&dev->interface->dev, "minor %d\n", dev->minor);
-
/* lock our device */
mutex_lock(&dev->mutex);
@@ -779,6 +767,7 @@ static int iowarrior_probe(struct usb_in
struct usb_host_interface *iface_desc;
int retval = -ENOMEM;
int res;
+ int minor;
/* allocate memory for our device state and initialize it */
dev = kzalloc(sizeof(struct iowarrior), GFP_KERNEL);
@@ -894,12 +883,12 @@ static int iowarrior_probe(struct usb_in
goto error;
}
- dev->minor = interface->minor;
+ minor = interface->minor;
/* let the user know what node this device is now attached to */
dev_info(&interface->dev, "IOWarrior product=0x%x, serial=%s interface=%d "
"now attached to iowarrior%d\n", dev->product_id, dev->chip_serial,
- iface_desc->desc.bInterfaceNumber, dev->minor - IOWARRIOR_MINOR_BASE);
+ iface_desc->desc.bInterfaceNumber, minor - IOWARRIOR_MINOR_BASE);
return retval;
error:
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 667/699] USB: serial: digi_acceleport: fix write buffer corruption
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (665 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 666/699] usb: iowarrior: remove inherent race with minor number Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 668/699] drm/i2c/sil164: Drop no-op remove function Greg Kroah-Hartman
` (35 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 24ca1fea8f2753bf33e1d458ec1ae5d9b7796a65 ]
The digi_write_inb_command() is supposed to wait for the write urb to
become available or return an error, but instead it updates the transfer
buffer and tries to resubmit the urb on timeout.
To make things worse, for commands like break control where no timeout
is used, the driver would corrupt the urb immediately due to a broken
jiffies comparison (on 32-bit machines this takes five minutes of uptime
to trigger due to INITIAL_JIFFIES).
Fix this by adding the missing return on timeout and waiting
indefinitely when no timeout has been specified as intended.
This issue was (sort of) flagged by Sashiko when reviewing an unrelated
change to the driver.
Link: https://sashiko.dev/#/patchset/20260610132232.356139-1-johan%40kernel.org?part=11
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
[ adjusted context for 5.10's `&port->write_wait` (no `priv->write_wait`) and kept the existing `unsigned long flags = 0;` declaration alongside the new `expire` variable ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/digi_acceleport.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -431,20 +431,22 @@ static int digi_write_inb_command(struct
int len;
struct digi_port *priv = usb_get_serial_port_data(port);
unsigned char *data = port->write_urb->transfer_buffer;
+ unsigned long expire;
unsigned long flags = 0;
dev_dbg(&port->dev, "digi_write_inb_command: TOP: port=%d, count=%d\n",
priv->dp_port_num, count);
if (timeout)
- timeout += jiffies;
- else
- timeout = ULONG_MAX;
+ expire = jiffies + timeout;
spin_lock_irqsave(&priv->dp_port_lock, flags);
while (count > 0 && ret == 0) {
- while (priv->dp_write_urb_in_use &&
- time_before(jiffies, timeout)) {
+ while (priv->dp_write_urb_in_use) {
+ if (timeout && time_after(jiffies, expire)) {
+ ret = -ETIMEDOUT;
+ break;
+ }
cond_wait_interruptible_timeout_irqrestore(
&port->write_wait, DIGI_RETRY_TIMEOUT,
&priv->dp_port_lock, flags);
@@ -453,6 +455,9 @@ static int digi_write_inb_command(struct
spin_lock_irqsave(&priv->dp_port_lock, flags);
}
+ if (ret)
+ break;
+
/* len must be a multiple of 4 and small enough to */
/* guarantee the write will send buffered data first, */
/* so commands are in order with data and not split */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 668/699] drm/i2c/sil164: Drop no-op remove function
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (666 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 667/699] USB: serial: digi_acceleport: fix write buffer corruption Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 669/699] leds: lm3697: Remove duplicated error reporting in .remove() Greg Kroah-Hartman
` (34 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Wolfram Sang,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit eb09882d64807c24228ed1d005dbbae70860ca3f ]
A remove callback that just returns 0 is equivalent to no callback at all
as can be seen in i2c_device_remove(). So simplify accordingly.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Stable-dep-of: 1f0bdc2884b6 ("usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i2c/sil164_drv.c | 7 -------
1 file changed, 7 deletions(-)
--- a/drivers/gpu/drm/i2c/sil164_drv.c
+++ b/drivers/gpu/drm/i2c/sil164_drv.c
@@ -370,12 +370,6 @@ sil164_probe(struct i2c_client *client,
return 0;
}
-static int
-sil164_remove(struct i2c_client *client)
-{
- return 0;
-}
-
static struct i2c_client *
sil164_detect_slave(struct i2c_client *client)
{
@@ -427,7 +421,6 @@ MODULE_DEVICE_TABLE(i2c, sil164_ids);
static struct drm_i2c_encoder_driver sil164_driver = {
.i2c_driver = {
.probe = sil164_probe,
- .remove = sil164_remove,
.driver = {
.name = "sil164",
},
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 669/699] leds: lm3697: Remove duplicated error reporting in .remove()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (667 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 668/699] drm/i2c/sil164: Drop no-op remove function Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 670/699] leds: lm3601x: Improve error reporting for problems during .remove() Greg Kroah-Hartman
` (33 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Machek, Uwe Kleine-König,
Wolfram Sang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit af89fa11fae1cee4e07453f780e6e5573ef0f477 ]
Returning an error value from an i2c remove callback results in an error
message being emitted by the i2c core, but otherwise it doesn't make a
difference. The device goes away anyhow and the devm cleanups are
called.
As lm3697_remove() already emits an error message on failure and the
additional error message by the i2c core doesn't add any useful
information, don't pass the error value up the stack. Instead continue
to clean up and return 0.
This patch is a preparation for making i2c remove callbacks return void.
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Stable-dep-of: 1f0bdc2884b6 ("usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/leds-lm3697.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/leds/leds-lm3697.c
+++ b/drivers/leds/leds-lm3697.c
@@ -337,10 +337,8 @@ static int lm3697_remove(struct i2c_clie
ret = regmap_update_bits(led->regmap, LM3697_CTRL_ENABLE,
LM3697_CTRL_A_B_EN, 0);
- if (ret) {
+ if (ret)
dev_err(dev, "Failed to disable the device\n");
- return ret;
- }
if (led->enable_gpio)
gpiod_direction_output(led->enable_gpio, 0);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 670/699] leds: lm3601x: Improve error reporting for problems during .remove()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (668 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 669/699] leds: lm3697: Remove duplicated error reporting in .remove() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 671/699] gpio: pca953x: Make platform teardown callback return void Greg Kroah-Hartman
` (32 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Machek, Uwe Kleine-König,
Wolfram Sang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 22a23436891886a66d21af3619f4a4e8809f0e0a ]
Returning an error value in an i2c remove callback results in a generic
error message being emitted by the i2c core, but otherwise it doesn't
make a difference. The device goes away anyhow and the devm cleanups are
called.
So instead of triggering the generic i2c error message, emit a more
helpful message if a problem occurs and return 0 to suppress the generic
message.
This patch is a preparation for making i2c remove callbacks return void.
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Stable-dep-of: 1f0bdc2884b6 ("usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/leds-lm3601x.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/leds/leds-lm3601x.c
+++ b/drivers/leds/leds-lm3601x.c
@@ -443,10 +443,15 @@ static int lm3601x_probe(struct i2c_clie
static int lm3601x_remove(struct i2c_client *client)
{
struct lm3601x_led *led = i2c_get_clientdata(client);
+ int ret;
- return regmap_update_bits(led->regmap, LM3601X_ENABLE_REG,
- LM3601X_ENABLE_MASK,
- LM3601X_MODE_STANDBY);
+ ret = regmap_update_bits(led->regmap, LM3601X_ENABLE_REG,
+ LM3601X_ENABLE_MASK, LM3601X_MODE_STANDBY);
+ if (ret)
+ dev_warn(&client->dev,
+ "Failed to put into standby (%pe)\n", ERR_PTR(ret));
+
+ return 0;
}
static const struct i2c_device_id lm3601x_id[] = {
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 671/699] gpio: pca953x: Make platform teardown callback return void
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (669 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 670/699] leds: lm3601x: Improve error reporting for problems during .remove() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 672/699] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Greg Kroah-Hartman
` (31 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko,
Uwe Kleine-König, Bartosz Golaszewski, Wolfram Sang,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 6a8f359c3132e4f51bdb263ad74ec632c65e55fd ]
All platforms that provide a teardown callback return 0. New users are
supposed to not make use of platform support, so there is no
functionality lost.
This patch is a preparation for making i2c remove callbacks return void.
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Stable-dep-of: 1f0bdc2884b6 ("usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-davinci/board-da850-evm.c | 12 ++++--------
drivers/gpio/gpio-pca953x.c | 11 +++--------
include/linux/platform_data/pca953x.h | 2 +-
3 files changed, 8 insertions(+), 17 deletions(-)
--- a/arch/arm/mach-davinci/board-da850-evm.c
+++ b/arch/arm/mach-davinci/board-da850-evm.c
@@ -519,8 +519,8 @@ exp_setup_sela_fail:
return ret;
}
-static int da850_evm_ui_expander_teardown(struct i2c_client *client,
- unsigned gpio, unsigned ngpio, void *c)
+static void da850_evm_ui_expander_teardown(struct i2c_client *client,
+ unsigned gpio, unsigned ngpio, void *c)
{
platform_device_unregister(&da850_evm_ui_keys_device);
@@ -532,8 +532,6 @@ static int da850_evm_ui_expander_teardow
gpio_free(gpio + DA850_EVM_UI_EXP_SEL_C);
gpio_free(gpio + DA850_EVM_UI_EXP_SEL_B);
gpio_free(gpio + DA850_EVM_UI_EXP_SEL_A);
-
- return 0;
}
/* assign the baseboard expander's GPIOs after the UI board's */
@@ -700,13 +698,11 @@ io_exp_setup_sw_fail:
return ret;
}
-static int da850_evm_bb_expander_teardown(struct i2c_client *client,
- unsigned gpio, unsigned ngpio, void *c)
+static void da850_evm_bb_expander_teardown(struct i2c_client *client,
+ unsigned gpio, unsigned ngpio, void *c)
{
platform_device_unregister(&da850_evm_bb_leds_device);
platform_device_unregister(&da850_evm_bb_keys_device);
-
- return 0;
}
static struct pca953x_platform_data da850_evm_ui_expander_info = {
--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@@ -1073,20 +1073,15 @@ static int pca953x_remove(struct i2c_cli
{
struct pca953x_platform_data *pdata = dev_get_platdata(&client->dev);
struct pca953x_chip *chip = i2c_get_clientdata(client);
- int ret;
if (pdata && pdata->teardown) {
- ret = pdata->teardown(client, chip->gpio_chip.base,
- chip->gpio_chip.ngpio, pdata->context);
- if (ret < 0)
- dev_err(&client->dev, "teardown failed, %d\n", ret);
- } else {
- ret = 0;
+ pdata->teardown(client, chip->gpio_chip.base,
+ chip->gpio_chip.ngpio, pdata->context);
}
regulator_disable(chip->regulator);
- return ret;
+ return 0;
}
#ifdef CONFIG_PM_SLEEP
--- a/include/linux/platform_data/pca953x.h
+++ b/include/linux/platform_data/pca953x.h
@@ -22,7 +22,7 @@ struct pca953x_platform_data {
int (*setup)(struct i2c_client *client,
unsigned gpio, unsigned ngpio,
void *context);
- int (*teardown)(struct i2c_client *client,
+ void (*teardown)(struct i2c_client *client,
unsigned gpio, unsigned ngpio,
void *context);
const char *const *names;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 672/699] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (670 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 671/699] gpio: pca953x: Make platform teardown callback return void Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 673/699] usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() Greg Kroah-Hartman
` (30 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Fan Wu, Heikki Krogerus,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fan Wu <fanwu01@zju.edu.cn>
[ Upstream commit 1f0bdc2884b67de337215079bba166df0cdf4ac5 ]
The threaded IRQ handler ccg_irq_handler() calls ucsi_notify_common(),
which on a connector-change event calls ucsi_connector_change() and
schedules connector work. In ucsi_ccg_remove(), ucsi_destroy() frees
uc->ucsi (kfree) before free_irq() is called, so a handler invocation
already in flight may access the freed object after ucsi_destroy().
CPU 0 (remove) | CPU 1 (threaded IRQ)
ucsi_destroy(uc->ucsi) | ccg_irq_handler()
kfree(ucsi) // FREE | ucsi_notify_common(uc->ucsi) // USE
Move free_irq() before ucsi_destroy() in the remove path. It is kept
after ucsi_unregister(): ucsi_unregister() cancels connector work whose
handler issues GET_CONNECTOR_STATUS through ucsi_send_command_common(),
which waits for a completion that is signalled from the IRQ handler, so
the IRQ must stay active until that work has been cancelled.
The probe error path already orders free_irq() before ucsi_destroy().
This bug was found by static analysis.
Fixes: e32fd989ac1c ("usb: typec: ucsi: ccg: Move to the new API")
Cc: stable <stable@kernel.org>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260616132011.103279-1-fanwu01@zju.edu.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/ucsi_ccg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -1418,8 +1418,8 @@ static int ucsi_ccg_remove(struct i2c_cl
cancel_work_sync(&uc->work);
pm_runtime_disable(uc->dev);
ucsi_unregister(uc->ucsi);
- ucsi_destroy(uc->ucsi);
free_irq(uc->irq, uc);
+ ucsi_destroy(uc->ucsi);
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 673/699] usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (671 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 672/699] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 674/699] usb: typec: tcpm: Fix VDM type for Enter Mode commands Greg Kroah-Hartman
` (29 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+ce1e5a1b4e086b43e56d,
syzbot+306212936b13e520679d, syzbot+457452d30bcdda75ead2,
Mauricio Faria de Oliveira, Stanislaw Gruszka, Sasha Levin,
Andrey Tsygunka
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauricio Faria de Oliveira <mfo@igalia.com>
[ Upstream commit e2674dfbed8a30d57e2bc872c4bfa6c3eec918bf ]
ueagle-atm uses the asynchronous request_firmware_nowait() in .probe(),
but does not wait for its completion, not even in .disconnect(); so, if the
device is unplugged meanwhile, its teardown runs concurrently with that.
Even though this inconsistency is worth addressing on its own, it has also
triggered several bug reports in syzbot over the years (some auto-closed)
where the firmware sysfs fallback mechanism (CONFIG_FW_LOADER_USER_HELPER)
creates a firmware subdirectory in the device directory during its removal,
which might hit unexpected conditions in kernfs, apparently, depending at
which point the add and remove operations raced. (See links.)
The pattern is:
usb ?-?: Direct firmware load for ueagle-atm/eagle?.fw failed with error -2
usb ?-?: Falling back to sysfs fallback for: ueagle-atm/eagle?.fw
<ERROR>
Call trace:
...
kernfs_create_dir_ns
sysfs_create_dir_ns
create_dir
kobject_add_internal
kobject_add_varg
kobject_add
class_dir_create_and_add
get_device_parent
device_add
fw_load_sysfs_fallback
fw_load_from_user_helper
firmware_fallback_sysfs
_request_firmware
request_firmware_work_func
...
(Some variations are observed, after fw_load_sysfs_fallback(), e.g., [1].)
While the kernfs side is being looked at, the ueagle-atm side can be fixed
by waiting for the pre-firmware load in the .disconnect() handler.
This change has a similar approach to previous work by Andrey Tsygunka [2]
(wait_for_completion() in .disconnect()), but it is relatively different in
design/implementation; using the Originally-by tag for credit assignment.
This has been tested with:
- synthetic reproducer to check the error path;
- USB gadget (virtual device) to check the firmware upload path;
- QEMU device emulator to check the device ID re-enumeration path;
(The latter two were written by Claude; no other code/text in this commit.)
Links (year first reported):
2025 https://syzbot.org/bug?extid=ce1e5a1b4e086b43e56d
2025 https://syzbot.org/bug?extid=9af8471255ac36e34fd4
2024 https://syzbot.org/bug?extid=306212936b13e520679d
2023 https://syzkaller.appspot.com/bug?extid=457452d30bcdda75ead2
2022 https://syzbot.org/bug?extid=782984d6f1701b526edb
2021 https://syzbot.org/bug?id=f3f221579f4ef7e9691281f3c6f56c05f83e8490
2021 https://syzbot.org/bug?id=84d86f0d71394829df6fc53daf6642c045983881
2021 https://syzbot.org/bug?id=3302dc1c0e2b9c94f2e8edb404eabc9267bc6f90
[1] https://syzkaller.appspot.com/bug?extid=457452d30bcdda75ead2
[2] https://lore.kernel.org/lkml/20250410093146.3776801-2-aitsygunka@yandex.ru/
Cc: stable <stable@kernel.org>
Reported-by: syzbot+ce1e5a1b4e086b43e56d@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=ce1e5a1b4e086b43e56d
Reported-by: syzbot+306212936b13e520679d@syzkaller.appspotmail.com
Closes: https://syzbot.org/bug?extid=306212936b13e520679d
Reported-by: syzbot+457452d30bcdda75ead2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=457452d30bcdda75ead2
Originally-by: Andrey Tsygunka <aitsygunka@yandex.ru>
Fixes: b72458a80c75 ("[PATCH] USB: Eagle and ADI 930 usb adsl modem driver")
Assisted-by: Claude:claude-opus-4.7 # usb gadget & qemu device for testing
Signed-off-by: Mauricio Faria de Oliveira <mfo@igalia.com>
Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
Link: https://patch.msgid.link/20260526-ueagle-atm_req-fw-sync-v3-1-93c01961daaf@igalia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/atm/ueagle-atm.c | 36 +++++++++++++++++++++++++++++++-----
1 file changed, 31 insertions(+), 5 deletions(-)
--- a/drivers/usb/atm/ueagle-atm.c
+++ b/drivers/usb/atm/ueagle-atm.c
@@ -599,7 +599,9 @@ static int uea_send_modem_cmd(struct usb
static void uea_upload_pre_firmware(const struct firmware *fw_entry,
void *context)
{
- struct usb_device *usb = context;
+ struct usb_interface *intf = context;
+ struct usb_device *usb = interface_to_usbdev(intf);
+ struct completion *fw_done = usb_get_intfdata(intf);
const u8 *pfw;
u8 value;
u32 crc = 0;
@@ -670,15 +672,17 @@ err_fw_corrupted:
err:
release_firmware(fw_entry);
uea_leaves(usb);
+ complete(fw_done);
}
/*
* uea_load_firmware - Load usb firmware for pre-firmware devices.
*/
-static int uea_load_firmware(struct usb_device *usb, unsigned int ver)
+static int uea_load_firmware(struct usb_interface *intf, unsigned int ver)
{
int ret;
char *fw_name = EAGLE_FIRMWARE;
+ struct usb_device *usb = interface_to_usbdev(intf);
uea_enters(usb);
uea_info(usb, "pre-firmware device, uploading firmware\n");
@@ -702,7 +706,7 @@ static int uea_load_firmware(struct usb_
}
ret = request_firmware_nowait(THIS_MODULE, 1, fw_name, &usb->dev,
- GFP_KERNEL, usb,
+ GFP_KERNEL, intf,
uea_upload_pre_firmware);
if (ret)
uea_err(usb, "firmware %s is not available\n", fw_name);
@@ -2598,8 +2602,23 @@ static int uea_probe(struct usb_interfac
usb_reset_device(usb);
- if (UEA_IS_PREFIRM(id))
- return uea_load_firmware(usb, UEA_CHIP_VERSION(id));
+ if (UEA_IS_PREFIRM(id)) {
+ struct completion *fw_done;
+
+ /* Wait for the firmware load to be done, in .disconnect() */
+ fw_done = kzalloc(sizeof(*fw_done), GFP_KERNEL);
+ if (!fw_done)
+ return -ENOMEM;
+
+ init_completion(fw_done);
+ usb_set_intfdata(intf, fw_done);
+
+ ret = uea_load_firmware(intf, UEA_CHIP_VERSION(id));
+ if (ret)
+ kfree(fw_done);
+
+ return ret;
+ }
ret = usbatm_usb_probe(intf, id, &uea_usbatm_driver);
if (ret == 0) {
@@ -2630,6 +2649,13 @@ static void uea_disconnect(struct usb_in
usbatm_usb_disconnect(intf);
mutex_unlock(&uea_mutex);
uea_info(usb, "ADSL device removed\n");
+ } else if (usb->config->desc.bNumInterfaces == 1) {
+ struct completion *fw_done = usb_get_intfdata(intf);
+
+ uea_dbg(usb, "pre-firmware device, waiting firmware upload\n");
+ wait_for_completion(fw_done);
+ uea_dbg(usb, "pre-firmware device, finished waiting\n");
+ kfree(fw_done);
}
uea_leaves(usb);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 674/699] usb: typec: tcpm: Fix VDM type for Enter Mode commands
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (672 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 673/699] usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 675/699] usb: gadget: f_fs: initialize reset_work at allocation time Greg Kroah-Hartman
` (28 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Andy Yan, Heikki Krogerus,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Yan <andyshrk@163.com>
[ Upstream commit 9cff680e47632b7723cb19f9c5e63669063c3417 ]
VDO() second parameter is VDM type (bit 15): 1 for SVDM, 0 for UVDM.
Using 'vdo ? 2 : 1' corrupts SVID low bit when vdo is non-NULL
(2 << 15 = BIT(16)). Enter Mode is always SVDM, hardcode to 1.
Fixes: 8face9aa57c8 ("usb: typec: Add parameter for the VDO to typec_altmode_enter()")
Cc: stable <stable@kernel.org>
Signed-off-by: Andy Yan <andyshrk@163.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260604105059.18750-1-andyshrk@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -1671,7 +1671,7 @@ static int tcpm_altmode_enter(struct typ
struct tcpm_port *port = typec_altmode_get_drvdata(altmode);
u32 header;
- header = VDO(altmode->svid, vdo ? 2 : 1, CMD_ENTER_MODE);
+ header = VDO(altmode->svid, 1, CMD_ENTER_MODE);
header |= VDO_OPOS(altmode->mode);
tcpm_queue_vdm_unlocked(port, header, vdo, vdo ? 1 : 0);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 675/699] usb: gadget: f_fs: initialize reset_work at allocation time
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (673 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 674/699] usb: typec: tcpm: Fix VDM type for Enter Mode commands Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 676/699] crypto: atmel-sha204a - Mark OF related data as maybe unused Greg Kroah-Hartman
` (27 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Tyler Baker, Loic Poulain,
Dmitry Baryshkov, Srinivas Kandagatla, Peter Chen,
Michał Nazarewicz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Baker <tyler.baker@oss.qualcomm.com>
[ Upstream commit 3137b243c93982fe3460335e12f9247739766e10 ]
ffs_fs_kill_sb() unconditionally calls cancel_work_sync() on
ffs->reset_work when a functionfs instance is unmounted:
ffs_data_reset(ffs);
cancel_work_sync(&ffs->reset_work);
However ffs->reset_work is only ever initialized via INIT_WORK() in
ffs_func_set_alt() and ffs_func_disable(), and only on the
FFS_DEACTIVATED path. That state is reached solely by ffs_data_closed()
when the instance is mounted with the "no_disconnect" option, so for the
common case (no "no_disconnect", or mounted and unmounted without ever
being deactivated) reset_work is never initialized.
ffs_data_new() allocates the ffs_data with kzalloc_obj() and does not
initialize reset_work, and ffs_data_reset()/ffs_data_clear() do not touch
it either, so reset_work.func is left NULL. cancel_work_sync() on such a
work then trips the WARN_ON(!work->func) guard in __flush_work():
WARNING: kernel/workqueue.c:4301 at __flush_work+0x330/0x360, CPU#3: umount
Call trace:
__flush_work
cancel_work_sync
ffs_fs_kill_sb [usb_f_fs]
deactivate_locked_super
deactivate_super
cleanup_mnt
__cleanup_mnt
task_work_run
exit_to_user_mode_loop
el0_svc
On older kernels cancel_work_sync() on a zero-initialized work struct was
a silent no-op, which hid the missing initialization.
Initialize reset_work once in ffs_data_new() so it is always valid for
the lifetime of the ffs_data, and drop the now-redundant INIT_WORK()
calls from the two deactivation paths.
Fixes: 18d6b32fca38 ("usb: gadget: f_fs: add "no_disconnect" mode")
Cc: stable <stable@kernel.org>
Signed-off-by: Tyler Baker <tyler.baker@oss.qualcomm.com>
Cc: Loic Poulain <loic.poulain@oss.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Tested-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Peter Chen <peter.chen@kernel.org>
Acked-by: Michał Nazarewicz <mina86@mina86.com>
Link: https://patch.msgid.link/20260609193635.2284430-1-tyler.baker@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ dropped the ffs_func_disable hunk since 6.6 predates the disable-body split and routes disable through ffs_func_set_alt, so removing the single lazy INIT_WORK there covers both paths ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -254,6 +254,7 @@ static int ffs_acquire_dev(const char *d
static void ffs_release_dev(struct ffs_dev *ffs_dev);
static int ffs_ready(struct ffs_data *ffs);
static void ffs_closed(struct ffs_data *ffs);
+static void ffs_reset_work(struct work_struct *work);
/* Misc helper functions ****************************************************/
@@ -1774,6 +1775,7 @@ static struct ffs_data *ffs_data_new(con
init_waitqueue_head(&ffs->ev.waitq);
init_waitqueue_head(&ffs->wait);
init_completion(&ffs->ep0req_completion);
+ INIT_WORK(&ffs->reset_work, ffs_reset_work);
/* XXX REVISIT need to update it in some places, or do we? */
ffs->ev.can_stall = 1;
@@ -3330,7 +3332,6 @@ static int ffs_func_set_alt(struct usb_f
if (ffs->state == FFS_DEACTIVATED) {
ffs->state = FFS_CLOSING;
- INIT_WORK(&ffs->reset_work, ffs_reset_work);
schedule_work(&ffs->reset_work);
return -ENODEV;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 676/699] crypto: atmel-sha204a - Mark OF related data as maybe unused
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (674 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 675/699] usb: gadget: f_fs: initialize reset_work at allocation time Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 677/699] crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 Greg Kroah-Hartman
` (26 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 75f3d950054389e2556277e42170e37dd97cd872 ]
The driver can be compile tested with !CONFIG_OF making certain data
unused:
drivers/crypto/atmel-sha204a.c:129:34: error: ‘atmel_sha204a_dt_ids’ defined but not used [-Werror=unused-const-variable=]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: ea5e57cc9718 ("crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/atmel-sha204a.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/crypto/atmel-sha204a.c
+++ b/drivers/crypto/atmel-sha204a.c
@@ -137,14 +137,16 @@ static int atmel_sha204a_remove(struct i
return 0;
}
-static const struct of_device_id atmel_sha204a_dt_ids[] = {
+static const struct of_device_id atmel_sha204a_dt_ids[] __maybe_unused = {
+ { .compatible = "atmel,atsha204", },
{ .compatible = "atmel,atsha204a", },
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(of, atmel_sha204a_dt_ids);
static const struct i2c_device_id atmel_sha204a_id[] = {
- { "atsha204a", 0 },
+ { "atsha204" },
+ { "atsha204a" },
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(i2c, atmel_sha204a_id);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 677/699] crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (675 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 676/699] crypto: atmel-sha204a - Mark OF related data as maybe unused Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 678/699] crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A Greg Kroah-Hartman
` (25 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
[ Upstream commit d86ad3911a5d4549297ed810ee450e5772fd665f ]
These drivers don't use the driver_data member of struct i2c_device_id,
so don't explicitly initialize this member.
This prepares putting driver_data in an anonymous union which requires
either no initialization or named designators. But it's also a nice
cleanup on its own.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: ea5e57cc9718 ("crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/atmel-ecc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/atmel-ecc.c
+++ b/drivers/crypto/atmel-ecc.c
@@ -387,7 +387,7 @@ MODULE_DEVICE_TABLE(of, atmel_ecc_dt_ids
#endif
static const struct i2c_device_id atmel_ecc_id[] = {
- { "atecc508a", 0 },
+ { "atecc508a" },
{ }
};
MODULE_DEVICE_TABLE(i2c, atmel_ecc_id);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 678/699] crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (676 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 677/699] crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 679/699] usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile Greg Kroah-Hartman
` (24 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Blum, Ard Biesheuvel,
Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thorsten Blum <thorsten.blum@linux.dev>
[ Upstream commit ea5e57cc97185329dcc5ebdcaae7e1500bf0ad0b ]
Commit 8006aff15516 ("crypto: atmel-sha204a - Set hwrng quality to
lowest possible") reduced the hwrng quality to 1 based on a review by
Bill Cox [1]. However, despite its title, the review only tested the
ATSHA204, not the ATSHA204A.
In the same thread, Atmel engineer Landon Cox wrote "this behavior has
been eliminated entirely"[2] in the ATSHA204A and "this problem does not
affect the ATECC108 or the ATECC108A (or the ATSHA204A)"[3].
According to the official ATSHA204A datasheet [4], the device contains a
high-quality hardware RNG that combines its output with an internal seed
value stored in EEPROM or SRAM to generate random numbers. The device
also implements all security functions using SHA-256, and the driver
uses the chip's Random command in seed-update mode.
Keep 'quality = 1' for ATSHA204, but drop the explicit hwrng quality
reduction for ATSHA204A and fall back to the hwrng core default.
[1] https://www.metzdowd.com/pipermail/cryptography/2014-December/023858.html
[2] https://www.metzdowd.com/pipermail/cryptography/2014-December/023852.html
[3] https://www.metzdowd.com/pipermail/cryptography/2014-December/023886.html
[4] https://ww1.microchip.com/downloads/en/DeviceDoc/ATSHA204A-Data-Sheet-40002025A.pdf
Fixes: 8006aff15516 ("crypto: atmel-sha204a - Set hwrng quality to lowest possible")
Cc: stable@vger.kernel.org
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/atmel-sha204a.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/drivers/crypto/atmel-sha204a.c
+++ b/drivers/crypto/atmel-sha204a.c
@@ -18,6 +18,12 @@
#include <linux/workqueue.h>
#include "atmel-i2c.h"
+/*
+ * According to review by Bill Cox [1], the ATSHA204 has very low entropy.
+ * [1] https://www.metzdowd.com/pipermail/cryptography/2014-December/023858.html
+ */
+static const unsigned short atsha204_quality = 1;
+
static void atmel_sha204a_rng_done(struct atmel_i2c_work_data *work_data,
void *areq, int status)
{
@@ -96,6 +102,7 @@ static int atmel_sha204a_probe(struct i2
const struct i2c_device_id *id)
{
struct atmel_i2c_client_priv *i2c_priv;
+ const unsigned short *quality;
int ret;
ret = atmel_i2c_probe(client, id);
@@ -109,11 +116,9 @@ static int atmel_sha204a_probe(struct i2
i2c_priv->hwrng.name = dev_name(&client->dev);
i2c_priv->hwrng.read = atmel_sha204a_rng_read;
- /*
- * According to review by Bill Cox [1], this HWRNG has very low entropy.
- * [1] https://www.metzdowd.com/pipermail/cryptography/2014-December/023858.html
- */
- i2c_priv->hwrng.quality = 1;
+ quality = i2c_get_match_data(client);
+ if (quality)
+ i2c_priv->hwrng.quality = *quality;
ret = devm_hwrng_register(&client->dev, &i2c_priv->hwrng);
if (ret)
@@ -138,14 +143,14 @@ static int atmel_sha204a_remove(struct i
}
static const struct of_device_id atmel_sha204a_dt_ids[] __maybe_unused = {
- { .compatible = "atmel,atsha204", },
+ { .compatible = "atmel,atsha204", .data = &atsha204_quality },
{ .compatible = "atmel,atsha204a", },
{ /* sentinel */ }
};
MODULE_DEVICE_TABLE(of, atmel_sha204a_dt_ids);
static const struct i2c_device_id atmel_sha204a_id[] = {
- { "atsha204" },
+ { "atsha204", (kernel_ulong_t)&atsha204_quality },
{ "atsha204a" },
{ /* sentinel */ }
};
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 679/699] usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (677 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 678/699] crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 680/699] btrfs: do not trim a device which is not writeable Greg Kroah-Hartman
` (23 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Neill Kapron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neill Kapron <nkapron@google.com>
[ Upstream commit 8bdcf96eb135aebacac319667f87db034fb38406 ]
Currently, ffs_epfile_release unconditionally frees the endpoint's
read_buffer when a file descriptor is closed. If userspace explicitly
opens the endpoint multiple times and closes one, the read_buffer is
destroyed. This can lead to silent data loss if other file descriptors
are still actively reading from the endpoint.
By tying the lifetime of the read_buffer to the ffs_epfile structure itself
(which is destroyed when the functionfs instance is torn down in
ffs_epfiles_destroy), we eliminate the brittle dependency on open/release
calls while correctly matching the conceptual lifetime of unread data on
the hardware endpoint.
Fixes: 9353afbbfa7b ("usb: gadget: f_fs: buffer data from ‘oversized’ OUT requests")
Cc: stable <stable@kernel.org>
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Neill Kapron <nkapron@google.com>
Link: https://patch.msgid.link/20260619040609.4010746-3-nkapron@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ adjusted context in ffs_epfiles_destroy() since 6.12 lacks the simple_remove_by_name() rework and still uses dentry-based cleanup ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1279,7 +1279,6 @@ ffs_epfile_release(struct inode *inode,
ENTER();
- __ffs_epfile_read_buffer_free(epfile);
ffs_data_closed(epfile->ffs);
return 0;
@@ -1945,6 +1944,7 @@ static void ffs_epfiles_destroy(struct f
for (; count; --count, ++epfile) {
BUG_ON(mutex_is_locked(&epfile->mutex));
+ __ffs_epfile_read_buffer_free(epfile);
if (epfile->dentry) {
d_delete(epfile->dentry);
dput(epfile->dentry);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 680/699] btrfs: do not trim a device which is not writeable
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (678 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 679/699] usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 681/699] crypto: qat - fix restarting state leak on allocation failure Greg Kroah-Hartman
` (22 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Su Yue, Filipe Manana, Qu Wenruo,
David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 1b1937eb08f51319bf71575484cde2b8c517aedc ]
[BUG]
There is a bug report that btrfs/242 can randomly fail with the
following NULL pointer dereference:
run fstests btrfs/242 at 2026-06-01 10:25:08
BTRFS: device fsid d4d7f234-487c-4787-88e4-47a8b68c9874 devid 1 transid 9 /dev/sdc (8:32) scanned by mount (122609)
BTRFS info (device sdc): first mount of filesystem d4d7f234-487c-4787-88e4-47a8b68c9874
BTRFS info (device sdc): using crc32c checksum algorithm
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS warning (device sdc): devid 2 uuid fbe72d72-3272-482d-80fb-ab88ed398192 is missing
BTRFS info (device sdc): allowing degraded mounts
BTRFS info (device sdc): turning on async discard
BTRFS info (device sdc): enabling free space tree
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018
user pgtable: 4k pages, 48-bit VAs, pgdp=000000013fd6b000
CPU: 4 UID: 0 PID: 122625 Comm: fstrim Not tainted 7.0.10-2-default #1 PREEMPT(full) openSUSE Tumbleweed e9a5f6b24978fba3bf015a992f865837fdfff3dd
Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025
pstate: 01400005 (nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : btrfs_trim_fs+0x34c/0xa00 [btrfs]
lr : btrfs_trim_fs+0x1f0/0xa00 [btrfs]
Call trace:
btrfs_trim_fs+0x34c/0xa00 [btrfs f02c1d570ceea621c69d302ba75dd61868083840] (P)
btrfs_ioctl_fitrim+0xe8/0x178 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
btrfs_ioctl+0xdd4/0x2bd8 [btrfs f02c1d570ceea621c69d302ba75dd61868083840]
__arm64_sys_ioctl+0xac/0x108
invoke_syscall.constprop.0+0x5c/0xd0
el0_svc_common.constprop.0+0x40/0xf0
do_el0_svc+0x24/0x40
el0_svc+0x40/0x1d0
el0t_64_sync_handler+0xa0/0xe8
el0t_64_sync+0x1b0/0x1b8
Code: 17ffff83 f94017e0 f9002be0 f9402ea0 (f9400c00)
---[ end trace 0000000000000000 ]---
Also the reporter is very kind to test the following ASSERT() added to
btrfs_trim_free_extents_throttle():
ASSERT(device->bdev,
"devid=%llu path=%s dev_state=0x%lx\n",
device->devid, btrfs_dev_name(device), device->dev_state);
And it shows the following output:
assertion failed: device->bdev, in extent-tree.c:6630 (devid=2 path=/dev/sdd dev_state=0x82)
Which means the device->bdev is NULL, and the dev_state is
BTRFS_DEV_STATE_IN_FS_METADATA | BTRFS_DEV_STATE_ITEM_FOUND, without
BTRFS_DEV_STATE_WRITEABLE flag set.
[CAUSE]
The pc points to the following call chain:
btrfs_trim_fs()
|- btrfs_trim_free_extents()
|- btrfs_trim_free_extents_throttle()
|- bdev_max_discard_sectors(device->bdev)
So the NULL pointer dereference is caused by device->bdev being NULL.
This looks impossible by a quick glance, as just before calling
btrfs_trim_free_extents_throttle(), we have skipped any device that has
BTRFS_DEV_STATE_MISSING flag set.
However in this particular case, there is a window where the missing
device is later re-scanned, causing btrfs to remove the
BTRFS_DEV_STATE_MISSING flag:
btrfs_control_ioctl()
|- btrfs_scan_one_device()
|- device_list_add()
|- rcu_assign_pointer(device->name, name);
| This updates the missing device's path to the new good path.
|
|- clear_bit(BTRFS_DEV_STATE_MISSING, &device->dev_state)
This removes the BTRFS_DEV_STATE_MISSING flag.
This allows the missing device to re-appear and clear the
BTRFS_DEV_STATE_MISSING flag. However the device still does not have
the BTRFS_DEV_STATE_WRITEABLE flag set, nor is its bdev pointer updated.
The bdev pointer remains NULL, triggering the crash later.
[FIX]
This is a big de-synchronization between BTRFS_DEV_STATE_MISSING and
device->bdev pointer, and shows a gap in btrfs's re-appearing-device
handling.
The proper handling of re-appearing device will need quite some extra
work, which is out of the context of this small fix.
Thankfully the regular bbio submission path has already handled it well
by checking if the device->bdev is NULL before submitting.
So here we just fix the crash by checking if the device is writeable and
has a bdev pointer before calling bdev_max_discard_sectors().
Reported-by: Su Yue <glass.su@suse.com>
Link: https://lore.kernel.org/linux-btrfs/wlwir19t.fsf@damenly.org/
Fixes: 499f377f49f0 ("btrfs: iterate over unused chunk space in FITRIM")
CC: stable@vger.kernel.org # 5.10+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/extent-tree.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5762,12 +5762,16 @@ static int btrfs_trim_free_extents(struc
*trimmed = 0;
- /* Discard not supported = nothing to do. */
- if (!blk_queue_discard(bdev_get_queue(device->bdev)))
+ /*
+ * The caller only filters out MISSING devices, but a device that was
+ * missing at mount and later rescanned has MISSING cleared while bdev
+ * is still NULL and WRITEABLE is still unset. Skip those here.
+ */
+ if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state) || !device->bdev)
return 0;
- /* Not writable = nothing to do. */
- if (!test_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state))
+ /* Discard not supported = nothing to do. */
+ if (!blk_queue_discard(bdev_get_queue(device->bdev)))
return 0;
/* No free space = nothing to do. */
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 681/699] crypto: qat - fix restarting state leak on allocation failure
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (679 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 680/699] btrfs: do not trim a device which is not writeable Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 682/699] crypto: qat - validate RSA CRT component lengths Greg Kroah-Hartman
` (21 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahsan Atta, Maksim Lukoshkov,
Giovanni Cabiddu, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahsan Atta <ahsan.atta@intel.com>
[ Upstream commit 7d3ed20f7e46b3e991936fedd7a28f3ff4aec8d2 ]
In adf_dev_aer_schedule_reset(), ADF_STATUS_RESTARTING is set before
allocating reset_data. If the allocation fails, the function returns
-ENOMEM without queuing reset work, so nothing ever clears the bit.
This leaves the device permanently stuck in the restarting state,
causing all subsequent reset attempts to be silently skipped.
Fix this by using test_and_set_bit() to atomically claim the
RESTARTING state, preventing duplicate reset scheduling races under
concurrent fatal error reporting. If the subsequent allocation fails,
clear the bit to restore clean state so future reset attempts can
proceed.
Cc: stable@vger.kernel.org
Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework")
Signed-off-by: Ahsan Atta <ahsan.atta@intel.com>
Co-developed-by: Maksim Lukoshkov <maksim.lukoshkov@intel.com>
Signed-off-by: Maksim Lukoshkov <maksim.lukoshkov@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qat/qat_common/adf_aer.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/crypto/qat/qat_common/adf_aer.c
+++ b/drivers/crypto/qat/qat_common/adf_aer.c
@@ -116,13 +116,14 @@ static int adf_dev_aer_schedule_reset(st
struct adf_reset_dev_data *reset_data;
if (!adf_dev_started(accel_dev) ||
- test_bit(ADF_STATUS_RESTARTING, &accel_dev->status))
+ test_and_set_bit(ADF_STATUS_RESTARTING, &accel_dev->status))
return 0;
- set_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
reset_data = kzalloc(sizeof(*reset_data), GFP_KERNEL);
- if (!reset_data)
+ if (!reset_data) {
+ clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
return -ENOMEM;
+ }
reset_data->accel_dev = accel_dev;
init_completion(&reset_data->compl);
reset_data->mode = mode;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 682/699] crypto: qat - validate RSA CRT component lengths
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (680 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 681/699] crypto: qat - fix restarting state leak on allocation failure Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 683/699] audit: add audit_log_nf_skb helper function Greg Kroah-Hartman
` (20 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Giovanni Cabiddu, Ahsan Atta,
Laurent M Coquerel, Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
[ Upstream commit b3ac78756588059729b9195fcc9f4b37d54057a5 ]
The generic RSA key parser (rsa_helper.c) bounds each CRT component (p,
q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()
allocates half-size DMA buffers (key_sz / 2) and right-aligns each
component with:
memcpy(dst + half_key_sz - len, src, len)
When a CRT component is larger than half_key_sz the subtraction
underflows and memcpy writes past the DMA buffer, causing memory
corruption.
Add a len > half_key_sz check next to the existing !len check for each
of the five CRT components so the driver falls back to the non-CRT path
instead of writing out of bounds.
Fixes: 879f77e9071f ("crypto: qat - Add RSA CRT mode")
Cc: stable@vger.kernel.org
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
Tested-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/qat/qat_common/qat_asym_algs.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/crypto/qat/qat_common/qat_asym_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c
@@ -1030,7 +1030,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->p;
len = rsa_key->p_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto err;
ctx->p = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_p, GFP_KERNEL);
if (!ctx->p)
@@ -1041,7 +1041,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->q;
len = rsa_key->q_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_p;
ctx->q = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_q, GFP_KERNEL);
if (!ctx->q)
@@ -1052,7 +1052,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->dp;
len = rsa_key->dp_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_q;
ctx->dp = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_dp,
GFP_KERNEL);
@@ -1064,7 +1064,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->dq;
len = rsa_key->dq_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_dp;
ctx->dq = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_dq,
GFP_KERNEL);
@@ -1076,7 +1076,7 @@ static void qat_rsa_setkey_crt(struct qa
ptr = rsa_key->qinv;
len = rsa_key->qinv_sz;
qat_rsa_drop_leading_zeros(&ptr, &len);
- if (!len)
+ if (!len || len > half_key_sz)
goto free_dq;
ctx->qinv = dma_alloc_coherent(dev, half_key_sz, &ctx->dma_qinv,
GFP_KERNEL);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 683/699] audit: add audit_log_nf_skb helper function
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (681 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 682/699] crypto: qat - validate RSA CRT component lengths Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 684/699] audit: fix potential integer overflow in audit_log_n_hex() Greg Kroah-Hartman
` (19 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Paul Moore,
Ricardo Robaina, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Robaina <rrobaina@redhat.com>
[ Upstream commit f19590b07cb620be1fcd5474c49515e21a05d406 ]
Netfilter code (net/netfilter/nft_log.c and net/netfilter/xt_AUDIT.c)
have to be kept in sync. Both source files had duplicated versions of
audit_ip4() and audit_ip6() functions, which can result in lack of
consistency and/or duplicated work.
This patch adds a helper function in audit.c that can be called by
netfilter code commonly, aiming to improve maintainability and
consistency.
Suggested-by: Florian Westphal <fw@strlen.de>
Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Stable-dep-of: 65dfde57d1e2 ("audit: fix potential integer overflow in audit_log_n_hex()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/audit.h | 8 +++++
kernel/audit.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++
net/netfilter/nft_log.c | 58 ------------------------------------------
net/netfilter/xt_AUDIT.c | 58 ------------------------------------------
4 files changed, 74 insertions(+), 114 deletions(-)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -186,6 +186,8 @@ extern void audit_log_lost(const ch
extern int audit_log_task_context(struct audit_buffer *ab);
extern void audit_log_task_info(struct audit_buffer *ab);
+extern int audit_log_nf_skb(struct audit_buffer *ab,
+ const struct sk_buff *skb, u8 nfproto);
extern int audit_update_lsm_rules(void);
@@ -251,6 +253,12 @@ static inline int audit_log_task_context
static inline void audit_log_task_info(struct audit_buffer *ab)
{ }
+static inline int audit_log_nf_skb(struct audit_buffer *ab,
+ const struct sk_buff *skb, u8 nfproto)
+{
+ return 0;
+}
+
static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
{
return INVALID_UID;
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -59,6 +59,8 @@
#include <linux/freezer.h>
#include <linux/pid_namespace.h>
#include <net/netns/generic.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
#include "audit.h"
@@ -2304,6 +2306,68 @@ void audit_log_path_denied(int type, con
audit_log_end(ab);
}
+int audit_log_nf_skb(struct audit_buffer *ab,
+ const struct sk_buff *skb, u8 nfproto)
+{
+ /* find the IP protocol in the case of NFPROTO_BRIDGE */
+ if (nfproto == NFPROTO_BRIDGE) {
+ switch (eth_hdr(skb)->h_proto) {
+ case htons(ETH_P_IP):
+ nfproto = NFPROTO_IPV4;
+ break;
+ case htons(ETH_P_IPV6):
+ nfproto = NFPROTO_IPV6;
+ break;
+ default:
+ goto unknown_proto;
+ }
+ }
+
+ switch (nfproto) {
+ case NFPROTO_IPV4: {
+ struct iphdr iph;
+ const struct iphdr *ih;
+
+ ih = skb_header_pointer(skb, skb_network_offset(skb),
+ sizeof(iph), &iph);
+ if (!ih)
+ return -ENOMEM;
+
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
+ &ih->saddr, &ih->daddr, ih->protocol);
+ break;
+ }
+ case NFPROTO_IPV6: {
+ struct ipv6hdr iph;
+ const struct ipv6hdr *ih;
+ u8 nexthdr;
+ __be16 frag_off;
+
+ ih = skb_header_pointer(skb, skb_network_offset(skb),
+ sizeof(iph), &iph);
+ if (!ih)
+ return -ENOMEM;
+
+ nexthdr = ih->nexthdr;
+ ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(iph),
+ &nexthdr, &frag_off);
+
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
+ &ih->saddr, &ih->daddr, nexthdr);
+ break;
+ }
+ default:
+ goto unknown_proto;
+ }
+
+ return 0;
+
+unknown_proto:
+ audit_log_format(ab, " saddr=? daddr=? proto=?");
+ return -EPFNOSUPPORT;
+}
+EXPORT_SYMBOL(audit_log_nf_skb);
+
/* global counter which is incremented every time something logs in */
static atomic_t session_id = ATOMIC_INIT(0);
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -26,46 +26,10 @@ struct nft_log {
char *prefix;
};
-static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
-{
- struct iphdr _iph;
- const struct iphdr *ih;
-
- ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
- if (!ih)
- return false;
-
- audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
- &ih->saddr, &ih->daddr, ih->protocol);
-
- return true;
-}
-
-static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
-{
- struct ipv6hdr _ip6h;
- const struct ipv6hdr *ih;
- u8 nexthdr;
- __be16 frag_off;
-
- ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
- if (!ih)
- return false;
-
- nexthdr = ih->nexthdr;
- ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
-
- audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
- &ih->saddr, &ih->daddr, nexthdr);
-
- return true;
-}
-
static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
{
struct sk_buff *skb = pkt->skb;
struct audit_buffer *ab;
- int fam = -1;
if (!audit_enabled)
return;
@@ -76,27 +40,7 @@ static void nft_log_eval_audit(const str
audit_log_format(ab, "mark=%#x", skb->mark);
- switch (nft_pf(pkt)) {
- case NFPROTO_BRIDGE:
- switch (eth_hdr(skb)->h_proto) {
- case htons(ETH_P_IP):
- fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
- break;
- case htons(ETH_P_IPV6):
- fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
- break;
- }
- break;
- case NFPROTO_IPV4:
- fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
- break;
- case NFPROTO_IPV6:
- fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
- break;
- }
-
- if (fam == -1)
- audit_log_format(ab, " saddr=? daddr=? proto=-1");
+ audit_log_nf_skb(ab, skb, nft_pf(pkt));
audit_log_end(ab);
}
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -28,46 +28,10 @@ MODULE_ALIAS("ip6t_AUDIT");
MODULE_ALIAS("ebt_AUDIT");
MODULE_ALIAS("arpt_AUDIT");
-static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
-{
- struct iphdr _iph;
- const struct iphdr *ih;
-
- ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
- if (!ih)
- return false;
-
- audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
- &ih->saddr, &ih->daddr, ih->protocol);
-
- return true;
-}
-
-static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
-{
- struct ipv6hdr _ip6h;
- const struct ipv6hdr *ih;
- u8 nexthdr;
- __be16 frag_off;
-
- ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
- if (!ih)
- return false;
-
- nexthdr = ih->nexthdr;
- ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
-
- audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
- &ih->saddr, &ih->daddr, nexthdr);
-
- return true;
-}
-
static unsigned int
audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
{
struct audit_buffer *ab;
- int fam = -1;
if (audit_enabled == AUDIT_OFF)
goto errout;
@@ -77,27 +41,7 @@ audit_tg(struct sk_buff *skb, const stru
audit_log_format(ab, "mark=%#x", skb->mark);
- switch (xt_family(par)) {
- case NFPROTO_BRIDGE:
- switch (eth_hdr(skb)->h_proto) {
- case htons(ETH_P_IP):
- fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
- break;
- case htons(ETH_P_IPV6):
- fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
- break;
- }
- break;
- case NFPROTO_IPV4:
- fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
- break;
- case NFPROTO_IPV6:
- fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
- break;
- }
-
- if (fam == -1)
- audit_log_format(ab, " saddr=? daddr=? proto=-1");
+ audit_log_nf_skb(ab, skb, xt_family(par));
audit_log_end(ab);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 684/699] audit: fix potential integer overflow in audit_log_n_hex()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (682 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 683/699] audit: add audit_log_nf_skb helper function Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 685/699] posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() Greg Kroah-Hartman
` (18 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Guy Briggs, Ricardo Robaina,
Paul Moore, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Robaina <rrobaina@redhat.com>
[ Upstream commit 65dfde57d1e29ce2b76fc23dd565eccd5c0bc0f0 ]
The function calculates new_len as len << 1 for hex encoding. This
has two overflow risks: the shift itself can overflow when len is
large, and the result can be truncated when assigned to new_len
(declared as int) from the size_t calculation.
Fix by using check_shl_overflow() to catch shift overflow and
changing new_len and loop counter i to size_t to prevent truncation.
Cc: stable@vger.kernel.org
Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings")
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
[PM: remove vertical whitspace noise]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/audit.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -61,6 +61,7 @@
#include <net/netns/generic.h>
#include <net/ip.h>
#include <net/ipv6.h>
+#include <linux/overflow.h>
#include "audit.h"
@@ -2034,7 +2035,8 @@ void audit_log_format(struct audit_buffe
void audit_log_n_hex(struct audit_buffer *ab, const unsigned char *buf,
size_t len)
{
- int i, avail, new_len;
+ int avail;
+ size_t i, new_len;
unsigned char *ptr;
struct sk_buff *skb;
@@ -2044,7 +2046,12 @@ void audit_log_n_hex(struct audit_buffer
BUG_ON(!ab->skb);
skb = ab->skb;
avail = skb_tailroom(skb);
- new_len = len<<1;
+
+ if (check_shl_overflow(len, 1, &new_len)) {
+ audit_log_format(ab, "?");
+ return;
+ }
+
if (new_len >= avail) {
/* Round the buffer request up to the next multiple */
new_len = AUDIT_BUFSIZ*(((new_len-avail)/AUDIT_BUFSIZ) + 1);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 685/699] posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (683 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 684/699] audit: fix potential integer overflow in audit_log_n_hex() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 686/699] KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers Greg Kroah-Hartman
` (17 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhan Xusheng, Thomas Gleixner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhan Xusheng <zhanxusheng1024@gmail.com>
commit 26aff38fefb1d6cd87e22525f41cc8f1aa61b24f upstream.
update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with
u64 nsecs = rlim_new * NSEC_PER_SEC;
On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC
(1000000000L) are 32-bit, so the multiplication is performed in unsigned
long and truncated for rlim_new > 4 seconds before being widened to u64.
The same file already casts to u64 for the matching computation in
check_process_timers():
u64 softns = (u64)soft * NSEC_PER_SEC;
As a result, the truncated value is installed into the CPUCLOCK_PROF
expiry cache (nextevt), causing the process CPU timer to be programmed
to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The
actual SIGXCPU/SIGKILL decision in check_process_timers() already casts
to u64 and is therefore correct, so limit enforcement is not broken;
only the expiry-cache programming is wrong. Apply the same cast here so
both paths convert rlim_cur identically.
64-bit kernels are unaffected.
Fixes: 858cf3a8c599 ("timers/itimer: Convert internal cputime_t units to nsec")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/posix-cpu-timers.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -37,7 +37,7 @@ void posix_cputimers_group_init(struct p
*/
void update_rlimit_cpu(struct task_struct *task, unsigned long rlim_new)
{
- u64 nsecs = rlim_new * NSEC_PER_SEC;
+ u64 nsecs = (u64)rlim_new * NSEC_PER_SEC;
spin_lock_irq(&task->sighand->siglock);
set_process_cpu_timer(task, CPUCLOCK_PROF, &nsecs, NULL);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 686/699] KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (684 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 685/699] posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 687/699] Bluetooth: L2CAP: Fix regressions caused by reusing ident Greg Kroah-Hartman
` (16 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Will Deacon, Oliver Upton,
Marc Zyngier
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit 3a07249981629ace483ebbef81ef6b34c2d2afec upstream.
kvm_io_bus_get_dev() returns a device that is only matched by the
address, and nothing else. This can cause a lifetime issue if
the matched device is not the expected type, as by the time
the caller can introspect the object, it might be gone (the srcu
lock having been dropped).
Given that there is only a single user of this helper, the simplest
option is to move the locking responsibility to the caller, which
can keep the srcu lock held for as long as it wants.
Note that this aligns with other kvm_io_bus*() helpers, which
already require the srcu lock to be held by the callers.
Reported-by: Will Deacon <will@kernel.org>
Fixes: 8a39d00670f07 ("KVM: kvm_io_bus: Add kvm_io_bus_get_dev() call")
Link: https://lore.kernel.org/all/20260626111344.802555-1-maz@kernel.org
Cc: stable@vger.kernel.org
Reviewed-by: Oliver Upton <oupton@kernel.org>
Link: https://patch.msgid.link/20260627105105.1005990-1-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-its.c | 15 +++++++++++----
virt/kvm/kvm_main.c | 16 +++++-----------
2 files changed, 16 insertions(+), 15 deletions(-)
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -704,6 +704,8 @@ struct vgic_its *vgic_msi_to_its(struct
u64 address;
struct kvm_io_device *kvm_io_dev;
struct vgic_io_device *iodev;
+ struct vgic_its *its = NULL;
+ int srcu_idx;
if (!vgic_has_its(kvm))
return ERR_PTR(-ENODEV);
@@ -713,18 +715,23 @@ struct vgic_its *vgic_msi_to_its(struct
address = (u64)msi->address_hi << 32 | msi->address_lo;
+ srcu_idx = srcu_read_lock(&kvm->srcu);
+
kvm_io_dev = kvm_io_bus_get_dev(kvm, KVM_MMIO_BUS, address);
if (!kvm_io_dev)
- return ERR_PTR(-EINVAL);
+ goto out;
if (kvm_io_dev->ops != &kvm_io_gic_ops)
- return ERR_PTR(-EINVAL);
+ goto out;
iodev = container_of(kvm_io_dev, struct vgic_io_device, dev);
if (iodev->iodev_type != IODEV_ITS)
- return ERR_PTR(-EINVAL);
+ goto out;
- return iodev->its;
+ its = iodev->its;
+out:
+ srcu_read_unlock(&kvm->srcu, srcu_idx);
+ return its ?: ERR_PTR(-EINVAL);
}
/*
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -4558,25 +4558,19 @@ struct kvm_io_device *kvm_io_bus_get_dev
gpa_t addr)
{
struct kvm_io_bus *bus;
- int dev_idx, srcu_idx;
- struct kvm_io_device *iodev = NULL;
+ int dev_idx;
- srcu_idx = srcu_read_lock(&kvm->srcu);
+ lockdep_assert_held(&kvm->srcu);
bus = srcu_dereference(kvm->buses[bus_idx], &kvm->srcu);
if (!bus)
- goto out_unlock;
+ return NULL;
dev_idx = kvm_io_bus_get_first_dev(bus, addr, 1);
if (dev_idx < 0)
- goto out_unlock;
+ return NULL;
- iodev = bus->range[dev_idx].dev;
-
-out_unlock:
- srcu_read_unlock(&kvm->srcu, srcu_idx);
-
- return iodev;
+ return bus->range[dev_idx].dev;
}
EXPORT_SYMBOL_GPL(kvm_io_bus_get_dev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 687/699] Bluetooth: L2CAP: Fix regressions caused by reusing ident
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (685 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 686/699] KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 688/699] iio: imu: inv_mpu6050: fix frequency setting when chip is off Greg Kroah-Hartman
` (15 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz,
Christian Eggers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 upstream.
This attempt to fix regressions caused by reusing ident which apparently
is not handled well on certain stacks causing the stack to not respond to
requests, so instead of simple returning the first unallocated id this
stores the last used tx_ident and then attempt to use the next until all
available ids are exausted and then cycle starting over to 1.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221120
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221177
Fixes: 6c3ea155e5ee ("Bluetooth: L2CAP: Fix not tracking outstanding TX ident")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tested-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/bluetooth/l2cap.h | 1 +
net/bluetooth/l2cap_core.c | 29 ++++++++++++++++++++++++++---
2 files changed, 27 insertions(+), 3 deletions(-)
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -691,6 +691,7 @@ struct l2cap_conn {
struct sk_buff *rx_skb;
__u32 rx_len;
struct ida tx_ida;
+ __u8 tx_ident;
struct sk_buff_head pending_rx;
struct work_struct pending_rx_work;
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -941,16 +941,39 @@ int l2cap_chan_check_security(struct l2c
static int l2cap_get_ident(struct l2cap_conn *conn)
{
+ u8 max;
+ int ident;
+
/* LE link does not support tools like l2ping so use the full range */
if (conn->hcon->type == LE_LINK)
- return ida_alloc_range(&conn->tx_ida, 1, 255, GFP_ATOMIC);
-
+ max = 255;
/* Get next available identificator.
* 1 - 128 are used by kernel.
* 129 - 199 are reserved.
* 200 - 254 are used by utilities like l2ping, etc.
*/
- return ida_alloc_range(&conn->tx_ida, 1, 128, GFP_ATOMIC);
+ else
+ max = 128;
+
+ /* Allocate ident using min as last used + 1 (cyclic) */
+ ident = ida_alloc_range(&conn->tx_ida, READ_ONCE(conn->tx_ident) + 1,
+ max, GFP_ATOMIC);
+ /* Force min 1 to start over */
+ if (ident <= 0) {
+ ident = ida_alloc_range(&conn->tx_ida, 1, max, GFP_ATOMIC);
+ if (ident <= 0) {
+ /* If all idents are in use, log an error, this is
+ * extremely unlikely to happen and would indicate a bug
+ * in the code that idents are not being freed properly.
+ */
+ BT_ERR("Unable to allocate ident: %d", ident);
+ return 0;
+ }
+ }
+
+ WRITE_ONCE(conn->tx_ident, ident);
+
+ return ident;
}
static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 688/699] iio: imu: inv_mpu6050: fix frequency setting when chip is off
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (686 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 687/699] Bluetooth: L2CAP: Fix regressions caused by reusing ident Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 689/699] iio: invensense: fix odr switching to same value Greg Kroah-Hartman
` (14 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
commit daec424cc57b33a28f8621eb7ac85f8bd327bd6b upstream.
Track correctly FIFO state and apply ODR change before starting
the chip. Without the fix, you cannot change ODR more than 1 time
when data buffering is off. This restriction on a single pending ODR
change should only apply when the FIFO is on.
Fixes: 111e1abd0045 ("iio: imu: inv_mpu6050: use the common inv_sensors timestamp module")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Link: https://lore.kernel.org/r/20240219154741.90601-1-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
@@ -112,6 +112,7 @@ int inv_mpu6050_prepare_fifo(struct inv_
if (enable) {
/* reset timestamping */
inv_sensors_timestamp_reset(&st->timestamp);
+ inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0);
/* reset FIFO */
d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
ret = regmap_write(st->map, st->reg->user_ctrl, d);
@@ -187,6 +188,10 @@ static int inv_mpu6050_set_enable(struct
if (result)
goto error_power_off;
} else {
+ st->chip_config.gyro_fifo_enable = 0;
+ st->chip_config.accl_fifo_enable = 0;
+ st->chip_config.temp_fifo_enable = 0;
+ st->chip_config.magn_fifo_enable = 0;
result = inv_mpu6050_prepare_fifo(st, false);
if (result)
goto error_power_off;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 689/699] iio: invensense: fix odr switching to same value
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (687 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 688/699] iio: imu: inv_mpu6050: fix frequency setting when chip is off Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 690/699] iio: imu: inv_icm42600: fix timestamp clock period by using lower value Greg Kroah-Hartman
` (13 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
commit 95444b9eeb8c5c0330563931d70c61ca3b101548 upstream.
ODR switching happens in 2 steps, update to store the new value and then
apply when the ODR change flag is received in the data. When switching to
the same ODR value, the ODR change flag is never happening, and frequency
switching is blocked waiting for the never coming apply.
Fix the issue by preventing update to happen when switching to same ODR
value.
Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Link: https://lore.kernel.org/r/20240524124851.567485-1-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
@@ -60,11 +60,15 @@ EXPORT_SYMBOL_NS_GPL(inv_sensors_timesta
int inv_sensors_timestamp_update_odr(struct inv_sensors_timestamp *ts,
uint32_t period, bool fifo)
{
+ uint32_t mult;
+
/* when FIFO is on, prevent odr change if one is already pending */
if (fifo && ts->new_mult != 0)
return -EAGAIN;
- ts->new_mult = period / ts->chip.clock_period;
+ mult = period / ts->chip.clock_period;
+ if (mult != ts->mult)
+ ts->new_mult = mult;
return 0;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 690/699] iio: imu: inv_icm42600: fix timestamp clock period by using lower value
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (688 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 689/699] iio: invensense: fix odr switching to same value Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 691/699] mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist Greg Kroah-Hartman
` (12 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
commit 8b0b864c11a2e2ada470f9d5010e1c2bf1eceef2 upstream.
Clock period value is used for computing periods of sampling. There is
no need for it to be higher than the maximum odr, otherwise we are
losing precision in the computation for nothing.
Switch clock period value to maximum odr period (8kHz).
Fixes: 0ecc363ccea7 ("iio: make invensense timestamp module generic")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 4 ++--
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -725,10 +725,10 @@ struct iio_dev *inv_icm42600_accel_init(
return ERR_PTR(-ENOMEM);
/*
- * clock period is 32kHz (31250ns)
+ * clock period is 8kHz (125000ns)
* jitter is +/- 2% (20 per mille)
*/
- ts_chip.clock_period = 31250;
+ ts_chip.clock_period = 125000;
ts_chip.jitter = 20;
ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
ts = iio_priv(indio_dev);
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -736,10 +736,10 @@ struct iio_dev *inv_icm42600_gyro_init(s
return ERR_PTR(-ENOMEM);
/*
- * clock period is 32kHz (31250ns)
+ * clock period is 8kHz (125000ns)
* jitter is +/- 2% (20 per mille)
*/
- ts_chip.clock_period = 31250;
+ ts_chip.clock_period = 125000;
ts_chip.jitter = 20;
ts_chip.init_period = inv_icm42600_odr_to_period(st->conf.accel.odr);
ts = iio_priv(indio_dev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 691/699] mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (689 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 690/699] iio: imu: inv_icm42600: fix timestamp clock period by using lower value Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 692/699] ipv6: mcast: Delay put pmc->idev in mld_del_delrec() Greg Kroah-Hartman
` (11 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Taehee Yoo,
David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
commit 4b4b84468aa27d0a18be8cb727f246aa35a3406d upstream.
struct ip6_sf_socklist and ipv6_mc_socklist are per-socket MLD data.
These data are protected by rtnl lock, socket lock, and RCU.
So, when these are used, it verifies whether rtnl lock is acquired or not.
ip6_mc_msfget() is called by do_ipv6_getsockopt().
But caller doesn't acquire rtnl lock.
So, when these data are used in the ip6_mc_msfget() lockdep warns about it.
But accessing these is actually safe because socket lock was acquired by
do_ipv6_getsockopt().
So, it changes lockdep annotation from rtnl lock to socket lock.
(rtnl_dereference -> sock_dereference)
Locking graph for mld data is like below:
When writing mld data:
do_ipv6_setsockopt()
rtnl_lock
lock_sock
(mld functions)
idev->mc_lock(if per-interface mld data is modified)
When reading mld data:
do_ipv6_getsockopt()
lock_sock
ip6_mc_msfget()
Splat looks like:
=============================
WARNING: suspicious RCU usage
5.12.0-rc4+ #503 Not tainted
-----------------------------
net/ipv6/mcast.c:610 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by mcast-listener-/923:
#0: ffff888007958a70 (sk_lock-AF_INET6){+.+.}-{0:0}, at:
ipv6_get_msfilter+0xaf/0x190
stack backtrace:
CPU: 1 PID: 923 Comm: mcast-listener- Not tainted 5.12.0-rc4+ #503
Call Trace:
dump_stack+0xa4/0xe5
ip6_mc_msfget+0x553/0x6c0
? ipv6_sock_mc_join_ssm+0x10/0x10
? lockdep_hardirqs_on_prepare+0x3e0/0x3e0
? mark_held_locks+0xb7/0x120
? lockdep_hardirqs_on_prepare+0x27c/0x3e0
? __local_bh_enable_ip+0xa5/0xf0
? lock_sock_nested+0x82/0xf0
ipv6_get_msfilter+0xc3/0x190
? compat_ipv6_get_msfilter+0x300/0x300
? lock_downgrade+0x690/0x690
do_ipv6_getsockopt.isra.6.constprop.13+0x1809/0x29e0
? do_ipv6_mcast_group_source+0x150/0x150
? register_lock_class+0x1750/0x1750
? kvm_sched_clock_read+0x14/0x30
? sched_clock+0x5/0x10
? sched_clock_cpu+0x18/0x170
? find_held_lock+0x3a/0x1c0
? lock_downgrade+0x690/0x690
? ipv6_getsockopt+0xdb/0x1b0
ipv6_getsockopt+0xdb/0x1b0
[ ... ]
Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 48 +++++++++++++++++++++++-------------------------
net/tipc/udp_media.c | 2 ++
2 files changed, 25 insertions(+), 25 deletions(-)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -114,10 +114,13 @@ int sysctl_mld_qrv __read_mostly = MLD_Q
#define mc_dereference(e, idev) \
rcu_dereference_protected(e, lockdep_is_held(&(idev)->mc_lock))
-#define for_each_pmc_rtnl(np, pmc) \
- for (pmc = rtnl_dereference((np)->ipv6_mc_list); \
+#define sock_dereference(e, sk) \
+ rcu_dereference_protected(e, lockdep_sock_is_held(sk))
+
+#define for_each_pmc_socklock(np, sk, pmc) \
+ for (pmc = sock_dereference((np)->ipv6_mc_list, sk); \
pmc; \
- pmc = rtnl_dereference(pmc->next))
+ pmc = sock_dereference(pmc->next, sk))
#define for_each_pmc_rcu(np, pmc) \
for (pmc = rcu_dereference((np)->ipv6_mc_list); \
@@ -183,7 +186,7 @@ static int __ipv6_sock_mc_join(struct so
if (!ipv6_addr_is_multicast(addr))
return -EINVAL;
- for_each_pmc_rtnl(np, mc_lst) {
+ for_each_pmc_socklock(np, sk, mc_lst) {
if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
ipv6_addr_equal(&mc_lst->addr, addr))
return -EADDRINUSE;
@@ -261,7 +264,7 @@ int ipv6_sock_mc_drop(struct sock *sk, i
return -EINVAL;
for (lnk = &np->ipv6_mc_list;
- (mc_lst = rtnl_dereference(*lnk)) != NULL;
+ (mc_lst = sock_dereference(*lnk, sk)) != NULL;
lnk = &mc_lst->next) {
if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
ipv6_addr_equal(&mc_lst->addr, addr)) {
@@ -326,7 +329,7 @@ void __ipv6_sock_mc_close(struct sock *s
ASSERT_RTNL();
- while ((mc_lst = rtnl_dereference(np->ipv6_mc_list)) != NULL) {
+ while ((mc_lst = sock_dereference(np->ipv6_mc_list, sk)) != NULL) {
struct net_device *dev;
np->ipv6_mc_list = mc_lst->next;
@@ -353,8 +356,11 @@ void ipv6_sock_mc_close(struct sock *sk)
if (!rcu_access_pointer(np->ipv6_mc_list))
return;
+
rtnl_lock();
+ lock_sock(sk);
__ipv6_sock_mc_close(sk);
+ release_sock(sk);
rtnl_unlock();
}
@@ -384,7 +390,7 @@ int ip6_mc_source(int add, int omode, st
err = -EADDRNOTAVAIL;
mutex_lock(&idev->mc_lock);
- for_each_pmc_rtnl(inet6, pmc) {
+ for_each_pmc_socklock(inet6, sk, pmc) {
if (pgsr->gsr_interface && pmc->ifindex != pgsr->gsr_interface)
continue;
if (ipv6_addr_equal(&pmc->addr, group))
@@ -407,7 +413,7 @@ int ip6_mc_source(int add, int omode, st
pmc->sfmode = omode;
}
- psl = rtnl_dereference(pmc->sflist);
+ psl = sock_dereference(pmc->sflist, sk);
if (!add) {
if (!psl)
goto done; /* err = -EADDRNOTAVAIL */
@@ -514,7 +520,7 @@ int ip6_mc_msfilter(struct sock *sk, str
goto done;
}
- for_each_pmc_rtnl(inet6, pmc) {
+ for_each_pmc_socklock(inet6, sk, pmc) {
if (pmc->ifindex != gsf->gf_interface)
continue;
if (ipv6_addr_equal(&pmc->addr, group))
@@ -555,7 +561,7 @@ int ip6_mc_msfilter(struct sock *sk, str
}
mutex_lock(&idev->mc_lock);
- psl = rtnl_dereference(pmc->sflist);
+ psl = sock_dereference(pmc->sflist, sk);
if (psl) {
ip6_mc_del_src(idev, group, pmc->sfmode,
psl->sl_count, psl->sl_addr, 0);
@@ -577,40 +583,32 @@ done:
int ip6_mc_msfget(struct sock *sk, struct group_filter *gsf,
struct sockaddr_storage *p)
{
- int err, i, count, copycount;
+ struct ipv6_pinfo *inet6 = inet6_sk(sk);
const struct in6_addr *group;
struct ipv6_mc_socklist *pmc;
- struct inet6_dev *idev;
- struct ipv6_pinfo *inet6 = inet6_sk(sk);
struct ip6_sf_socklist *psl;
- struct net *net = sock_net(sk);
+ int i, count, copycount;
group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
if (!ipv6_addr_is_multicast(group))
return -EINVAL;
- idev = ip6_mc_find_dev_rtnl(net, group, gsf->gf_interface);
- if (!idev)
- return -ENODEV;
-
- err = -EADDRNOTAVAIL;
/* changes to the ipv6_mc_list require the socket lock and
- * rtnl lock. We have the socket lock and rcu read lock,
- * so reading the list is safe.
+ * rtnl lock. We have the socket lock, so reading the list is safe.
*/
- for_each_pmc_rtnl(inet6, pmc) {
+ for_each_pmc_socklock(inet6, sk, pmc) {
if (pmc->ifindex != gsf->gf_interface)
continue;
if (ipv6_addr_equal(group, &pmc->addr))
break;
}
if (!pmc) /* must have a prior join */
- return err;
+ return -EADDRNOTAVAIL;
gsf->gf_fmode = pmc->sfmode;
- psl = rtnl_dereference(pmc->sflist);
+ psl = sock_dereference(pmc->sflist, sk);
count = psl ? psl->sl_count : 0;
copycount = count < gsf->gf_numsrc ? count : gsf->gf_numsrc;
@@ -2620,7 +2618,7 @@ static int ip6_mc_leave_src(struct sock
struct ip6_sf_socklist *psl;
int err;
- psl = rtnl_dereference(iml->sflist);
+ psl = sock_dereference(iml->sflist, sk);
if (idev)
mutex_lock(&idev->mc_lock);
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -411,8 +411,10 @@ static int enable_mcast(struct udp_beare
err = ip_mc_join_group(sk, &mreqn);
#if IS_ENABLED(CONFIG_IPV6)
} else {
+ lock_sock(sk);
err = ipv6_stub->ipv6_sock_mc_join(sk, ub->ifindex,
&remote->ipv6);
+ release_sock(sk);
#endif
}
return err;
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 692/699] ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (690 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 691/699] mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 693/699] net: ethernet: rmnet: Always subtract MAP header Greg Kroah-Hartman
` (10 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yue Haibing, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <yuehaibing@huawei.com>
commit ae3264a25a4635531264728859dbe9c659fad554 upstream.
pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec()
does, the reference should be put after ip6_mc_clear_src() return.
Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data")
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -806,8 +806,8 @@ static void mld_del_delrec(struct inet6_
} else {
im->mca_crcount = idev->mc_qrv;
}
- in6_dev_put(pmc->idev);
ip6_mc_clear_src(pmc);
+ in6_dev_put(pmc->idev);
kfree_rcu(pmc, rcu);
}
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 693/699] net: ethernet: rmnet: Always subtract MAP header
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (691 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 692/699] ipv6: mcast: Delay put pmc->idev in mld_del_delrec() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 694/699] ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() Greg Kroah-Hartman
` (9 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kristian Evensen, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristian Evensen <kristian.evensen@gmail.com>
commit 8b8701d0b4925807a6d4dc4699cb80a1e16218ad upstream.
Commit e1d9a90a9bfd ("net: ethernet: rmnet: Support for ingress MAPv5
checksum offload") broke ingress handling for devices where
RMNET_FLAGS_INGRESS_MAP_CKSUMV5 or RMNET_FLAGS_INGRESS_MAP_CKSUMV4 are
not set. Unless either of these flags are set, the MAP header is not
removed. This commit restores the original logic by ensuring that the
MAP header is removed for all MAP packets.
Fixes: e1d9a90a9bfd ("net: ethernet: rmnet: Support for ingress MAPv5 checksum offload")
Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -88,11 +88,12 @@ __rmnet_map_ingress_handler(struct sk_bu
goto free_skb;
skb_pull(skb, sizeof(*map_header));
rmnet_set_skb_proto(skb);
- } else if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4) {
+ } else {
/* Subtract MAP header */
skb_pull(skb, sizeof(*map_header));
rmnet_set_skb_proto(skb);
- if (!rmnet_map_checksum_downlink_packet(skb, len + pad))
+ if (port->data_format & RMNET_FLAGS_INGRESS_MAP_CKSUMV4 &&
+ !rmnet_map_checksum_downlink_packet(skb, len + pad))
skb->ip_summed = CHECKSUM_UNNECESSARY;
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 694/699] ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (692 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 693/699] net: ethernet: rmnet: Always subtract MAP header Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 695/699] ipv6: fix lockdep splat in in6_dump_addrs() Greg Kroah-Hartman
` (8 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Pinilla Caparros,
Ignat Korchagin, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ignat Korchagin <ignat@cloudflare.com>
commit 26394fc118d6115390bd5b3a0fb17096271da227 upstream.
Some time ago 8965779d2c0e ("ipv6,mcast: always hold idev->lock before mca_lock")
switched ipv6_get_lladdr() to __ipv6_get_lladdr(), which is rcu-unsafe
version. That was OK, because idev->lock was held for these codepaths.
In 88e2ca308094 ("mld: convert ifmcaddr6 to RCU") these external locks were
removed, so we probably need to restore the original rcu-safe call.
Otherwise, we occasionally get a machine crashed/stalled with the following
in dmesg:
[ 3405.966610][T230589] general protection fault, probably for non-canonical address 0xdead00000000008c: 0000 [#1] SMP NOPTI
[ 3405.982083][T230589] CPU: 44 PID: 230589 Comm: kworker/44:3 Tainted: G O 5.15.19-cloudflare-2022.2.1 #1
[ 3405.998061][T230589] Hardware name: SUPA-COOL-SERV
[ 3406.009552][T230589] Workqueue: mld mld_ifc_work
[ 3406.017224][T230589] RIP: 0010:__ipv6_get_lladdr+0x34/0x60
[ 3406.025780][T230589] Code: 57 10 48 83 c7 08 48 89 e5 48 39 d7 74 3e 48 8d 82 38 ff ff ff eb 13 48 8b 90 d0 00 00 00 48 8d 82 38 ff ff ff 48 39 d7 74 22 <66> 83 78 32 20 77 1b 75 e4 89 ca 23 50 2c 75 dd 48 8b 50 08 48 8b
[ 3406.055748][T230589] RSP: 0018:ffff94e4b3fc3d10 EFLAGS: 00010202
[ 3406.065617][T230589] RAX: dead00000000005a RBX: ffff94e4b3fc3d30 RCX: 0000000000000040
[ 3406.077477][T230589] RDX: dead000000000122 RSI: ffff94e4b3fc3d30 RDI: ffff8c3a31431008
[ 3406.089389][T230589] RBP: ffff94e4b3fc3d10 R08: 0000000000000000 R09: 0000000000000000
[ 3406.101445][T230589] R10: ffff8c3a31430000 R11: 000000000000000b R12: ffff8c2c37887100
[ 3406.113553][T230589] R13: ffff8c3a39537000 R14: 00000000000005dc R15: ffff8c3a31431000
[ 3406.125730][T230589] FS: 0000000000000000(0000) GS:ffff8c3b9fc80000(0000) knlGS:0000000000000000
[ 3406.138992][T230589] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3406.149895][T230589] CR2: 00007f0dfea1db60 CR3: 000000387b5f2000 CR4: 0000000000350ee0
[ 3406.162421][T230589] Call Trace:
[ 3406.170235][T230589] <TASK>
[ 3406.177736][T230589] mld_newpack+0xfe/0x1a0
[ 3406.186686][T230589] add_grhead+0x87/0xa0
[ 3406.195498][T230589] add_grec+0x485/0x4e0
[ 3406.204310][T230589] ? newidle_balance+0x126/0x3f0
[ 3406.214024][T230589] mld_ifc_work+0x15d/0x450
[ 3406.223279][T230589] process_one_work+0x1e6/0x380
[ 3406.232982][T230589] worker_thread+0x50/0x3a0
[ 3406.242371][T230589] ? rescuer_thread+0x360/0x360
[ 3406.252175][T230589] kthread+0x127/0x150
[ 3406.261197][T230589] ? set_kthread_struct+0x40/0x40
[ 3406.271287][T230589] ret_from_fork+0x22/0x30
[ 3406.280812][T230589] </TASK>
[ 3406.288937][T230589] Modules linked in: ... [last unloaded: kheaders]
[ 3406.476714][T230589] ---[ end trace 3525a7655f2f3b9e ]---
Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
Reported-by: David Pinilla Caparros <dpini@cloudflare.com>
Signed-off-by: Ignat Korchagin <ignat@cloudflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/addrconf.h | 2 --
net/ipv6/addrconf.c | 4 ++--
net/ipv6/mcast.c | 2 +-
3 files changed, 3 insertions(+), 5 deletions(-)
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -117,8 +117,6 @@ struct inet6_ifaddr *ipv6_get_ifaddr(str
int ipv6_dev_get_saddr(struct net *net, const struct net_device *dev,
const struct in6_addr *daddr, unsigned int srcprefs,
struct in6_addr *saddr);
-int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
- u32 banned_flags);
int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
u32 banned_flags);
bool inet_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2,
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1851,8 +1851,8 @@ out:
}
EXPORT_SYMBOL(ipv6_dev_get_saddr);
-int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
- u32 banned_flags)
+static int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
+ u32 banned_flags)
{
struct inet6_ifaddr *ifp;
int err = -EADDRNOTAVAIL;
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1776,7 +1776,7 @@ static struct sk_buff *mld_newpack(struc
skb_reserve(skb, hlen);
skb_tailroom_reserve(skb, mtu, tlen);
- if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
+ if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
/* <draft-ietf-magma-mld-source-05.txt>:
* use unspecified address as the source address
* when a valid link-local address is not available.
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 695/699] ipv6: fix lockdep splat in in6_dump_addrs()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (693 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 694/699] ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 696/699] net: mld: fix reference count leak in mld_{query | report}_work() Greg Kroah-Hartman
` (7 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Taehee Yoo,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 4e43e64d0f1332fcc503babad4dc31aead7131ca upstream.
As reported by syzbot, we should not use rcu_dereference()
when rcu_read_lock() is not held.
WARNING: suspicious RCU usage
5.19.0-rc2-syzkaller #0 Not tainted
net/ipv6/addrconf.c:5175 suspicious rcu_dereference_check() usage!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz-executor326/3617:
#0: ffffffff8d5848e8 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xae/0xc20 net/netlink/af_netlink.c:2223
stack backtrace:
CPU: 0 PID: 3617 Comm: syz-executor326 Not tainted 5.19.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
in6_dump_addrs+0x12d1/0x1790 net/ipv6/addrconf.c:5175
inet6_dump_addr+0x9c1/0xb50 net/ipv6/addrconf.c:5300
netlink_dump+0x541/0xc20 net/netlink/af_netlink.c:2275
__netlink_dump_start+0x647/0x900 net/netlink/af_netlink.c:2380
netlink_dump_start include/linux/netlink.h:245 [inline]
rtnetlink_rcv_msg+0x73e/0xc90 net/core/rtnetlink.c:6046
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:734
____sys_sendmsg+0x6eb/0x810 net/socket.c:2492
___sys_sendmsg+0xf3/0x170 net/socket.c:2546
__sys_sendmsg net/socket.c:2575 [inline]
__do_sys_sendmsg net/socket.c:2584 [inline]
__se_sys_sendmsg net/socket.c:2582 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2582
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
Fixes: 88e2ca308094 ("mld: convert ifmcaddr6 to RCU")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Taehee Yoo <ap420073@gmail.com>
Link: https://lore.kernel.org/r/20220628121248.858695-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/addrconf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5178,9 +5178,9 @@ next:
fillargs->event = RTM_GETMULTICAST;
/* multicast address */
- for (ifmca = rcu_dereference(idev->mc_list);
+ for (ifmca = rtnl_dereference(idev->mc_list);
ifmca;
- ifmca = rcu_dereference(ifmca->next), ip_idx++) {
+ ifmca = rtnl_dereference(ifmca->next), ip_idx++) {
if (ip_idx < s_ip_idx)
continue;
err = inet6_fill_ifmcaddr(skb, ifmca, fillargs);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 696/699] net: mld: fix reference count leak in mld_{query | report}_work()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (694 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 695/699] ipv6: fix lockdep splat in in6_dump_addrs() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 697/699] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work Greg Kroah-Hartman
` (6 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Taehee Yoo,
Eric Dumazet, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
commit 3e7d18b9dca388940a19cae30bfc1f76dccd8c28 upstream.
mld_{query | report}_work() processes queued events.
If there are too many events in the queue, it re-queue a work.
And then, it returns without in6_dev_put().
But if queuing is failed, it should call in6_dev_put(), but it doesn't.
So, a reference count leak would occur.
THREAD0 THREAD1
mld_report_work()
spin_lock_bh()
if (!mod_delayed_work())
in6_dev_hold();
spin_unlock_bh()
spin_lock_bh()
schedule_delayed_work()
spin_unlock_bh()
Script to reproduce(by Hangbin Liu):
ip netns add ns1
ip netns add ns2
ip netns exec ns1 sysctl -w net.ipv6.conf.all.force_mld_version=1
ip netns exec ns2 sysctl -w net.ipv6.conf.all.force_mld_version=1
ip -n ns1 link add veth0 type veth peer name veth0 netns ns2
ip -n ns1 link set veth0 up
ip -n ns2 link set veth0 up
for i in `seq 50`; do
for j in `seq 100`; do
ip -n ns1 addr add 2021:${i}::${j}/64 dev veth0
ip -n ns2 addr add 2022:${i}::${j}/64 dev veth0
done
done
modprobe -r veth
ip -a netns del
splat looks like:
unregister_netdevice: waiting for veth0 to become free. Usage count = 2
leaked reference.
ipv6_add_dev+0x324/0xec0
addrconf_notify+0x481/0xd10
raw_notifier_call_chain+0xe3/0x120
call_netdevice_notifiers+0x106/0x160
register_netdevice+0x114c/0x16b0
veth_newlink+0x48b/0xa50 [veth]
rtnl_newlink+0x11a2/0x1a40
rtnetlink_rcv_msg+0x63f/0xc00
netlink_rcv_skb+0x1df/0x3e0
netlink_unicast+0x5de/0x850
netlink_sendmsg+0x6c9/0xa90
____sys_sendmsg+0x76a/0x780
__sys_sendmsg+0x27c/0x340
do_syscall_64+0x43/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Tested-by: Hangbin Liu <liuhangbin@gmail.com>
Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1545,7 +1545,6 @@ static void mld_query_work(struct work_s
if (++cnt >= MLD_MAX_QUEUE) {
rework = true;
- schedule_delayed_work(&idev->mc_query_work, 0);
break;
}
}
@@ -1556,8 +1555,10 @@ static void mld_query_work(struct work_s
__mld_query_work(skb);
mutex_unlock(&idev->mc_lock);
- if (!rework)
- in6_dev_put(idev);
+ if (rework && queue_delayed_work(mld_wq, &idev->mc_query_work, 0))
+ return;
+
+ in6_dev_put(idev);
}
/* called with rcu_read_lock() */
@@ -1652,7 +1653,6 @@ static void mld_report_work(struct work_
if (++cnt >= MLD_MAX_QUEUE) {
rework = true;
- schedule_delayed_work(&idev->mc_report_work, 0);
break;
}
}
@@ -1663,8 +1663,10 @@ static void mld_report_work(struct work_
__mld_report_work(skb);
mutex_unlock(&idev->mc_lock);
- if (!rework)
- in6_dev_put(idev);
+ if (rework && queue_delayed_work(mld_wq, &idev->mc_report_work, 0))
+ return;
+
+ in6_dev_put(idev);
}
static bool is_in(struct ifmcaddr6 *pmc, struct ip6_sf_list *psf, int type,
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 697/699] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (695 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 696/699] net: mld: fix reference count leak in mld_{query | report}_work() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 698/699] ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() Greg Kroah-Hartman
` (5 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a9400cabb1d784e49abf,
Nikita Zhandarovich, Taehee Yoo, Eric Dumazet, Hangbin Liu,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
commit 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 upstream.
idev->mc_ifc_count can be written over without proper locking.
Originally found by syzbot [1], fix this issue by encapsulating calls
to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with
mutex_lock() and mutex_unlock() accordingly as these functions
should only be called with mc_lock per their declarations.
[1]
BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work
write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0:
mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline]
ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725
addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949
addrconf_notify+0x310/0x980
notifier_call_chain kernel/notifier.c:93 [inline]
raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461
__dev_notify_flags+0x205/0x3d0
dev_change_flags+0xab/0xd0 net/core/dev.c:8685
do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916
rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]
__rtnl_newlink net/core/rtnetlink.c:3717 [inline]
rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754
rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558
netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910
...
write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1:
mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653
process_one_work kernel/workqueue.c:2627 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700
worker_thread+0x525/0x730 kernel/workqueue.c:2781
...
Fixes: 2d9a93b4902b ("mld: convert from timer to delayed work")
Reported-by: syzbot+a9400cabb1d784e49abf@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/000000000000994e09060ebcdffb@google.com/
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Acked-by: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20240117172102.12001-1-n.zhandarovich@fintech.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2754,8 +2754,12 @@ void ipv6_mc_down(struct inet6_dev *idev
synchronize_net();
mld_query_stop_work(idev);
mld_report_stop_work(idev);
+
+ mutex_lock(&idev->mc_lock);
mld_ifc_stop_work(idev);
mld_gq_stop_work(idev);
+ mutex_unlock(&idev->mc_lock);
+
mld_dad_stop_work(idev);
}
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 698/699] ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (696 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 697/699] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 699/699] mld: fix suspicious RCU usage in __ipv6_dev_mc_dec() Greg Kroah-Hartman
` (4 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Taehee Yoo, Cong Wang,
David Ahern, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 17ef8efc00b34918b966388b2af0993811895a8c upstream.
As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops
in igmp6_event_query() and igmp6_event_report()")) I think the
synchronize_net() call in ipv6_mc_down() is not needed.
Under load, synchronize_net() can last between 200 usec and 5 ms.
KASAN seems to agree as well.
Fixes: f185de28d9ae ("mld: add new workqueues for process mld events")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Taehee Yoo <ap420073@gmail.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 1 -
1 file changed, 1 deletion(-)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2751,7 +2751,6 @@ void ipv6_mc_down(struct inet6_dev *idev
/* Should stop work after group drop. or we will
* start work again in mld_ifc_event()
*/
- synchronize_net();
mld_query_stop_work(idev);
mld_report_stop_work(idev);
^ permalink raw reply [flat|nested] 704+ messages in thread
* [PATCH 5.10 699/699] mld: fix suspicious RCU usage in __ipv6_dev_mc_dec()
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (697 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 698/699] ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() Greg Kroah-Hartman
@ 2026-07-21 15:27 ` Greg Kroah-Hartman
2026-07-21 16:32 ` [PATCH 5.10 000/699] 5.10.261-rc1 review Florian Fainelli
` (3 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Greg Kroah-Hartman @ 2026-07-21 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Taehee Yoo,
David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
commit aa8caa767e319bad34a82bfce7da1ed2b9c0ed6f upstream.
__ipv6_dev_mc_dec() internally uses sleepable functions so that caller
must not acquire atomic locks. But caller, which is addrconf_verify_rtnl()
acquires rcu_read_lock_bh().
So this warning occurs in the __ipv6_dev_mc_dec().
Test commands:
ip netns add A
ip link add veth0 type veth peer name veth1
ip link set veth1 netns A
ip link set veth0 up
ip netns exec A ip link set veth1 up
ip a a 2001:db8::1/64 dev veth0 valid_lft 2 preferred_lft 1
Splat looks like:
============================
WARNING: suspicious RCU usage
5.12.0-rc6+ #515 Not tainted
-----------------------------
kernel/sched/core.c:8294 Illegal context switch in RCU-bh read-side
critical section!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
4 locks held by kworker/4:0/1997:
#0: ffff88810bd72d48 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at:
process_one_work+0x761/0x1440
#1: ffff888105c8fe00 ((addr_chk_work).work){+.+.}-{0:0}, at:
process_one_work+0x795/0x1440
#2: ffffffffb9279fb0 (rtnl_mutex){+.+.}-{3:3}, at:
addrconf_verify_work+0xa/0x20
#3: ffffffffb8e30860 (rcu_read_lock_bh){....}-{1:2}, at:
addrconf_verify_rtnl+0x23/0xc60
stack backtrace:
CPU: 4 PID: 1997 Comm: kworker/4:0 Not tainted 5.12.0-rc6+ #515
Workqueue: ipv6_addrconf addrconf_verify_work
Call Trace:
dump_stack+0xa4/0xe5
___might_sleep+0x27d/0x2b0
__mutex_lock+0xc8/0x13f0
? lock_downgrade+0x690/0x690
? __ipv6_dev_mc_dec+0x49/0x2a0
? mark_held_locks+0xb7/0x120
? mutex_lock_io_nested+0x1270/0x1270
? lockdep_hardirqs_on_prepare+0x12c/0x3e0
? _raw_spin_unlock_irqrestore+0x47/0x50
? trace_hardirqs_on+0x41/0x120
? __wake_up_common_lock+0xc9/0x100
? __wake_up_common+0x620/0x620
? memset+0x1f/0x40
? netlink_broadcast_filtered+0x2c4/0xa70
? __ipv6_dev_mc_dec+0x49/0x2a0
__ipv6_dev_mc_dec+0x49/0x2a0
? netlink_broadcast_filtered+0x2f6/0xa70
addrconf_leave_solict.part.64+0xad/0xf0
? addrconf_join_solict.part.63+0xf0/0xf0
? nlmsg_notify+0x63/0x1b0
__ipv6_ifa_notify+0x22c/0x9c0
? inet6_fill_ifaddr+0xbe0/0xbe0
? lockdep_hardirqs_on_prepare+0x12c/0x3e0
? __local_bh_enable_ip+0xa5/0xf0
? ipv6_del_addr+0x347/0x870
ipv6_del_addr+0x3b1/0x870
? addrconf_ifdown+0xfe0/0xfe0
? rcu_read_lock_any_held.part.27+0x20/0x20
addrconf_verify_rtnl+0x8a9/0xc60
addrconf_verify_work+0xf/0x20
process_one_work+0x84c/0x1440
In order to avoid this problem, it uses rcu_read_unlock_bh() for
a short time. RCU is used for avoiding freeing
ifp(struct *inet6_ifaddr) while ifp is being used. But this will
not be released even if rcu_read_unlock_bh() is used.
Because before rcu_read_unlock_bh(), it uses in6_ifa_hold(ifp).
So this is safe.
Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data")
Suggested-by: Eric Dumazet <edumazet@google.com>
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/addrconf.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4550,7 +4550,9 @@ restart:
age >= ifp->valid_lft) {
spin_unlock(&ifp->lock);
in6_ifa_hold(ifp);
+ rcu_read_unlock_bh();
ipv6_del_addr(ifp);
+ rcu_read_lock_bh();
goto restart;
} else if (ifp->prefered_lft == INFINITY_LIFE_TIME) {
spin_unlock(&ifp->lock);
^ permalink raw reply [flat|nested] 704+ messages in thread
* Re: [PATCH 5.10 000/699] 5.10.261-rc1 review
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (698 preceding siblings ...)
2026-07-21 15:27 ` [PATCH 5.10 699/699] mld: fix suspicious RCU usage in __ipv6_dev_mc_dec() Greg Kroah-Hartman
@ 2026-07-21 16:32 ` Florian Fainelli
2026-07-21 20:16 ` Woody Suwalski
` (2 subsequent siblings)
702 siblings, 0 replies; 704+ messages in thread
From: Florian Fainelli @ 2026-07-21 16:32 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 7/21/26 08:15, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.261 release.
> There are 699 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.261-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
perf fails to build with this error:
util/event.c: In function 'machine__resolve':
util/event.c:668:32: warning: implicit declaration of function
'perf_env__get_cpu_topology'; did you mean
'perf_env__read_cpu_topology_map'? [-Wimplicit-function-declaration]
668 | topo = perf_env__get_cpu_topology(env,
(struct perf_cpu){ al->cpu });
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
| perf_env__read_cpu_topology_map
util/event.c:668:83: warning: excess elements in struct initializer
668 | topo = perf_env__get_cpu_topology(env,
(struct perf_cpu){ al->cpu });
|
^~
util/event.c:668:83: note: (near initialization for '(anonymous)')
util/event.c:668:81: error: invalid use of undefined type 'struct perf_cpu'
668 | topo = perf_env__get_cpu_topology(env,
(struct perf_cpu){ al->cpu });
|
^
make[6]: ***
[/local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/build/Makefile.build:97:
/local/users/fainelli/buildroot/output/arm/build/linux-custom/tools/perf/util/event.o]
Error 1
make[6]: *** Waiting for unfinished jobs....
which is due to commit 07511f3c23cdaf1dbb44802f026fcc476351dfe2 ("perf
tools: Use perf_env__get_cpu_topology() in machine__resolve()"), it
looks like we need to also backport those commits:
751835c57632006232bf30405cd7201dceb0b8e0 ("perf stat: Introduce
perf_env__get_cpu_topology() to guard NULL env->cpu")
6d18804b963b78dcd53851f11e9080408b3d85c2 ("perf cpumap: Give CPUs their
own type")
c760174401f605cf63314d3817069a40945f0e0b ("perf cpumap: Reduce cpu size
from int to int16_t")
--
Florian
^ permalink raw reply [flat|nested] 704+ messages in thread
* Re: [PATCH 5.10 000/699] 5.10.261-rc1 review
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (699 preceding siblings ...)
2026-07-21 16:32 ` [PATCH 5.10 000/699] 5.10.261-rc1 review Florian Fainelli
@ 2026-07-21 20:16 ` Woody Suwalski
2026-07-21 22:20 ` Brett A C Sheffield
2026-07-22 2:31 ` Dominique Martinet
702 siblings, 0 replies; 704+ messages in thread
From: Woody Suwalski @ 2026-07-21 20:16 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.261 release.
> There are 699 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.261-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
>
Compiled OK for an i386 and runs OK on a 32-bit eeepc. No new problems
noticed.
Tested-by: Woody Suwalski <terraluna977@gmail.com>
^ permalink raw reply [flat|nested] 704+ messages in thread
* Re: [PATCH 5.10 000/699] 5.10.261-rc1 review
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (700 preceding siblings ...)
2026-07-21 20:16 ` Woody Suwalski
@ 2026-07-21 22:20 ` Brett A C Sheffield
2026-07-22 2:31 ` Dominique Martinet
702 siblings, 0 replies; 704+ messages in thread
From: Brett A C Sheffield @ 2026-07-21 22:20 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 5.10.261-rc1-00700-g9067606e05eb #1 SMP Tue Jul 21 20:27:17 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 704+ messages in thread
* Re: [PATCH 5.10 000/699] 5.10.261-rc1 review
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
` (701 preceding siblings ...)
2026-07-21 22:20 ` Brett A C Sheffield
@ 2026-07-22 2:31 ` Dominique Martinet
702 siblings, 0 replies; 704+ messages in thread
From: Dominique Martinet @ 2026-07-22 2:31 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Greg Kroah-Hartman wrote on Tue, Jul 21, 2026 at 05:15:59PM +0200:
> This is the start of the stable review cycle for the 5.10.261 release.
> There are 699 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 23 Jul 2026 15:23:00 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.261-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
Tested 9067606e05eb ("Linux 5.10.261-rc1") on:
- arm i.MX6ULL (Armadillo 640)
- arm64 i.MX8MP (Armadillo G4)
- arm64 i.MX8ULP (Armadillo IoT A9E)
No obvious regression in dmesg or basic tests:
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
--
Dominique Martinet
^ permalink raw reply [flat|nested] 704+ messages in thread
end of thread, other threads:[~2026-07-22 2:32 UTC | newest]
Thread overview: 704+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-21 15:15 [PATCH 5.10 000/699] 5.10.261-rc1 review Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 001/699] nvmet-tcp: fix race between ICReq handling and queue teardown Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 002/699] nfsd: release layout stid on setlease failure Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 003/699] nfsd: reset write verifier on deferred writeback errors Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 004/699] userfaultfd: gate must_wait writability check on pte_present() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 005/699] clk: imx: Add check for kcalloc Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 006/699] nfsd: move name lookup out of nfsd4_list_rec_dir() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 007/699] nfsd: change nfs4_client_to_reclaim() to allocate data Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 008/699] mmc: renesas_sdhi: Add quirk entry for RZ/G2H SoC Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 009/699] KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 010/699] perf trace beauty fcntl: Fix build with older kernel headers Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 011/699] bus: mhi: host: Add alignment check for event ring read pointer Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 012/699] netfilter: nf_log: validate MAC header was set before dumping it Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 013/699] skmsg: convert struct sk_msg_sg::copy to a bitmap Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 014/699] net: skmsg: preserve sg.copy across SG transforms Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 015/699] apparmor: fix use-after-free in rawdata dedup loop Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 016/699] net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 017/699] apparmor: mediate the implicit connect of TCP fast open sendmsg Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 018/699] f2fs: adjust zone capacity when considering valid block count Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 019/699] f2fs: fix to round down start offset of fallocate for pin file Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 020/699] f2fs: validate orphan inode entry count Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 021/699] f2fs: bound i_inline_xattr_size for non-inline-xattr inodes Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 022/699] f2fs: fix potential deadlock in f2fs_balance_fs() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 023/699] f2fs: fix listxattr handling of corrupted xattr entries Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 024/699] NFSv4/flexfiles: reject zero filehandle version count Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 025/699] fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 026/699] i2c: core: fix irq domain leak on adapter registration failure Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 027/699] i2c: core: fix hang " Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 028/699] i2c: core: fix NULL-deref " Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 029/699] i2c: core: fix adapter debugfs creation Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 030/699] i2c: core: fix adapter registration race Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 031/699] hdlc_ppp: sync per-proto timers before freeing hdlc state Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 032/699] xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 033/699] usb: gadget: function: rndis: add length check to response query Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 034/699] usb: gadget: function: rndis: add length check for header Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 035/699] iio: accel: bmc150: clamp the device-reported FIFO frame count Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 036/699] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 037/699] iio: adc: lpc32xx: Initialize completion before requesting IRQ Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 038/699] iio: adc: ti-ads124s08: Return reset GPIO lookup errors Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 039/699] iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 040/699] iio: event: Fix event FIFO reset race Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 041/699] iio: gyro: bmg160: bail out when bandwidth/filter is not in table Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 042/699] iio: gyro: bmg160: wait full startup time after mode change at probe Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 043/699] iio: imu: bmi160: add IRQF_NO_THREAD to data-ready trigger IRQ Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 044/699] iio: imu: st_lsm6dsx: deselect shub page before reading whoami Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 045/699] iio: light: al3010: fix incorrect scale for the highest gain range Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 046/699] iio: light: gp2ap002: fix runtime PM leak on read error Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 047/699] iio: light: opt3001: fix missing state reset on timeout Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 048/699] iio: light: veml6030: fix channel type when pushing events Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 049/699] iio: magnetometer: ak8975: Add missed pm_runtime_put_autosuspend() call Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 050/699] iio: temperature: ltc2983: Fix reinit_completion() called after conversion start Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 051/699] ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 052/699] ALSA: es1938: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 053/699] ALSA: firewire: isight: bound the sample count to the packet payload Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 054/699] ALSA: usb-audio: avoid kobject path lookup in DualSense match Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 055/699] ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 056/699] ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 057/699] ALSA: usb-audio: Roll back quirk control caches on write errors Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 058/699] ALSA: usb-audio: Update Babyface Pro control caches only after successful writes Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 059/699] ALSA: usb-audio: Update US-16x08 EQ/comp shadow state " Greg Kroah-Hartman
2026-07-21 15:16 ` [PATCH 5.10 060/699] Bluetooth: btusb: fix use-after-free on registration failure Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 061/699] binder: fix UAF in binder_thread_release() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 062/699] usb: xhci: Fix sleep in atomic context in xhci_free_streams() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 063/699] PCI: altera: Do not dispose parent IRQ mapping Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 064/699] PCI: host-common: Request bus reassignment when not probe-only Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 065/699] netfilter: ipset: fix race between dump and ip_set_list resize Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 066/699] virtio-mmio: fix device release warning on module unload Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 067/699] hwrng: virtio: clamp device-reported used.len at copy_data() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 068/699] USB: chaoskey: Fix slab-use-after-free in chaoskey_release() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 069/699] 6lowpan: fix NHC entry use-after-free on error path Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 070/699] tipc: fix out-of-bounds read in broadcast Gap ACK blocks Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 071/699] media: staging: ipu3-imgu: Add range check for imgu_css_cfg_acc_stripe Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 072/699] crypto: amlogic - avoid double cleanup in meson_crypto_probe() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 073/699] net: af_key: initialize alg_key_len for IPComp states Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 074/699] audit: Fix data races of skb_queue_len() readers on audit_queue Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 075/699] debugobjects: Plug race against a concurrent OOM disable Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 076/699] gpio: eic-sprd: use raw_spinlock_t in the irq startup path Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 077/699] io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 078/699] ipv4: igmp: remove multicast group from hash table on device destruction Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 079/699] net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 080/699] mfd: cros_ec: Delay dev_set_drvdata() until probe success Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 081/699] netfilter: ebtables: module names must be null-terminated Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 082/699] netfilter: ebtables: terminate table name before find_table_lock() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 083/699] Bluetooth: bnep: pin L2CAP connection during netdev registration Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 084/699] Bluetooth: fix UAF in bt_accept_dequeue() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 085/699] Bluetooth: L2CAP: validate option length before reading conf opt value Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 086/699] net: Drop the lock in skb_may_tx_timestamp() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 087/699] sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 088/699] cpufreq: Fix hotplug-suspend race during reboot Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 089/699] cpufreq: pcc: fix use-after-free and double free in _OSC evaluation Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 090/699] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 091/699] HID: wacom: stop hardware after post-start probe failures Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 092/699] HID: lg-g15: cancel pending work on remove to fix a use-after-free Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 093/699] HID: sensor-hub: Add sensor_hub_input_attr_read_values() for multi-byte reads Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 094/699] hfs/hfsplus: zero-initialize buffer in hfs_bnode_read Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 095/699] nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 096/699] net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 097/699] usb: cdc_acm: Add quirk for Uniden BC125AT scanner Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 098/699] USB: core: add USB_QUIRK_NO_LPM for VIA Labs USB 2.0 hub Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 099/699] usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 100/699] USB: idmouse: fix use-after-free on disconnect race Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 101/699] USB: ldusb: " Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 102/699] USB: iowarrior: fix use-after-free on disconnect Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 103/699] USB: quirks: add NO_LPM for the Samsung T5 EVO Portable SSD Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 104/699] USB: legousbtower: fix use-after-free on disconnect race Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 105/699] usb: sl811-hcd: disable controller wakeup on remove Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 106/699] USB: storage: include US_FL_NO_SAME in quirks mask Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 107/699] USB: misc: uss720: unregister parport on probe failure Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 108/699] usb: mtu3: unmap request DMA on queue failure Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 109/699] USB: serial: option: add Telit Cinterion FE990D50 compositions Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 110/699] USB: serial: digi_acceleport: fix broken rx after throttle Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 111/699] USB: serial: digi_acceleport: fix hard lockup on disconnect Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 112/699] USB: ulpi: fix memory leak on registration failure Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 113/699] USB: usb-storage: ene_ub6250: restore media-ready check Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 114/699] usbip: tools: support SuperSpeedPlus devices Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 115/699] usbip: vudc: fix NULL deref in vep_dequeue() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 116/699] usb: typec: tcpm: Validate SVID index in svdm_consume_modes() Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 117/699] usb: typec: ucsi: Invert DisplayPort role assignment Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 118/699] usb: typec: ucsi: Pass full DP config payload in SET_NEW_CAM for DP alt mode Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 119/699] iio: adc: spear: Initialize completion before requesting IRQ Greg Kroah-Hartman
2026-07-21 15:17 ` [PATCH 5.10 120/699] iio: temperature: ltc2983: Fix n_wires default bypassing rotation check Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 121/699] udf: validate free block extents against the partition length Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 122/699] udf: validate VAT header length against the VAT inode size Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 123/699] udf: validate sparing table length as an entry count, not a byte count Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 124/699] dm-ioctl: report an error if a device has no table Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 125/699] partitions: aix: bound the pp_count scan to the ppe array Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 126/699] isofs: bound Rock Ridge symlink components to the SL record Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 127/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 128/699] crypto: caam - use print_hex_dump_devel to guard key hex dumps again Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 129/699] crypto: ecc - Fix carry overflow in vli multiplication Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 130/699] crypto: pcrypt - restore callback for non-parallel fallback Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 131/699] crypto: drbg - Fix returning success on failure in CTR_DRBG Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 132/699] crypto: drbg - Fix drbg_max_addtl() on 64-bit kernels Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 133/699] crypto: drbg - Fix the fips_enabled priority boost Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 134/699] crypto: talitos - use dma_sync_single_for_cpu() before reading descriptor header Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 135/699] spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 136/699] spi: fsl-lpspi: terminate the RX channel on TX prepare failure path Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 137/699] tracing: Prevent out-of-bounds read in glob matching Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 138/699] NFSv4: include MAY_WRITE in open permission mask for O_TRUNC Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 139/699] exfat: bound uniname advance in exfat_find_dir_entry() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 140/699] KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 141/699] udmabuf: fix DMA direction mismatch in release_udmabuf() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 142/699] i2c: stm32f7: truncate clock period instead of rounding it Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 143/699] Input: synaptics-rmi4 - unregister function handlers on physical driver registration failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 144/699] Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 145/699] Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 146/699] Input: elan_i2c - prevent division by zero and arithmetic underflow Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 147/699] Input: goodix - clamp the device-reported contact count Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 148/699] Input: iforce - bound the device-reported force-feedback effect index Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 149/699] Input: touchwin - reset the packet index on every complete packet Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 150/699] Input: maplemouse - fix NULL pointer dereference in open() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 151/699] Input: mms114 - fix multi-touch slot corruption Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 152/699] Input: maple_keyb - set driver data before registering input device Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 153/699] Input: maplemouse " Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 154/699] Input: maplecontrol " Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 155/699] RDMA/siw: bound Read Response placement to the RREAD length Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 156/699] fuse: fix device node leak in cuse_process_init_reply() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 157/699] fuse: re-lock request before returning from fuse_ref_folio() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 158/699] sched/fair: Only update stats for allowed CPUs when looking for dst group Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 159/699] crypto: algif_skcipher - force synchronous processing on trees without ctx->state Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 160/699] tools/mm/slabinfo: fix total_objects attribute name Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 161/699] crypto: af_alg - Remove zero-copy support from skcipher and aead Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 162/699] media: uvcvideo: Avoid partial metadata buffers Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 163/699] media: uvcvideo: Fix buffer sequence in frame gaps Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 164/699] serial: msm: Disable DMA for kernel console UART Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 165/699] serial: 8250_omap: clear rx_running on zero-length DMA completes Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 166/699] afs: Fix netns teardown to cancel the preallocation charger Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 167/699] afs: fix NULL pointer dereference in afs_get_tree() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 168/699] afs: Fix further netns teardown to cancel the preallocation charger Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 169/699] drm/tidss: Drop extra drm_mode_config_reset() call Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 170/699] drm/radeon: fix memory leak in radeon_ring_restore() on lock failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 171/699] driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 172/699] wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 173/699] kconfig: fix potential NULL pointer dereference in conf_askvalue Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 174/699] wifi: ath9k: fix OOB access from firmware tx status queue ID Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 175/699] ARM: dts: am335x-sl50: Fix audio bitclock and frame master endpoint Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 176/699] watchdog: sprd_wdt: Remove redundant sprd_wdt_disable() on register failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 177/699] media: cedrus: Fix failure to clean up hardware on probe failure Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 178/699] pinctrl: sunxi: fix regulator leak in sunxi_pmx_request() error path Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 179/699] crypto: atmel-sha204a - fix blocking and non-blocking rng logic Greg Kroah-Hartman
2026-07-21 15:18 ` [PATCH 5.10 180/699] crypto: ecrdsa - fix unknown OID check in ecrdsa_param_curve Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 181/699] crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 182/699] iommu/amd: Fix a stale comment about which legacy mode is user visible Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 183/699] clk: scmi: Fix clock rate rounding Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 184/699] thermal: hwmon: Fix critical temperature attribute removal Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 185/699] net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 186/699] crypto: ccp - Treat zero-length cert chain as query for blob lengths Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 187/699] net/sched: sch_htb: annotate data-races (I) Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 188/699] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 189/699] RDMA/hns: Fix arithmetic overflow in calc_hem_config() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 190/699] RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 191/699] RDMA/srpt: fix integer overflow in immediate data length check Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 192/699] media: atomisp: Fix memory leak in atomisp_fixed_pattern_table() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 193/699] sysfs: clamp show() return value in sysfs_kf_read() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 194/699] net/sched: sch_drr: annotate data-races around cl->deficit Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 195/699] media: rockchip: rga: fix too small buffer size Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 196/699] device property: fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 197/699] cpufreq: Documentation: fix sampling_down_factor range Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 198/699] cpufreq: conservative: Simplify frequency limit handling Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 199/699] pwm: imx27: Fix variable truncation in .apply() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 200/699] bus: sunxi-rsb: Always check register address validity Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 201/699] IB/mlx4: Fix refcount leak in add_port() error path Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 202/699] RDMA/hns: Fix warning in poll cq direct mode Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 203/699] PM: sleep: Use complete() in device_pm_sleep_init() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 204/699] MIPS: Fix big-endian stack argument fetching in o32 wrapper Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 205/699] MIPS: DEC: Remove do_IRQ() call indirection Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 206/699] mtd: spi-nor: Drop duplicate Kconfig dependency Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 207/699] nvme-multipath: fix flex array size in struct nvme_ns_head Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 208/699] workqueue: drop spurious * from print_worker_info() fn declaration Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 209/699] ipv6: guard against possible NULL deref in __in6_dev_stats_get() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 210/699] net/sched: cls_bpf: prevent unbounded recursion in offload rollback Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 211/699] drm/tegra: dc: Fix device node reference leak in tegra_dc_has_output() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 212/699] rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 213/699] ocfs2: dont BUG_ON an invalid journal dinode Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 214/699] ocfs2: kill osb->system_file_mutex lock Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 215/699] drm/msm/dp: fix HPD state status bit shift value Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 216/699] drm/msm/dp: Fix the ISR_* enum values Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 217/699] media: qcom: venus: drop extra padding in NV12 raw size calculation Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 218/699] ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 219/699] ARM: imx3: Fix CCM node reference leak Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 220/699] ARM: imx31: Fix IIM mapping leak in revision check Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 221/699] scsi: Revert "scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans" Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 222/699] scsi: pm8001: Fix error code in non_fatal_log_show() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 223/699] mm/fake-numa: fix under-allocation detection in uniform split Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 224/699] lib/test_meminit: use && for bools Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 225/699] bpftool: Use libbpf error code for flow dissector query Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 226/699] perf/x86/amd/core: Always use the NMI latency mitigation Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 227/699] ocfs2: rebase copied fsdlm LVB pointers in locking_state Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 228/699] ocfs2: fix buffer head management in ocfs2_read_blocks() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 229/699] ocfs2: reject FITRIM ranges shorter than a cluster Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 230/699] ocfs2/dlm: require a ref for locking_state debugfs open Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 231/699] ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release() Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 232/699] netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 233/699] netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 234/699] netfilter: conntrack: call nf_ct_gre_keymap_destroy() if master helper is pptp Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 235/699] bpf: Update transport_header when encapsulating UDP tunnel in lwt Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 236/699] wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 237/699] riscv: stacktrace: Remove bogus -0x4 offset in non-FP walk_stackframe Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 238/699] ACPI: IPMI: Fix message kref handling on dead device Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 239/699] cpufreq: Documentation: fix conservative governor freq_step description Greg Kroah-Hartman
2026-07-21 15:19 ` [PATCH 5.10 240/699] spi: ep93xx: fix double-free of zeropage on DMA setup failure Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 241/699] firmware_loader: Fix recursive lock in device_cache_fw_images() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 242/699] configfs: fix lockless traversals of ->s_children Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 243/699] pinctrl: mediatek: mt8516: Fix Schmitt trigger register offset of pins 34-39 Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 244/699] pinctrl: mediatek: mt8167: " Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 245/699] hwspinlock: qcom: avoid uninitialized struct members Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 246/699] btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 247/699] fbdev: sm501fb: Fix buffer errors in OF binding code Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 248/699] IB/mlx4: Fill in the access_flags if IB_MR_REREG_ACCESS is not specified Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 249/699] vhost/vdpa: validate virtqueue index in mmap and fault paths Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 250/699] tools/virtio: check mmap return value in vringh_test Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 251/699] bonding: 3ad: fix mux port state on oper down Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 252/699] fs: efs: remove unneeded debug prints Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 253/699] RDMA/mlx5: Fix undefined shift of user RQ WQE size Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 254/699] ASoC: fsl: fsl_audmix: Validate written enum values Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 255/699] ASoC: tegra: tegra210_ahub: Validate written enum value Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 256/699] net: fib_rules: Dont dump dying fib_rule in fib_rules_dump() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 257/699] sctp: validate embedded address parameter length Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 258/699] net/sched: sch_hfsc: Dont make class passive twice Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 259/699] tipc: require net admin for TIPCv2 netlink mutators Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 260/699] tipc: prevent snt_unacked underflow on CONN_ACK Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 261/699] crypto: marvell/octeontx - fix DMA cleanup using wrong loop index Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 262/699] crypto: cavium/cpt " Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 263/699] crypto: rng - Free default RNG on module exit Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 264/699] spi: xilinx: use FIFO occupancy register to determine buffer size Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 265/699] net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 266/699] net/sched: sch_codel: " Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 267/699] kcm: use WRITE_ONCE() when changing lower socket callbacks Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 268/699] netfilter: nf_conncount: callers must hold rcu read lock Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 269/699] bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 270/699] bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 271/699] MIPS: mm: Fix out-of-bounds write in maar_res_walk() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 272/699] powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 273/699] powerpc/powernv: fix preempt count leak in pnv_kexec_wait_secondaries_down Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 274/699] powerpc/kexec: fix double get_cpu() imbalance in kexec_prepare_cpus Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 275/699] KEYS: Use acquire when reading state in keyring search Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 276/699] tipc: fix UAF in tipc_l2_send_msg() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 277/699] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 278/699] ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 279/699] net/9p: fix race condition on rdma->state in trans_rdma.c Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 280/699] staging: nvec: fix use-after-free in nvec_rx_completed() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 281/699] coresight: cti: Fix DT filter signals silently ignored Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 282/699] x86/platform/olpc: xo15: Drop wakeup source on driver removal Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 283/699] platform/x86: xo15-ebook: Fix wakeup source and GPE handling Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 284/699] perf sched: Add missing mmap2 handler in timehist Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 285/699] staging: most: video: avoid double free on video register failure Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 286/699] usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 287/699] usb: host: max3421: Reject hub port requests for non-existent ports Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 288/699] char: tlclk: fix use-after-free in tlclk_cleanup() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 289/699] iio: light: si1133: reset counter to prevent race condition Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 290/699] iio: light: si1133: prevent race condition on timeout Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 291/699] iio: magnetometer: ak8975: fix potential kernel stack memory leak Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 292/699] iio: accel: mma8452: handle I2C read error(s) in mma8452_read() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 293/699] HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 294/699] perf: Fix off-by-one stack buffer overflow in kallsyms__parse() Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 295/699] perf sched: Clean up idle_threads entry on init failure Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 296/699] perf sched: Replace BUG_ON and add NULL checks in replay event helpers Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 297/699] perf mmap: Fix NULL deref in aio cleanup on alloc failure Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 298/699] perf c2c: Fix use-after-free in he__get_c2c_hists() error path Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 299/699] dmaengine: Fix possible use after free Greg Kroah-Hartman
2026-07-21 15:20 ` [PATCH 5.10 300/699] clk: qcom: a53: Corrected frequency multiplier for 1152MHz Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 301/699] pNFS/filelayout: fix cheking if a layout is striped Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 302/699] NFSv4/pnfs: defer return_range callbacks until after inode unlock Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 303/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS on fatal DS connect errors Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 304/699] NFSv4/flexfiles: honor FF_FLAGS_NO_IO_THRU_MDS in pg_get_mirror_count_write Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 305/699] PCI: mediatek: Fix operator precedence in PCIE_FTS_NUM_L0 macro Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 306/699] perf tools: Fix get_max_num() size_t underflow on empty sysfs file Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 307/699] perf tools: Use perf_env__get_cpu_topology() in machine__resolve() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 308/699] PCI: rcar-host: Remove unused LIST_HEAD(res) Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 309/699] perf sched: Fix idle-hist callchain display using wrong rb_first variant Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 310/699] perf bpf: Use scnprintf() in snprintf_hex() and synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 311/699] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 312/699] perf pmu: Fix perf_pmu__parse_scale/unit() OOB access on empty sysfs file Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 313/699] tools lib api: Fix missing null termination in filename__read_int/ull() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 314/699] perf symbols: Fix signed overflow in sysfs__read_build_id() size check Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 315/699] perf symbols: Bounds-check .gnu_debuglink section data Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 316/699] perf tools: Fix thread__set_comm_from_proc() on empty comm file Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 317/699] perf symbols: Bounds-check descsz in sysfs__read_build_id() GNU fallback Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 318/699] tools lib api: Fix filename__write_int() writing uninitialized stack data Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 319/699] tools lib api: Fix mount_overload() snprintf truncation and toupper range Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 320/699] perf bpf: Add NULL check for btf__type_by_id() in synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 321/699] perf symbols: Add bounds checks to elf_read_build_id() note iteration Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 322/699] perf symbols: Add bounds checks to read_build_id() note iteration in minimal build Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 323/699] PCI: mediatek: Fix possible truncation in mtk_pcie_parse_port() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 324/699] PCI: mediatek: Use actual physical address instead of virt_to_phys() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 325/699] apparmor: check label build before no_new_privs test Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 326/699] apparmor: aa_label_alloc use aa_label_free on alloc failure Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 327/699] apparmor: grab ns lock and refresh when looking up changehat child profiles Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 328/699] apparmor: fix potential UAF in aa_replace_profiles Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 329/699] apparmor: aa_getprocattr free procattr leak on format failure Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 330/699] apparmor: put secmark label after secid lookup Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 331/699] i3c: master: Prevent reuse of dynamic address on device add failure Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 332/699] apparmor: fix label can not be immediately before a declaration Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 333/699] sparc: led: avoid trimming a newline from empty writes Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 334/699] perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 335/699] perf tools: Use snprintf() for root_dir path construction Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 336/699] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 337/699] xfrm: validate selector family and prefixlen during match Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 338/699] perf machine: Use snprintf() for guestmount path construction Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 339/699] octeontx2-pf: Fix leak of SQ timestamp buffer on teardown Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 340/699] net: psample: fix info leak in PSAMPLE_ATTR_DATA Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 341/699] sctp: hold socket lock when dumping endpoints in sctp_diag Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 342/699] arm64/hw_breakpoint: reject unaligned watchpoints that would truncate BAS Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 343/699] thermal: intel: Fix dangling resources on thermal_throttle_online() failure Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 344/699] ACPI: resource: Amend kernel-doc style Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 345/699] ieee802154: Remove WARN_ON() in cfg802154_pernet_exit() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 346/699] ieee802154: fix kernel-infoleak in dgram_recvmsg() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 347/699] netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 348/699] netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 349/699] irqchip/crossbar: Fix parent domain resource leak Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 350/699] selftests/mm: clarify alternate unmapping in compaction_test Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 351/699] selftests/mm: allow PUD-level entries in compound testcase of hmm tests Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 352/699] rtc: abx80x: fix the RTC_VL_CLR clearing all status flags Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 353/699] rtc: ds1307: handle oscillator stop flag for ds1337/ds1339/ds3231 Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 354/699] bpf: Fix stack slot index in nospec checks Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 355/699] drm/edid: fix OOB read in drm_parse_tiled_block() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 356/699] ipv6: Fix null-ptr-deref in fib6_nh_mtu_change() Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 357/699] ipv4: fib: Dont ignore error route in local/main tables Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 358/699] netfilter: nf_conncount: prevent connlimit drops for early confirmed ct Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 359/699] netfilter: nft_synproxy: stop bypassing the priv->info snapshot Greg Kroah-Hartman
2026-07-21 15:21 ` [PATCH 5.10 360/699] alpha/PCI: Add security_locked_down() check to pci_mmap_resource() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 361/699] alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 362/699] net: dsa: sja1105: round up PTP perout pin duration Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 363/699] ipv6: fix error handling in disable_ipv6 sysctl Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 364/699] ipv6: fix error handling in ignore_routes_with_linkdown sysctl Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 365/699] ipv6: fix error handling in forwarding sysctl Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 366/699] ipv6: fix error handling in disable_policy sysctl Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 367/699] smb/client: preserve errors from smb2_set_sparse() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 368/699] rtc: ds1307: Fix off-by-one issue with wday for rx8130 Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 369/699] rtc: cmos: unregister HPET IRQ handler on probe failure Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 370/699] net: mvneta: re-enable percpu interrupt on resume Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 371/699] net: sungem: fix probe error cleanup Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 372/699] tracing: probes: fix typo in a log message Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 373/699] spi: sh-msiof: abort transfers when reset times out Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 374/699] gpio: mvebu: fail probe if gpiochip registration fails Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 375/699] gpio: htc-egpio: use managed gpiochip registration Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 376/699] seg6: validate SRH length before reading fixed fields Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 377/699] hwmon: adm1275: Prevent reading uninitialized stack Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 378/699] usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 379/699] tracing/events: Fix to check the simple_tsk_fn creation Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 380/699] virtio_net: disable cb when NAPI is busy-polled Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 381/699] cxgb4: Fix decode strings dump for T6 adapters Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 382/699] gpio: timberdale: Return -ENOMEM on dynamic memory allocation in probe Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 383/699] net/sched: hhf: clear heavy-hitter state on reset Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 384/699] afs: Fix error code in afs_extract_vl_addrs() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 385/699] afs: Fix callback service message parsers to pass through -EAGAIN Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 386/699] afs: Fix vllist leak Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 387/699] afs: Fix unchecked-length string display in debug statement Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 388/699] ata: sata_gemini: unwind clocks on IDE pinctrl errors Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 389/699] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 390/699] HID: core: Fix OOB read in hid_get_report for numbered reports Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 391/699] net: usb: net1080: validate packet_len before pad-byte access in rx_fixup Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 392/699] gue: validate REMCSUM private option length Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 393/699] netfilter: xt_u32: reject invalid shift counts Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 394/699] netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 395/699] netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 396/699] qede: fix off-by-one in BD ring consumption on build_skb failure Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 397/699] net: qualcomm: rmnet: simplify some byte order logic Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 398/699] net: qualcomm: rmnet: kill RMNET_MAP_GET_*() accessor macros Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 399/699] net: qualcomm: rmnet: use masks instead of C bit-fields Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 400/699] net: qualcomm: rmnet: dont use C bit-fields in rmnet checksum header Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 401/699] net: ethernet: rmnet: Support for ingress MAPv5 checksum offload Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 402/699] net: qualcomm: rmnet: add tx packets aggregation Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 403/699] net: qualcomm: rmnet: validate MAP frame length before ingress parsing Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 404/699] net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 405/699] Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 406/699] Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 407/699] ring-buffer: Fix event length with forced 8-byte alignment Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 408/699] net: usb: lan78xx: disable VLAN filter in promiscuous mode Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 409/699] net/sched: cake: reject overhead values that underflow length Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 410/699] mld: convert from timer to delayed work Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 411/699] mld: get rid of inet6_dev->mc_lock Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 412/699] mld: convert ipv6_mc_socklist->sflist to RCU Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 413/699] mld: convert ip6_sf_list " Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 414/699] mld: convert ifmcaddr6 " Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 415/699] mld: add new workqueues for process mld events Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 416/699] mld: add mc_lock for protecting per-interface mld data Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 417/699] ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report() Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 418/699] ipv6: mcast: Replace locking comments with lockdep annotations Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 419/699] ipv6: mcast: Fix potential UAF in MLD delayed work Greg Kroah-Hartman
2026-07-21 15:22 ` [PATCH 5.10 420/699] ipvs: pass parsed transport offset to state handlers Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 421/699] ipvs: use parsed transport offset in TCP state lookup Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 422/699] ipvs: fix PMTU for GUE/GRE tunnel ICMP errors Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 423/699] ipvs: ensure inner headers in ICMP errors are in headroom Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 424/699] dm era: fix NULL pointer dereference in metadata_open() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 425/699] regulator: core: Make regulator_lock_two() logic easier to follow Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 426/699] regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 427/699] net/mlx5: Fix L3 tunnel entropy refcount leak Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 428/699] smb: client: fix overflow in passthrough ioctl bounds check Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 429/699] mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 430/699] net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 431/699] net: atm: reject out-of-range traffic classes in QoS validation Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 432/699] net: ife: require ETH_HLEN to be pullable in ife_decode() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 433/699] arm64: dts: qcom: sdm630: describe adsp_mem region properly Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 434/699] KVM: arm64: vgic: Check the interrupt is still ours before migrating it Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 435/699] fbdev: sm712: Fix operator precedence in big_swap macro Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 436/699] fbdev: radeon: fix potential memory leak in radeonfb_pci_register() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 437/699] fbdev: i740fb: fix potential memory leak in i740fb_probe() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 438/699] fbdev: s3fb: fix potential memory leak in s3_pci_probe() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 439/699] fbdev: uvesafb: fix potential memory leak in uvesafb_probe() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 440/699] fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 441/699] fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 442/699] fbdev: nvidia: fix potential memory leak in nvidiafb_probe() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 443/699] fbdev: tridentfb: fix potential memory leak in trident_pci_probe() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 444/699] netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 445/699] netfilter: nfnl_cthelper: apply per-class values when updating policies Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 446/699] netfilter: xt_cluster: reject template conntracks in hash match Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 447/699] netfilter: nf_nat_sip: reload possible stale data pointer Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 448/699] netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 449/699] netfilter: nf_conncount: fix zone comparison in tuple dedup Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 450/699] netfilter: xt_nat: reject unsupported target families Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 451/699] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 452/699] gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 453/699] soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 454/699] soc: fsl: qe: panic on ioremap() failure in qe_reset() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 455/699] leds: uleds: Fix potential buffer overread Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 456/699] mfd: sm501: Fix reference leak on failed device registration Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 457/699] x86/boot: Validate console=uart8250 baud rate to fix early boot hang Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 458/699] x86/boot: Reject too long acpi_rsdp= values Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 459/699] batman-adv: gw: acquire ethernet header only after skb realloc Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 460/699] batman-adv: access unicast_ttvn skb->data " Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 461/699] batman-adv: dat: acquire ARP hw source " Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 462/699] batman-adv: bla: reacquire gw address " Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 463/699] batman-adv: dat: ensure accessible eth_hdr proto field Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 464/699] batman-adv: dat: fix tie-break for candidate selection Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 465/699] batman-adv: tt: avoid request storms during pending request Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 466/699] batman-adv: fix VLAN priority offset Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 467/699] batman-adv: frag: free unfragmentable packet Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 468/699] batman-adv: frag: fix primary_if leak on failed linearization Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 469/699] batman-adv: tt: prevent TVLV OOB check overflow Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 470/699] mfd: tps6586x: Fix OF node refcount Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 471/699] nvdimm/btt: Free arenas on btt_init() error paths Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 472/699] nvdimm/btt: Free arena sub-allocations on discover_arenas() error path Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 473/699] lockd: Plug nlm_file leak when nlm_do_fopen() fails Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 474/699] lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 475/699] MIPS: ip22-gio: fix gio device memory leak Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 476/699] MIPS: ip22-gio: fix kfree() of static object Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 477/699] MIPS: ip22-gio: fix device reference leak in probe Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 478/699] MIPS: DEC: Ensure 32-bit stack location for o32 prom_printf() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 479/699] power: supply: charger-manager: fix refcount leak in is_full_charged() Greg Kroah-Hartman
2026-07-21 15:23 ` [PATCH 5.10 480/699] proc: only bump parent nlink when registering directories Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 481/699] mtd: slram: remove failed entries from the device list Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 482/699] scsi: smartpqi: Use shost_to_hba() in pqi_scan_finished() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 483/699] ocfs2: use kzalloc for quota recovery bitmap allocation Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 484/699] mtd: rawnand: fix condition in nand_select_target() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 485/699] ocfs2: avoid moving extents to occupied clusters Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 486/699] ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 487/699] ocfs2: reject dinodes with non-canonical i_mode type Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 488/699] ocfs2: reject dinodes whose i_rdev disagrees with the file type Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 489/699] ocfs2: reject non-inline dinodes with i_size and zero i_clusters Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 490/699] mtd: maps: vmu-flash: fix NULL pointer dereference in initialization Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 491/699] irqchip/crossbar: Use correct index in crossbar_domain_free() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 492/699] i2c: mediatek: fix WRRD for SoCs without auto_restart option Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 493/699] i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 494/699] xen/gntdev: fix error handling in ioctl Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 495/699] xfrm: use compat translator only for u64 alignment mismatch Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 496/699] xfrm: xfrm_interface: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 497/699] tpm: fix event_size output in tpm1_binary_bios_measurements_show Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 498/699] tpm: Make the TPM character devices non-seekable Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 499/699] time: Fix off-by-one in compat settimeofday() usec validation Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 500/699] spi: uniphier: Fix completion initialization order before devm_request_irq() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 501/699] sctp: validate STALE_COOKIE cause length before reading staleness Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 502/699] nvmet-rdma: handle inline data with a nonzero offset Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 503/699] can: isotp: use unconditional synchronize_rcu() in isotp_release() Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 504/699] can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 505/699] can: bcm: add missing rcu list annotations and operations Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 506/699] dm thin metadata: fix superblock refcount leak on snapshot shadow failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 507/699] dm thin metadata: fix metadata snapshot consistency on commit failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 508/699] dm era: fix out-of-bounds memory access for non-zero start sector Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 509/699] dm-bufio: fix wrong count calculation in dm_bufio_issue_discard Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 510/699] dm-log: fix a bitset_size overflow on 32bit machines Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 511/699] dm-stats: fix dm_jiffies_to_msec64 Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 512/699] dm-stats: fix merge accounting Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 513/699] dm_early_create: fix freeing used table on dm_resume failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 514/699] dm-verity: increase sprintf buffer size Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 515/699] scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 516/699] scsi: sg: Report request-table problems when any status is set Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 517/699] scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 518/699] Input: ims-pcu - fix use-after-free and double-free in disconnect Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 519/699] Input: ims-pcu - release data interface on disconnect Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 520/699] Input: ims-pcu - validate control endpoint type Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 521/699] Input: ims-pcu - add response length checks Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 522/699] Input: ims-pcu - fix DMA mapping violation in line setup Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 523/699] Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 524/699] Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 525/699] Input: ims-pcu - fix type confusion " Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 526/699] cpu: hotplug: Preserve per instance callback errors Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 527/699] gpios: palmas: add .get_direction() op Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 528/699] net: sit: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 529/699] net: ena: clean up XDP TX queues when regular TX setup fails Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 530/699] net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 531/699] net: ip_vti: " Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 532/699] net: ip6_gre: " Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 533/699] ieee802154: admin-gate legacy LLSEC dump operations Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 534/699] ieee802154: allow legacy LLSEC ADD/DEL ops to pass strict validation Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 535/699] ieee802154: ca8210: fix cas_ctl leak on spi_async failure Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 536/699] ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 537/699] nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 538/699] batman-adv: retrieve ethhdr after potential skb realloc on RX Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 539/699] batman-adv: ensure minimal ethernet header on TX Greg Kroah-Hartman
2026-07-21 15:24 ` [PATCH 5.10 540/699] rtmutex: Use waiter::task instead of current in remove_waiter() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 541/699] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 542/699] bnx2x: fix potential memory leak in bnx2x_alloc_mem_bp() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 543/699] hwmon: (w83627hf) remove VID sysfs files on error and remove Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 544/699] hwmon: (w83793) remove vrm sysfs file on probe failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 545/699] net: liquidio: fix BAR resource leak on PF number failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 546/699] fsl/fman: Free init resources on KeyGen failure in fman_init() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 547/699] net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 548/699] tracing/probes: Fix double addition of offset for @+FOFFSET Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 549/699] orangefs: keep the readdir entry size 64-bit in fill_from_part() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 550/699] ata: pata_pxa: Fix DMA channel leak on probe error Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 551/699] hwmon: (asus_atk0110) Check package count before accessing element Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 552/699] s390/monwriter: Reject buffer reuse with different data length Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 553/699] mac802154: remove interfaces with RCU list deletion Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 554/699] llc: fix SAP refcount leak in llc_ui_autobind() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 555/699] ipvs: use parsed transport offset in SCTP state lookup Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 556/699] ipvs: reset full ip_vs_seq structs in ip_vs_conn_new Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 557/699] drbd: reject data replies with an out-of-range payload size Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 558/699] cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 559/699] wifi: rt2x00: avoid full teardown before work setup in probe Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 560/699] wifi: mac80211: fix memory leak in ieee80211_register_hw() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 561/699] regulator: ltc3676: Fix incorrect IRQSTAT bit offsets Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 562/699] Bluetooth: btrtl: validate firmware patch bounds Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 563/699] llc: fix SAP refcount leak when creating incoming sockets Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 564/699] macsec: fix promiscuity refcount leak in macsec_dev_open() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 565/699] memstick: ms_block: reject a card that reports too many blocks Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 566/699] ipvs: fix more places with wrong ipv6 transport offsets Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 567/699] reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 568/699] reset: sunxi: fix memory region leak on ioremap failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 569/699] powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 570/699] wifi: mac80211: free ack status frame on TX header build failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 571/699] wifi: mwifiex: fix permanently busy scans after multiple roam iterations Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 572/699] mtd: onenand: samsung: report DMA completion timeouts Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 573/699] mmc: vub300: defer reset until cmd_mutex is unlocked Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 574/699] mtd: rawnand: fsl_ifc: return errors for failed page reads Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 575/699] mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 576/699] mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 577/699] crypto: amcc - fix incorrect kernel-doc comment syntax in files Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 578/699] crypto: crypto4xx - Remove ahash-related code Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 579/699] crypto: crypto4xx - Remove insecure and unused rng_alg Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 580/699] batman-adv: clean untagged VLAN on netdev registration failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 581/699] ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 582/699] iio: imu: adis: add IRQF_NO_THREAD to non-FIFO trigger IRQ Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 583/699] iio: hid-sensor-rotation: Fix stale or zero output when reading raw values Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 584/699] iio: imu: inv_icm42600: make timestamp module chip independent Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 585/699] iio: move inv_icm42600 timestamp module in common Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 586/699] iio: make invensense timestamp module generic Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 587/699] iio: imu: inv_mpu6050: use the common inv_sensors timestamp module Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 588/699] iio: invensense: remove redundant initialization of variable period Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 589/699] iio: invensense: fix timestamp glitches when switching frequency Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 590/699] iio: imu: inv_icm42600: stabilized timestamp in interrupt Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 591/699] iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 592/699] bitops: make BYTES_TO_BITS() treewide-available Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 593/699] iio: common: st_sensors: honour channel endianness in read_axis_data Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 594/699] ALSA: aoa: check snd_ctl_new1() return value Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 595/699] Bluetooth: btintel: Fix offset calculation boot address parameter Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 596/699] Bluetooth: btintel: Check firmware version before download Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 597/699] Bluetooth: btusb: fix use-after-free on marvell probe failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 598/699] Bluetooth: btusb: fix wakeup source leak on " Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 599/699] vfio/pci: Release the VGA arbiter client on register_device() failure Greg Kroah-Hartman
2026-07-21 15:25 ` [PATCH 5.10 600/699] binder: fix UAF in binder_free_transaction() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 601/699] PCI: altera: Fix resource leaks on probe failure Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 602/699] media: atomisp: replace boolean comparison of values with bool variables Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 603/699] media: staging: media: atomisp: Fix sh_css.c brace coding style issues Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 604/699] media: staging: media: atomisp: Fix the rest of sh_css.c brace issues Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 605/699] media: staging: media: atomisp: Replace if else clause with a ternary Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 606/699] media: staging: media: atomisp: Fix alignment and line length issues Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 607/699] staging: media: atomisp: reduce load_primary_binaries() stack usage Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 608/699] cifs: Create a new shared file holding smb2 pdu definitions Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 609/699] cifs: remove check of list iterator against head past the loop body Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 610/699] smb2: small refactor in smb2_check_message() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 611/699] cifs: remove unused server parameter from calc_smb_size() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 612/699] smb: client: restrict implied bcc[0] exemption to responses without data area Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 613/699] PCI: imx6: Fix IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 614/699] staging: rtl8723bs: split too long line Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 615/699] staging: rtl8723bs: remove commented out RT_ASSERT occurrences Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 616/699] staging: rtl8723bs: remove all 5Ghz network types Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 617/699] staging: rtl8723bs: remove 5Ghz code related to channel plan definition Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 618/699] staging: rtl8723bs: remove 5Ghz code blocks Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 619/699] staging: rtl8723bs: remove commented out condition Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 620/699] staging: rtl8723bs: clean up comparsions to NULL Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 621/699] staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 622/699] staging: rtl8723bs: Fix space issues Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 623/699] staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 624/699] staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 625/699] PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 626/699] PCI: mediatek: Convert bool to single quirks entry and bitmap Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 627/699] PCI: mediatek: Fix IRQ domain leak when port fails to enable Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 628/699] staging: rtl8723bs: remove DBG_871X log argument Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 629/699] crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 630/699] PCI: Prevent resource tree corruption when BAR resize fails Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 631/699] PCI: Free saved list without holding pci_bus_sem Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 632/699] PCI: Fix restoring BARs on BAR resize rollback path Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 633/699] PCI: Add kerneldoc for pci_resize_resource() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 634/699] PCI: Move Resizable BAR code to rebar.c Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 635/699] PCI: Skip Resizable BAR restore on read error Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 636/699] coresight: etb10: restore atomic_t for shared reading state Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 637/699] netfilter: ebtables: Use vmalloc_array() to improve code Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 638/699] netfilter: ebtables: zero chainstack array Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 639/699] Bluetooth: L2CAP: Fix not tracking outstanding TX ident Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 640/699] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 641/699] Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 642/699] smb: client: Fix next buffer leak in receive_encrypted_standard() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 643/699] smb: client: mask server-provided mode to 07777 in modefromsid Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 644/699] smb: client: use unaligned reads in parse_posix_ctxt() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 645/699] smb: client: harden POSIX SID length parsing Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 646/699] writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 647/699] X.509: Fix validation of ASN.1 certificate header Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 648/699] proc: use generic setattr() for /proc/$PID/net Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 649/699] proc: rename proc_setattr to proc_nochmod_setattr Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 650/699] proc: protect ptrace_may_access() with exec_update_lock (FD links) Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 651/699] HID: add haptics page defines Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 652/699] HID: multitouch: fix out-of-bounds bit access on mt_io_flags Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 653/699] cpufreq: intel_pstate: Sync policy->cur during CPU offline Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 654/699] proc: protect ptrace_may_access() with exec_update_lock (part 1) Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 655/699] HID: appleir: fix UAF on pending key_up_timer in remove() Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 656/699] serial: 8250_mid: Remove 8250_pci usage Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 657/699] serial: 8250_mid: Disable DMA for selected platforms Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 658/699] xfs: reflect sb features in xfs_mount Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 659/699] xfs: fix unreachable BIGTIME check in dquot flush validation Greg Kroah-Hartman
2026-07-21 15:26 ` [PATCH 5.10 660/699] xfs: use null daddr for unset first bad log block Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 661/699] hfs/hfsplus: prevent getting negative values of offset/length Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 662/699] hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 663/699] usb: gadget: function: Simplify diagnostic messaging in printer Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 664/699] usb: gadget: f_printer: take kref only for successful open Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 665/699] usb: free iso schedules on failed submit Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 666/699] usb: iowarrior: remove inherent race with minor number Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 667/699] USB: serial: digi_acceleport: fix write buffer corruption Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 668/699] drm/i2c/sil164: Drop no-op remove function Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 669/699] leds: lm3697: Remove duplicated error reporting in .remove() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 670/699] leds: lm3601x: Improve error reporting for problems during .remove() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 671/699] gpio: pca953x: Make platform teardown callback return void Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 672/699] usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 673/699] usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 674/699] usb: typec: tcpm: Fix VDM type for Enter Mode commands Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 675/699] usb: gadget: f_fs: initialize reset_work at allocation time Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 676/699] crypto: atmel-sha204a - Mark OF related data as maybe unused Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 677/699] crypto: atmel - Drop explicit initialization of struct i2c_device_id::driver_data to 0 Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 678/699] crypto: atmel-sha204a - drop hwrng quality reduction for ATSHA204A Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 679/699] usb: gadget: f_fs: Tie read_buffer lifetime to ffs_epfile Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 680/699] btrfs: do not trim a device which is not writeable Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 681/699] crypto: qat - fix restarting state leak on allocation failure Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 682/699] crypto: qat - validate RSA CRT component lengths Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 683/699] audit: add audit_log_nf_skb helper function Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 684/699] audit: fix potential integer overflow in audit_log_n_hex() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 685/699] posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 686/699] KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 687/699] Bluetooth: L2CAP: Fix regressions caused by reusing ident Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 688/699] iio: imu: inv_mpu6050: fix frequency setting when chip is off Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 689/699] iio: invensense: fix odr switching to same value Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 690/699] iio: imu: inv_icm42600: fix timestamp clock period by using lower value Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 691/699] mld: change lockdep annotation for ip6_sf_socklist and ipv6_mc_socklist Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 692/699] ipv6: mcast: Delay put pmc->idev in mld_del_delrec() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 693/699] net: ethernet: rmnet: Always subtract MAP header Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 694/699] ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 695/699] ipv6: fix lockdep splat in in6_dump_addrs() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 696/699] net: mld: fix reference count leak in mld_{query | report}_work() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 697/699] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 698/699] ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() Greg Kroah-Hartman
2026-07-21 15:27 ` [PATCH 5.10 699/699] mld: fix suspicious RCU usage in __ipv6_dev_mc_dec() Greg Kroah-Hartman
2026-07-21 16:32 ` [PATCH 5.10 000/699] 5.10.261-rc1 review Florian Fainelli
2026-07-21 20:16 ` Woody Suwalski
2026-07-21 22:20 ` Brett A C Sheffield
2026-07-22 2:31 ` Dominique Martinet
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.