* [PATCH 5.15 000/935] 5.15.221-rc1 review
@ 2026-09-12 6:50 Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 001/935] ALSA: aloop: Fix racy access at PCM trigger Greg Kroah-Hartman
` (937 more replies)
0 siblings, 938 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 5.15.221 release.
There are 935 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 14 Sep 2026 06:54:17 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.221-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.15.221-rc1
Bjorn Andersson <bjorn.andersson@linaro.org>
clk: qcom: gdsc: Bump parent usage count when GDSC is found enabled
Xixin Liu <liuxixin@kylinos.cn>
nvmet-rdma: fix queue leak when connect backlog is exceeded
Catalin Marinas <catalin.marinas@arm.com>
kselftest/arm64: mte: Use the correct naming for tag check modes in check_hugetlb_options.c
Catalin Marinas <catalin.marinas@arm.com>
kselftest/arm64: mte: Skip the hugetlb tests if MTE not supported on such mappings
Zhang Chen <zhangchen01@kylinos.cn>
Bluetooth: L2CAP: Fix send LE flow credits in ACL link
Takashi Iwai <tiwai@suse.de>
ALSA: control: Fix unannotated kfree() cleanup
Dan Carpenter <dan.carpenter@linaro.org>
HID: fix an error code in hid_check_device_match()
Leon Romanovsky <leon@kernel.org>
RDMA/nldev: Check stat attribute before accessing it
Abel Vesa <abel.vesa@linaro.org>
clk: qcom: Drop mmcx gdsc supply for dispcc and videocc
Wentao Liang <vulab@iscas.ac.cn>
nvme: target: rdma: fix ndev refcount leak on queue connect
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_htb: limit htb_classify inner-class filter hops
Jiayuan Chen <jiayuan.chen@linux.dev>
tcp: fix corruption of urgent data on multi-segment retransmit
Deepanshu Kartikey <kartikey406@gmail.com>
usb: atm: usbatm: fix invalid ci_range initialization
bui duc phuc <phucduc.bui@gmail.com>
net: fec: only stop PTP if it was initialized
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Account for the UC filter list for filtering tests
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Check multiple MMC counters
Muhammad Usama Anjum <usama.anjum@arm.com>
selftests/arm64: Treat KSM merge_across_nodes as optional
Muhammad Usama Anjum <usama.anjum@arm.com>
selftests/arm64: Print missing MTE TAP headers
Yang Shi <yang@os.amperecomputing.com>
selftests: arm64: add hugetlb mte tests
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
Marino Dzalto <marino.dzalto@gmail.com>
netfilter: xt_HL: add pr_fmt and checkentry validation
Michal Koutný <mkoutny@suse.com>
netfilter: xt_cgroup: Make it independent from net_cls
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: move hardware offload step after building the chain blob
Alice Mikityanska <alice@isovalent.com>
virtio-net: Ensure that TCP packets don't overflow gso_segs
Maxime Chevallier <maxime.chevallier@bootlin.com>
net: stmmac: selftests: Pass the IP proto mask in the TC selftest
bui duc phuc <phucduc.bui@gmail.com>
net: ethernet: sun4i-emac: Fix IRQ error handling
Aleksandr Nogikh <nogikh@google.com>
libceph: validate banner payload length
HyeongJun An <sammiee5311@gmail.com>
ASoC: dapm: Fix off-by-one check on the second enum channel
John Johansen <john.johansen@canonical.com>
apparmor: policy_int make sure list heads are initialized before fail path
Thorsten Blum <thorsten.blum@linux.dev>
apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
Ruoyu Wang <ruoyuw560@gmail.com>
tpm: st33zp24: Validate locality read result
Ruoyu Wang <ruoyuw560@gmail.com>
tpm: st33zp24: Return zero on status read failure
Victor Nogueira <victor@mojatatu.com>
net/sched: sch_teql: restore skb->dev on the slave failure path
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sfq: clamp quantum to avoid signed overflow soft lockup
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: hhf: clamp quantum before hhf_change() to avoid overflow
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: fq_pie: clamp default quantum to avoid signed overflow
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
Jamal Hadi Salim <jhs@mojatatu.com>
net/sched: fq_codel: clamp default quantum and mtu
Eric Dumazet <edumazet@google.com>
net_sched: export pfifo_fast prio2band[]
Eric Dumazet <edumazet@google.com>
net_sched: sch_fq: change how @inactive is tracked
Eric Dumazet <edumazet@google.com>
net_sched: sch_fq: struct sched_data reorg
Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
net: ip6_gre: Remove the unused function ip6gre_tnl_addr_conflict()
Eric Dumazet <edumazet@google.com>
net/sched: act_skbmod: fix length calculations and avoid invalid header warnings
Eric Dumazet <edumazet@google.com>
net_sched: act_skbmod: use RCU in tcf_skbmod_dump()
Frank Sorenson <sorenson@redhat.com>
cifs: fix clearing stats for fastest execution of each smb2 command
Allison Henderson <achender@kernel.org>
net/rds: use wq_has_sleeper() in rds_cong_map_updated()
Naveen Mamindlapalli <naveenm@marvell.com>
octeontx2-af: Fix TL3/TL2 link config ENA clearing
Xiang Mei <xmei5@asu.edu>
net: qualcomm: rmnet: restore skb->dev on deaggregated frames
Cen Zhang (Microsoft) <blbllhy@gmail.com>
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
Hyunwoo Kim <imv4bel@gmail.com>
Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop
Chris Lu <chris.lu@mediatek.com>
Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
Pauli Virtanen <pav@iki.fi>
Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister
Edward Adam Davis <eadavis@qq.com>
bluetooth/l2cap: sync sock recv cb and release
Sebastian Urban <surban@surban.net>
Bluetooth: compute LE flow credits based on recvbuf space
Dan Carpenter <error27@gmail.com>
scsi: qla2xxx: Fix an loop timeout test
Junrui Luo <moonafterrain@outlook.com>
NFSv4/pnfs: key the data server cache on the NFS version
Jeff Layton <jlayton@kernel.org>
nfs: move the nfs4_data_server_cache into struct nfs_net
Junrui Luo <moonafterrain@outlook.com>
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion
Mahanta Jambigi <mjambigi@linux.ibm.com>
net/smc: free pending qentry in smc_llc_flow_stop() before memset
Ruoyu Wang <ruoyuw560@gmail.com>
net: ipa: balance runtime PM reference on remove error
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
net: ipa: Convert to platform remove callback returning void
Alex Elder <elder@linaro.org>
net: ipa: report when the driver has been removed
Marek Czernohous <marek@czernohous.de>
forcedeth: stop the tx_timeout register dump past the requested window
Fan Ye <fy15309206903@gmail.com>
net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
Ruoyu Wang <ruoyuw560@gmail.com>
net: bridge: Reject descending VLAN tunnel ranges
Serhat Kumral <serhatkumral1@gmail.com>
RDMA/ucma: Allow path records to exactly fit the output buffer
Takashi Iwai <tiwai@suse.de>
ALSA: control: Use automatic cleanup of kfree()
Bradley Morgan <include@grrlz.net>
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
Yi Ding <yi.s.ding@gmail.com>
rtc: pcf8563: fix clock provider leak on unbind
Li RongQing <lirongqing@baidu.com>
vdpa/mlx5: fix wrong list iterated in add_direct_chain error path
Michael S. Tsirkin <mst@redhat.com>
virtio_balloon: disable indirect descriptors
Jian-Ming Liao <Jm_Liao@asmedia.com.tw>
i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Refactor PIO register initialization
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
Adrian Hunter <adrian.hunter@intel.com>
i3c: mipi-i3c-hci: Quieten initialization messages
Jarkko Nikula <jarkko.nikula@linux.intel.com>
i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
Jarkko Nikula <jarkko.nikula@linux.intel.com>
i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes
Ruoyu Wang <ruoyuw560@gmail.com>
bonding: initialize err for empty target lists
Nguyen Dinh Phi <phind.uet@gmail.com>
vsock: use sock_error() to consume sk_err after a failed connect
HyeongJun An <sammiee5311@gmail.com>
platform/x86: dell-wmi-sysman: Fix instance ID bounds
Karl Mehltretter <kmehltretter@gmail.com>
8139cp: fix Rx and Tx not being disabled in cp_suspend
Xu Rao <raoxu@uniontech.com>
ALSA: hda: Fix connection list comparison in proc output
Weiming Shi <bestswngs@gmail.com>
fs/ntfs3: validate ef->size covers the record's name and value
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
Baokun Li <libaokun@linux.alibaba.com>
cuse: wait for pending RCU callbacks on module exit
Nikolay Aleksandrov <razor@blackwall.org>
net: bridge: vlan: fix inverted default vlan notification
Joas Antonio dos Santos <joasantonio108@gmail.com>
ipvs: fix integer overflow in ftp helper port/address parsing
Lukasz Majewski <lukma@denx.de>
net: hsr: Use full string description when opening HSR network device
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
hsr: Use a single struct for self_node.
Qingfang Deng <qingfang.deng@linux.dev>
pppox: drain queued packets on channel handoff
Junseo Lim <zirajs7@gmail.com>
net: kcm: Hold RCU read lock while running BPF parser
Ruoyu Wang <ruoyuw560@gmail.com>
NFSv4: remove callback IDR entry on client allocation failure
Arnaud Bonnet <abo@medichon.fr>
nfs: refactor pNFS functions using clear_and_wake_up_bit
Arnaud Bonnet <abo@medichon.fr>
nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: extend the connection limiting mechanism to support IPv6
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: limit repeated connections from clients with the same IP
Junseo Lim <zirajs7@gmail.com>
bpf: Reject negative optlen in cgroup getsockopt hook
Junseo Lim <zirajs7@gmail.com>
lwt_bpf: Restore reserved headroom after xmit program
ZhangGuoDong <zhangguodong@kylinos.cn>
smb/server: preserve error status in smb2_handle_negotiate()
Delphine CC Chiu <Delphine_CC_Chiu@wiwynn.com>
hwmon: (emc1403) Add support for EMC1442
Linmao Li <lilinmao@kylinos.cn>
mailbox: rockchip: disable pclk on probe failure and unbind
Arnaldo Carvalho de Melo <acme@redhat.com>
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
Zhushuai Yin <yinzhushuai@huawei.com>
crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
Israel Téllez García <i.tellez@btesa.com>
bpf: Fix pending_pos walk on 32-bit ring position wrap
Steven Rostedt <rostedt@goodmis.org>
tracing: Have trace_event_update_all() only handle module that is loading
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing: Remove "__attribute__()" from the type field of event format
Aleksandr Nogikh <nogikh@google.com>
ALSA: core: Fix use-after-free in snd_card_do_free()
Chandrakanth Patil <chandrakanth.patil@broadcom.com>
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
Phillip Lougher <phillip@squashfs.org.uk>
Squashfs: check block offset is not negative
Krystian Kaniewski <krystianmkaniewski@gmail.com>
ocfs2: fix circular locking dependency in ocfs2_init_acl()
Yuan Chen <chenyuan@kylinos.cn>
bpftool: Fix double close in map dump
Bijan Tabatabai <btabatabai@wisc.edu>
x86/pkeys: Fix pkey_alloc() return value when pkeys are not supported
Yuho Choi <dbgh9129@gmail.com>
clocksource/drivers/armada: Unwind timer clock on init failure
Guangshuo Li <lgs201920130244@gmail.com>
clocksource/drivers/clps711x: Do not unmap clocksource MMIO
Peter Oberparleiter <oberpar@linux.ibm.com>
s390/debug: Fix deadlock during unregister
Yuho Choi <dbgh9129@gmail.com>
xenbus: Unregister reboot notifier on init failure
Henrik Grimler <henrik.grimler@axis.com>
power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
Henrik Grimler <henrik.grimler@axis.com>
power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
Henrik Grimler <henrik.grimler@axis.com>
power: supply: bq27xxx: bq27520g4: fix REG_TTES address
Matti Vaittinen <mazziesaccount@gmail.com>
power: supply: bd99954: Drop bad register fields
Felix Gu <ustc.gu@gmail.com>
spi: img-spfi: don't disable runtime PM on DMA deferred probe
Vineet Gupta <vineet.gupta@linux.dev>
selftests/bpf: vmtest.sh: Preserve command quoting when running in the VM
Pu Lehui <pulehui@huawei.com>
selftests/bpf: Add description for running vmtest on RV64
Pu Lehui <pulehui@huawei.com>
selftests/bpf: Support local rootfs image for vmtest
Pu Lehui <pulehui@huawei.com>
selftests/bpf: Limit URLS parsing logic to actual scope in vmtest
Daniel Xu <dxu@dxuuu.xyz>
selftests/bpf: Fix vmtest.sh getopts optstring
KP Singh <kpsingh@kernel.org>
bpf/docs: Update list of architectures supported.
Ilya Leoshkevich <iii@linux.ibm.com>
selfetests/bpf: Adapt vmtest.sh to s390 libbpf CI changes
Yucong Sun <sunyucong@gmail.com>
selfetests/bpf: Update vmtest.sh defaults
Ran Hongyun <ranhongyun1@huawei.com>
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
Rosen Penev <rosenp@gmail.com>
ASoC: xilinx: formatter_pcm: fix stream_data leak on open error
Yuho Choi <dbgh9129@gmail.com>
ubi: Fix rollback for explicit UBI device numbers
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: fastmap: Add module parameter to control reserving filling pool PEBs
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: fastmap: Wait until there are enough free PEBs before filling pools
Yang Li <yang.lee@linux.alibaba.com>
ubi: Simplify bool conversion
ZhaoLong Wang <wangzhaolong1@huawei.com>
ubi: fastmap: Add fastmap control support for module parameter
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: fastmap: Add fastmap control support for 'UBI_IOCATT' ioctl
Zhihao Cheng <chengzhihao1@huawei.com>
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
Zhihao Cheng <chengzhihao1@huawei.com>
UBI: Preserve torture flag when rescheduling failed erasures
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: Replace erase_block() with sync_erase()
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash
Zhihao Cheng <chengzhihao1@huawei.com>
ubi: fastmap: Fix missed ec updating after erasing old fastmap data block
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
ubi: fastmap: Use the bitmap API to allocate bitmaps
Jilin Yuan <yuanjilin@cdjrlc.com>
ubi: Fix repeated words in comments
LiangCheng Wang <zaq14760@gmail.com>
ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
bui duc phuc <phucduc.bui@gmail.com>
ASoC: pxa: Use devm_clk_get_optional() for extclk clock
Zhu Yanjun <yanjun.zhu@linux.dev>
RDMA/cma: Fix WARNING in res_to_rt
Fan Wu <fanwu01@zju.edu.cn>
RDMA/cxgb4: Free debugfs on registration failure
Guangshuo Li <lgs201920130244@gmail.com>
dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
Yun Zhou <yun.zhou@windriver.com>
nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing
Linmao Li <lilinmao@kylinos.cn>
nfc: digital: Do not dump a NULL response in command completion
Yinhao Hu <dddddd@hust.edu.cn>
nfc: pn533: hold a reference to the request skb during send_frame
Doruk Tan Ozturk <doruk@0sec.ai>
nfc: llcp: bound SNL TLV parsing to the skb and add length checks
Zhenghang Xiao <kipreyyy@gmail.com>
nfc: nci: fix double completion race in nci_data_exchange_complete
Breno Leitao <leitao@debian.org>
nfc: llcp: read llcp_sock->local under the socket lock in getsockopt
Breno Leitao <leitao@debian.org>
nfc: llcp: avoid userspace overflow on invalid optlen
Guixin Liu <kanie@linux.alibaba.com>
nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()
Babanpreet Singh <bbnpreetsingh@gmail.com>
spi: sprd-adi: Fix probe succeeding without registering the controller
Michael Walle <mwalle@kernel.org>
powerpc/configs: enable CONFIG_RAS to fix EDAC support
Weiming Shi <bestswngs@gmail.com>
SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6
Karl Mehltretter <kmehltretter@gmail.com>
m68k: Fix backtraces for non-running tasks
Desnes Nunes <desnesn@redhat.com>
iommu/vt-d: Fix UCTP context table slot when copying root entries
Danila Chernetsov <listdansp@mail.ru>
fbdev: kyro: Validate overlay viewport coordinates
Ian Rogers <irogers@google.com>
perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
Ian Rogers <irogers@google.com>
perf synthetic-events: Fix uninitialized pthread_join
Ian Rogers <irogers@google.com>
perf stat: Fix evsel_list leak in cmd_stat
Namhyung Kim <namhyung@kernel.org>
perf stat: Clear screen only if output file is a tty
Rosen Penev <rosenp@gmail.com>
ARM: dts: helios4: add SATA regulator supplies
Rosen Penev <rosenp@gmail.com>
ARM: dts: helios4: add vcc-supply to GPIO expander
Rosen Penev <rosenp@gmail.com>
ARM: dts: helios4: add vcc-supply to EEPROM
Tomáš Macholda <tomas.macholda@nic.cz>
arm64: dts: turris-mox: fix usb3 phys
Victor Nogueira <victor@mojatatu.com>
net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
Baowen Zheng <baowen.zheng@corigine.com>
flow_offload: rename offload functions with offload instead of flow
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: gp2ap002: re-enable irq if runtime suspend fails
Nikhil Gautam <nikhilgtr@gmail.com>
iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
Ali Ahmet Memis <ali@iusegentoo.com>
Bluetooth: MSFT: validate evt_prefix_len against the response length
HyeongJun An <sammiee5311@gmail.com>
Bluetooth: virtio_bt: avoid OOB read of build info string
Yang Xiuwei <yangxiuwei@kylinos.cn>
scsi: sd: Fix sd_done() sense handling condition
Tanushree Shah <tshah@linux.ibm.com>
perf trace-event: Fix integer truncation in do_read() and skip()
Zijun Hu <zijun.hu@oss.qualcomm.com>
Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
Ricardo Neri <ricardo.neri-calderon@linux.intel.com>
sched/fair: Check CPU capacity before comparing group types during load balance
Kamal Wadhwa <kamal.wadhwa@oss.qualcomm.com>
regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
Yeoreum Yun <yeoreum.yun@arm.com>
coresight: etm4x: fix underflow for usage of (nrseqstate - 1)
James Clark <james.clark@linaro.org>
coresight: Change syncfreq to be a u8
James Clark <james.clark@arm.com>
coresight: etm4x: Cleanup TRCIDR5 register accesses
James Clark <james.clark@arm.com>
coresight: etm4x: Cleanup TRCIDR4 register accesses
James Clark <james.clark@arm.com>
coresight: etm4x: Cleanup TRCIDR3 register accesses
James Clark <james.clark@arm.com>
coresight: etm4x: Cleanup TRCIDR2 register accesses
Yeoreum Yun <yeoreum.yun@arm.com>
coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
Loic Poulain <loic.poulain@oss.qualcomm.com>
phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend
Linkai Gong <gonglinkai@kylinos.cn>
soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
Yichong Chen <chenyichong@uniontech.com>
hugetlbfs: release subpool on fill_super failure
Simon Glass <sjg@chromium.org>
pinctrl: rockchip: Reset the pin count when recalculating SoC data
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
firmware_loader: do not queue completed sysfs fallback requests
Russ Weight <russell.h.weight@intel.com>
firmware_loader: Check fw_state_is_done in loading_store
Manish Rangankar <mrangankar@marvell.com>
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/gfx6: Use PFP on the compute queues too
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
Tanushree Shah <tshah@linux.ibm.com>
perf trace-event: Fix buffer overflow in read_string()
Gerald Loacker <gerald.loacker@wolfvision.net>
phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
Jan Kara <jack@suse.cz>
ext4: fix spurious message about orphan cleanup on RO fs
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu/gfx6: Fixup emit_cntxcntl()
Pengpeng Hou <pengpeng@iscas.ac.cn>
mfd: iqs62x: Reject zero-length firmware records
Pengpeng Hou <pengpeng@iscas.ac.cn>
mfd: rave-sp: validate received frame payload lengths
Vladimir Murzin <vladimir.murzin@arm.com>
arm64: hibernate: Restore DAIF state on error
Ada Couprie Diaz <ada.coupriediaz@arm.com>
arm64: hibernate: mask DAIF before restoring hibernated kernel
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
RDMA/siw: Fix use-after-free in siw_accept()
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Introduce siw_free_cm_id
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: post the full-feature receive buffers after session registration
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: delay the final Login Response until the session is registered
Karl Mehltretter <kmehltretter@gmail.com>
cpufreq: imx6q: fix out-of-bounds write when probed more than once
Karl Mehltretter <kmehltretter@gmail.com>
cpufreq: imx6q: fix devres accumulation across driver rebind
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: dw-hdmi: Drop TCON TOP port reference
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: tcon: Drop remote endpoint reference
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: crtc: Propagate layer initialization error
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: tcon: Drop TCON TOP device reference
Geert Uytterhoeven <geert+renesas@glider.be>
bitfield: Add non-constant field_{prep,get}() helpers
Geert Uytterhoeven <geert+renesas@glider.be>
bitfield: Add less-checking __FIELD_{GET,PREP}()
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
of: property: use unsigned int return on of_graph_get_endpoint_count()
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
of: property: add missing kerneldoc for of_graph_get_endpoint_count()
Jernej Skrabec <jernej.skrabec@gmail.com>
drm/sun4i: vi scaler: Fix coefficient selection
Cen Zhang <zzzccc427@gmail.com>
ocfs2: synchronize heartbeat callbacks with o2net teardown
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: use bitmap API in fill_node_map
Xie Yuanbin <xieyuanbin1@huawei.com>
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
Sergei Litvin <litvindev@gmail.com>
scripts/tags.sh: Prevent binary files appearing in cscope.files
Jialu Xu <xujialu@vimux.org>
scripts/tags.sh: improve compiled sources generation
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry()
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
remoteproc: Move resource table data structure to its own header
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/sysfs: Add static PCI resource attribute macros
Andreas Kemnade <andreas@kemnade.info>
drm/omap: dsi: Do not copy isr table
Yichong Chen <chenyichong@uniontech.com>
fat: release buffer head after rebuilding parent
Guangshuo Li <lgs201920130244@gmail.com>
rapidio: clear mport->net when rio_add_net() fails
Calvin Owens <calvin@wbinvd.org>
pps-gpio: remove dead capture_clear code
Michael Byczkowski <by@by-online.de>
pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
Bastien Curutchet <bastien.curutchet@bootlin.com>
pps: clients: gpio: Bypass edge's direction check when not needed
Calvin Owens <calvin@wbinvd.org>
pps: don't try to wait for negative timeouts in PPS_FETCH
Bradley Morgan <include@grrlz.net>
lib/string: fix memchr_inv() for large ranges
Tao Cui <cuitao@kylinos.cn>
block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
Tao Cui <cuitao@kylinos.cn>
block/blk-iocost: collect per-cpu latency stats over possible CPUs
Tao Cui <cuitao@kylinos.cn>
block/blk-stat: drain per-cpu callback stats over possible CPUs
Breno Leitao <leitao@debian.org>
phonet: pep: do not write beyond optlen in getsockopt
Sang-Heon Jeon <ekffu200098@gmail.com>
iio: light: tsl2583: return zero in write_raw() on success
Sang-Heon Jeon <ekffu200098@gmail.com>
iio: light: isl29028: return zero in write_raw() on success
Yuanshen Cao <alex.caoys@gmail.com>
iio: light: tsl2772: fix ALS calibscale readback
Arnaldo Carvalho de Melo <acme@redhat.com>
perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
Arnaldo Carvalho de Melo <acme@redhat.com>
perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
Arnaldo Carvalho de Melo <acme@redhat.com>
perf auxtrace: Fix queue grow overflow and old array leak
Arnaldo Carvalho de Melo <acme@redhat.com>
perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
Jiancheng Huang <jchuang@seu.edu.cn>
HID: lg4ff: validate report length before fixed offsets
Ai Chao <aichao@kylinos.cn>
HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
Hans de Goede <hdegoede@redhat.com>
HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling
Yousef Alhouseen <alhouseenyousef@gmail.com>
HID: synchronize input before cleaning up a failed probe
Dmitry Torokhov <dmitry.torokhov@gmail.com>
HID: ensure timely release of driver-allocated resources
Dmitry Torokhov <dmitry.torokhov@gmail.com>
HID: split apart hid_device_probe to make logic more apparent
Karl Mehltretter <kmehltretter@gmail.com>
tty: clear cdev pointer after cdev_add() failure
Karl Mehltretter <kmehltretter@gmail.com>
serial: amba-pl011: unprepare console clock on unregister
Thomas Bogendoerfer <tsbogend@alpha.franken.de>
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
Gou Hao <gouhao@uniontech.com>
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
firmware: coreboot: Validate table bounds
Titouan Ameline de Cadeville <titouan.ameline@gmail.com>
firmware: google: Add bounds checks in coreboot_table_populate()
Zhao Li <enderaoelyther@gmail.com>
wifi: mac80211: skip unused probe response countdown offsets
Slawomir Stepien <sst@poczta.fm>
wifi: zd1211rw: reject secondary interfaces to prevent conflicts
Zhao Li <enderaoelyther@gmail.com>
wifi: mac80211: send TWT teardown to peer after setup TX failure
Pranjal Shrivastava <praan@google.com>
iommu/arm-smmu-v3: Convert to use atomic poll timeout
Linghui Wu <linghui.wu@oss.qualcomm.com>
wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Check snprintf truncation for guest kallsyms path
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Free scandir entries in guest kernel map creation
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Reset errno before strtol in guest kernel map creation
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Don't abort guest map creation on first inaccessible dir
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Check snprintf truncation in machines__findnew()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Use snprintf() for guestmount path construction
Arnaldo Carvalho de Melo <acme@redhat.com>
perf machine: Guard against NULL strlist in machines__findnew()
Joy Zou <joy.zou@oss.nxp.com>
regulator: core: use system_freezable_wq for init complete work
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: fix leak in ath11k_service_ready_ext_event()
Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
drm/msm/dsi: Drop dev_pm_opp_set_rate(0)
Leo Yan <leo.yan@arm.com>
perf: arm_spe: Make wakeup range check overflow safe
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
Felix Fietkau <nbd@nbd.name>
wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
Eason Lai <Eason.Lai@mediatek.com>
wifi: mt76: mt792x: Fix memory leak in SDIO TX path
Devin Wittmayer <lucid_duck@justthetip.ca>
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
Yichong Chen <chenyichong@uniontech.com>
fanotify: report full event length for FIONREAD
Abdun Nihaal <nihaal@cse.iitm.ac.in>
misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Fix device_register() error path
Jakub Kicinski <kuba@kernel.org>
i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices
Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
iommu/dma: Check atomic pool allocation result directly
Vladimir Zapolskiy <vz@kernel.org>
clk: qcom: Return expected ENOMEM error on dynamic allocation failure
Stanislav Kinsburskii <skinsburskii@linux.microsoft.com>
lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone
Pu Lehui <pulehui@huawei.com>
bpf: Fix potential UAF in bpf_netns_link_update_prog
Hongyan Xu <getshell@seu.edu.cn>
power: supply: sc2731_charger: cancel work on remove
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
power: supply: sc2731_charger: Convert to platform remove callback returning void
Hongyan Xu <getshell@seu.edu.cn>
power: supply: isp1704_charger: cancel work on remove
Cheng-Han Wu <hank20010209@gmail.com>
selftests/zram: fix kernel_gte() for POSIX sh
Sajal Gupta <sajal2005gupta@gmail.com>
md/raid5-ppl: fix use-after-free in ppl_do_flush()
Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: rtlwifi: pci: fix error path in rtl_pci_probe()
Guixin Liu <kanie@linux.alibaba.com>
nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: reject login PDUs declaring more data than was received
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
IB/isert: reject PDUs declaring more data than was received
Leon Romanovsky <leon@kernel.org>
RDMA/cxgb4: free STAG index when TPT entry write fails
Leon Romanovsky <leon@kernel.org>
RDMA/mlx5: Send cong param changes to the resolved port mdev
Leon Romanovsky <leon@kernel.org>
RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs
David Strahan <David.Strahan@microchip.com>
scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
Bart Van Assche <bvanassche@acm.org>
scsi: smartpqi: Stop using the SCSI pointer
Mike McGowen <Mike.McGowen@microchip.com>
scsi: smartpqi: Fix BUILD_BUG_ON() statements
Bart Van Assche <bvanassche@acm.org>
scsi: smartpqi: Switch to attribute groups
Bart Van Assche <bvanassche@acm.org>
scsi: core: Register sysfs attributes earlier
Murthy Bhat <Murthy.Bhat@microchip.com>
scsi: smartpqi: Capture controller reason codes
David Lee <david.lee@trailofbits.com>
nilfs2: prevent out-of-bounds read in super root block parsing
Joshua Crofts <joshua.crofts1@gmail.com>
nilfs2: fix infinite loop in nilfs_clean_segments()
longlong yan <yanlonglong@kylinos.cn>
clk/x86: pmc_atom: add kasprintf return value check
Myeonghun Pak <mhun512@gmail.com>
clk: palmas: Manage external-control prepare with devm
Guangshuo Li <lgs201920130244@gmail.com>
clk: tegra: tegra124-emc: put EMC node on register failure
Ondrej Jirman <megi@xff.cz>
arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
Yonatan Nachum <ynachum@amazon.com>
RDMA/efa: Fix PBL chunk length computation
Weiming Shi <bestswngs@gmail.com>
fs/ntfs3: reject restart table growth beyond U16_MAX entries
Ivy Lopez <skunkolee@gmail.com>
staging: rtl8723bs: use kfree_sensitive() for key material
Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
remoteproc: Prevent crash handling to race with rproc_del()
Jingyi Wang <jingyi.wang@oss.qualcomm.com>
remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
Mukesh Ojha <quic_mojha@quicinc.com>
remoteproc: Use unbounded workqueue for recovery work
Babanpreet Singh <bbnpreetsingh@gmail.com>
w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
Yichong Chen <chenyichong@uniontech.com>
isofs: release zisofs block pointer buffer head
Maher Sanalla <msanalla@nvidia.com>
RDMA/mlx5: Fix integer overflow of user QP buffer size
Can Peng <pengcan@kylinos.cn>
crypto: keembay - publish OF module alias for OCS AES/SM4
Linmao Li <lilinmao@kylinos.cn>
crypto: keembay - Initialize completion before requesting IRQ
Babanpreet Singh <bbnpreetsingh@gmail.com>
power: supply: sbs-battery: Use a per-device serial number buffer
Karl Mehltretter <kmehltretter@gmail.com>
ARM: lpc32xx: only run SoC init on LPC32xx hardware
Fabio Estevam <festevam@gmail.com>
arm64: dts: rockchip: Fix Gru WLAN sideband interrupt
Rob Herring <robh@kernel.org>
arm64: dts: rockchip: Fix PCI node addresses on rk3399-gru
Chen-Yu Tsai <wenst@chromium.org>
arm64: dts: rockchip: Add gru-scarlet-dumo board
Weiming Wu <weiming3@asu.edu>
fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init
Florian Westphal <fw@strlen.de>
netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
Can Peng <pengcan@kylinos.cn>
drm/tve200: add OF module alias for autoloading
Cosmo Chou <chou.cosmo@gmail.com>
leds: pca9532: Fix phantom device registration on missing hardware
Leo Yan <leo.yan@arm.com>
perf cs-etm: Avoid truncating AUX buffer sizes to int
Leo Yan <leo.yan@arm.com>
perf cs-etm: Flush thread stacks after decoder reset
Andre Przywara <andre.przywara@arm.com>
ARM: dts: allwinner: a10: Fix PMU interrupt
Xiang Mei <xmei5@asu.edu>
ext4: check dir entry fits before reading the hash trailer in ext4_search_dir()
Guanghui Yang <3497809730@qq.com>
ext4: fix buffer_head leak in ext4_init_orphan_info
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx()
Venkateswara Naralasetty <quic_vnaralas@quicinc.com>
ath11k: add trace log support
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
Jeff Johnson <jeff.johnson@oss.qualcomm.com>
wifi: ath6kl: avoid buffer overreads in WMI event handlers
Baokun Li <libaokun@linux.alibaba.com>
ext4: drain in-flight DIO before buffered write fallback
Pengpeng Hou <pengpeng@iscas.ac.cn>
thermal: intel: int3400: clean up ODVP on probe failures
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
thermal: int340x_thermal: Consolidate priv->data_vault checks
Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
Haoxiang Li <haoxiang_li2024@163.com>
iommu/qcom: Remove sysfs device on probe failure path
Miaoqian Lin <linmq006@gmail.com>
iommu/arm-smmu: Add missing pm_runtime_disable() in qcom_iommu_device_probe
Patrisious Haddad <phaddad@nvidia.com>
RDMA/core: Fix potential use after free in ib_free_cq()
Mark Zhang <markzhang@nvidia.com>
RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()
Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
RDMA/restrack: Fix typos in the comments
Aharon Landau <aharonl@nvidia.com>
RDMA/nldev: Split nldev_stat_set_mode_doit out of nldev_stat_set_doit
Leon Romanovsky <leon@kernel.org>
RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
Yun Zhou <yun.zhou@windriver.com>
ext4: skip extra isize expansion during mount to prevent deadlock
Xiang Mei <xmei5@asu.edu>
ext4: fix out-of-bounds read in ext4_read_inline_dir()
Chen Pei <cp0613@linux.alibaba.com>
ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root
Pengpeng Hou <pengpeng@iscas.ac.cn>
ACPI: processor: validate MADT IOAPIC entry bounds
Kemeng Shi <shikemeng@huaweicloud.com>
irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc()
TanZheng <tanzheng@kylinos.cn>
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
Danila Chernetsov <listdansp@mail.ru>
RDMA/hfi1: Propagate sdma_txinit_ahg() errors
Jun Yan <jerrysteve1101@gmail.com>
arm64: dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
Linmao Li <lilinmao@kylinos.cn>
ASoC: meson: Keep link pointers valid on realloc failure
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Clear stale requests on termination
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Serialize channel state checks
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Serialize abort state updates
Yuho Choi <dbgh9129@gmail.com>
driver core: soc: Unregister bus on early device registration failure
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
driver core: soc: remove layering violation for the soc_bus
Alban Bedel <alban.bedel@lht.dlh.de>
software node: Fix software_node_get_reference_args() with index -1
Ian Rogers <irogers@google.com>
perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
zhouminqiang <zhouminqiang2@huawei.com>
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
Ruoyu Wang <ruoyuw560@gmail.com>
mtd: mtdswap: Avoid freeing registered blktrans device twice
Pengpeng Hou <pengpeng@iscas.ac.cn>
soc: ti: knav_qmss: Remove debugfs file on teardown
Md Shofiqul Islam <shofiqtest@gmail.com>
soc: ti: knav_qmss_queue: Implement resource cleanup in remove()
Xiang Mei <xmei5@asu.edu>
vfio/pci: clear vdev->msi_perm after freeing it on init failure
Myeonghun Pak <mhun512@gmail.com>
char: xilinx_hwicap: unregister class on init errors
Linmao Li <lilinmao@kylinos.cn>
ppdev: prevent overflow when setting port timeout
Pengpeng Hou <pengpeng@iscas.ac.cn>
misc: ad525x_dpot: use driver core groups for sysfs files
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
misc: ad525x_dpot: Make ad_dpot_remove() return void
Gleb Markov <markov.gi@npc-ksb.ru>
misc: rtsx: add missing write register handling
Gui-Dong Han <hanguidong02@gmail.com>
misc: bcm-vk: Use acquire/release for msgq_inited
Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
speakup: keyhelp: guard letter_offsets possible out-of-range indexing
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
Yuho Choi <dbgh9129@gmail.com>
uio: Fix stale info pointer in failed registration path
David Lee <david.lee@trailofbits.com>
UDF symlink pathComponent header OOB read
Karl Mehltretter <kmehltretter@gmail.com>
tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
Xu Yang <xu.yang_2@nxp.com>
usb: gadget: f_uac1_legacy: remove broken string configfs attributes
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI: processor: idle: Expand _LPI package sanity checks
Wolfram Sang <wsa+renesas@sang-engineering.com>
ACPI: move from strlcpy() with unused retval to strscpy()
Thorsten Blum <thorsten.blum@linux.dev>
crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
Pu Lehui <pulehui@huawei.com>
bpf: Sync tail_call_reachable with callee state on entry
Mikko Perttunen <mperttunen@nvidia.com>
gpu: host1x: Avoid stack over-read in debug output helpers
Mikko Perttunen <mperttunen@nvidia.com>
gpu: host1x: Fix offset calculation in trace_write_gather
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
arm64: dts: qcom: sm8250: Add camcc DT node
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
arm64: dts: qcom: sm8250: remove mmcx regulator
Sibi Sankar <sibis@codeaurora.org>
arm64: dts: qcom: sm8250: Use QMP property to control load state
Maoyi Xie <maoyixie.tju@gmail.com>
drm/bridge: tc358767: clamp the reported AUX read size to the request
Uday Khare <udaykhare77@gmail.com>
remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
cpufreq: intel_pstate: Fix setting minimum P-state at init time
Herve Codina <herve.codina@bootlin.com>
genirq/generic_chip: Introduce irq_domain_{alloc,remove}_generic_chips()
Herve Codina <herve.codina@bootlin.com>
irqdomain: Handle additional domain flags in irq_domain_instantiate()
Herve Codina <herve.codina@bootlin.com>
irqdomain: Introduce irq_domain_instantiate()
Herve Codina <herve.codina@bootlin.com>
irqdomain: Introduce irq_domain_free()
Dan Carpenter <error27@gmail.com>
cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
Bryam Vargas <hexlabsecurity@proton.me>
libnvdimm/labels: Bound the on-media label size before the shift
Baochen Qiang <baochen.qiang@oss.qualcomm.com>
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
Kyle Zeng <kylebot@openai.com>
hfsplus: validate thread record before delete key rebuild
Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com>
rpmsg: glink: fix deadlock in endpoint destroy during driver detach
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
rpmsg: glink: remove duplicate code for rpmsg device remove
Arun Kumar Neelakantam <aneela@codeaurora.org>
rpmsg: glink: Remove the rpmsg dev in close_ack
Xiang Mei <xmei5@asu.edu>
isofs: fix out-of-bounds page array access on empty zisofs block
Fabio M. De Francesco <fmdefrancesco@gmail.com>
fs/isofs: replace kmap() with kmap_local_page()
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Initialize debugfs after probe completes
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Stop flushing the global IB workqueue
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Create workqueues before device initialization
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Remove redundant PCI device ID validation
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Free RX data on late probe failure
Leon Romanovsky <leon@kernel.org>
RDMA/hfi1: Preserve unit 0 on allocation failure
Sean Rhodes <sean@starlabs.systems>
misc: rtsx_usb: avoid USB I/O in runtime autosuspend
Pengpeng Hou <pengpeng@iscas.ac.cn>
pmdomain: bcm: bcm2835: handle genpd provider registration errors
Evgenii Burenchev <evg28bur@yandex.ru>
ALSA: hpi: Check transport errors during HPI6000 adapter initialization
Xiang Mei <xmei5@asu.edu>
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
Yuho Choi <dbgh9129@gmail.com>
hwrng: ks-sa - Fix runtime PM cleanup on registration failure
Martin Kaiser <martin@kaiser.cx>
hwrng: ks-sa - access private data via struct hwrng
Leon Romanovsky <leon@kernel.org>
RDMA/ipoib: Drain RCU callbacks during module teardown
Leon Romanovsky <leon@kernel.org>
RDMA/mlx5: Drain RCU callbacks during module teardown
Mark Zhang <markzhang@nvidia.com>
RDMA/mlx: Calling qp event handler in workqueue context
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
RDMA/mlx4: Avoid flush_scheduled_work() usage
Leon Romanovsky <leon@kernel.org>
RDMA/core: Wait for RCU callbacks before unloading ib_core
Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
RDMA/core: Avoid flush_workqueue(system_unbound_wq) usage
Mert Seftali <mertsftl@gmail.com>
iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
drm/panel: samsung-s6d16d0: Power off on prepare failure
Biju Das <biju.das.jz@bp.renesas.com>
usb: renesas_usbhs: Fix power-off ordering on unbind
Fei Shao <fshao@chromium.org>
usb: mtu3: allow system suspend during active gadget connection
Linmao Li <lilinmao@kylinos.cn>
platform/surface: acpi-notify: Check ACPI companion before use
Linmao Li <lilinmao@kylinos.cn>
platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL
Michael Bommarito <michael.bommarito@gmail.com>
usb: gadget: configfs: fix out-of-bounds read of qw_sign
Wolfram Sang <wsa+renesas@sang-engineering.com>
hwspinlock: propagate errno when registering single lock
Armin Wolf <W_Armin@gmx.de>
platform/x86: dell-wmi-base: Fix resource leak on module load failure
Armin Wolf <W_Armin@gmx.de>
platform/x86: dell-privacy: Fix race condition
Cosmo Chou <chou.cosmo@gmail.com>
leds: pca9532: Fix inverted GPIO output polarity
Wei Wang <wei.w.wang@hotmail.com>
iommu/amd: Fix false positive in SB IOAPIC IVRS validation
Fu Hao <fuhao@open-hieco.net>
iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
Wei Wang <wei.w.wang@hotmail.com>
iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
Vladimir Zapolskiy <vz@kernel.org>
iommu/msm: Return -ENOMEM on memory allocation failure in probe
Akari Tsuyukusa <akkun11.open@gmail.com>
iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX
Breno Leitao <leitao@debian.org>
efi: fix stale reference to efi_recover_from_page_fault()
Daniel Borkmann <daniel@iogearbox.net>
bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux
Aleksandr Nogikh <nogikh@google.com>
udf: Mark LVID buffer as uptodate before marking it dirty
Hongyan Xu <getshell@seu.edu.cn>
usb: gadget: r8a66597: avoid double free of ep0_req in probe error path
Herman van Hazendonk <github.com@herrie.org>
clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister()
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
clk: qcom: gdsc: Capture pm_genpd_add_subdomain result code
Bryan O'Donoghue <bryan.odonoghue@linaro.org>
clk: qcom: gdsc: Release pm subdomains in reverse add order
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gdsc: enable optional power domain support
Herman van Hazendonk <github.com@herrie.org>
clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
Herman van Hazendonk <github.com@herrie.org>
clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
David Woodhouse <dwmw@amazon.co.uk>
timekeeping: Account for monotonicity adjustment in ntp_error
Thomas Weißschuh <thomas.weissschuh@linutronix.de>
y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
Yuho Choi <dbgh9129@gmail.com>
clocksource: Unregister subsystem on device registration failure
Jiangshan Yi <yijiangshan@kylinos.cn>
selftests: timers: leap-a-day: Fix -w option and update usage comment
Kemeng Shi <shikemeng@huaweicloud.com>
irqchip/gic-v3-its: Fix memleak in its_probe_one()
Feng Yang <yangfeng@kylinos.cn>
selftests/bpf: Fix memory leak in msg_alloc_iov
Malaya Kumar Rout <malayarout91@gmail.com>
selftests/bpf: Fix memory leak in msg_alloc_iov error path
Evgenii Burenchev <evg28bur@yandex.ru>
ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
Dawei Feng <dawei.feng@seu.edu.cn>
staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: replace pr_warn with dev_warn in fill and rx paths
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
Yuvraj Singh Chauhan <ysinghcin@gmail.com>
staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
Jakub Kicinski <kuba@kernel.org>
staging: switch to netif_napi_add_weight()
Jakub Kicinski <kuba@kernel.org>
netdev: reshuffle netif_napi_add() APIs to allow dropping weight
Ayush Mukkanwar <ayushmukkanwar@gmail.com>
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
Dan Carpenter <error27@gmail.com>
staging: fbtft: Use sysfs_emit_at() to print to sysfs file
Bryam Vargas <hexlabsecurity@proton.me>
greybus: audio: bound the topology section sizes against the fetched size
Ahmet Sezgin Duran <ahmet@sezginduran.net>
staging: sm750fb: gate dualview dataflow using g_dualview
Alexander A. Klimov <grandmaster@al2klimov.de>
staging: greybus: audio: correct sscanf() return value check
Haowen Tu <tuhaowen@uniontech.com>
PM: sleep: Fix off-by-one in wakelocks number limit check
Yuho Choi <dbgh9129@gmail.com>
bus: ti-sysc: Fix /chosen node reference leak
Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
nvmet-rdma: fix response resource leak on queue teardown
Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
nvmet-rdma: factor out response resource cleanup
Guixin Liu <kanie@linux.alibaba.com>
nvmet-rdma: use sbitmap to replace rsp free list
Hannes Reinecke <hare@suse.de>
nvmet-rdma: avoid circular locking dependency on install_queue()
Pengpeng Hou <pengpeng@iscas.ac.cn>
crypto: sa2ul - stop probe if context pool creation fails
Tang Bin <tangbin@cmss.chinamobile.com>
crypto: sa2ul - Use the defined variable to clean code
Lothar Rubusch <l.rubusch@gmail.com>
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - reject hardware ECDH without a public key
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - clean up and improve ECDH comments
Thorsten Blum <thorsten.blum@linux.dev>
crypto: atmel-ecc - replace min_t with min
Giovanni Cabiddu <giovanni.cabiddu@intel.com>
crypto: qat - clear AES key schedule from stack
Tzung-Bi Shih <tzungbi@kernel.org>
platform/chrome: sensorhub: Fix memory overread in ring handler
Hisam Mehboob <hisamshar@gmail.com>
selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check
Hanlin Song <pgeorge8929@gmail.com>
csky: Fix a4/a5 restoration in syscall trace path
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
Vladimir Zapolskiy <vz@kernel.org>
dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
Suraj Gupta <suraj.gupta2@amd.com>
dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers
Vladimir Zapolskiy <vz@kernel.org>
dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
Yichong Chen <chenyichong@uniontech.com>
tools/bpf/bpftool: Reset vmlinux BTF after map commands
Jiri Olsa <jolsa@kernel.org>
bpftool: Fix pretty print dump for maps without BTF loaded
Hengqi Chen <hengqi.chen@gmail.com>
bpftool: Use libbpf_get_error() to check error
Andrii Nakryiko <andrii@kernel.org>
bpftool: Update btf_dump__new() and perf_buffer__new_raw() calls
Asad Kamal <asad.kamal@amd.com>
drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup
Asad Kamal <asad.kamal@amd.com>
drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup
Ian Rogers <irogers@google.com>
perf tests: Fix flakiness in BPF counters test on hybrid systems
Namhyung Kim <namhyung@kernel.org>
perf test: Fix perf stat --bpf-counters on hybrid machines
Tengda Wu <wutengda@huaweicloud.com>
perf test: Use sqrtloop workload to test bperf event
Veronika Molnarova <vmolnaro@redhat.com>
perf test stat_bpf_counter.sh: Stabilize the test results
Ian Rogers <irogers@google.com>
perf test bpf-counters: Add test for BPF event modifier
Thomas Richter <tmricht@linux.ibm.com>
perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test
Athira Rajeev <atrajeev@linux.vnet.ibm.com>
perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning
Sean Young <sean@mess.org>
media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
Sean Young <sean@mess.org>
media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
Daniel McCarthy <daniel@dragonzap.com>
pinctrl: bcm2835: Don't remove an unregistered GPIO chip
Zide Chen <zide.chen@intel.com>
perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
Henrik Grimler <henrik.grimler@axis.com>
drm/lima: call drm_mm_init() with a valid allocation range
Brian Masney <bmasney@redhat.com>
clk: imx: scu: drop redundant init.ops variable assignment
Weigang He <geoffreyhe2@gmail.com>
ARM: imx: fix device_node refcount leaks in imx7_src_init()
Weigang He <geoffreyhe2@gmail.com>
ARM: imx: fix device_node refcount leak in imx_src_init()
Min zhang <zhangmin2026@yeah.net>
clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: fsl_audmix: rework runtime PM handling in probe
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: rt700-sdw: always drain jack work on remove
Alexander A. Klimov <grandmaster@al2klimov.de>
clk: moxart: remove unused variables, fix refcount leak
Gui-Dong Han <hanguidong02@gmail.com>
media: cec-pin: Fix event FIFO ordering
Weigang He <geoffreyhe2@gmail.com>
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
Michael Bommarito <michael.bommarito@gmail.com>
HID: roccat: bound device-supplied profile index
Philipp Weber <kernel@phwe.de>
HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
Konstantin Andreev <andreev@swemel.ru>
smack: restrict smackfs/{direct,mapped} values to 0-255
Konstantin Andreev <andreev@swemel.ru>
smack: deduplicate smackfs/{direct,mapped} file_operations
Dmitry Antipov <dmantipov@yandex.ru>
smack: simplify write handlers of sysfs entries
Konstantin Andreev <andreev@swemel.ru>
smack: fix incorrect task context in smack_msg_queue_msgrcv
Casey Schaufler <casey@schaufler-ca.com>
Smack: fix W=1 build warnings
Maxime Ripard <mripard@kernel.org>
drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
Daniel Borkmann <daniel@iogearbox.net>
bpf: Enforce expected_attach_type for tailcall compatibility
Martin Blumenstingl <martin.blumenstingl@googlemail.com>
clk: meson: align gxbb_32k_clk_sel number of parents with actual count
Mahesh Rao <mahesh.rao@altera.com>
firmware: stratix10-svc: Add mutex in stratix10 memory management
Arnaldo Carvalho de Melo <acme@redhat.com>
perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: avoid CRC corruption due to parallel claim add
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: atomically update mac addresses
Sean Shen <grayhat@foxmail.com>
ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE
Norbert Szetei <norbert@doyensec.com>
ksmbd: fix overflow in dacloffset bounds check
Jian Shen <shenjian15@huawei.com>
net: hns3: don't auto enable misc vector
Jiayuan Chen <jiayuan.chen@linux.dev>
bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops
Zhengchuan Liang <zcliangcn@gmail.com>
net: af_key: zero aligned sockaddr tail in PF_KEY exports
Xiang Mei <xmei5@asu.edu>
bridge: mrp: reject zero test interval to avoid OOM panic
Wang Liang <wangliang74@huawei.com>
net: fix NULL pointer dereference in l3mdev_l3_rcv
Jie Wang <wangjie125@huawei.com>
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
Duoming Zhou <duoming@zju.edu.cn>
ax25: fix use-after-free bugs caused by ax25_ds_del_timer
Andrei Matei <andreimatei1@gmail.com>
bpf: Guard stack limits against 32bit overflow
Steve Wahl <steve.wahl@hpe.com>
x86/mm/ident_map: Use gbpages only where full GB page should be mapped.
SJ Park <sj@kernel.org>
mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
SJ Park <sj@kernel.org>
mm/damon/vaddr-kunit: check region count in three_regions test
SJ Park <sj@kernel.org>
mm/damon/vaddr: drop last same folio access check optimization
SJ Park <sj@kernel.org>
mm/damon/core-kunit: check region count before testing in split_at()
Sechang Lim <rhkrqnwk98@gmail.com>
tcp: clear sock_ops cb flags before force-closing a child socket
Arthur Gautier <baloo@superbaloo.net>
xhci: fix lost bounce buffers on TDs spanning several ring segments
Faith Ekstrand <faith.ekstrand@collabora.com>
drm/nouveau: Use write-combined maps for coherent
Sunil Khatri <sunil.khatri@amd.com>
drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
Kavan Smith <kavansmith82@gmail.com>
drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
Tao Yu <tao1.yu@intel.com>
drm/gud: validate TV mode names before creating enum property
Deepanshu Kartikey <kartikey406@gmail.com>
drm/gud: NUL-terminate TV mode names read from the device
Harry Wentland <harry.wentland@amd.com>
drm/amd/display: avoid divide-by-zero in __is_lut_linear()
Thomas Zimmermann <tzimmermann@suse.de>
drm/hibmc: Fix list of formats on the primary plane
Wentao Liang <vulab@iscas.ac.cn>
drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
Danilo Krummrich <dakr@kernel.org>
drm: fix race between partial drm_dev_register() failure and ioctl
Johan Hovold <johan@kernel.org>
drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
Zhan Xusheng <zhanxusheng1024@gmail.com>
f2fs: fix i_size when pinned fallocate partially fails
Wenjie Qi <qwjhust@gmail.com>
f2fs: return writeback error from collapse range
Hao-Qun Huang <alvinhuang0603@gmail.com>
f2fs: reject overlapping move range after len expansion
Wenjie Qi <qwjhust@gmail.com>
f2fs: return symlink writeback errors
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Avoid double completion in async IOCB timeout
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Don't query firmware state while chip is down
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix FCE trace enable parsing in debugfs
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix cs84xx use-after-free on host teardown
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Serialize flash version read in reset handler
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
Nilesh Javali <njavali@marvell.com>
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
Arash Golgol <arash.golgol@gmail.com>
media: vimc: fix pixel format lookup in enum_framesizes
Uday Khare <udaykhare77@gmail.com>
media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure
Mohammed EL Kadiri <med08elkadiri@gmail.com>
media: venus: fix payload size calculation in parse_raw_formats()
Mohammed EL Kadiri <med08elkadiri@gmail.com>
media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
Biren Pandya <birenpandya@gmail.com>
media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
Ming Qian <ming.qian@oss.nxp.com>
media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
Ilya Krutskih <devsec@tpz.ru>
media: tda18250: fix possible integer overflow
Lei Huang <huanglei@kylinos.cn>
media: s2255: check firmware size before reading trailing marker
HyeongJun An <sammiee5311@gmail.com>
media: s2255: bound JPEG frame size before copying into the buffer
Valery Borovsky <vebohr@gmail.com>
media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure
Valery Borovsky <vebohr@gmail.com>
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
Myeonghun Pak <mhun512@gmail.com>
media: rc: sunxi-cir: Unregister rc device on probe failure
Christian Hewitt <christianshewitt@gmail.com>
media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
Biren Pandya <birenpandya@gmail.com>
media: i2c: ov7740: fix use-after-destroy in remove
Biren Pandya <birenpandya@gmail.com>
media: i2c: ov02a10: fix endpoint parsing use-after-free
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
media: go7007: defer the ALSA v4l2 put until card release
Jiangong.Han <jiangong.han@windriver.com>
media: em28xx: fix use-after-free of dev_next->devlist on disconnect
Diego Fernando Mancera Gomez <diegomancera.dev@gmail.com>
media: em28xx: defer audio-only extension registration
Fan Wu <fanwu01@zju.edu.cn>
media: cx23885: cancel NetUP CI work before teardown
Bryam Vargas <hexlabsecurity@proton.me>
media: cx231xx: reject geometry changes while the VBI queue is busy
Ruoyu Wang <ruoyuw560@gmail.com>
media: cobalt: Avoid freeing ALSA private data twice
Dawei Feng <dawei.feng@seu.edu.cn>
media: cedrus: fix memory leak in cedrus_init_ctrls()
Ruoyu Wang <ruoyuw560@gmail.com>
media: cec: Serialize exclusive follower delivery
Yi Ding <yi.s.ding@gmail.com>
media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
Valery Borovsky <vebohr@gmail.com>
media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Restore sigset on error path
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Zero initialize irq in reinject_machine_check
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Free guest debug data on vcpu destroy
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Fix old_data leak in guest debug error path
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Fix memory leak in guest debug handling
Christian Borntraeger <borntraeger@linux.ibm.com>
KVM: s390: Fix length check __import_wp_info()
Carlos López <clopez@suse.de>
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
Yosry Ahmed <yosry@kernel.org>
KVM: nVMX: Service local TLB flushes on failed nested VM-Enter
Yosry Ahmed <yosry@kernel.org>
KVM: nVMX: Always flush vpid02 on first use
Sanjay Chitroda <sanjayembeddedse@gmail.com>
iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
Cong Nguyen <congnt264@gmail.com>
iio: srf04: fix pm_runtime handling on probe error path
Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
iio: light: gp2ap002: Disable regulators on resume failure
Giorgi Tchankvetadze <giorgi@tchankvetadze.com>
iio: light: cm32181: return zero after writing calibscale
Cong Nguyen <congnt264@gmail.com>
iio: gyro: mpu3050: fix sign of raw angular velocity readings
Erick Henrique <erick.henrique.rodrigues@usp.br>
iio: dac: m62332: Fix regulator reference count imbalance
Linmao Li <lilinmao@kylinos.cn>
iio: chemical: sgp30: Handle IAQ thread creation failure
Moksh Panicker <mokshpanicker.7@gmail.com>
iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
WenTao Liang <vulab@iscas.ac.cn>
ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
Haoxiang Li <haoxiang_li2024@163.com>
AsoC: intel: sst: fix PCI device reference leak on probe failure
Haoxiang Li <haoxiang_li2024@163.com>
ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: cs35l34: drain threaded IRQ before runtime suspend
Runyu Xiao <runyu.xiao@seu.edu.cn>
ASoC: cs35l33: drain threaded IRQ before runtime suspend
Linkai Gong <gonglinkai@kylinos.cn>
i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
Stephan Gerhold <stephan.gerhold@linaro.org>
clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: prevent CRC corruptions after claim flush
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: fix freeing of claims on meshif deletion
Sven Eckelmann <sven@narfation.org>
batman-adv: dat: avoid unaligned fault in IP extraction
Zhiling Zou <zhilinz@nebusec.ai>
batman-adv: fix stale receive device on merged fragments
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: rawnand: validate ONFI extended parameter page sections
Xu Rao <raoxu@uniontech.com>
mtd: mtdoops: free page bitmap when the backing MTD is removed
Pengpeng Hou <pengpeng@iscas.ac.cn>
mtd: afs: validate v2 image info bounds
Helge Deller <deller@gmx.de>
parisc: Fix alignment of asm statements in head.S
Pei Xiao <xiaopei01@kylinos.cn>
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
Bryam Vargas <hexlabsecurity@proton.me>
nvdimm/btt: reject an arena whose nfree is below the lane count
caina <caina@uniontech.com>
Revert "irqchip/mbigen: Fix mbigen node address layout"
Shivam Kumar <kumar.shivam43666@gmail.com>
nvmet-tcp: reject unsolicited H2CData PDUs
Shivam Kumar <kumar.shivam43666@gmail.com>
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-tcp: check the data direction of a C2HData PDU
Takashi Iwai <tiwai@suse.de>
ALSA: pcm: Fix race between non-atomic ops and trigger-start
Runyu Xiao <runyu.xiao@seu.edu.cn>
ALSA: harmony: initialize locks before requesting IRQ
Ahmad Byagowi <ahmadexp@gmail.com>
i2c: mux: Fix channel node leak on adapter add failure
Vasileios Almpanis <vasilisalmpanis@gmail.com>
i2c: core: fix debugfs UAF on adapter removal
Dapeng Mi <dapeng1.mi@linux.intel.com>
perf/x86/intel: Fix kernel address leakages in LBR stack
Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: aiptek - switch to using dev_groups for driver-specific attributes
Pengpeng Hou <pengpeng@iscas.ac.cn>
Input: aiptek - validate raw macro indices before updating state
Bradley Morgan <brads@mainlining.org>
ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
Hajo Noerenberg <hajo-linux-ide@noerenberg.de>
ata: ahci: work around lost interrupts on Marvell 88SE61xx
Damien Le Moal <dlemoal@kernel.org>
block: flag zoned disks with GENHD_FL_NO_PART
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
Koichiro Den <den@valinux.co.jp>
dmaengine: dw-edma: Complete descriptors before pausing
Mikulas Patocka <mpatocka@redhat.com>
dm: fix resume-vs-remove race
Ibrahim Hashimov <security@auditcode.ai>
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
Wei Jie Law <98lawweijie@gmail.com>
HID: rmi: fix OOB access with undersized RMI reports
Runyu Xiao <runyu.xiao@seu.edu.cn>
scsi: pm8001: Use rollback index when freeing MSI-X vectors
Sujal Tuladhar <sujaltuladhar1231@gmail.com>
scsi: target: iscsi: Reserve a terminator byte for the login payload
Can Peng <pengcan@kylinos.cn>
thermal/drivers/qoriq: Disable clock on resume failure
Can Peng <pengcan@kylinos.cn>
thermal/drivers/imx: Disable clock on runtime resume failure
Muhammad Bilal <meatuni001@gmail.com>
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
Muhammad Bilal <meatuni001@gmail.com>
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
Jeffin Philip <jeffinphilip14@gmail.com>
usb: gadget: fix null pointer dereference in usb_put_function_instance()
Lovekesh Solanki <lovekeshsolanki00@gmail.com>
USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
Jameson Thies <jthies@google.com>
usb: typec: ucsi: displayport: Fix OOB altmode array index
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
Liu Qi <liuqi@longcheer.com>
usb-storage: ene_ub6250: fix race between scan work and probe
Shuangpeng Bai <shuangpeng.kernel@gmail.com>
media: usbtv: keep device alive while ALSA card exists
Stephan Gerhold <stephan@gerhold.net>
clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
HyeongJun An <sammiee5311@gmail.com>
ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
Griffin Kroah-Hartman <griffin@kroah.com>
usb: image: mdc800: change kmalloc() to kzalloc()
Sabrina Dubroca <sd@queasysnail.net>
espintcp: remove encap socket caching to avoid reference leak
Petr Vaganov <p.vaganov@ideco.ru>
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
Steven Rostedt <rostedt@goodmis.org>
tracing/mmiotrace: Remove reference to unused per CPU data pointer
Zack Rusin <zack.rusin@broadcom.com>
drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
Koichiro Den <den@valinux.co.jp>
net: ntb_netdev: Fix TX busy and drop handling
Tzung-Bi Shih <tzungbi@kernel.org>
ALSA: seq: Fix port lock leak in deliver_to_subscribers()
Bryam Vargas <hexlabsecurity@proton.me>
selinux: reject an unclaimed class value in security_get_classes()
Christian Göttsche <cgzones@googlemail.com>
selinux: avoid implicit conversions in services code
Eric Dumazet <edumazet@google.com>
tcp: fix potential race in tcp_v6_syn_recv_sock()
Youngjae Kwon <yjkwon0026@snu.ac.kr>
fsnotify: Fix stale object mask after concurrent mark updates
Jinjie Ruan <ruanjinjie@huawei.com>
entry: Fix seccomp bypass after ptrace with TSYNC
Bjoern Doebel <doebel@amazon.de>
RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe
Yuqi Xu <xuyuqiabc@gmail.com>
openvswitch: Fix CT limit teardown use-after-free
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: fix kernel-doc warnings in internal headers
Norbert Szetei <norbert@doyensec.com>
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
Norbert Szetei <norbert@doyensec.com>
net: skbuff: don't touch shared zerocopy state in skb_tx_error()
Tzung-Bi Shih <tzungbi@kernel.org>
platform/chrome: sensorhub: Fix dropped timestamp events and log spam
Zhan Xusheng <zhanxusheng1024@gmail.com>
udf: Fix i_lenExtents truncation on 32-bit kernels
Thomas Gleixner <tglx@kernel.org>
timer: Keep debugobjects state consistent in migrate_timer_list()
Bradley Morgan <include@grrlz.net>
taskstats: fix cpumask parsing cutting off the last character
Jann Horn <jannh@google.com>
smack: fix cred UAF in smack_file_send_sigiotask()
Bradley Morgan <include@grrlz.net>
signal: avoid shared siginfo namespace rewrites
Myeonghun Pak <mhun512@gmail.com>
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
Maoyi Xie <maoyixie.tju@gmail.com>
w1: ds28e17: reject an oversize length on an I2C block read
Chengfeng Ye <nicoyip.dev@gmail.com>
vsock/virtio: flush works in dependency order
Runyu Xiao <runyu.xiao@seu.edu.cn>
wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
Stanislaw Gruszka <stf_xl@wp.pl>
wifi: rtl818x: initialize eeprom_93cx6 struct to zero
Fabio Estevam <festevam@nabladev.com>
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
Abdun Nihaal <nihaal@cse.iitm.ac.in>
wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
Maoyi Xie <maoyixie.tju@gmail.com>
i3c: master: svc: bound IBI payload to the requested max_payload_len
Adrian Hunter <adrian.hunter@intel.com>
i3c: master: Fix info leak and UAF in device unregister path
Haotian Zhang <vulab@iscas.ac.cn>
dm-switch: use WRITE_ONCE() in switch_region_table_write()
Mikulas Patocka <mpatocka@redhat.com>
dm-stats: fix a crash if allocation of per-cpu data fails
Nathan Chancellor <nathan@kernel.org>
arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
Naman Jain <namjain@linux.microsoft.com>
PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
Takashi Iwai <tiwai@suse.de>
ALSA: virmidi: Check card index validity at probe
Takashi Iwai <tiwai@suse.de>
ALSA: serial-u16550: Check card index validity at probe
Takashi Iwai <tiwai@suse.de>
ALSA: portman2x4: Check card index validity at probe
Runyu Xiao <runyu.xiao@seu.edu.cn>
ALSA: pcxhr: initialize mutexes before requesting threaded IRQ
Takashi Iwai <tiwai@suse.de>
ALSA: mts64: Check card index validity at probe
Takashi Iwai <tiwai@suse.de>
ALSA: mpu401: Check card index validity at probe
Baul Lee <baul.lee@xbow.com>
ALSA: bcd2000: clear the URB pointers on disconnect
Takashi Iwai <tiwai@suse.de>
ALSA: aloop: Check card index validity at probe
Baul Lee <baul.lee@xbow.com>
ALSA: 6fire: bound the MIDI event length from the device
Zhiling Zou <zhilinz@nebusec.ai>
seg6: reset IP6CB after IPv6 decapsulation
Zhiling Zou <zhilinz@nebusec.ai>
net: cap advertised IP tunnel headroom
Hidayath Khan <hidayath@linux.ibm.com>
net/smc: fix socket refcount leak in smc_switch_conns()
Koichiro Den <den@valinux.co.jp>
net: ntb_netdev: Count packets dropped on RX refill failure
Koichiro Den <den@valinux.co.jp>
net: ntb_netdev: Avoid double-accounting netif_rx() drops
Koichiro Den <den@valinux.co.jp>
NTB: ntb_transport: Reject oversized TX buffers
Koichiro Den <den@valinux.co.jp>
NTB: ntb_transport: Fail TX enqueue when the QP link is down
Koichiro Den <den@valinux.co.jp>
NTB: ntb_transport: Recycle TX entries before client callbacks
Ruoyu Wang <ruoyuw560@gmail.com>
net: openvswitch: fix nf_connlabels leak in ovs_ct_init
Ilya Maximets <i.maximets@ovn.org>
net: openvswitch: fix flow mask use-after-free on flow deletion
Asim Viladi Oglu Manizada <manizada@pm.me>
net: tun: bound receive headroom
Fabio Porcedda <fabio.porcedda@gmail.com>
net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
Aleksandr Khromov <haa@amicon.ru>
slip: fix use-after-free in sl_sync()
Weiming Shi <bestswngs@gmail.com>
xdp: fix zero-copy frame layout
Alexandra Winter <wintera@linux.ibm.com>
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
Seiji Nishikawa <snishika@redhat.com>
ipmi: si: Fix NULL pointer dereference after failed registration
Yousef Alhouseen <alhouseenyousef@gmail.com>
ipmi: ipmb: validate write message length
Kuan-Wei Chiu <visitorckw@gmail.com>
interconnect: Fix use after free in icc_get() and of_icc_get_by_index()
Bryam Vargas <hexlabsecurity@proton.me>
platform/chrome: sensorhub: Bound the EC-reported sensor number
Fan Wu <fanwu01@zju.edu.cn>
mmc: via-sdmmc: stop card-detect handling on probe failure
HyeongJun An <sammiee5311@gmail.com>
platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
Kevin Tian <kevin.tian@intel.com>
iommu/vt-d: Fix no_iommu to disable platform opt-in
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/proc: Use file_ns_capable() when checking config space read access
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
Krzysztof Wilczyński <kwilczynski@kernel.org>
PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
Ronald Claveau <linux-kernel-dev@aliel.fr>
PCI: meson: Fix GPIO state while requesting PERST#
Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: Propagate partial completion length across ERP recovery
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: Guard sysfs discipline callbacks against unallocated private data
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: Do not complete a failed ESE read as successful
Jianing Li <m13940358460@163.com>
power: supply: max17040: synchronize work cancellation on suspend
Fan Wu <fanwu01@zju.edu.cn>
power: supply: ucs1002: fix use-after-free on remove
Maoyi Xie <maoyixie.tju@gmail.com>
power: supply: twl4030_charger: cancel workers via devm
Fan Wu <fanwu01@zju.edu.cn>
power: supply: lp8727: fix use-after-free in lp8727_release_irq()
Jameson Thies <jthies@google.com>
power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS
Bryam Vargas <hexlabsecurity@proton.me>
power: supply: cros_usbpd-charger: bound the EC-reported port count
Fan Wu <fanwu01@zju.edu.cn>
power: supply: bq256xx: drain usb_work before freeing the charger
Fan Wu <fanwu01@zju.edu.cn>
power: supply: bq24257: fix use-after-free on remove
Jun Yang <junvyyang@tencent.com>
sctp: fix stream->outcnt underflow on duplicate RECONF responses
Jun Yang <junvyyang@tencent.com>
sctp: distinguish sequence zero from wildcard in reconf lookup
Weiming Shi <bestswngs@gmail.com>
sctp: fix NULL deref on untransmitted RECONF completion
Hyunwoo Kim <imv4bel@gmail.com>
sctp: drop a chunk if its transport was removed
Hyunwoo Kim <imv4bel@gmail.com>
sctp: stop processing a packet once its association is deleted
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-tcp: reject a read that transferred too few bytes
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
Yehyeong Lee <yhlee@isslab.korea.ac.kr>
nvme: zero the discard fallback page
Ewan D. Milne <emilne@redhat.com>
nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
Michael Bommarito <michael.bommarito@gmail.com>
lockd: pin next file across nlm_inspect_file lock-drop
Cong Nguyen <congnt264@gmail.com>
hwmon: (max6621) fix temperature clamp range
Cong Nguyen <congnt264@gmail.com>
hwmon: (max6621) fix negative temperature offset and crit readings
Norbert Szetei <norbert@doyensec.com>
openvswitch: only skb_tx_error() a packet we are about to drop
Ali Ahmet Memis <ali@iusegentoo.com>
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
Zhan Xusheng <zhanxusheng1024@gmail.com>
ocfs2: fix readdir position truncation on 32-bit kernels
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
Joseph Qi <joseph.qi@linux.alibaba.com>
ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
Ibrahim Hashimov <security@auditcode.ai>
ocfs2: validate rl_used against rl_count in refcount block validator
Bryam Vargas <hexlabsecurity@proton.me>
ocfs2: validate lengths in dlm_mig_lockres_handler
Bryam Vargas <hexlabsecurity@proton.me>
ocfs2: bound namelen in dlm_migrate_request_handler
Dmitry Antipov <dmantipov@yandex.ru>
ocfs2: always run deallocs on copy-on-write completion
Zhiling Zou <zhilinz@nebusec.ai>
orangefs: skip leading spaces before parsing client debug masks
Yifei Gao <gyf161023@gmail.com>
orangefs: fix double-free of trailer_buf on readdir copy failure
WenTao Liang <vulab@iscas.ac.cn>
regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
WenTao Liang <vulab@iscas.ac.cn>
regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer
Norbert Szetei <norbert@doyensec.com>
RDMA/ucma: Lock the handler in ucma_set_ib_path()
Fan Wu <fanwu01@zju.edu.cn>
RDMA/cxgb4: Cancel reg_work before freeing device on remove
Vaibhav Nagare <nagarevaibhav@gmail.com>
qede: Fix NULL pointer dereference in TPA fragment processing
Johan Hovold <johan@kernel.org>
remoteproc: scp: Fix device reference leak on failed lookup
Chunkai Deng <chunkai.deng@oss.qualcomm.com>
rpmsg: glink: smem: order FIFO read after availability check
Hao-Qun Huang <alvinhuang0603@gmail.com>
staging: media: tegra-video: vi: fix probe failure on skipped last port
Doruk Tan Ozturk <doruk@0sec.ai>
wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
David Lee <david.lee@trailofbits.com>
udf: reject VAT indexes equal to the entry count
Chris Mason <clm@meta.com>
svcrdma: Fix pcl_for_each_segment for empty chunks
Chris Mason <clm@meta.com>
svcrdma: Fix offset arithmetic in read_chunk_range
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
Chris Mason <clm@meta.com>
sunrpc: init gssp_lock before publishing proc entry
Chris Mason <clm@meta.com>
SUNRPC: harden gss_unwrap_resp_priv length checks
Chris Mason <clm@meta.com>
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
Chris Mason <clm@meta.com>
SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
Jeff Layton <jlayton@kernel.org>
SUNRPC: always drain cache_cleaner before destroying a cache_detail
Jeff Layton <jlayton@kernel.org>
sunrpc: route to a populated pool in svc_pool_for_cpu()
Chris Mason <clm@meta.com>
SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
Harshit Varu <harshitvaru666@gmail.com>
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
Qing Ming <a0yami@mailbox.org>
mpls: reload header after pskb_may_pull()
Coly Li <colyli@fygo.io>
md: do overflow check for sb->bblog_shift in super_1_load()
Bryam Vargas <hexlabsecurity@proton.me>
libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
Yuyang Huang <sigefriedhyy@gmail.com>
ipv6: use RCU iterator to dump route exceptions
Zhiling Zou <zhilinz@nebusec.ai>
ip6_gre: fix hardware header length for NBMA tunnels
Zhiling Zou <zhilinz@nebusec.ai>
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
Guangshuo Li <lgs201920130244@gmail.com>
Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
Guangshuo Li <lgs201920130244@gmail.com>
Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
Valentin Kindschi <valentin.kindschi@fiveco.ch>
Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
Chengfeng Ye <nicoyip.dev@gmail.com>
Bluetooth: RFCOMM: serialize security confirmation handling
Gongwei Li <ligongwei@kylinos.cn>
Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
Guangshuo Li <lgs201920130244@gmail.com>
Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
Hui Su <sh_def@163.com>
cpufreq: schedutil: Fix rate limit overflow
Bryam Vargas <hexlabsecurity@proton.me>
dm array: reject an array block whose value size is not the caller's
Ilya Krutskih <devsec@tpz.ru>
dm raid1: reserve space for NUL-terminator in build_constructor_string()
liyouhong <liyouhong@kylinos.cn>
dm-era: fix shadowed superblock leak on take-snap failure
Jiangshan Yi <yijiangshan@kylinos.cn>
bnx2x: fix double free in bnx2x_init_firmware() error path
Christoph Zwerschke <cito@online.de>
Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
Christoph Zwerschke <cito@online.de>
Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
Hongyan Xu <getshell@seu.edu.cn>
auxdisplay: charlcd: cancel backlight work on registration failure
Niklas Cassel <cassel@kernel.org>
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
Matt Turner <mattst88@gmail.com>
alpha: marvel: Fix lock ordering in init_io7_irqs()
Matt Turner <mattst88@gmail.com>
alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
Krzysztof Wilczyński <kwilczynski@kernel.org>
alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
Tien Sung Ang <tien.sung.ang@altera.com>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
Marek Czernohous <marek@czernohous.de>
forcedeth: fix off-by-one when saving/restoring non-PCI config space
Myeonghun Pak <mhun512@gmail.com>
fbdev: uvesafb: unregister connector callback on init failure
Florian Fuchs <fuchsfl@gmail.com>
fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
Runyu Xiao <runyu.xiao@seu.edu.cn>
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
Yemu Lu <prcups@krgm.moe>
fat: restore original value when fat_ent_write failed
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: show filename encryption options
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: release message context on send failure
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: reject too-small tag 70 packets
HanQuan <eilaimemedsnaimel@gmail.com>
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: pass packet set buffer size to parser
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: hold msg ctx list lock when cleaning daemon queue
Yichong Chen <chenyichong@uniontech.com>
ecryptfs: fix tag 11 packet exact-fit size check
Pengpeng Hou <pengpeng@iscas.ac.cn>
eCryptfs: bound the packet-length peek to the user buffer
Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3: bound page_lcns[] index by the log record
Samuel Page <sam@bynar.io>
fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
Xiang Mei <xmei5@asu.edu>
fs/ntfs3: validate dirty page table on log replay
Jiangshan Yi <yijiangshan@kylinos.cn>
HID: mcp2221: validate report size in mcp2221_raw_event()
Haoxiang Li <haoxiang_li2024@163.com>
HID: sensor: custom: Fix field sysfs group cleanup on failure
Xu Rao <raoxu@uniontech.com>
HID: roccat: free buffered reports when destroying device
Ibrahim Hashimov <security@auditcode.ai>
HID: picolcd: clamp eeprom debugfs read to bytes actually received
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
audit: avoid dropping live tree ref on fsnotify rule autoremove
Michael Bommarito <michael.bommarito@gmail.com>
ceph: bound xattr value length in __build_xattrs()
Michael Bommarito <michael.bommarito@gmail.com>
ceph: bound num_export_targets array for mds info v2/v3
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
Xiubo Li <xiubo.li@clyso.com>
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
libceph: reject buckets with mismatched CRUSH ids
Chuck Lever <cel@kernel.org>
NFSD: Prevent lock owner use-after-free during client teardown
Jeff Layton <jlayton@kernel.org>
nfsd: revoke copy-notify stateids before dropping their reference
Jeff Layton <jlayton@kernel.org>
nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
Robbie Ko <robbieko@synology.com>
nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
Jeff Layton <jlayton@kernel.org>
nfsd: initialize copy-notify stateid before publishing it
Jeff Layton <jlayton@kernel.org>
nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
Jeff Layton <jlayton@kernel.org>
nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
Jeff Layton <jlayton@kernel.org>
nfsd: fix version mismatch loops in nfsd_acl_init_request()
Chris Mason <clm@meta.com>
nfsd: fix cpntf publish race in nfs4_init_cp_state
Jeff Layton <jlayton@kernel.org>
nfsd: check client ownership when cancelling a copy-notify stateid
Jeff Layton <jlayton@kernel.org>
nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
Jeff Layton <jlayton@kernel.org>
nfsd: add filehandle match check to nfsd4_delegreturn()
Jeff Layton <jlayton@kernel.org>
nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
Jeff Layton <jlayton@kernel.org>
nfsd: validate symlink target length in NFSv4 CREATE
Chuck Lever <chuck.lever@oracle.com>
nfsd: sample writeback error cursor before async COPY loop
Jeff Layton <jlayton@kernel.org>
nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
Chuck Lever <chuck.lever@oracle.com>
nfsd: Reset write verifier when async COPY writeback fails
Junrui Luo <moonafterrain@outlook.com>
NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
Mike Snitzer <snitzer@kernel.org>
NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
Michael Bommarito <michael.bommarito@gmail.com>
NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
Chuck Lever <cel@kernel.org>
NFSD: Fix off-by-one in DRC bucket pruning limit
Chuck Lever <cel@kernel.org>
NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
Ibrahim Hashimov <security@auditcode.ai>
ubifs: fix out-of-bounds read in signature length check
Abdurrahman Hussain <abdurrahman@nexthop.ai>
of: fix out-of-bounds read in of_alias_scan() stem parser
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Junrui Luo <moonafterrain@outlook.com>
media: vicodec: fix out-of-bounds write in FWHT encoder
Weigang He <geoffreyhe2@gmail.com>
media: cec: stm32: prevent out-of-bounds write on RX overflow
Vincent Mailhol <mailhol@kernel.org>
lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
Xingrui Li <baka9@bakabaka9.tech>
HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
Daisuke Matsuda <matsuda@preferred.jp>
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
Neill Kapron <nkapron@google.com>
usb: gadget: f_fs: Prevent deadlock during ep0 read loop
Jeffin Philip <jeffinphilip14@gmail.com>
usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
Yun Zhou <yun.zhou@windriver.com>
usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
Myeonghun Pak <mhun512@gmail.com>
usb: gadget: snps_udc_plat: clean up PHY on probe deferral
Sonali Pradhan <sonalipradhan@google.com>
usb: gadget: u_audio: Fix use-after-free on sound card disconnect
Johan Hovold <johan@kernel.org>
USB: phy: fsl-usb: fix missing static keywords
Francesco Lavra <flavra@baylibre.com>
usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
Hao-Qun Huang <alvinhuang0603@gmail.com>
staging: greybus: hid: fix SET_REPORT return value
Hans Verkuil <hverkuil+cisco@kernel.org>
Revert "media: v4l2-dev: fix error handling in __video_register_device()"
James Kim <james010kim@gmail.com>
rapidio: mport_cdev: fix use-after-free in dma_req_free()
Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
powerpc/powermac: fix OF node refcount
Hui Su <sh_def@163.com>
tracing: Fix crash passing ERR_PTR to kthread_stop()
Kiryl Shutsemau (Meta) <kas@kernel.org>
x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
Joy H.J. Lee <rkr0k0r@gmail.com>
tools/compiler: match glibc 2.42 definition of __attribute_const__
Guopeng Zhang <zhangguopeng@kylinos.cn>
mm: memcg: stop reclaim when a limit update is superseded
Breno Leitao <leitao@debian.org>
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
Jordan R Abrahams-Whitehead <ajordanr@google.com>
include/linux/list.h: mark list_add and __list_add as __always_inline
Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
timers/itimer: Zero-init old itimerval before copy to userspace
Felix Yan <felixonmars@archlinux.org>
clocksource/drivers/timer-sun4i: Advertise a real minimum delta
Matt Turner <mattst88@gmail.com>
alpha: don't leak hardware-fabricated FP exception bits to user space
Matt Turner <mattst88@gmail.com>
alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
Takashi Iwai <tiwai@suse.de>
ALSA: aloop: Fix racy access at PCM trigger
-------------
Diffstat:
.../ABI/testing/configfs-usb-gadget-uac1_legacy | 3 -
Documentation/usb/gadget-testing.rst | 3 -
.../media/v4l/ext-ctrls-colorimetry.rst | 12 +-
Makefile | 4 +-
arch/alpha/include/uapi/asm/fpu.h | 8 +-
arch/alpha/kernel/pci-sysfs.c | 6 +-
arch/alpha/kernel/sys_marvel.c | 25 +-
arch/alpha/kernel/traps.c | 6 +-
arch/alpha/math-emu/math.c | 88 ++++-
arch/arm/boot/dts/armada-388-helios4.dts | 13 +
arch/arm/boot/dts/sun4i-a10.dtsi | 2 +-
arch/arm/mach-imx/src.c | 3 +
arch/arm/mach-lpc32xx/common.c | 5 +-
arch/arm/mach-lpc32xx/common.h | 2 +
arch/arm/mach-lpc32xx/phy3250.c | 2 +
arch/arm/mach-lpc32xx/pm.c | 5 +-
arch/arm/mm/fault.c | 16 +-
.../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 4 +-
arch/arm64/boot/dts/amlogic/meson-axg-s400.dts | 4 +
.../boot/dts/marvell/armada-3720-turris-mox.dts | 3 +-
arch/arm64/boot/dts/qcom/sm8250.dtsi | 51 +--
arch/arm64/boot/dts/rockchip/Makefile | 1 +
.../boot/dts/rockchip/rk3399-gru-chromebook.dtsi | 6 +-
.../boot/dts/rockchip/rk3399-gru-scarlet-dumo.dts | 41 +++
arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 1 +
arch/arm64/kernel/hibernate.c | 16 +-
arch/csky/kernel/entry.S | 6 +-
arch/m68k/kernel/traps.c | 4 +-
arch/mips/kernel/ptrace.c | 6 +-
arch/openrisc/kernel/entry.S | 43 ++-
arch/parisc/kernel/head.S | 1 +
arch/powerpc/configs/85xx-hw.config | 1 +
arch/powerpc/kernel/smp.c | 3 +
arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
arch/s390/kernel/debug.c | 10 +-
arch/s390/kvm/guestdbg.c | 9 +-
arch/s390/kvm/interrupt.c | 2 +-
arch/s390/kvm/kvm-s390.c | 7 +-
arch/x86/events/intel/lbr.c | 12 +-
arch/x86/events/intel/uncore.c | 2 -
arch/x86/include/asm/insn-eval.h | 36 ++
arch/x86/include/asm/pkeys.h | 3 +
arch/x86/kvm/emulate.c | 26 +-
arch/x86/kvm/hyperv.c | 25 +-
arch/x86/kvm/vmx/nested.c | 18 +
arch/x86/mm/ident_map.c | 23 +-
block/blk-iocost.c | 2 +-
block/blk-stat.c | 2 +-
block/genhd.c | 7 +
block/kyber-iosched.c | 2 +-
drivers/accessibility/speakup/keyhelp.c | 17 +-
drivers/accessibility/speakup/kobjects.c | 6 +-
drivers/acpi/bus.c | 4 +-
drivers/acpi/pci_root.c | 3 +-
drivers/acpi/processor_core.c | 31 +-
drivers/acpi/processor_idle.c | 34 +-
drivers/acpi/utils.c | 6 +-
drivers/ata/ahci.c | 49 +++
drivers/ata/libata-scsi.c | 28 +-
drivers/auxdisplay/charlcd.c | 21 +-
drivers/base/arch_numa.c | 12 +
drivers/base/firmware_loader/fallback.c | 38 +--
drivers/base/firmware_loader/firmware.h | 10 +
drivers/base/soc.c | 19 +-
drivers/base/swnode.c | 2 +-
drivers/bluetooth/btmtksdio.c | 13 +-
drivers/bluetooth/btusb.c | 15 +-
drivers/bluetooth/hci_bcm.c | 1 +
drivers/bluetooth/hci_h5.c | 4 +-
drivers/bluetooth/hci_intel.c | 1 +
drivers/bluetooth/hci_ldisc.c | 2 +-
drivers/bluetooth/hci_serdev.c | 2 +-
drivers/bluetooth/virtio_bt.c | 8 +-
drivers/bus/mhi/host/main.c | 6 +
drivers/bus/ti-sysc.c | 12 +-
drivers/char/hw_random/ks-sa-rng.c | 22 +-
drivers/char/ipmi/ipmb_dev_int.c | 5 +-
drivers/char/ipmi/ipmi_msghandler.c | 1 +
drivers/char/ppdev.c | 10 +-
drivers/char/tpm/st33zp24/st33zp24.c | 8 +-
drivers/char/tpm/tpm_i2c_nuvoton.c | 6 +-
drivers/char/xilinx_hwicap/xilinx_hwicap.c | 5 +-
drivers/clk/clk-moxart.c | 14 -
drivers/clk/clk-palmas.c | 14 +-
drivers/clk/hisilicon/reset.c | 2 +-
drivers/clk/imx/clk-scu.c | 1 -
drivers/clk/meson/gxbb.c | 2 +-
drivers/clk/qcom/common.c | 4 +-
drivers/clk/qcom/dispcc-sm8250.c | 1 -
drivers/clk/qcom/gcc-mdm9607.c | 182 +----------
drivers/clk/qcom/gcc-msm8916.c | 5 +-
drivers/clk/qcom/gcc-msm8939.c | 5 +-
drivers/clk/qcom/gdsc.c | 108 +++++-
drivers/clk/qcom/gdsc.h | 2 +
drivers/clk/qcom/videocc-sm8250.c | 4 -
drivers/clk/tegra/clk-tegra124-emc.c | 1 +
drivers/clk/x86/clk-pmc-atom.c | 3 +
drivers/clocksource/clps711x-timer.c | 2 +-
drivers/clocksource/timer-armada-370-xp.c | 18 +-
drivers/clocksource/timer-sun4i.c | 2 +-
drivers/cpufreq/imx6q-cpufreq.c | 6 +-
drivers/cpufreq/intel_pstate.c | 19 +-
drivers/cpufreq/spear-cpufreq.c | 4 +-
drivers/crypto/atmel-ecc.c | 45 ++-
drivers/crypto/atmel-sha204a.c | 6 +-
drivers/crypto/gemini/sl3516-ce-cipher.c | 8 -
drivers/crypto/hisilicon/sec2/sec_crypto.c | 12 +-
drivers/crypto/keembay/keembay-ocs-aes-core.c | 5 +-
drivers/crypto/qat/qat_common/qat_algs.c | 1 +
drivers/crypto/sa2ul.c | 19 +-
drivers/dma/dw-edma/dw-edma-core.c | 37 ++-
drivers/dma/hisi_dma.c | 2 +-
drivers/dma/mediatek/mtk-uart-apdma.c | 2 +-
drivers/dma/qcom/bam_dma.c | 1 +
drivers/dma/xilinx/xilinx_dma.c | 12 +-
drivers/firmware/google/coreboot_table.c | 26 +-
drivers/firmware/stratix10-svc.c | 21 +-
drivers/fpga/altera-cvp.c | 10 +-
drivers/fpga/stratix10-soc.c | 21 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +-
drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 74 +++--
.../drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 6 +
.../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 24 ++
.../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 35 +-
.../gpu/drm/bridge/cadence/cdns-mhdp8546-core.c | 2 +-
drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 3 +-
drivers/gpu/drm/bridge/tc358767.c | 2 +-
drivers/gpu/drm/drm_atomic_uapi.c | 2 +
drivers/gpu/drm/drm_drv.c | 34 +-
drivers/gpu/drm/gud/gud_connector.c | 12 +-
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 6 +-
drivers/gpu/drm/lima/lima_device.c | 12 +-
drivers/gpu/drm/msm/dsi/dsi_host.c | 14 +-
drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +-
drivers/gpu/drm/omapdrm/dss/dsi.c | 7 +-
drivers/gpu/drm/omapdrm/dss/dsi.h | 2 -
drivers/gpu/drm/panel/panel-samsung-s6d16d0.c | 10 +-
drivers/gpu/drm/sun4i/sun4i_backend.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_crtc.c | 2 +-
drivers/gpu/drm/sun4i/sun4i_tcon.c | 20 +-
drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 2 +
drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 2 +-
drivers/gpu/drm/sun4i/sun8i_vi_scaler.c | 18 +-
drivers/gpu/drm/tve200/tve200_drv.c | 1 +
drivers/gpu/drm/vmwgfx/ttm_object.c | 7 +-
drivers/gpu/host1x/debug.c | 4 +-
drivers/gpu/host1x/hw/channel_hw.c | 5 +-
drivers/hid/hid-core.c | 127 ++++---
drivers/hid/hid-lg4ff.c | 8 +
drivers/hid/hid-mcp2221.c | 7 +
drivers/hid/hid-picolcd_debugfs.c | 9 +
drivers/hid/hid-rmi.c | 46 ++-
drivers/hid/hid-roccat-kone.c | 8 +-
drivers/hid/hid-roccat.c | 13 +-
drivers/hid/hid-sensor-custom.c | 9 +-
drivers/hid/hid-sensor-hub.c | 46 +--
drivers/hid/i2c-hid/i2c-hid-core.c | 16 +-
drivers/hid/wacom_wac.c | 13 +
drivers/hsi/controllers/omap_ssi_core.c | 6 +
drivers/hwmon/emc1403.c | 6 +-
drivers/hwmon/max6621.c | 8 +-
drivers/hwspinlock/hwspinlock_core.c | 2 +-
drivers/hwtracing/coresight/coresight-etm4x-cfg.c | 2 +-
drivers/hwtracing/coresight/coresight-etm4x-core.c | 87 ++---
.../hwtracing/coresight/coresight-etm4x-sysfs.c | 6 +-
drivers/hwtracing/coresight/coresight-etm4x.h | 38 ++-
drivers/i2c/i2c-core-base.c | 6 +
drivers/i2c/i2c-mux.c | 1 +
drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 +
drivers/i3c/master.c | 11 +-
drivers/i3c/master/dw-i3c-master.c | 10 +-
drivers/i3c/master/mipi-i3c-hci/core.c | 30 +-
drivers/i3c/master/mipi-i3c-hci/dma.c | 4 +-
drivers/i3c/master/mipi-i3c-hci/ext_caps.c | 55 ++--
drivers/i3c/master/mipi-i3c-hci/pio.c | 54 +--
drivers/i3c/master/svc-i3c-master.c | 10 +-
drivers/iio/accel/dmard09.c | 7 +
drivers/iio/chemical/atlas-sensor.c | 6 +-
drivers/iio/chemical/sgp30.c | 3 +
drivers/iio/dac/m62332.c | 17 +-
drivers/iio/gyro/mpu3050-core.c | 2 +-
drivers/iio/light/cm32181.c | 2 +-
drivers/iio/light/gp2ap002.c | 24 +-
drivers/iio/light/isl29028.c | 2 +-
drivers/iio/light/tsl2583.c | 2 +-
drivers/iio/light/tsl2772.c | 2 +-
drivers/iio/orientation/hid-sensor-rotation.c | 20 +-
drivers/iio/proximity/srf04.c | 1 +
drivers/iio/temperature/hid-sensor-temperature.c | 3 +-
drivers/infiniband/core/cma.c | 6 +-
drivers/infiniband/core/cq.c | 14 +-
drivers/infiniband/core/device.c | 27 +-
drivers/infiniband/core/nldev.c | 117 ++++---
drivers/infiniband/core/restrack.c | 4 +-
drivers/infiniband/core/ucma.c | 7 +-
drivers/infiniband/hw/cxgb4/device.c | 8 +-
drivers/infiniband/hw/cxgb4/mem.c | 4 +-
drivers/infiniband/hw/efa/efa_verbs.c | 15 +-
drivers/infiniband/hw/hfi1/chip.c | 4 +-
drivers/infiniband/hw/hfi1/hfi.h | 2 -
drivers/infiniband/hw/hfi1/init.c | 44 +--
drivers/infiniband/hw/hfi1/user_sdma.c | 13 +-
drivers/infiniband/hw/mlx4/cm.c | 29 +-
drivers/infiniband/hw/mlx4/main.c | 18 +-
drivers/infiniband/hw/mlx4/mlx4_ib.h | 6 +
drivers/infiniband/hw/mlx4/qp.c | 121 +++++--
drivers/infiniband/hw/mlx5/cong.c | 8 +-
drivers/infiniband/hw/mlx5/main.c | 9 +
drivers/infiniband/hw/mlx5/qp.c | 144 +++++---
drivers/infiniband/hw/mlx5/qp.h | 2 +
drivers/infiniband/hw/mlx5/qpc.c | 3 +-
drivers/infiniband/sw/rxe/rxe_resp.c | 6 +-
drivers/infiniband/sw/siw/siw_cm.c | 32 +-
drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 +
drivers/infiniband/ulp/isert/ib_isert.c | 85 ++++-
drivers/infiniband/ulp/isert/ib_isert.h | 1 +
drivers/infiniband/ulp/srp/ib_srp.c | 45 ++-
drivers/infiniband/ulp/srpt/ib_srpt.c | 9 +-
drivers/input/tablet/aiptek.c | 33 +-
drivers/interconnect/core.c | 7 +-
drivers/iommu/amd/init.c | 42 ++-
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 5 +-
drivers/iommu/arm/arm-smmu/qcom_iommu.c | 14 +-
drivers/iommu/dma-iommu.c | 13 +-
drivers/iommu/intel/iommu.c | 16 +-
drivers/iommu/msm_iommu.c | 2 +-
drivers/iommu/mtk_iommu_v1.c | 2 +-
drivers/irqchip/irq-gic-v3-its.c | 15 +-
drivers/irqchip/irq-mbigen.c | 20 +-
drivers/leds/leds-pca9532.c | 18 +-
drivers/mailbox/rockchip-mailbox.c | 17 +-
drivers/md/dm-era-target.c | 5 +
drivers/md/dm-log-userspace-base.c | 1 +
drivers/md/dm-stats.c | 6 +-
drivers/md/dm-switch.c | 2 +-
drivers/md/dm.c | 2 +-
drivers/md/md.c | 7 +
drivers/md/persistent-data/dm-array.c | 16 +
drivers/md/raid5-ppl.c | 4 +-
drivers/media/cec/core/cec-adap.c | 8 +-
drivers/media/cec/core/cec-pin.c | 8 +-
drivers/media/cec/platform/meson/ao-cec-g12a.c | 1 +
drivers/media/cec/platform/stm32/stm32-cec.c | 3 +-
drivers/media/dvb-frontends/rtl2832_sdr.c | 23 +-
drivers/media/i2c/ov02a10.c | 12 +-
drivers/media/i2c/ov7740.c | 4 +-
drivers/media/i2c/video-i2c.c | 8 +-
drivers/media/pci/cobalt/cobalt-alsa-main.c | 1 -
drivers/media/pci/cx23885/cimax2.c | 1 +
drivers/media/platform/qcom/venus/hfi_parser.c | 9 +-
drivers/media/rc/sunxi-cir.c | 9 +-
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 +-
drivers/media/test-drivers/vimc/vimc-capture.c | 4 +-
drivers/media/tuners/tda18250.c | 4 +-
drivers/media/usb/airspy/airspy.c | 19 +-
drivers/media/usb/cx231xx/cx231xx-video.c | 4 +-
drivers/media/usb/em28xx/em28xx-cards.c | 3 +-
drivers/media/usb/em28xx/em28xx-core.c | 2 +
drivers/media/usb/go7007/snd-go7007.c | 10 +-
drivers/media/usb/s2255/s2255drv.c | 11 +
drivers/media/usb/usbtv/usbtv-audio.c | 11 +
drivers/media/v4l2-core/v4l2-ctrls-core.c | 49 ++-
drivers/media/v4l2-core/v4l2-dev.c | 14 +-
drivers/media/v4l2-core/v4l2-fwnode.c | 2 +
drivers/mfd/iqs62x.c | 2 +-
drivers/mfd/rave-sp.c | 64 ++--
drivers/misc/ad525x_dpot-i2c.c | 4 +-
drivers/misc/ad525x_dpot-spi.c | 4 +-
drivers/misc/ad525x_dpot.c | 181 +++++-----
drivers/misc/ad525x_dpot.h | 5 +-
drivers/misc/bcm-vk/bcm_vk_msg.c | 6 +-
drivers/misc/cardreader/rtsx_pcr.c | 2 +
drivers/misc/cardreader/rtsx_usb.c | 23 +-
drivers/misc/vmw_vmci/vmci_event.c | 4 +-
drivers/mmc/host/via-sdmmc.c | 8 +-
drivers/mtd/mtdoops.c | 3 +
drivers/mtd/mtdpart.c | 3 +-
drivers/mtd/mtdswap.c | 1 +
drivers/mtd/nand/raw/nand_onfi.c | 27 +-
drivers/mtd/parsers/afs.c | 7 +
drivers/mtd/ubi/attach.c | 4 +-
drivers/mtd/ubi/build.c | 63 +++-
drivers/mtd/ubi/cdev.c | 5 +-
drivers/mtd/ubi/eba.c | 5 +-
drivers/mtd/ubi/fastmap-wl.c | 53 ++-
drivers/mtd/ubi/fastmap.c | 76 +----
drivers/mtd/ubi/io.c | 13 +-
drivers/mtd/ubi/ubi.h | 19 +-
drivers/mtd/ubi/wl.c | 38 ++-
drivers/mtd/ubi/wl.h | 6 +-
drivers/net/bonding/bond_netlink.c | 2 +-
drivers/net/ethernet/allwinner/sun4i-emac.c | 4 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +
drivers/net/ethernet/freescale/fec_main.c | 6 +-
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 12 +-
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_ptp.c | 3 +
.../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 11 +-
drivers/net/ethernet/mellanox/mlx4/qp.c | 14 +-
drivers/net/ethernet/nvidia/forcedeth.c | 6 +-
drivers/net/ethernet/qlogic/qede/qede.h | 8 +-
drivers/net/ethernet/qlogic/qede/qede_fp.c | 1 +
.../net/ethernet/qualcomm/rmnet/rmnet_map_data.c | 1 +
drivers/net/ethernet/realtek/8139cp.c | 2 +-
.../net/ethernet/stmicro/stmmac/dwmac1000_core.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +-
.../net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +-
.../net/ethernet/stmicro/stmmac/stmmac_selftests.c | 41 ++-
drivers/net/gtp.c | 2 +
drivers/net/ipa/ipa_main.c | 29 +-
drivers/net/ipvlan/ipvlan_l3s.c | 1 -
drivers/net/ntb_netdev.c | 38 ++-
drivers/net/ppp/pppox.c | 17 +
drivers/net/slip/slip.c | 11 +-
drivers/net/thunderbolt.c | 6 +-
drivers/net/tun.c | 21 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/wireless/ath/ath10k/snoc.c | 9 +-
drivers/net/wireless/ath/ath11k/debug.c | 12 +-
drivers/net/wireless/ath/ath11k/debug.h | 3 +-
drivers/net/wireless/ath/ath11k/dp_rx.c | 32 +-
drivers/net/wireless/ath/ath11k/trace.c | 1 +
drivers/net/wireless/ath/ath11k/trace.h | 172 ++++++++++
drivers/net/wireless/ath/ath11k/wmi.c | 15 +-
drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 +
drivers/net/wireless/ath/ath6kl/wmi.c | 17 +-
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +-
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 12 +
drivers/net/wireless/mediatek/mt76/mt7615/main.c | 5 +-
drivers/net/wireless/mediatek/mt76/mt76x02_mac.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 8 +-
drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 6 +-
drivers/net/wireless/mediatek/mt76/sdio.c | 11 +-
drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 2 +-
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +-
drivers/net/wireless/realtek/rtlwifi/pci.c | 6 +-
drivers/net/wireless/realtek/rtw88/tx.c | 1 +
drivers/net/wireless/zydas/zd1211rw/zd_usb.c | 8 +
drivers/nfc/pn533/pn533.c | 21 +-
drivers/ntb/ntb_transport.c | 38 +--
drivers/nvdimm/btt.c | 8 +
drivers/nvdimm/label.c | 17 +-
drivers/nvme/host/core.c | 2 +-
drivers/nvme/host/fc.c | 8 +-
drivers/nvme/host/tcp.c | 45 ++-
drivers/nvme/target/rdma.c | 121 ++++---
drivers/nvme/target/tcp.c | 10 +
drivers/nvme/target/zns.c | 2 +-
drivers/of/base.c | 2 +-
drivers/of/property.c | 10 +-
drivers/parisc/eisa.c | 5 +
drivers/pci/controller/dwc/pci-meson.c | 2 +-
drivers/pci/controller/pci-hyperv.c | 1 +
drivers/pci/pci-sysfs.c | 45 ++-
drivers/pci/proc.c | 8 +-
drivers/pci/quirks.c | 2 +-
drivers/perf/arm_spe_pmu.c | 2 +-
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 26 +-
drivers/phy/rockchip/phy-rockchip-inno-csidphy.c | 2 +-
drivers/pinctrl/bcm/pinctrl-bcm2835.c | 1 -
drivers/pinctrl/pinctrl-rockchip.c | 10 +
drivers/platform/chrome/cros_ec_sensorhub_ring.c | 28 +-
drivers/platform/mellanox/mlxbf-pmc.c | 10 +-
drivers/platform/surface/surface_acpi_notify.c | 6 +-
drivers/platform/x86/dell/dell-wmi-base.c | 17 +-
drivers/platform/x86/dell/dell-wmi-privacy.c | 4 +-
.../x86/dell/dell-wmi-sysman/biosattr-interface.c | 1 -
.../x86/dell/dell-wmi-sysman/dell-wmi-sysman.h | 2 +-
drivers/power/supply/bd99954-charger.h | 23 +-
drivers/power/supply/bq24257_charger.c | 16 +-
drivers/power/supply/bq256xx_charger.c | 29 +-
drivers/power/supply/bq27xxx_battery.c | 6 +-
drivers/power/supply/cros_usbpd-charger.c | 17 +-
drivers/power/supply/isp1704_charger.c | 1 +
drivers/power/supply/lp8727_charger.c | 4 +-
drivers/power/supply/max17040_battery.c | 2 +-
drivers/power/supply/sbs-battery.c | 7 +-
drivers/power/supply/sc2731_charger.c | 8 +-
drivers/power/supply/twl4030_charger.c | 12 +-
drivers/power/supply/ucs1002_power.c | 6 +-
drivers/pps/clients/pps-gpio.c | 62 ++--
drivers/pps/pps.c | 10 +-
drivers/rapidio/devices/rio_mport_cdev.c | 10 +-
drivers/rapidio/rio-scan.c | 1 +
drivers/regulator/as3722-regulator.c | 1 -
drivers/regulator/core.c | 6 +-
drivers/regulator/max8998.c | 1 -
drivers/regulator/qcom-rpmh-regulator.c | 6 +-
drivers/remoteproc/mtk_scp.c | 9 +-
drivers/remoteproc/qcom_common.c | 4 +-
drivers/remoteproc/remoteproc_core.c | 160 +++++----
drivers/remoteproc/remoteproc_sysfs.c | 1 -
drivers/rpmsg/qcom_glink_native.c | 36 +-
drivers/rpmsg/qcom_glink_smem.c | 7 +
drivers/rtc/rtc-pcf8563.c | 4 +-
drivers/s390/block/dasd.c | 6 +-
drivers/s390/block/dasd_eckd.c | 40 ++-
drivers/s390/block/dasd_erp.c | 3 +
drivers/scsi/hosts.c | 23 +-
drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +
drivers/scsi/pm8001/pm8001_init.c | 4 +-
drivers/scsi/qla2xxx/qla_attr.c | 7 +-
drivers/scsi/qla2xxx/qla_bsg.c | 39 ++-
drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
drivers/scsi/qla2xxx/qla_dfs.c | 4 +-
drivers/scsi/qla2xxx/qla_edif.c | 3 +
drivers/scsi/qla2xxx/qla_gs.c | 4 +-
drivers/scsi/qla2xxx/qla_init.c | 44 ++-
drivers/scsi/qla2xxx/qla_inline.h | 13 +
drivers/scsi/qla2xxx/qla_isr.c | 39 ++-
drivers/scsi/qla2xxx/qla_mbx.c | 26 +-
drivers/scsi/qla2xxx/qla_nx2.c | 2 +-
drivers/scsi/qla2xxx/qla_os.c | 14 +-
drivers/scsi/scsi_lib.c | 2 +
drivers/scsi/scsi_priv.h | 4 +-
drivers/scsi/scsi_sysfs.c | 81 ++---
drivers/scsi/sd.c | 4 +-
drivers/scsi/smartpqi/smartpqi.h | 25 +-
drivers/scsi/smartpqi/smartpqi_init.c | 123 ++++---
drivers/scsi/smartpqi/smartpqi_sis.c | 11 +-
drivers/scsi/smartpqi/smartpqi_sis.h | 4 +-
drivers/soc/bcm/bcm2835-power.c | 7 +-
drivers/soc/fsl/qe/qe_ic.c | 3 +-
drivers/soc/samsung/exynos-pmu.c | 4 +-
drivers/soc/ti/knav_qmss.h | 1 +
drivers/soc/ti/knav_qmss_queue.c | 14 +-
drivers/soundwire/qcom.c | 2 +-
drivers/spi/spi-img-spfi.c | 5 +-
drivers/spi/spi-sprd-adi.c | 6 +
drivers/staging/fbtft/fbtft-sysfs.c | 2 +-
drivers/staging/greybus/audio_gb.c | 13 +
drivers/staging/greybus/audio_manager_sysfs.c | 2 +-
drivers/staging/greybus/hid.c | 2 +-
drivers/staging/media/meson/vdec/vdec.c | 4 +-
drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +-
drivers/staging/media/tegra-video/vi.c | 9 +-
drivers/staging/octeon/ethernet-mem.c | 43 ++-
drivers/staging/octeon/ethernet-mem.h | 8 +-
drivers/staging/octeon/ethernet-rx.c | 55 ++--
drivers/staging/octeon/ethernet-rx.h | 13 +-
drivers/staging/octeon/ethernet-tx.c | 2 +
drivers/staging/octeon/ethernet.c | 43 ++-
drivers/staging/octeon/octeon-ethernet.h | 14 +
drivers/staging/qlge/qlge_main.c | 4 +-
drivers/staging/rtl8723bs/core/rtw_cmd.c | 8 +-
drivers/staging/rtl8723bs/core/rtw_ieee80211.c | 7 +
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 4 +-
drivers/staging/sm750fb/sm750.c | 4 +-
drivers/target/iscsi/iscsi_target_login.c | 2 +-
drivers/thermal/imx_thermal.c | 9 +-
.../intel/int340x_thermal/int3400_thermal.c | 9 +-
drivers/thermal/qoriq_thermal.c | 13 +-
drivers/tty/hvc/Kconfig | 2 +-
drivers/tty/serial/amba-pl011.c | 10 +
drivers/tty/tty_io.c | 4 +-
drivers/uio/uio.c | 5 +
drivers/usb/atm/usbatm.c | 4 +-
drivers/usb/dwc2/gadget.c | 11 +-
drivers/usb/gadget/configfs.c | 4 +-
drivers/usb/gadget/function/f_fs.c | 14 +-
drivers/usb/gadget/function/f_mass_storage.c | 2 +-
drivers/usb/gadget/function/f_tcm.c | 23 +-
drivers/usb/gadget/function/f_uac1_legacy.c | 56 ----
drivers/usb/gadget/function/f_uvc.c | 7 +-
drivers/usb/gadget/function/u_audio.c | 24 +-
drivers/usb/gadget/function/u_uac1_legacy.h | 3 -
drivers/usb/gadget/functions.c | 2 +-
drivers/usb/gadget/legacy/inode.c | 3 +-
drivers/usb/gadget/udc/r8a66597-udc.c | 1 -
drivers/usb/gadget/udc/snps_udc_plat.c | 5 +-
drivers/usb/host/xhci-ring.c | 32 +-
drivers/usb/image/mdc800.c | 4 +-
drivers/usb/mtu3/mtu3_core.c | 11 +-
drivers/usb/phy/phy-fsl-usb.c | 52 +--
drivers/usb/phy/phy-fsl-usb.h | 6 +-
drivers/usb/renesas_usbhs/common.c | 6 +-
drivers/usb/storage/ene_ub6250.c | 2 +
drivers/usb/typec/ucsi/displayport.c | 2 +-
drivers/vdpa/mlx5/core/mr.c | 2 +-
drivers/vfio/pci/vfio_pci_config.c | 1 +
drivers/video/fbdev/kyro/fbdev.c | 24 +-
.../fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 +-
drivers/video/fbdev/pvr2fb.c | 4 +-
drivers/video/fbdev/uvesafb.c | 2 +
drivers/virtio/virtio_balloon.c | 6 +
drivers/w1/masters/ds2482.c | 4 +
drivers/w1/slaves/w1_ds28e17.c | 8 +
drivers/xen/xenbus/xenbus_xs.c | 16 +-
fs/ceph/caps.c | 11 +-
fs/ceph/mdsmap.c | 11 +-
fs/ceph/xattr.c | 1 +
fs/cifs/cifs_debug.c | 2 +-
fs/ecryptfs/crypto.c | 2 +-
fs/ecryptfs/ecryptfs_kernel.h | 3 +-
fs/ecryptfs/keystore.c | 45 ++-
fs/ecryptfs/messaging.c | 11 +-
fs/ecryptfs/miscdev.c | 5 +-
fs/ecryptfs/super.c | 7 +
fs/ext4/file.c | 7 +
fs/ext4/inline.c | 11 +-
fs/ext4/inode.c | 10 +
fs/ext4/namei.c | 2 +
fs/ext4/orphan.c | 10 +-
fs/f2fs/file.c | 14 +-
fs/f2fs/namei.c | 11 +-
fs/fat/misc.c | 4 +
fs/fat/nfs.c | 4 +-
fs/fuse/cuse.c | 5 +
fs/hfsplus/catalog.c | 25 +-
fs/hfsplus/hfsplus_fs.h | 6 +
fs/hugetlbfs/inode.c | 3 +-
fs/isofs/compress.c | 25 +-
fs/ksmbd/connection.h | 6 +
fs/ksmbd/smb2pdu.c | 14 +-
fs/ksmbd/smbacl.c | 17 +-
fs/ksmbd/transport_tcp.c | 37 +++
fs/lockd/svcsubs.c | 53 +--
fs/nfs/client.c | 21 +-
fs/nfs/filelayout/filelayoutdev.c | 3 +-
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 3 +-
fs/nfs/inode.c | 4 +-
fs/nfs/internal.h | 1 +
fs/nfs/netns.h | 6 +-
fs/nfs/nfs4client.c | 1 +
fs/nfs/pnfs.c | 36 +-
fs/nfs/pnfs.h | 3 +-
fs/nfs/pnfs_nfs.c | 39 ++-
fs/nfsd/flexfilelayoutxdr.c | 20 +-
fs/nfsd/nfs2acl.c | 31 +-
fs/nfsd/nfs4proc.c | 39 ++-
fs/nfsd/nfs4state.c | 206 +++++++++---
fs/nfsd/nfs4xdr.c | 17 +
fs/nfsd/nfscache.c | 2 +-
fs/nfsd/nfsfh.c | 4 +-
fs/nfsd/nfsproc.c | 7 +
fs/nfsd/nfssvc.c | 4 +-
fs/nfsd/nfsxdr.c | 32 +-
fs/nilfs2/bmap.c | 2 +-
fs/nilfs2/bmap.h | 2 +-
fs/nilfs2/btree.c | 39 ++-
fs/nilfs2/direct.c | 4 +-
fs/nilfs2/segment.c | 4 +
fs/nilfs2/the_nilfs.c | 6 +
fs/notify/fanotify/fanotify_user.c | 17 +-
fs/notify/inotify/inotify_user.c | 15 +-
fs/ntfs3/frecord.c | 9 +
fs/ntfs3/fslog.c | 47 ++-
fs/ntfs3/fsntfs.c | 8 +-
fs/ntfs3/xattr.c | 25 +-
fs/ocfs2/acl.c | 141 +++++---
fs/ocfs2/acl.h | 19 +-
fs/ocfs2/cluster/heartbeat.c | 201 +++++++++---
fs/ocfs2/cluster/heartbeat.h | 7 +-
fs/ocfs2/cluster/netdebug.c | 2 +-
fs/ocfs2/cluster/nodemanager.c | 10 +
fs/ocfs2/cluster/nodemanager.h | 1 +
fs/ocfs2/cluster/tcp.c | 89 +++--
fs/ocfs2/cluster/tcp.h | 1 +
fs/ocfs2/dir.c | 2 +-
fs/ocfs2/dlm/dlmdomain.c | 2 +-
fs/ocfs2/dlm/dlmmaster.c | 6 +
fs/ocfs2/dlm/dlmrecovery.c | 9 +
fs/ocfs2/namei.c | 17 +-
fs/ocfs2/refcounttree.c | 47 ++-
fs/ocfs2/stack_o2cb.c | 6 +-
fs/ocfs2/xattr.c | 91 +++---
fs/ocfs2/xattr.h | 9 +-
fs/orangefs/devorangefs-req.c | 1 +
fs/orangefs/orangefs-debugfs.c | 1 +
fs/squashfs/cache.c | 2 +-
fs/ubifs/auth.c | 2 +-
fs/udf/inode.c | 2 +-
fs/udf/partition.c | 2 +-
fs/udf/super.c | 23 +-
fs/udf/symlink.c | 2 +
include/linux/bitfield.h | 95 +++++-
include/linux/bpf.h | 1 +
include/linux/efi.h | 4 +-
include/linux/hid.h | 1 +
include/linux/irq.h | 25 ++
include/linux/irqdomain.h | 23 ++
include/linux/list.h | 15 +-
include/linux/mlx4/qp.h | 1 +
include/linux/netdevice.h | 50 ++-
include/linux/nfs_xdr.h | 2 +-
include/linux/of_graph.h | 4 +-
include/linux/remoteproc.h | 284 +---------------
include/linux/rsc_table.h | 364 +++++++++++++++++++++
include/linux/rtsx_usb.h | 3 +
include/linux/sunrpc/svc_rdma_pcl.h | 2 +-
include/linux/virtio_net.h | 4 +
include/media/rc-map.h | 2 -
include/net/bluetooth/l2cap.h | 11 +-
include/net/inet_connection_sock.h | 12 +-
include/net/ip_tunnels.h | 11 +-
include/net/pkt_cls.h | 6 +-
include/net/pkt_sched.h | 1 +
include/net/sch_generic.h | 1 +
include/net/sctp/structs.h | 2 +-
include/net/tc_act/tc_skbmod.h | 1 +
include/net/tcp.h | 13 +-
include/net/xfrm.h | 1 -
include/rdma/ib_verbs.h | 11 +-
include/scsi/scsi_device.h | 7 +
include/scsi/scsi_host.h | 12 +
include/uapi/linux/time_types.h | 2 +-
include/uapi/mtd/ubi-user.h | 8 +-
kernel/auditfilter.c | 6 +-
kernel/bpf/cgroup.c | 2 +-
kernel/bpf/core.c | 5 +
kernel/bpf/net_namespace.c | 17 +-
kernel/bpf/ringbuf.c | 2 +-
kernel/bpf/verifier.c | 30 +-
kernel/entry/common.c | 3 +
kernel/irq/generic-chip.c | 147 ++++++---
kernel/irq/irqdomain.c | 57 +++-
kernel/locking/lockdep.c | 2 +
kernel/power/wakelock.c | 2 +-
kernel/sched/cpufreq_schedutil.c | 17 +-
kernel/sched/fair.c | 22 +-
kernel/signal.c | 4 +
kernel/sys.c | 2 +-
kernel/taskstats.c | 3 +-
kernel/time/clocksource.c | 8 +-
kernel/time/itimer.c | 2 +-
kernel/time/timekeeping.c | 6 +
kernel/time/timer.c | 1 +
kernel/trace/trace.c | 28 +-
kernel/trace/trace.h | 4 +-
kernel/trace/trace_events.c | 136 ++++++--
kernel/trace/trace_mmiotrace.c | 24 +-
lib/string.c | 3 +-
lib/test_hmm.c | 2 +-
lib/ucs2_string.c | 2 +-
mm/damon/core-test.h | 8 +
mm/damon/vaddr-test.h | 5 +
mm/damon/vaddr.c | 33 +-
mm/memcontrol.c | 6 +
mm/vmscan.c | 2 +-
net/ax25/ax25_dev.c | 2 +-
net/batman-adv/bridge_loop_avoidance.c | 80 ++---
net/batman-adv/distributed-arp-table.c | 66 ++--
net/batman-adv/main.c | 4 +
net/batman-adv/types.h | 2 +-
net/bluetooth/6lowpan.c | 25 +-
net/bluetooth/hci_event.c | 7 +-
net/bluetooth/l2cap_core.c | 58 +++-
net/bluetooth/l2cap_sock.c | 114 +++++--
net/bluetooth/msft.c | 5 +
net/bluetooth/rfcomm/core.c | 12 +-
net/bridge/br_mrp_netlink.c | 4 +-
net/bridge/br_netlink_tunnel.c | 3 +-
net/bridge/br_vlan.c | 4 +-
net/ceph/messenger_v2.c | 5 +
net/ceph/osdmap.c | 2 +
net/core/dev.c | 6 +-
net/core/filter.c | 6 +-
net/core/lwt_bpf.c | 15 +-
net/core/skbuff.c | 11 +-
net/core/xdp.c | 4 +-
net/dccp/dccp.h | 4 +-
net/dccp/ipv4.c | 4 +-
net/dccp/ipv6.c | 7 +-
net/dccp/minisocks.c | 2 +-
net/hsr/hsr_device.c | 14 +-
net/hsr/hsr_framereg.c | 63 ++--
net/hsr/hsr_main.h | 8 +-
net/ipv4/esp4.c | 49 +--
net/ipv4/inet_connection_sock.c | 9 +
net/ipv4/ip_tunnel.c | 2 +-
net/ipv4/syncookies.c | 2 +-
net/ipv4/tcp_fastopen.c | 2 +-
net/ipv4/tcp_ipv4.c | 8 +-
net/ipv4/tcp_minisocks.c | 2 +-
net/ipv4/tcp_output.c | 2 +-
net/ipv6/esp6.c | 49 +--
net/ipv6/ip6_gre.c | 34 +-
net/ipv6/ip6_tunnel.c | 22 +-
net/ipv6/route.c | 2 +-
net/ipv6/seg6_local.c | 9 +
net/ipv6/sit.c | 2 +-
net/ipv6/tcp_ipv6.c | 98 +++---
net/ipv6/xfrm6_input.c | 2 +-
net/iucv/af_iucv.c | 2 +
net/kcm/kcmsock.c | 3 +
net/key/af_key.c | 52 ++-
net/mac80211/s1g.c | 2 +-
net/mac80211/tx.c | 3 +-
net/mpls/af_mpls.c | 2 +
net/mptcp/subflow.c | 6 +-
net/mptcp/syncookies.c | 1 +
net/netfilter/Kconfig | 2 +-
net/netfilter/ipvs/ip_vs_ftp.c | 10 +-
net/netfilter/nf_nat_sip.c | 5 +
net/netfilter/nf_tables_api.c | 14 +-
net/netfilter/xt_cgroup.c | 21 +-
net/netfilter/xt_hl.c | 27 ++
net/nfc/digital_core.c | 2 +-
net/nfc/llcp_core.c | 29 +-
net/nfc/llcp_sock.c | 14 +-
net/nfc/nci/data.c | 10 +-
net/nfc/nci/rsp.c | 41 ++-
net/openvswitch/conntrack.c | 130 +++++---
net/openvswitch/conntrack.h | 6 +-
net/openvswitch/datapath.c | 60 ++--
net/openvswitch/datapath.h | 26 +-
net/openvswitch/vport.h | 8 +
net/phonet/pep.c | 2 +-
net/rds/cong.c | 4 +-
net/sched/act_skbmod.c | 38 ++-
net/sched/cls_api.c | 30 +-
net/sched/cls_flower.c | 8 +-
net/sched/cls_matchall.c | 8 +-
net/sched/sch_api.c | 7 +-
net/sched/sch_codel.c | 2 +-
net/sched/sch_fq.c | 30 +-
net/sched/sch_fq_codel.c | 6 +-
net/sched/sch_fq_pie.c | 3 +-
net/sched/sch_generic.c | 9 +-
net/sched/sch_hhf.c | 4 +
net/sched/sch_htb.c | 7 +-
net/sched/sch_sfq.c | 3 +-
net/sched/sch_teql.c | 1 +
net/sctp/inqueue.c | 7 +-
net/sctp/sm_sideeffect.c | 4 +
net/sctp/stream.c | 48 ++-
net/smc/af_smc.c | 6 +-
net/smc/smc_core.c | 14 +-
net/smc/smc_llc.c | 1 +
net/sunrpc/auth_gss/auth_gss.c | 6 +-
net/sunrpc/auth_gss/gss_krb5_wrap.c | 13 +-
net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 -
net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 -
net/sunrpc/auth_gss/svcauth_gss.c | 3 +-
net/sunrpc/cache.c | 7 +-
net/sunrpc/rpcb_clnt.c | 4 +
net/sunrpc/sunrpc_syms.c | 1 +
net/sunrpc/svc.c | 29 +-
net/sunrpc/xdr.c | 2 +-
net/sunrpc/xprtrdma/svc_rdma_rw.c | 9 +-
net/vmw_vsock/af_vsock.c | 6 +-
net/vmw_vsock/virtio_transport.c | 2 +-
net/xfrm/xfrm_state.c | 3 -
scripts/tags.sh | 2 +-
security/apparmor/lib.c | 20 +-
security/integrity/ima/ima_appraise.c | 2 +
security/selinux/include/security.h | 4 +-
security/selinux/selinuxfs.c | 7 +-
security/selinux/ss/services.c | 45 ++-
security/smack/smack.h | 5 +-
security/smack/smack_lsm.c | 95 ++++--
security/smack/smackfs.c | 222 ++++---------
sound/core/control.c | 27 +-
sound/core/control_compat.c | 69 ++--
sound/core/init.c | 4 +-
sound/core/pcm_native.c | 2 +
sound/core/seq/seq_clientmgr.c | 1 +
sound/drivers/aloop.c | 107 +++---
sound/drivers/mpu401/mpu401.c | 6 +
sound/drivers/mts64.c | 6 +
sound/drivers/portman2x4.c | 6 +
sound/drivers/serial-u16550.c | 6 +
sound/drivers/virmidi.c | 6 +
sound/parisc/harmony.c | 6 +-
sound/pci/asihpi/hpi6000.c | 5 +
sound/pci/hda/hda_proc.c | 2 +-
sound/pci/pcxhr/pcxhr.c | 14 +-
sound/pci/via82xx_modem.c | 26 +-
sound/soc/codecs/cs35l33.c | 14 +-
sound/soc/codecs/cs35l34.c | 14 +-
sound/soc/codecs/rt700-sdw.c | 6 +-
sound/soc/fsl/fsl-asoc-card.c | 4 +-
sound/soc/fsl/fsl_audmix.c | 24 +-
sound/soc/fsl/mpc5200_psc_i2s.c | 1 +
sound/soc/intel/atom/sst/sst_pci.c | 4 +-
sound/soc/meson/meson-card-utils.c | 17 +-
sound/soc/pxa/pxa-ssp.c | 7 +-
sound/soc/samsung/aries_wm8994.c | 1 +
sound/soc/soc-dapm.c | 2 +-
sound/soc/xilinx/xlnx_formatter_pcm.c | 14 +-
sound/usb/6fire/comm.c | 9 +-
sound/usb/bcd2000/bcd2000.c | 11 +-
sound/usb/midi.c | 2 +
tools/bpf/bpftool/btf.c | 11 +-
tools/bpf/bpftool/gen.c | 12 +-
tools/bpf/bpftool/iter.c | 7 +-
tools/bpf/bpftool/map.c | 51 +--
tools/bpf/bpftool/map_perf_ring.c | 9 +-
tools/bpf/bpftool/struct_ops.c | 14 +-
tools/include/linux/compiler.h | 2 +-
tools/perf/builtin-sched.c | 40 ++-
tools/perf/builtin-stat.c | 15 +-
tools/perf/tests/shell/stat_bpf_counters.sh | 97 ++++--
tools/perf/ui/browsers/hists.c | 6 +-
tools/perf/util/auxtrace.c | 15 +-
tools/perf/util/cs-etm.c | 81 ++++-
tools/perf/util/dso.c | 19 +-
tools/perf/util/intel-bts.c | 2 +-
tools/perf/util/intel-pt.c | 2 +-
tools/perf/util/machine.c | 34 +-
tools/perf/util/synthetic-events.c | 6 +-
tools/perf/util/thread-stack.c | 2 +-
tools/perf/util/trace-event-read.c | 33 +-
.../selftests/arm64/mte/check_buffer_fill.c | 2 +
.../selftests/arm64/mte/check_child_memory.c | 2 +
.../selftests/arm64/mte/check_gcr_el1_cswitch.c | 1 +
.../selftests/arm64/mte/check_hugetlb_options.c | 298 +++++++++++++++++
.../selftests/arm64/mte/check_ksm_options.c | 31 +-
.../selftests/arm64/mte/check_mmap_options.c | 2 +
.../selftests/arm64/mte/check_tags_inclusion.c | 2 +
tools/testing/selftests/arm64/mte/check_user_mem.c | 2 +
tools/testing/selftests/bpf/README.rst | 32 +-
tools/testing/selftests/bpf/test_sockmap.c | 3 +-
tools/testing/selftests/bpf/vmtest.sh | 111 ++++---
.../selftests/rseq/rseq-x86-thread-pointer.h | 4 +-
tools/testing/selftests/timers/leap-a-day.c | 19 +-
tools/testing/selftests/zram/zram_lib.sh | 2 +-
816 files changed, 9364 insertions(+), 4585 deletions(-)
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 001/935] ALSA: aloop: Fix racy access at PCM trigger
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 002/935] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Greg Kroah-Hartman
` (936 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5f8f3acdee1ec7a7ef7b,
Takashi Iwai, Karl Mehltretter, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 826af7fa62e347464b1b4e0ba2fe19a92438084f ]
The PCM trigger callback of aloop driver tries to check the PCM state
and stop the stream of the tied substream in the corresponding cable.
Since both check and stop operations are performed outside the cable
lock, this may result in UAF when a program attempts to trigger
frequently while opening/closing the tied stream, as spotted by
fuzzers.
For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with
cable->lock spinlock, and add the proper NULL checks. This avoids
already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream
that may be stopped in this function, which was the major pain point
leading to UAF.
Reported-by: syzbot+5f8f3acdee1ec7a7ef7b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/69783ba1.050a0220.c9109.0011.GAE@google.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260203141003.116584-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ Karl Mehltretter: open-coded spin_lock_irqsave() instead of scoped_guard();
used snd_pcm_running() instead of cruntime->state; dropped the access-mode
comparison and notification (462494565c27, e299a9fd433f, cdac6e1f7164);
kept the stop_count handling from the e5c33cdc6f40 backport. ]
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/aloop.c | 99 ++++++++++++++++++++++++++-----------------
1 file changed, 59 insertions(+), 40 deletions(-)
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index c083b223df85c..74cfd9119ccf6 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -322,56 +322,75 @@ static int loopback_snd_timer_close_cable(struct loopback_pcm *dpcm)
static int loopback_check_format(struct loopback_cable *cable, int stream)
{
+ struct loopback_pcm *dpcm_play, *dpcm_capt;
struct snd_pcm_runtime *runtime, *cruntime;
struct loopback_setup *setup;
struct snd_card *card;
- int check;
+ unsigned long flags;
+ bool stop_capture = false;
+ int check, err = 0;
+
+ spin_lock_irqsave(&cable->lock, flags);
+ dpcm_play = cable->streams[SNDRV_PCM_STREAM_PLAYBACK];
+ dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE];
if (cable->valid != CABLE_VALID_BOTH) {
- if (stream == SNDRV_PCM_STREAM_PLAYBACK)
- goto __notify;
- return 0;
- }
- runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
- substream->runtime;
- cruntime = cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
- substream->runtime;
- check = runtime->format != cruntime->format ||
- runtime->rate != cruntime->rate ||
- runtime->channels != cruntime->channels;
- if (!check)
- return 0;
- if (stream == SNDRV_PCM_STREAM_CAPTURE) {
- return -EIO;
+ if (stream == SNDRV_PCM_STREAM_CAPTURE || !dpcm_play)
+ goto unlock;
} else {
- /* close must not free the peer runtime below */
- atomic_inc(&cable->stop_count);
- snd_pcm_stop(cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
- substream, SNDRV_PCM_STATE_DRAINING);
- if (atomic_dec_and_test(&cable->stop_count))
- wake_up(&cable->stop_wait);
- __notify:
- runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
- substream->runtime;
- setup = get_setup(cable->streams[SNDRV_PCM_STREAM_PLAYBACK]);
- card = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->loopback->card;
- if (setup->format != runtime->format) {
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
- &setup->format_id);
- setup->format = runtime->format;
+ if (!dpcm_play || !dpcm_capt) {
+ err = -EIO;
+ goto unlock;
}
- if (setup->rate != runtime->rate) {
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
- &setup->rate_id);
- setup->rate = runtime->rate;
+ runtime = dpcm_play->substream->runtime;
+ cruntime = dpcm_capt->substream->runtime;
+ if (!runtime || !cruntime) {
+ err = -EIO;
+ goto unlock;
}
- if (setup->channels != runtime->channels) {
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
- &setup->channels_id);
- setup->channels = runtime->channels;
+ check = runtime->format != cruntime->format ||
+ runtime->rate != cruntime->rate ||
+ runtime->channels != cruntime->channels;
+ if (!check)
+ goto unlock;
+ if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ err = -EIO;
+ goto unlock;
+ } else if (snd_pcm_running(dpcm_capt->substream)) {
+ /* close must not free the peer runtime below */
+ atomic_inc(&cable->stop_count);
+ stop_capture = true;
}
}
- return 0;
+
+ setup = get_setup(dpcm_play);
+ card = dpcm_play->loopback->card;
+ runtime = dpcm_play->substream->runtime;
+ if (setup->format != runtime->format) {
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &setup->format_id);
+ setup->format = runtime->format;
+ }
+ if (setup->rate != runtime->rate) {
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &setup->rate_id);
+ setup->rate = runtime->rate;
+ }
+ if (setup->channels != runtime->channels) {
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &setup->channels_id);
+ setup->channels = runtime->channels;
+ }
+
+unlock:
+ spin_unlock_irqrestore(&cable->lock, flags);
+ if (stop_capture) {
+ snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING);
+ if (atomic_dec_and_test(&cable->stop_count))
+ wake_up(&cable->stop_wait);
+ }
+
+ return err;
}
static void loopback_active_notify(struct loopback_pcm *dpcm)
--
2.53.0
^ permalink raw reply related [flat|nested] 945+ messages in thread
* [PATCH 5.15 002/935] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 001/935] ALSA: aloop: Fix racy access at PCM trigger Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 003/935] alpha: dont leak hardware-fabricated FP exception bits to user space Greg Kroah-Hartman
` (935 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit 49672d026cc4773608e1222b69b29fd70f41336b upstream.
ieee_swcr_to_fpcr() converts the software IEEE trap-enable and status
bits kept in thread_info.ieee_state into the hardware FPCR format. It
contained:
fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;
FPCR_DNOD (bit 47) disables denormal operand traps: with it set the
hardware handles a denormal operand itself, treating it as zero, instead
of trapping for software completion. The intent was to set DNOD when the
user has not asked for SIGFPE on denormal operands, but
IEEE_TRAP_ENABLE_DNO is clear by default, so ieee_swcr_to_fpcr(0) always
set DNOD.
Instructions built with the software completion suffix therefore never
trapped on a denormal operand. The hardware silently substituted zero
and produced wrong results, affecting every program compiled with -mieee
and default FPU settings, glibc included.
Set FPCR_DNOD only when IEEE_MAP_DMZ is requested, which is exactly the
case where flushing denormal inputs to zero is what the user asked for.
DNOD then encodes MAP_DMZ, which ieee_fpcr_to_swcr() already recovers
from FPCR_DNZ, so drop its attempt to recover IEEE_TRAP_ENABLE_DNO from
DNOD; the DNO trap enable lives solely in ieee_state.
Both functions are in a uapi header, so the encoding change is visible to
userspace, but nothing outside the kernel is known to depend on DNOD
carrying the DNO trap enable, and the kernel is the only writer of the
FPCR.
This must not be backported on its own. Re-enabling denormal operand
traps exposes a second bug, fixed in the following patch: those traps
usually find an exact result, and for an exact result the emulator did
not write the FPCR back, leaving hardware-fabricated exception bits
visible to user space. Taken alone this change would make spurious
exception flags more common.
The bug predates the git history, so there is no commit to reference in a
Fixes tag.
Cc: stable@vger.kernel.org # 5.15+
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-1-c99d75608e60@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/include/uapi/asm/fpu.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/alpha/include/uapi/asm/fpu.h
+++ b/arch/alpha/include/uapi/asm/fpu.h
@@ -101,7 +101,12 @@ ieee_swcr_to_fpcr(unsigned long sw)
| IEEE_TRAP_ENABLE_OVF)) << 48;
fp |= (~sw & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE)) << 57;
fp |= (sw & IEEE_MAP_UMZ ? FPCR_UNDZ | FPCR_UNFD : 0);
- fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;
+ /*
+ * Disable denormal operand traps only when denormal inputs are to be
+ * flushed to zero. Otherwise they must keep trapping, so that /S
+ * instructions reach the kernel emulation handler.
+ */
+ fp |= (sw & IEEE_MAP_DMZ ? FPCR_DNOD : 0);
return fp;
}
@@ -116,7 +121,6 @@ ieee_fpcr_to_swcr(unsigned long fp)
| IEEE_TRAP_ENABLE_OVF);
sw |= (~fp >> 57) & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE);
sw |= (fp >> 47) & IEEE_MAP_UMZ;
- sw |= (~fp >> 41) & IEEE_TRAP_ENABLE_DNO;
return sw;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 003/935] alpha: dont leak hardware-fabricated FP exception bits to user space
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 001/935] ALSA: aloop: Fix racy access at PCM trigger Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 002/935] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 004/935] clocksource/drivers/timer-sun4i: Advertise a real minimum delta Greg Kroah-Hartman
` (934 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit bcfe3187412e342b4619efb92c945f073855ebc0 upstream.
On EV6 and later the hardware records exception status bits in the FPCR
before delivering a software completion trap, and those bits can be wrong
for the instruction that trapped. Converting a double that is exactly
representable as a subnormal float sets FPCR_UNF even though the result
is exact, and an underflow trap additionally sets FPCR_INE even when the
emulated operation turns out to be exact.
alpha_fp_emul() only wrote the FPCR when soft-fp raised an exception, so
whenever it determined that the instruction was exact the fabricated bits
stayed in the FPCR and were reported to user space by fetestexcept().
Pass the exception summary register down from do_entArith() so the
handler can tell which exceptions the hardware attributed to the trapping
instruction, and always write the FPCR. Clear the exceptions that the
trap reported but that soft-fp did not raise. EXC_SUM reports only the
underflow or overflow when the hardware also set INE, so treat INE as a
candidate in that case, and treat a trap with no reported exception as a
denormal operand trap, for which the hardware can fabricate INE and UNF
as well. Bits that software has already confirmed in ieee_state belong
to this or an earlier instruction and are never cleared.
The imprecise path passes no summary. There the trap was taken somewhere
in the trap shadow, so EXC_SUM is not attribution for the instruction
being re-executed -- and only EV6, which traps precisely and so never
takes that path, has fabricated bits to clear. For the same reason the
clearing is guarded by implver(), matching swcr_update_status().
On an UP1500 (EV68) this takes the glibc math testsuite from 831 failures
to 28, the remainder being unrelated to exception status.
This belongs with the preceding fix to ieee_swcr_to_fpcr(), and should
not be backported without it -- nor it without this. That fix stops
FPCR_DNOD being set unconditionally, so denormal operand traps start
firing again. Those traps very often find an exact result, which is
precisely the case where the old code left the FPCR unwritten and the
fabricated bits visible. Applied alone it would make spurious exception
flags more common, not less.
One case cannot be resolved here: an inexact instruction without the
software completion suffix never traps, so its INE reaches the FPCR
without being recorded anywhere else. Such a bit is indistinguishable
from an INE the hardware fabricated for a trapping instruction, and is
lost if an underflow or overflow trap with an exact result follows it.
The FPCR is the only record of those instructions and it carries no
attribution.
The bug predates the git history, so there is no commit to reference in a
Fixes tag.
Cc: stable@vger.kernel.org # 5.15+
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-2-c99d75608e60@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/traps.c | 6 +--
arch/alpha/math-emu/math.c | 88 +++++++++++++++++++++++++++++++++++++++------
2 files changed, 80 insertions(+), 14 deletions(-)
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -200,12 +200,12 @@ static long dummy_emul(void) { return 0;
long (*alpha_fp_emul_imprecise)(struct pt_regs *regs, unsigned long writemask)
= (void *)dummy_emul;
EXPORT_SYMBOL_GPL(alpha_fp_emul_imprecise);
-long (*alpha_fp_emul) (unsigned long pc)
+long (*alpha_fp_emul) (unsigned long pc, unsigned long summary)
= (void *)dummy_emul;
EXPORT_SYMBOL_GPL(alpha_fp_emul);
#else
long alpha_fp_emul_imprecise(struct pt_regs *regs, unsigned long writemask);
-long alpha_fp_emul (unsigned long pc);
+long alpha_fp_emul (unsigned long pc, unsigned long summary);
#endif
asmlinkage void
@@ -219,7 +219,7 @@ do_entArith(unsigned long summary, unsig
emulate the instruction. If the processor supports
precise exceptions, we don't have to search. */
if (!amask(AMASK_PRECISE_TRAP))
- si_code = alpha_fp_emul(regs->pc - 4);
+ si_code = alpha_fp_emul(regs->pc - 4, summary);
else
si_code = alpha_fp_emul_imprecise(regs, write_mask);
if (si_code == 0)
--- a/arch/alpha/math-emu/math.c
+++ b/arch/alpha/math-emu/math.c
@@ -57,13 +57,13 @@ MODULE_DESCRIPTION("FP Software completi
MODULE_LICENSE("GPL v2");
extern long (*alpha_fp_emul_imprecise)(struct pt_regs *, unsigned long);
-extern long (*alpha_fp_emul) (unsigned long pc);
+extern long (*alpha_fp_emul) (unsigned long pc, unsigned long summary);
static long (*save_emul_imprecise)(struct pt_regs *, unsigned long);
-static long (*save_emul) (unsigned long pc);
+static long (*save_emul) (unsigned long pc, unsigned long summary);
long do_alpha_fp_emul_imprecise(struct pt_regs *, unsigned long);
-long do_alpha_fp_emul(unsigned long);
+long do_alpha_fp_emul(unsigned long, unsigned long);
static int alpha_fp_emul_init_module(void)
{
@@ -91,7 +91,22 @@ module_exit(alpha_fp_emul_cleanup_module
/*
- * Emulate the floating point instruction at address PC. Returns -1 if the
+ * Exception bits of the exception summary register (EXC_SUM). Bit 0 is the
+ * software completion bit; bits 1 through 5 report the exceptions the
+ * hardware attributed to the trapping instruction, and lie at the same
+ * positions as the corresponding IEEE_TRAP_ENABLE_* bits.
+ */
+#define EXC_SUM_INV (1UL << 1)
+#define EXC_SUM_DZE (1UL << 2)
+#define EXC_SUM_OVF (1UL << 3)
+#define EXC_SUM_UNF (1UL << 4)
+#define EXC_SUM_INE (1UL << 5)
+#define EXC_SUM_MASK (EXC_SUM_INV | EXC_SUM_DZE | EXC_SUM_OVF \
+ | EXC_SUM_UNF | EXC_SUM_INE)
+
+/*
+ * Emulate the floating point instruction at address PC. SUMMARY is the
+ * exception summary register the trap was delivered with. Returns -1 if the
* instruction to be emulated is illegal (such as with the opDEC trap), else
* the SI_CODE for a SIGFPE signal, else 0 if everything's ok.
*
@@ -100,7 +115,7 @@ module_exit(alpha_fp_emul_cleanup_module
* stick the result of the operation into the appropriate register.
*/
long
-alpha_fp_emul (unsigned long pc)
+alpha_fp_emul (unsigned long pc, unsigned long summary)
{
FP_DECL_EX;
FP_DECL_S(SA); FP_DECL_S(SB); FP_DECL_S(SR);
@@ -305,12 +320,56 @@ done:
swcr |= (_fex << IEEE_STATUS_TO_EXCSUM_SHIFT);
current_thread_info()->ieee_state
|= (_fex << IEEE_STATUS_TO_EXCSUM_SHIFT);
+ }
- /* Update hardware control register. */
- fpcr &= (~FPCR_MASK | FPCR_DYN_MASK);
- fpcr |= ieee_swcr_to_fpcr(swcr);
- wrfpcr(fpcr);
+ /*
+ * EV6 records exception status bits in the FPCR before delivering the
+ * software completion trap, and swcr_update_status() above merged them
+ * into SWCR. Some can be wrong for the instruction we just emulated:
+ * a CVTTS of a value exactly representable as a subnormal sets FPCR_UNF
+ * even though the result is exact. Clear the exceptions the trap
+ * reported but that soft-fp did not raise.
+ */
+ if (implver() == IMPLVER_EV6) {
+ unsigned long spurious = summary & EXC_SUM_MASK;
+
+ if (spurious & (EXC_SUM_UNF | EXC_SUM_OVF)) {
+ /*
+ * EXC_SUM reports only the underflow or overflow,
+ * but the hardware sets INE alongside it in the FPCR.
+ */
+ spurious |= EXC_SUM_INE;
+ } else if (!spurious) {
+ /*
+ * No exception reported, so this was a denormal
+ * operand trap, for which INE and UNF can be
+ * fabricated as well.
+ */
+ spurious = EXC_SUM_INE | EXC_SUM_UNF;
+ }
+ /*
+ * Never clear an exception software has confirmed. Every
+ * instruction that genuinely raises one traps for software
+ * completion and is recorded in ieee_state above, so a bit
+ * found there -- including one just set from _fex -- belongs
+ * to this or an earlier instruction and must survive.
+ */
+ spurious &= ~(current_thread_info()->ieee_state
+ >> IEEE_STATUS_TO_EXCSUM_SHIFT);
+
+ swcr &= ~(spurious << IEEE_STATUS_TO_EXCSUM_SHIFT);
+ }
+
+ /*
+ * Update hardware control register. This has to happen even when
+ * soft-fp raised nothing, to clear any fabricated bits.
+ */
+ fpcr &= (~FPCR_MASK | FPCR_DYN_MASK);
+ fpcr |= ieee_swcr_to_fpcr(swcr);
+ wrfpcr(fpcr);
+
+ if (_fex) {
/* Do we generate a signal? */
_fex = _fex & swcr & IEEE_TRAP_ENABLE_MASK;
si_code = 0;
@@ -392,9 +451,16 @@ alpha_fp_emul_imprecise (struct pt_regs
break;
}
if (!write_mask) {
- /* Re-execute insns in the trap-shadow. */
+ /*
+ * Re-execute insns in the trap-shadow. Pass no
+ * exception summary: it describes the trap, which
+ * was taken anywhere in the shadow, and so is not
+ * attribution for this instruction. Nothing is
+ * lost, since only EV6 -- which traps precisely and
+ * never comes this way -- needs it.
+ */
regs->pc = trigger_pc + 4;
- si_code = alpha_fp_emul(trigger_pc);
+ si_code = alpha_fp_emul(trigger_pc, 0);
goto egress;
}
trigger_pc -= 4;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 004/935] clocksource/drivers/timer-sun4i: Advertise a real minimum delta
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 003/935] alpha: dont leak hardware-fabricated FP exception bits to user space Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 005/935] timers/itimer: Zero-init old itimerval before copy to userspace Greg Kroah-Hartman
` (933 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Indrek Kruusa, Felix Yan,
Daniel Lezcano, Jernej Skrabec
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Yan <felixonmars@archlinux.org>
commit d21808328225ab8cee46885bf9a0dffcefbe630e upstream.
sun4i_clkevt_next_event() compensates for the timer stop/start
synchronization delay by programming evt - TIMER_SYNC_TICKS into the
hardware interval register. The clockevent device currently advertises
TIMER_SYNC_TICKS as min_delta_ticks, so the clockevents core is allowed
to call set_next_event() with evt == TIMER_SYNC_TICKS.
That programs a zero-tick interval. With oneshot/highres/nohz timer
operation this can leave the next event stuck, which was observed as a
boot hang on Allwinner D1 after the clockevents core started reusing
forced minimum-delta events.
Advertise one extra tick instead, so the smallest event accepted by the
core still programs at least one hardware tick after the synchronization
compensation.
Fixes: 12e1480bcb49 ("clocksource: sun4i: Report the minimum tick that we can program")
Reported-by: Indrek Kruusa <indrek.kruusa@gmail.com>
Closes: https://lore.kernel.org/linux-riscv/CA+fTLhgLmTY+exGujKf8OYYQvcEW5X5NJ_5sLq2AYL6zER2c0A@mail.gmail.com/
Assisted-by: Codex:gpt-5.5
Signed-off-by: Felix Yan <felixonmars@archlinux.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Tested-by: Indrek Kruusa <indrek.kruusa@gmail.com>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-riscv/CA+fTLhgLmTY+exGujKf8OYYQvcEW5X5NJ_5sLq2AYL6zER2c0A@mail.gmail.com/
Link: https://patch.msgid.link/20260624220434.4183732-1-felixonmars@archlinux.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clocksource/timer-sun4i.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clocksource/timer-sun4i.c
+++ b/drivers/clocksource/timer-sun4i.c
@@ -209,7 +209,7 @@ static int __init sun4i_timer_init(struc
sun4i_timer_clear_interrupt(timer_of_base(&to));
clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
- TIMER_SYNC_TICKS, 0xffffffff);
+ TIMER_SYNC_TICKS + 1, 0xffffffff);
/* Enable timer0 interrupt */
val = readl(timer_of_base(&to) + TIMER_IRQ_EN_REG);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 005/935] timers/itimer: Zero-init old itimerval before copy to userspace
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 004/935] clocksource/drivers/timer-sun4i: Advertise a real minimum delta Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 006/935] include/linux/list.h: mark list_add and __list_add as __always_inline Greg Kroah-Hartman
` (932 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Thomas Gleixner
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8 upstream.
On native sparc64, struct __kernel_old_timeval contains a four-byte hole
after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit.
put_itimerval() fills only the named fields in a stack-allocated
__kernel_old_itimerval and copies the entire object to userspace, so
getitimer() can expose the two padding holes.
Zero-initialize the aggregate before assigning the fields so implicit
padding is deterministic before it crosses the user/kernel boundary.
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: Codex:gpt-5
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260809190428.1523014-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/itimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/time/itimer.c
+++ b/kernel/time/itimer.c
@@ -100,7 +100,7 @@ static int do_getitimer(int which, struc
static int put_itimerval(struct __kernel_old_itimerval __user *o,
const struct itimerspec64 *i)
{
- struct __kernel_old_itimerval v;
+ struct __kernel_old_itimerval v = {};
v.it_interval.tv_sec = i->it_interval.tv_sec;
v.it_interval.tv_usec = i->it_interval.tv_nsec / NSEC_PER_USEC;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 006/935] include/linux/list.h: mark list_add and __list_add as __always_inline
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 005/935] timers/itimer: Zero-init old itimerval before copy to userspace Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 007/935] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Greg Kroah-Hartman
` (931 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jordan R Abrahams-Whitehead,
Nathan Chancellor, Eric Dumazet, Nick Desaulniers,
Giuliano Procida, Yabin Cui, Bill Wendling, Justin Stitt,
Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan R Abrahams-Whitehead <ajordanr@google.com>
commit 2780860eddecba9ffe210bb9436eee3cf22bfcdd upstream.
This commit resolves an issue where modpost section verification fails due
to section mismatches between list_add and its callers.
At present, list_add (and its internal __list_add) are called from both
.text and .init code sections. Since inlining can vary per call site,
list_add can be 4 different states:
list_add in text with arguments to non-.init.data values
list_add in init with arguments to static .init.data values
list_add in init with arguments to non-.init.data values
list_add in text with arguments to static .init.data values
It is last instance that ends up causing the section mismatch caused by
constant propagation of the address of static libs inside the `dir_add` as
seen below (with the dir_list being defined statically in initramfs.c,
resting in .init.data).
WARNING: modpost: vmlinux.o: section mismatch in reference: __list_add
(section: .text.unlikely.) -> dir_list (section: .init.data)
Because of these section matching requirements, semantically, __list_add
and list_add MUST be inlined. This will then ensure callers inside .init
will receive a list_add that exists and refers to only .init data, and
list_add code in .text sections will only refer to non-init data.
This issue manifests predominently in AutoFDO with clang, which is very
hesitant to inline cold functions such as list_add even when marked
`inline`. Marking them as `__always_inline` therefore matches the
existing semantic constraints imposed by modpost's section mismatch
checks.
Link: https://lore.kernel.org/20260731-always-inline-list-add-v1-1-d29f54ce5477@google.com
Link: https://lore.kernel.org/all/CANn89iJVQe=wedLheJmjZjOTJsWHijT0jZs=iRxKssJZbjAxHw@mail.gmail.com/
Signed-off-by: Jordan R Abrahams-Whitehead <ajordanr@google.com>
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Suggested-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reported-by: Giuliano Procida <gprocida@google.com>
Reported-by: Yabin Cui <yabinc@google.com>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2173
Cc: Bill Wendling <morbo@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/list.h | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -59,10 +59,13 @@ static inline bool __list_del_entry_vali
*
* This is only for internal list manipulation where we know
* the prev/next entries already!
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
*/
-static inline void __list_add(struct list_head *new,
- struct list_head *prev,
- struct list_head *next)
+static __always_inline void __list_add(struct list_head *new,
+ struct list_head *prev,
+ struct list_head *next)
{
if (!__list_add_valid(new, prev, next))
return;
@@ -80,8 +83,12 @@ static inline void __list_add(struct lis
*
* Insert a new entry after the specified head.
* This is good for implementing stacks.
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
*/
-static inline void list_add(struct list_head *new, struct list_head *head)
+static __always_inline void list_add(struct list_head *new,
+ struct list_head *head)
{
__list_add(new, head, head->next);
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 007/935] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 006/935] include/linux/list.h: mark list_add and __list_add as __always_inline Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 008/935] mm: memcg: stop reclaim when a limit update is superseded Greg Kroah-Hartman
` (930 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Paul E. McKenney,
Johannes Weiner, Shakeel Butt, Axel Rasmussen, Barry Song,
David Hildenbrand, Kairui Song, Lorenzo Stoakes, Michal Hocko,
Wei Xu, Yuanchu Xie, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit 25f52e81216884a7444bf07a606691feb09a94e3 upstream.
I am seeing some rcu_tasks stalls in the Meta fleet during reclaim.
INFO: rcu_tasks detected stalls on tasks:
0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle_cpu: -1/8
task:GlobalCPUThread state:R running task pid:2552016 tgid:2524552
Call Trace:
shrink_lruvec
mem_cgroup_iter
shrink_node
do_try_to_free_pages
try_to_free_pages
__alloc_frozen_pages_noprof
alloc_pages_noprof
pte_alloc_one
__pte_alloc
handle_mm_fault
Nothing promises direct reclaim returns in bounded time, and the scan loop
in shrink_lruvec() only calls cond_resched(), which is a no-op on
PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU quiescent
state, so the reclaiming task never reports one and becomes a holdout.
Upgrade it to cond_resched_tasks_rcu_qs(), which reports a quiescent state
even when cond_resched() does nothing.
PS: This has been discussed in [1]
Link: https://lore.kernel.org/20260810-rcu_task_shrink_lruvec-v1-1-4d9f7d5251cb@debian.org
Link: https://lore.kernel.org/all/amdWVTs0WKOxguxP@gmail.com/ [1]
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2771,7 +2771,7 @@ static void shrink_lruvec(struct lruvec
}
}
- cond_resched();
+ cond_resched_tasks_rcu_qs();
if (nr_reclaimed < nr_to_reclaim || proportional_reclaim)
continue;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 008/935] mm: memcg: stop reclaim when a limit update is superseded
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 007/935] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 009/935] tools/compiler: match glibc 2.42 definition of __attribute_const__ Greg Kroah-Hartman
` (929 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guopeng Zhang, Tao Cui,
Johannes Weiner, Michal Hocko, Muchun Song, Roman Gushchin,
Shakeel Butt, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guopeng Zhang <zhangguopeng@kylinos.cn>
commit 9477820c63cbf4d97114238f3d1ff10dfd6bee3f upstream.
kernfs serializes file operations only per open file, so separate open
files can update the same memory.high or memory.max file concurrently.
Both handlers store the new limit before synchronous reclaim, but continue
to use the writer's local target in the reclaim loop. If another writer
raises or removes the limit, the first writer can continue reclaiming
toward a stale target.
For memory.max, this can leave the writer looping indefinitely once
reclaim retries are exhausted. The OOM path sees sufficient margin under
the current limit and returns true without killing, while the writer still
compares usage against its stale target and records another OOM event.
Check the current limit at the start of each reclaim iteration and stop if
it no longer matches the writer's target.
Reproducer:
Populate a cgroup with anonymous memory and disable swapping. Lower
memory.max from one open file, then restore it to "max" through another
open file after the new limit becomes visible.
Without the patch, the first writer remains blocked and repeatedly
increments the OOM event counter. With the patch, it returns normally.
This was not motivated by a reported production workload. We found it
through automated randomized testing for our cgroup observability work
and reduced it to the reproducer above.
Link: https://lore.kernel.org/20260724021805.1234583-1-guopeng.zhang@linux.dev
Fixes: 8c8c383c04f6 ("mm: memcontrol: try harder to set a new memory.high")
Fixes: b6e6edcfa405 ("mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6323,6 +6323,9 @@ static ssize_t memory_high_write(struct
unsigned long nr_pages = page_counter_read(&memcg->memory);
unsigned long reclaimed;
+ if (high != READ_ONCE(memcg->memory.high))
+ break;
+
if (nr_pages <= high)
break;
@@ -6371,6 +6374,9 @@ static ssize_t memory_max_write(struct k
for (;;) {
unsigned long nr_pages = page_counter_read(&memcg->memory);
+ if (max != READ_ONCE(memcg->memory.max))
+ break;
+
if (nr_pages <= max)
break;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 009/935] tools/compiler: match glibc 2.42 definition of __attribute_const__
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 008/935] mm: memcg: stop reclaim when a limit update is superseded Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 010/935] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Greg Kroah-Hartman
` (928 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joy H.J. Lee, Nathan Chancellor,
David Laight, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy H.J. Lee <rkr0k0r@gmail.com>
commit 8700a4761beb219873956666cf91776a2c61e698 upstream.
glibc 2.42 added __attribute_const__ to sys/cdefs.h:
# define __attribute_const__ __attribute__ ((__const__))
GCC 15 warns when a macro is redefined to a different replacement list
(-Wbuiltin-macro-redefined). Since host tool Makefiles (resolve_btfids,
objtool) pass -Werror, this conflict becomes fatal.
The warning is suppressed on standard native builds because GCC treats
/usr/include as a system header path (-isystem), and macro-redefinition
warnings from system headers are silently suppressed by GCC. It fires
when glibc headers are on a regular include path (-I) instead, which
is the case in cross-compilation setups such as NixOS, where the
sysroot's glibc is passed explicitly via -I rather than -isystem.
Per (C11 6.10.3), identical replacement lists are accepted silently.
Match the glibc definition exactly, including the space before "((", so
the redefinition is accepted without warning regardless of whether
glibc headers are treated as system or non-system includes.
Link: https://lore.kernel.org/20260701200635.3992767-1-rkr0k0r@gmail.com
Signed-off-by: Joy H.J. Lee <rkr0k0r@gmail.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: David Laight <david.laight.linux@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/linux/compiler.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/include/linux/compiler.h
+++ b/tools/include/linux/compiler.h
@@ -67,7 +67,7 @@
#define __read_mostly
#ifndef __attribute_const__
-# define __attribute_const__
+# define __attribute_const__ __attribute__ ((__const__))
#endif
#ifndef __maybe_unused
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 010/935] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 009/935] tools/compiler: match glibc 2.42 definition of __attribute_const__ Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 011/935] tracing: Fix crash passing ERR_PTR to kthread_stop() Greg Kroah-Hartman
` (927 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau (Meta), Dave Hansen,
Sean Christopherson
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau (Meta) <kas@kernel.org>
commit 1fe104b048d77d6cb25bd938e6a67450fb50e61d upstream.
KVM's instruction emulator has a small helper, assign_register(), that
writes a value into a register following the x86 rules for writes to
general-purpose registers: an 8- or 16-bit write leaves the rest of the
register untouched, a 32-bit write zero-extends the result to 64 bits,
and a 64-bit write replaces the whole register.
The TDX guest #VE handler needs the same logic for port I/O emulation
to get 32-bit zero-extension right. Rather than add a third copy of
the same switch, move the helper verbatim to <asm/insn-eval.h>, rename
it to insn_assign_reg(), and route KVM's callers through it.
Add <asm/insn.h> to the header's includes so it builds standalone in
callers that have not pulled it in transitively.
No functional change.
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Sean Christopherson <seanjc@google.com>
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260713133753.223947-3-kirill@shutemov.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/insn-eval.h | 36 ++++++++++++++++++++++++++++++++++++
arch/x86/kvm/emulate.c | 26 ++++----------------------
2 files changed, 40 insertions(+), 22 deletions(-)
--- a/arch/x86/include/asm/insn-eval.h
+++ b/arch/x86/include/asm/insn-eval.h
@@ -9,6 +9,7 @@
#include <linux/compiler.h>
#include <linux/bug.h>
#include <linux/err.h>
+#include <asm/insn.h>
#include <asm/ptrace.h>
#define INSN_CODE_SEG_ADDR_SZ(params) ((params >> 4) & 0xf)
@@ -31,4 +32,39 @@ int insn_fetch_from_user_inatomic(struct
bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
unsigned char buf[MAX_INSN_SIZE], int buf_size);
+/*
+ * Write @val into *@reg following the x86 rules for writes to
+ * general-purpose registers (Intel SDM Vol. 1, "General-Purpose
+ * Registers in 64-Bit Mode"): an 8- or 16-bit write leaves the rest of
+ * the register untouched, a 32-bit write zero-extends the result into
+ * the upper 32 bits, and a 64-bit write replaces the whole register.
+ *
+ * @bytes is the width of the write, not a property of the instruction:
+ * an instruction that, say, sign-extends a 32-bit immediate into a
+ * 64-bit register does a 64-bit write here.
+ *
+ * @reg need not be 8-byte aligned: KVM's instruction emulator offsets
+ * the pointer by one byte to address the high-byte registers (AH, CH,
+ * DH, BH). Use narrow stores for the sub-word cases so the access
+ * width matches @bytes and the adjacent bytes are left alone.
+ */
+static inline void insn_assign_reg(unsigned long *reg, u64 val, int bytes)
+{
+ switch (bytes) {
+ case 1:
+ *(u8 *)reg = (u8)val;
+ break;
+ case 2:
+ *(u16 *)reg = (u16)val;
+ break;
+ case 4:
+ /* A 32-bit write zero-extends into the upper 32 bits. */
+ *reg = (u32)val;
+ break;
+ case 8:
+ *reg = val;
+ break;
+ }
+}
+
#endif /* _ASM_X86_INSN_EVAL_H */
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -23,6 +23,7 @@
#include "kvm_emulate.h"
#include <linux/stringify.h>
#include <asm/debugreg.h>
+#include <asm/insn-eval.h>
#include <asm/nospec-branch.h>
#include "x86.h"
@@ -525,25 +526,6 @@ static void assign_masked(ulong *dest, u
*dest = (*dest & ~mask) | (src & mask);
}
-static void assign_register(unsigned long *reg, u64 val, int bytes)
-{
- /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
- switch (bytes) {
- case 1:
- *(u8 *)reg = (u8)val;
- break;
- case 2:
- *(u16 *)reg = (u16)val;
- break;
- case 4:
- *reg = (u32)val;
- break; /* 64b: zero-extend */
- case 8:
- *reg = val;
- break;
- }
-}
-
static inline unsigned long ad_mask(struct x86_emulate_ctxt *ctxt)
{
return (1UL << (ctxt->ad_bytes << 3)) - 1;
@@ -591,7 +573,7 @@ register_address_increment(struct x86_em
{
ulong *preg = reg_rmw(ctxt, reg);
- assign_register(preg, *preg + inc, ctxt->ad_bytes);
+ insn_assign_reg(preg, *preg + inc, ctxt->ad_bytes);
}
static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)
@@ -1781,7 +1763,7 @@ static int load_segment_descriptor(struc
static void write_register_operand(struct operand *op)
{
- return assign_register(op->addr.reg, op->val, op->bytes);
+ return insn_assign_reg(op->addr.reg, op->val, op->bytes);
}
static int writeback(struct x86_emulate_ctxt *ctxt, struct operand *op)
@@ -2015,7 +1997,7 @@ static int em_popa(struct x86_emulate_ct
rc = emulate_pop(ctxt, &val, ctxt->op_bytes);
if (rc != X86EMUL_CONTINUE)
break;
- assign_register(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
+ insn_assign_reg(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
--reg;
}
return rc;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 011/935] tracing: Fix crash passing ERR_PTR to kthread_stop()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 010/935] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 012/935] powerpc/powermac: fix OF node refcount Greg Kroah-Hartman
` (926 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Steven Rostedt
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 649bc7df3e5d7be6f7996a95084037dbf3cad1e5 upstream.
event_test_stuff() calls kthread_run() and unconditionally passes the
returned task_struct pointer to kthread_stop(). kthread_run() returns an
error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for
example under memory pressure during the boot-time event self-test.
kthread_stop() then dereferences the invalid pointer, crashing the kernel.
Check the result of kthread_run() before passing it to kthread_stop(). Use
WARN_ON() so that a failure to create the self-test thread does not go
unnoticed, matching the ring-buffer self-test fix in commit
91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").
Cc: stable@vger.kernel.org
Fixes: e6187007d6c3 ("tracing/events: add startup tests for events")
Link: https://patch.msgid.link/20260817120642.668375-3-sh_def@163.com
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -4032,6 +4032,8 @@ static __init void event_test_stuff(void
struct task_struct *test_thread;
test_thread = kthread_run(event_test_thread, NULL, "test-events");
+ if (WARN_ON(IS_ERR(test_thread)))
+ return;
msleep(1);
kthread_stop(test_thread);
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 012/935] powerpc/powermac: fix OF node refcount
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 011/935] tracing: Fix crash passing ERR_PTR to kthread_stop() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 013/935] rapidio: mport_cdev: fix use-after-free in dma_req_free() Greg Kroah-Hartman
` (925 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Bartosz Golaszewski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
commit bd0abfe6b013aeb2a1aebc5fbc7ceeb50355bda3 upstream.
Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().
Cc: stable@vger.kernel.org
Fixes: 81e5d8646ff6 ("i2c/powermac: Register i2c devices from device-tree")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260706-pdev-fwnode-ref-v3-1-1ff028e33779@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1501,7 +1501,7 @@ static int __init pmac_i2c_create_platfo
if (bus->platform_dev == NULL)
return -ENOMEM;
bus->platform_dev->dev.platform_data = bus;
- bus->platform_dev->dev.of_node = bus->busnode;
+ bus->platform_dev->dev.of_node = of_node_get(bus->busnode);
platform_device_add(bus->platform_dev);
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 013/935] rapidio: mport_cdev: fix use-after-free in dma_req_free()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 012/935] powerpc/powermac: fix OF node refcount Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 014/935] Revert "media: v4l2-dev: fix error handling in __video_register_device()" Greg Kroah-Hartman
` (924 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Kim, Dan Carpenter,
Alexandre Bounine, Matt Porter, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Kim <james010kim@gmail.com>
commit 5cbef379a94b161726c5f504598bf4791d45cedc upstream.
dma_req_free() acquires buf_mutex through req->map, drops the mapping
reference with kref_put(), and then dereferences req->map again to unlock
the mutex.
If kref_put() drops the last reference, mport_release_mapping() frees the
mapping, and the subsequent mutex_unlock() dereferences a freed object.
This is a use-after-free.
Fix this by caching map and md before kref_put(), clearing req->map while
holding buf_mutex, and using the cached md for mutex unlocking.
The bug is reachable from userspace via the RapidIO mport character device
interface.
Link: https://lore.kernel.org/20260723235220.588424-1-james010kim@gmail.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: James Kim <james010kim@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rapidio/devices/rio_mport_cdev.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -582,9 +582,13 @@ static void dma_req_free(struct kref *re
}
if (req->map) {
- mutex_lock(&req->map->md->buf_mutex);
- kref_put(&req->map->ref, mport_release_mapping);
- mutex_unlock(&req->map->md->buf_mutex);
+ struct rio_mport_mapping *map = req->map;
+ struct mport_dev *md = map->md;
+
+ mutex_lock(&md->buf_mutex);
+ req->map = NULL;
+ kref_put(&map->ref, mport_release_mapping);
+ mutex_unlock(&md->buf_mutex);
}
kref_put(&priv->dma_ref, mport_release_dma);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 014/935] Revert "media: v4l2-dev: fix error handling in __video_register_device()"
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 013/935] rapidio: mport_cdev: fix use-after-free in dma_req_free() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 015/935] staging: greybus: hid: fix SET_REPORT return value Greg Kroah-Hartman
` (923 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Hans Verkuil
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil+cisco@kernel.org>
commit e7600f5cee5de14065f950807931d6e6d40fb2d7 upstream.
This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a.
The intentions of that patch were good, but it doesn't work.
The idea is that if device_register fails, you have to do a put_device
to let the ref counter release resources.
However, the V4L2 API says that if video_register_device() fails, then
you have to call video_device_release(), which kfree()s the video_device
struct.
But the put_device() will already have freed the struct, so you end
up in a double-free scenario.
There is not really a good way of fixing this without breaking
video_register_device() into two parts, one that initializes everything,
and one that does the actual device_register, and then converting all
V4L2 drivers to this new model.
That is a massive job, and it is very unlikely that device_register
will fail.
So rather than ending up in a double-free scenario, just revert this
patch, and in that case we'll have a small memory leak. Which is a lot
more robust.
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Fixes: 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-media/20260520090624.1071139-1-lgs201920130244@gmail.com/
Link: https://lore.kernel.org/all/2026042058-charm-storable-4ad8@gregkh/
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-dev.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -1032,25 +1032,25 @@ int __video_register_device(struct video
vdev->dev.class = &video_class;
vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
vdev->dev.parent = vdev->dev_parent;
- vdev->dev.release = v4l2_device_release;
dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num);
-
- /* Increase v4l2_device refcount */
- v4l2_device_get(vdev->v4l2_dev);
-
mutex_lock(&videodev_lock);
ret = device_register(&vdev->dev);
if (ret < 0) {
mutex_unlock(&videodev_lock);
pr_err("%s: device_register failed\n", __func__);
- put_device(&vdev->dev);
- return ret;
+ goto cleanup;
}
+ /* Register the release callback that will be called when the last
+ reference to the device goes away. */
+ vdev->dev.release = v4l2_device_release;
if (nr != -1 && nr != vdev->num && warn_if_nr_in_use)
pr_warn("%s: requested %s%d, got %s\n", __func__,
name_base, nr, video_device_node_name(vdev));
+ /* Increase v4l2_device refcount */
+ v4l2_device_get(vdev->v4l2_dev);
+
/* Part 5: Register the entity. */
ret = video_register_media_controller(vdev);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 015/935] staging: greybus: hid: fix SET_REPORT return value
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 014/935] Revert "media: v4l2-dev: fix error handling in __video_register_device()" Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 016/935] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Greg Kroah-Hartman
` (922 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hao-Qun Huang
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit 6d45195a9626d8aaaaed212c55638829a9c624a3 upstream.
__gb_hid_output_raw_report() stores the result of gb_hid_set_report()
in ret and even adjusts it to account for the report ID byte, but then
always returns 0.
This hides Greybus transport errors from HID_REQ_SET_REPORT callers,
and makes hidraw report zero bytes written to user space on success,
although hid_hw_raw_request() is expected to return the number of
bytes transferred or a negative errno. The sibling GET_REPORT path,
__gb_hid_get_raw_report(), already follows this convention.
Return ret like the other HID transport drivers do.
Fixes: 96eab779e198 ("greybus: hid: add HID class driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Link: https://patch.msgid.link/20260704081613.434445-1-alvinhuang0603@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/greybus/hid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -256,7 +256,7 @@ static int __gb_hid_output_raw_report(st
if (report_id && ret >= 0)
ret++; /* add report_id to the number of transferred bytes */
- return 0;
+ return ret;
}
static int gb_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 016/935] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 015/935] staging: greybus: hid: fix SET_REPORT return value Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 017/935] USB: phy: fsl-usb: fix missing static keywords Greg Kroah-Hartman
` (921 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Francesco Lavra
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
commit bf1e90189a98ca4a824fd64b4f3c6043d13c98ea upstream.
When a USB host suspends a connected device, the DWC2 USB device controller
enters a partial power down state where controller registers are not
accessible. If the USB gadget is then disconnected or deactivated
(e.g. when a gadget function is unbound from the controller), the `pullup`
callback in struct usb_gadget_ops is invoked; if the controller is kept in
partial power down, the register write in dwc2_hsotg_core_disconnect() does
not take effect; as a result, the USB host keeps seeing the device as
connected, even though the device is disabled.
Properly exit partial power down state in the pullup callback, so that the
USB host detects a device disconnection as intended.
Fixes: 97861781daff ("usb: dwc2: Allow entering hibernation from USB_SUSPEND interrupt")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Link: https://patch.msgid.link/20260728154420.2021519-1-flavra@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/gadget.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -4678,6 +4678,7 @@ static int dwc2_hsotg_pullup(struct usb_
{
struct dwc2_hsotg *hsotg = to_hsotg(gadget);
unsigned long flags;
+ int ret = 0;
dev_dbg(hsotg->dev, "%s: is_on: %d op_state: %d\n", __func__, is_on,
hsotg->op_state);
@@ -4689,6 +4690,13 @@ static int dwc2_hsotg_pullup(struct usb_
}
spin_lock_irqsave(&hsotg->lock, flags);
+ if (hsotg->in_ppd) {
+ ret = dwc2_exit_partial_power_down(hsotg, 0, true);
+ if (ret) {
+ dev_err(hsotg->dev, "exit partial_power_down failed\n");
+ goto exit;
+ }
+ }
if (is_on) {
hsotg->enabled = 1;
dwc2_hsotg_core_init_disconnected(hsotg, false);
@@ -4702,9 +4710,10 @@ static int dwc2_hsotg_pullup(struct usb_
}
hsotg->gadget.speed = USB_SPEED_UNKNOWN;
+exit:
spin_unlock_irqrestore(&hsotg->lock, flags);
- return 0;
+ return ret;
}
static int dwc2_hsotg_vbus_session(struct usb_gadget *gadget, int is_active)
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 017/935] USB: phy: fsl-usb: fix missing static keywords
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 016/935] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 018/935] usb: gadget: u_audio: Fix use-after-free on sound card disconnect Greg Kroah-Hartman
` (920 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Brown, Johan Hovold
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 80574c40598aedbc1751c528e414d7e224bc6313 upstream.
A recent change enabling compile testing of a Freescale dual-role
controller indirectly enabled a USB PHY driver to be built. That driver
in turn is missing a bunch of static keywords which results in warnings
like:
drivers/usb/phy/phy-fsl-usb.c:105:5: error: no previous prototype for 'write_ulpi' [-Werror=missing-prototypes]
105 | int write_ulpi(u8 addr, u8 data)
| ^~~~~~~~~~
which consequently breaks -Werror builds.
Add the missing static keywords.
Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
Cc: stable@vger.kernel.org # 3.0
Reported-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/4f9f5ff9-8eaa-4bd5-9331-37119f78e13f@sirena.org.uk
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260717154957.1853976-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy-fsl-usb.c | 52 +++++++++++++++++++++---------------------
drivers/usb/phy/phy-fsl-usb.h | 6 ++--
2 files changed, 29 insertions(+), 29 deletions(-)
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -45,7 +45,7 @@
static const char driver_name[] = "fsl-usb2-otg";
-const pm_message_t otg_suspend_state = {
+static const pm_message_t otg_suspend_state = {
.event = 1,
};
@@ -56,11 +56,11 @@ static struct fsl_otg *fsl_otg_dev;
static int srp_wait_done;
/* FSM timers */
-struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
+static struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
*b_ase0_brst_tmr, *b_se0_srp_tmr;
/* Driver specific timers */
-struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
+static struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
*b_srp_wait_tmr, *a_wait_enum_tmr;
static struct list_head active_timers;
@@ -101,7 +101,7 @@ static void (*_fsl_writel)(u32 v, unsign
#define fsl_writel(val, addr) writel(val, addr)
#endif /* CONFIG_PPC32 */
-int write_ulpi(u8 addr, u8 data)
+static int write_ulpi(u8 addr, u8 data)
{
u32 temp;
@@ -114,7 +114,7 @@ int write_ulpi(u8 addr, u8 data)
/* Operations that will be called from OTG Finite State Machine */
/* Charge vbus for vbus pulsing in SRP */
-void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -132,7 +132,7 @@ void fsl_otg_chrg_vbus(struct otg_fsm *f
}
/* Discharge vbus through a resistor to ground */
-void fsl_otg_dischrg_vbus(int on)
+static void fsl_otg_dischrg_vbus(int on)
{
u32 tmp;
@@ -150,7 +150,7 @@ void fsl_otg_dischrg_vbus(int on)
}
/* A-device driver vbus, controlled through PP bit in PORTSC */
-void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -168,7 +168,7 @@ void fsl_otg_drv_vbus(struct otg_fsm *fs
* Pull-up D+, signalling connect by periperal. Also used in
* data-line pulsing in SRP
*/
-void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -187,7 +187,7 @@ void fsl_otg_loc_conn(struct otg_fsm *fs
* port. In host mode, controller will automatically send SOF.
* Suspend will block the data on the port.
*/
-void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -202,7 +202,7 @@ void fsl_otg_loc_sof(struct otg_fsm *fsm
}
/* Start SRP pulsing by data-line pulsing, followed with v-bus pulsing. */
-void fsl_otg_start_pulse(struct otg_fsm *fsm)
+static void fsl_otg_start_pulse(struct otg_fsm *fsm)
{
u32 tmp;
@@ -218,7 +218,7 @@ void fsl_otg_start_pulse(struct otg_fsm
fsl_otg_add_timer(fsm, b_data_pulse_tmr);
}
-void b_data_pulse_end(unsigned long foo)
+static void b_data_pulse_end(unsigned long foo)
{
#ifdef HA_DATA_PULSE
#else
@@ -229,7 +229,7 @@ void b_data_pulse_end(unsigned long foo)
fsl_otg_pulse_vbus();
}
-void fsl_otg_pulse_vbus(void)
+static void fsl_otg_pulse_vbus(void)
{
srp_wait_done = 0;
fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 1);
@@ -237,7 +237,7 @@ void fsl_otg_pulse_vbus(void)
fsl_otg_add_timer(&fsl_otg_dev->fsm, b_vbus_pulse_tmr);
}
-void b_vbus_pulse_end(unsigned long foo)
+static void b_vbus_pulse_end(unsigned long foo)
{
fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 0);
@@ -250,7 +250,7 @@ void b_vbus_pulse_end(unsigned long foo)
fsl_otg_add_timer(&fsl_otg_dev->fsm, b_srp_wait_tmr);
}
-void b_srp_end(unsigned long foo)
+static void b_srp_end(unsigned long foo)
{
fsl_otg_dischrg_vbus(0);
srp_wait_done = 1;
@@ -265,7 +265,7 @@ void b_srp_end(unsigned long foo)
* a_host will start by SRP. It needs to set b_hnp_enable before
* actually suspending to start HNP
*/
-void a_wait_enum(unsigned long foo)
+static void a_wait_enum(unsigned long foo)
{
VDBG("a_wait_enum timeout\n");
if (!fsl_otg_dev->phy.otg->host->b_hnp_enable)
@@ -275,13 +275,13 @@ void a_wait_enum(unsigned long foo)
}
/* The timeout callback function to set time out bit */
-void set_tmout(unsigned long indicator)
+static void set_tmout(unsigned long indicator)
{
*(int *)indicator = 1;
}
/* Initialize timers */
-int fsl_otg_init_timers(struct otg_fsm *fsm)
+static int fsl_otg_init_timers(struct otg_fsm *fsm)
{
/* FSM used timers */
a_wait_vrise_tmr = otg_timer_initializer(&set_tmout, TA_WAIT_VRISE,
@@ -338,7 +338,7 @@ int fsl_otg_init_timers(struct otg_fsm *
}
/* Uninitialize timers */
-void fsl_otg_uninit_timers(void)
+static void fsl_otg_uninit_timers(void)
{
/* FSM used timers */
kfree(a_wait_vrise_tmr);
@@ -390,7 +390,7 @@ static struct fsl_otg_timer *fsl_otg_get
}
/* Add timer to timer list */
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
{
struct fsl_otg_timer *timer = gtimer;
struct fsl_otg_timer *tmp_timer;
@@ -420,7 +420,7 @@ static void fsl_otg_fsm_add_timer(struct
}
/* Remove timer from the timer list; clear timeout status */
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
{
struct fsl_otg_timer *timer = gtimer;
struct fsl_otg_timer *tmp_timer, *del_tmp;
@@ -442,7 +442,7 @@ static void fsl_otg_fsm_del_timer(struct
}
/* Reset controller, not reset the bus */
-void otg_reset_controller(void)
+static void otg_reset_controller(void)
{
u32 command;
@@ -454,7 +454,7 @@ void otg_reset_controller(void)
}
/* Call suspend/resume routines in host driver */
-int fsl_otg_start_host(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_host(struct otg_fsm *fsm, int on)
{
struct usb_otg *otg = fsm->otg;
struct device *dev;
@@ -521,7 +521,7 @@ end:
* Call suspend and resume function in udc driver
* to stop and start udc driver.
*/
-int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
{
struct usb_otg *otg = fsm->otg;
struct device *dev;
@@ -703,7 +703,7 @@ static int fsl_otg_start_hnp(struct usb_
* intact. It needs to have knowledge of some USB interrupts
* such as port change.
*/
-irqreturn_t fsl_otg_isr(int irq, void *dev_id)
+static irqreturn_t fsl_otg_isr(int irq, void *dev_id)
{
struct otg_fsm *fsm = &((struct fsl_otg *)dev_id)->fsm;
struct usb_otg *otg = ((struct fsl_otg *)dev_id)->phy.otg;
@@ -829,7 +829,7 @@ err:
}
/* OTG Initialization */
-int usb_otg_start(struct platform_device *pdev)
+static int usb_otg_start(struct platform_device *pdev)
{
struct fsl_otg *p_otg;
struct usb_phy *otg_trans = usb_get_phy(USB_PHY_TYPE_USB2);
@@ -1002,7 +1002,7 @@ static int fsl_otg_remove(struct platfor
return 0;
}
-struct platform_driver fsl_otg_driver = {
+static struct platform_driver fsl_otg_driver = {
.probe = fsl_otg_probe,
.remove = fsl_otg_remove,
.driver = {
--- a/drivers/usb/phy/phy-fsl-usb.h
+++ b/drivers/usb/phy/phy-fsl-usb.h
@@ -373,6 +373,6 @@ struct fsl_otg_config {
#define FSL_OTG_NAME "fsl-usb2-otg"
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_pulse_vbus(void);
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_pulse_vbus(void);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 018/935] usb: gadget: u_audio: Fix use-after-free on sound card disconnect
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 017/935] USB: phy: fsl-usb: fix missing static keywords Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 019/935] usb: gadget: snps_udc_plat: clean up PHY on probe deferral Greg Kroah-Hartman
` (919 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sonali Pradhan
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonali Pradhan <sonalipradhan@google.com>
commit 858965947081d10d41d9a1010a540d3d5eea958b upstream.
g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the underlying struct snd_uac_chip
context. However, snd_card_free_when_closed() returns asynchronously
while ALSA control elements (kctls) remain open in userspace.
When userspace control applications access or close these open file
descriptors, kctl callbacks attempt to dereference kctl->private_data
pointing to &uac->c_prm or &uac->p_prm within the freed uac structure,
resulting in a use-after-free (UAF) memory corruption.
Fix this issue by deferring the destruction of struct snd_uac_chip until
all references to the ALSA sound card are released. Register a custom
card->private_free callback (u_audio_card_free) during g_audio_setup()
that frees uac and its associated playback/capture request and ring
buffers only when the sound card reference count drops to zero.
Fixes: 6c67ed9ad9b8 ("usb: gadget: u_audio: don't let userspace block driver unbind")
Cc: stable@vger.kernel.org
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
Link: https://patch.msgid.link/20260810071237.2207680-1-sonalipradhan@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/u_audio.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -967,6 +967,20 @@ static struct snd_kcontrol_new u_audio_c
},
};
+static void u_audio_card_free(struct snd_card *card)
+{
+ struct snd_uac_chip *uac = card->private_data;
+
+ if (!uac)
+ return;
+
+ kfree(uac->p_prm.reqs);
+ kfree(uac->c_prm.reqs);
+ kfree(uac->p_prm.rbuf);
+ kfree(uac->c_prm.rbuf);
+ kfree(uac);
+}
+
int g_audio_setup(struct g_audio *g_audio, const char *pcm_name,
const char *card_name)
{
@@ -1046,6 +1060,8 @@ int g_audio_setup(struct g_audio *g_audi
goto fail;
uac->card = card;
+ card->private_data = uac;
+ card->private_free = u_audio_card_free;
/*
* Create first PCM device
@@ -1178,6 +1194,8 @@ int g_audio_setup(struct g_audio *g_audi
snd_fail:
snd_card_free(card);
+ return err;
+
fail:
kfree(uac->p_prm.reqs);
kfree(uac->c_prm.reqs);
@@ -1203,12 +1221,6 @@ void g_audio_cleanup(struct g_audio *g_a
card = uac->card;
if (card)
snd_card_free_when_closed(card);
-
- kfree(uac->p_prm.reqs);
- kfree(uac->c_prm.reqs);
- kfree(uac->p_prm.rbuf);
- kfree(uac->c_prm.rbuf);
- kfree(uac);
}
EXPORT_SYMBOL_GPL(g_audio_cleanup);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 019/935] usb: gadget: snps_udc_plat: clean up PHY on probe deferral
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 018/935] usb: gadget: u_audio: Fix use-after-free on sound card disconnect Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 020/935] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Greg Kroah-Hartman
` (918 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 886338ea7d40e4ba5123c58204d7f7e53d825825 upstream.
When the referenced extcon device has not registered yet,
extcon_get_edev_by_phandle() returns -EPROBE_DEFER after the driver has
initialized and powered on the PHY. The direct return bypasses the common
cleanup path and leaves both operations unbalanced.
Store the lookup error first and route deferred probing through exit_phy,
while retaining the existing behavior of suppressing the error message for
deferral.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 1b9f35adb0ff ("usb: gadget: udc: Add Synopsys UDC Platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260804140510.37639-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/snps_udc_plat.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/udc/snps_udc_plat.c
+++ b/drivers/usb/gadget/udc/snps_udc_plat.c
@@ -161,10 +161,9 @@ static int udc_plat_probe(struct platfor
if (of_get_property(dev->of_node, "extcon", NULL)) {
udc->edev = extcon_get_edev_by_phandle(dev, 0);
if (IS_ERR(udc->edev)) {
- if (PTR_ERR(udc->edev) == -EPROBE_DEFER)
- return -EPROBE_DEFER;
- dev_err(dev, "Invalid or missing extcon\n");
ret = PTR_ERR(udc->edev);
+ if (ret != -EPROBE_DEFER)
+ dev_err(dev, "Invalid or missing extcon\n");
goto exit_phy;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 020/935] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 019/935] usb: gadget: snps_udc_plat: clean up PHY on probe deferral Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 021/935] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Greg Kroah-Hartman
` (917 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+c9f9d646b08f3b6032fe,
Yun Zhou
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
commit 9dbf74f4022f80f7669d2b3c22c5deb46c1b5674 upstream.
usbg_make_tpg() held dep_lock while calling
configfs_depend_item_unlocked(), which acquires the configfs root
inode lock when operating across subsystems. This creates a circular
lock dependency with configfs_rmdir():
dep_lock -> configfs root inode lock -> su_mutex -> dep_lock
In usbg_make_tpg(), dep_lock only serialized the read of opts->ready,
which is a monotonic flag that transitions from false to true exactly
once (in tcm_set_name()) and never reverts. Remove dep_lock from
usbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access
opts->ready locklessly instead.
Reported-by: syzbot+c9f9d646b08f3b6032fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c9f9d646b08f3b6032fe
Fixes: 4bb8548df632 ("usb: gadget: f_tcm: add configfs support")
Cc: stable@vger.kernel.org
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260731081151.285599-1-yun.zhou@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1340,19 +1340,25 @@ static struct se_portal_group *usbg_make
opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
func_inst);
- mutex_lock(&opts->dep_lock);
- if (!opts->ready)
- goto unlock_dep;
+ if (!READ_ONCE(opts->ready))
+ goto unlock_inst;
if (opts->has_dep) {
if (!try_module_get(opts->dependent))
- goto unlock_dep;
+ goto unlock_inst;
} else {
+ /*
+ * configfs_depend_item_unlocked() may acquire the configfs
+ * root inode lock when the target belongs to a different
+ * subsystem. Calling it under dep_lock would create a
+ * circular dependency:
+ * dep_lock -> configfs inode lock -> su_mutex -> dep_lock
+ */
ret = configfs_depend_item_unlocked(
wwn->wwn_group.cg_subsys,
&opts->func_inst.group.cg_item);
if (ret)
- goto unlock_dep;
+ goto unlock_inst;
}
tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
@@ -1378,7 +1384,6 @@ static struct se_portal_group *usbg_make
tpg_instances[i].tpg = tpg;
tpg->fi = tpg_instances[i].func_inst;
- mutex_unlock(&opts->dep_lock);
mutex_unlock(&tpg_instances_lock);
return &tpg->se_tpg;
@@ -1391,8 +1396,6 @@ unref_dep:
module_put(opts->dependent);
else
configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
-unlock_dep:
- mutex_unlock(&opts->dep_lock);
unlock_inst:
mutex_unlock(&tpg_instances_lock);
@@ -2350,9 +2353,7 @@ static int tcm_set_name(struct usb_funct
pr_debug("tcm: Activating %s\n", name);
- mutex_lock(&opts->dep_lock);
- opts->ready = true;
- mutex_unlock(&opts->dep_lock);
+ WRITE_ONCE(opts->ready, true);
return 0;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 021/935] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 020/935] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 022/935] usb: gadget: f_fs: Prevent deadlock during ep0 read loop Greg Kroah-Hartman
` (916 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+de553c19cb054f174a35,
Jeffin Philip
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
commit bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc upstream.
In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().
Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
Fixes: 0f9df9393855 ("usb: gadget: uvc: fix error path in uvc_function_bind()")
Fixes: 6d11ed76c45d ("usb: gadget: f_uvc: convert f_uvc to new function interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260813174311.130823-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_uvc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -781,9 +781,12 @@ uvc_function_bind(struct usb_configurati
v4l2_error:
v4l2_device_unregister(&uvc->v4l2_dev);
error:
- if (uvc->control_req)
+ if (uvc->control_req) {
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ uvc->control_req = NULL;
+ }
kfree(uvc->control_buf);
+ uvc->control_buf = NULL;
usb_free_all_descriptors(f);
return ret;
@@ -958,7 +961,9 @@ static void uvc_function_unbind(struct u
uvc->vdev_release_done = NULL;
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ uvc->control_req = NULL;
kfree(uvc->control_buf);
+ uvc->control_buf = NULL;
usb_free_all_descriptors(f);
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 022/935] usb: gadget: f_fs: Prevent deadlock during ep0 read loop
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 021/935] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 023/935] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Greg Kroah-Hartman
` (915 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neill Kapron
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neill Kapron <nkapron@google.com>
commit 569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082 upstream.
Currently, ffs_ep0_read() holds ffs->mutex when it prepares to go to
sleep waiting for an event. When no setup events are pending, it calls
wait_event_interruptible_exclusive_locked_irq() with the mutex still
held. The wait macro deliberately drops the waitqueue spinlock before
sleeping but does not drop the mutex.
If a userspace daemon is polling ep0 via read() and the gadget is
asynchronously torn down via configfs (e.g., echo "" > UDC), a
deadlock can occur:
1. The configfs teardown calls functionfs_unbind(), which queues a
FUNCTIONFS_UNBIND event.
2. The daemon wakes up, consumes the event, and drops the mutex.
3. However, if the daemon loops and immediately issues another read()
before exiting, it reacquires ffs->mutex and again goes into an
interruptible sleep.
4. Meanwhile, functionfs_unbind() continues execution and attempts to
acquire ffs->mutex to tear down ep0req.
5. The kernel deadlocks because the configfs thread is stuck in an
uninterruptible sleep waiting for the mutex, while the userspace
daemon is in an interruptible sleep holding the mutex forever
because no more events will arrive.
To fix this, we drop both the waitqueue spinlock and ffs->mutex before
going to sleep, and use wait_event_interruptible_exclusive() instead.
Upon waking up, we jump back to the `retry` label to safely reacquire
the mutex and re-evaluate the state machine. By not sleeping with
ffs->mutex held, we natively decouple gadget teardowns (which require
the mutex) from userspace polling.
Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Neill Kapron <nkapron@google.com>
Link: https://patch.msgid.link/20260724204117.4036015-1-nkapron@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -519,6 +519,7 @@ static ssize_t ffs_ep0_read(struct file
if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
return -EIDRM;
+retry:
/* Acquire mutex */
ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
if (ret < 0)
@@ -553,10 +554,15 @@ static ssize_t ffs_ep0_read(struct file
break;
}
- if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
- ffs->ev.count)) {
- ret = -EINTR;
- break;
+ if (!ffs->ev.count) {
+ spin_unlock_irq(&ffs->ev.waitq.lock);
+ mutex_unlock(&ffs->mutex);
+
+ if (wait_event_interruptible_exclusive(ffs->ev.waitq,
+ ffs->ev.count))
+ return -EINTR;
+
+ goto retry;
}
/* unlocks spinlock */
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 023/935] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 022/935] usb: gadget: f_fs: Prevent deadlock during ep0 read loop Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 024/935] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Greg Kroah-Hartman
` (914 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daisuke Matsuda, Xu Yilun, Xu Yilun
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daisuke Matsuda <matsuda@preferred.jp>
commit 9da70a43b5fea60d758137f7f0ccfe19356cb5bb upstream.
The trailing byte path in altera_cvp_send_block() dereferences a u32
pointer even when only 1-3 bytes remain in the input buffer. If the buffer
ends at a page or scatterlist boundary, this can read past the valid image
data and fault.
Copy the remaining bytes into a zero-initialized u32 before writing the
final word so only valid bytes are read from the input buffer.
Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daisuke Matsuda <matsuda@preferred.jp>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260723081912.74082-1-dskmtsd@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/fpga/altera-cvp.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -16,6 +16,7 @@
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/sizes.h>
+#include <linux/string.h>
#define CVP_BAR 0 /* BAR used for data transfer in memory mode */
#define CVP_DUMMY_WR 244 /* dummy writes to clear CvP state machine */
@@ -265,7 +266,7 @@ static int altera_cvp_v2_wait_for_credit
static int altera_cvp_send_block(struct altera_cvp_conf *conf,
const u32 *data, size_t len)
{
- u32 mask, words = len / sizeof(u32);
+ u32 words = len / sizeof(u32);
int i, remainder;
for (i = 0; i < words; i++)
@@ -274,9 +275,10 @@ static int altera_cvp_send_block(struct
/* write up to 3 trailing bytes, if any */
remainder = len % sizeof(u32);
if (remainder) {
- mask = BIT(remainder * 8) - 1;
- if (mask)
- conf->write_data(conf, *data & mask);
+ u32 word = 0;
+
+ memcpy(&word, data, remainder);
+ conf->write_data(conf, word);
}
return 0;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 024/935] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 023/935] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 025/935] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Greg Kroah-Hartman
` (913 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Xingrui Li,
Srinivas Pandruvada, Jiri Kosina
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingrui Li <baka9@bakabaka9.tech>
commit c92693f3ed099401d0383ef35ca1fe1e6ba033de upstream.
sensor_hub_get_feature() clamps its return value to the caller's buffer
size, but the copy loop still copies field->report_size / 8 bytes for
each report value. A malicious HID descriptor can advertise a large
feature field size while an IIO caller supplies a small stack buffer,
such as a single s32, causing an out-of-bounds write.
HID core stores parsed report values in __s32 slots and clamps extracted
values to 32 bits. Reject feature fields that require more than one slot
per value, guard the total byte count calculation, and clamp each
per-value copy to the remaining caller buffer.
Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer for feature report")
Cc: stable@kernel.org
Assisted-by: OpenAI:GPT-5.5-Cyber
Signed-off-by: Xingrui Li <baka9@bakabaka9.tech>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-hub.c | 44 +++++++++++++++++++++++++------------------
1 file changed, 26 insertions(+), 18 deletions(-)
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -239,12 +239,17 @@ int sensor_hub_get_feature(struct hid_se
u32 field_index, int buffer_size, void *buffer)
{
struct hid_report *report;
+ struct hid_field *field;
struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
- int report_size;
+ size_t field_size;
+ size_t report_size;
+ size_t copied = 0;
+ size_t to_copy;
int ret = 0;
- u8 *val_ptr;
- int buffer_index = 0;
- int i;
+ unsigned int i;
+
+ if (!buffer || buffer_size <= 0)
+ return -EINVAL;
memset(buffer, 0, buffer_size);
@@ -258,26 +263,29 @@ int sensor_hub_get_feature(struct hid_se
hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT);
hid_hw_wait(hsdev->hdev);
+ field = report->field[field_index];
+
/* calculate number of bytes required to read this field */
- report_size = DIV_ROUND_UP(report->field[field_index]->report_size,
- 8) *
- report->field[field_index]->report_count;
- if (!report_size) {
+ field_size = DIV_ROUND_UP(field->report_size, 8);
+ /* HID core stores each parsed report value in a __s32 slot. */
+ if (!field_size || field_size > sizeof(field->value[0])) {
+ ret = -EINVAL;
+ goto done_proc;
+ }
+ if (field->report_count > SIZE_MAX / field_size) {
ret = -EINVAL;
goto done_proc;
}
- ret = min(report_size, buffer_size);
- val_ptr = (u8 *)report->field[field_index]->value;
- for (i = 0; i < report->field[field_index]->report_count; ++i) {
- if (buffer_index >= ret)
- break;
-
- memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
- report->field[field_index]->report_size / 8);
- val_ptr += sizeof(__s32);
- buffer_index += (report->field[field_index]->report_size / 8);
+ report_size = field_size * field->report_count;
+ report_size = min_t(size_t, report_size, buffer_size);
+
+ for (i = 0; i < field->report_count && copied < report_size; ++i) {
+ to_copy = min(field_size, report_size - copied);
+ memcpy(&((u8 *)buffer)[copied], &field->value[i], to_copy);
+ copied += to_copy;
}
+ ret = copied;
done_proc:
mutex_unlock(&data->mutex);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 025/935] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 024/935] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 026/935] media: cec: stm32: prevent out-of-bounds write on RX overflow Greg Kroah-Hartman
` (912 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Kees Cook,
Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol@kernel.org>
commit cec0d03fe785380540dc1b4d07c80f67ae2ffc78 upstream.
Patch series "lib/ucs2_string.c: fix out-of-bounds read in
ucs2_strnlen()", v2.
This series fixes an off-by-one out-of-bounds read in ucs2_strnlen().
The first patch is the real fix, the second patch comes as a bonus and
fixes the code indentation.
This patch (of 2):
ucs2_strnlen() checks the current character before checking whether the
caller-provided maximum length has been reached. If the input is not
NUL-terminated within that bound, the loop can read one ucs2_char_t past
the limit.
Test the length before dereferencing to prevent an off-by-one
out-of-bounds read.
Link: https://lore.kernel.org/20260723-fix-ucs2_strnlen-v2-0-9ea94e32a358@kernel.org
Link: https://lore.kernel.org/20260723-fix-ucs2_strnlen-v2-1-9ea94e32a358@kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/ucs2_string.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/ucs2_string.c
+++ b/lib/ucs2_string.c
@@ -8,7 +8,7 @@ ucs2_strnlen(const ucs2_char_t *s, size_
{
unsigned long length = 0;
- while (*s++ != 0 && length < maxlength)
+ while (length < maxlength && *s++ != 0)
length++;
return length;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 026/935] media: cec: stm32: prevent out-of-bounds write on RX overflow
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 025/935] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 027/935] media: vicodec: fix out-of-bounds write in FWHT encoder Greg Kroah-Hartman
` (911 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Hans Verkuil
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
commit fb9dda38d4b9e90db07ed9a0ee2d35bf85494035 upstream.
stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using
rx_msg.len as the write index, incrementing it on every RXBR
(receive-byte-ready) interrupt without checking it against the buffer
size:
cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
rx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct
cec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a
completed message (RXEND). The number of bytes received before RXEND is
decided by the remote CEC device (it sets EOM), not by the driver. A
peer that keeps sending bytes without ending the message drives RXBR
repeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes
out of bounds into the surrounding memory. This is reachable in normal
operation once the driver has probed and receiving is enabled, from the
IRQ thread, without any local privilege.
The length check in the CEC core runs on the consumer side, after the
byte has been stored, so it does not prevent the overflow. Bound the
index in the driver before the store, as the other platform CEC drivers
already do (e.g. tegra_cec), dropping the excess bytes of an overlong
frame.
Found by static analysis tool CodeQL.
Fixes: d69ae57453c8 ("[media] cec: add STM32 cec driver")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/platform/stm32/stm32-cec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/cec/platform/stm32/stm32-cec.c
+++ b/drivers/media/cec/platform/stm32/stm32-cec.c
@@ -133,7 +133,8 @@ static void stm32_rx_done(struct stm32_c
u32 val;
regmap_read(cec->regmap, CEC_RXDR, &val);
- cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
+ if (cec->rx_msg.len < CEC_MAX_MSG_SIZE)
+ cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
}
if (cec->irq_status & RXEND) {
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 027/935] media: vicodec: fix out-of-bounds write in FWHT encoder
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 026/935] media: cec: stm32: prevent out-of-bounds write on RX overflow Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 028/935] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Greg Kroah-Hartman
` (910 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9 upstream.
vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:
coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()
encodes one plane per component, and an incompressible plane takes the
FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.
For a 4-component pixel format all four planes are full resolution
(width_div == height_div == 1), so a frame that forces every plane
through the unencoded fallback writes
sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning
the plane by coded_w * coded_h, which can result in corruption
of adjacent kernel heap memory.
Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest
components_num among the supported raw formats, so the capture buffer is
always large enough for the unencoded fallback.
Fixes: 16ecf6dff97c ("media: vicodec: Add support for 4 planes formats")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -61,11 +61,11 @@ struct pixfmt_info {
};
static const struct v4l2_fwht_pixfmt_info pixfmt_fwht = {
- V4L2_PIX_FMT_FWHT, 0, 3, 1, 1, 1, 1, 1, 0, 1
+ V4L2_PIX_FMT_FWHT, 0, 4, 1, 1, 1, 1, 1, 0, 1
};
static const struct v4l2_fwht_pixfmt_info pixfmt_stateless_fwht = {
- V4L2_PIX_FMT_FWHT_STATELESS, 0, 3, 1, 1, 1, 1, 1, 0, 1
+ V4L2_PIX_FMT_FWHT_STATELESS, 0, 4, 1, 1, 1, 1, 1, 0, 1
};
static void vicodec_dev_release(struct device *dev)
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 028/935] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 027/935] media: vicodec: fix out-of-bounds write in FWHT encoder Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 029/935] of: fix out-of-bounds read in of_alias_scan() stem parser Greg Kroah-Hartman
` (909 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Ryusuke Konishi,
Viacheslav Dubeyko
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit 45662dedb8f272ef7f16e69f13424c4bd0399240 upstream.
Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error
in nilfs_direct_propagate() during testing.
Analysis revealed that after truncating a file, a node block immediately
below the B-tree root was not deleted. Instead, it remained in the B-tree
node cache in a dirty state. The log writer subsequently detected this
block and incorrectly invoked nilfs_direct_propagate() on it, which is
designed to handle only data blocks in direct mapping.
B-tree nodes in the cache are managed by virtual block numbers, and their
logical keys typically exceed the range expected by direct mapping.
Consequently, processing such a node as a direct mapping entry triggers
a slab-out-of-bounds access.
The root cause is that when a B-tree mapping collapses into a direct
mapping during truncation, an intermediate node block pointed to by the
root node is left behind as garbage instead of being explicitly deleted.
This resolves the issue by adding a nilfs_btree_discard() operation
to delete the remaining intermediate node block during the conversion.
A 'deform' flag is added to the bop_delete interface to explicitly signal
that the deletion is part of a mapping transformation. This allows the
B-tree mapping implementation to perform the necessary cleanup and
discarding of the residual node structure that would be otherwise be left
orphaned after the transition.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/r/08A3603A-ADB6-484C-9015-9AC1340E6FB8@gmail.com
Fixes: 36a580eb489f ("nilfs2: direct block mapping")
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/bmap.c | 2 +-
fs/nilfs2/bmap.h | 2 +-
fs/nilfs2/btree.c | 39 ++++++++++++++++++++++++++++++++-------
fs/nilfs2/direct.c | 4 ++--
4 files changed, 36 insertions(+), 11 deletions(-)
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -181,7 +181,7 @@ static int nilfs_bmap_do_delete(struct n
return ret;
}
- return bmap->b_ops->bop_delete(bmap, key);
+ return bmap->b_ops->bop_delete(bmap, key, false);
}
/**
--- a/fs/nilfs2/bmap.h
+++ b/fs/nilfs2/bmap.h
@@ -50,7 +50,7 @@ struct nilfs_bmap_operations {
int (*bop_lookup_contig)(const struct nilfs_bmap *, __u64, __u64 *,
unsigned int);
int (*bop_insert)(struct nilfs_bmap *, __u64, __u64);
- int (*bop_delete)(struct nilfs_bmap *, __u64);
+ int (*bop_delete)(struct nilfs_bmap *bmap, __u64 key, bool deform);
void (*bop_clear)(struct nilfs_bmap *);
int (*bop_propagate)(struct nilfs_bmap *, struct buffer_head *);
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1426,6 +1426,28 @@ static void nilfs_btree_shrink(struct ni
path[level].bp_bh = NULL;
}
+/**
+ * nilfs_btree_discard - discard the last node for the mapping transformation
+ * @btree: bmap struct of btree
+ * @path: array of nilfs_btree_path struct
+ * @level: level of the B-tree node being operated on
+ * @keyp: argument for passing a key (unused)
+ * @ptrp: argument for passing a pointer (unused)
+ */
+static void nilfs_btree_discard(struct nilfs_bmap *btree,
+ struct nilfs_btree_path *path, int level,
+ __u64 *keyp, __u64 *ptrp)
+{
+ struct nilfs_btree_node *root = nilfs_btree_get_root(btree);
+
+ nilfs_btree_node_delete(root, 0, NULL, NULL,
+ NILFS_BTREE_ROOT_NCHILDREN_MAX);
+ nilfs_btree_node_set_level(root, level);
+
+ nilfs_btnode_delete(path[level].bp_bh);
+ path[level].bp_bh = NULL;
+}
+
static void nilfs_btree_nop(struct nilfs_bmap *btree,
struct nilfs_btree_path *path,
int level, __u64 *keyp, __u64 *ptrp)
@@ -1436,7 +1458,7 @@ static int nilfs_btree_prepare_delete(st
struct nilfs_btree_path *path,
int *levelp,
struct nilfs_bmap_stats *stats,
- struct inode *dat)
+ struct inode *dat, bool deform)
{
struct buffer_head *bh;
struct nilfs_btree_node *node, *parent, *sib;
@@ -1523,15 +1545,17 @@ static int nilfs_btree_prepare_delete(st
if (nilfs_btree_node_get_nchildren(node) - 1 <=
NILFS_BTREE_ROOT_NCHILDREN_MAX) {
path[level].bp_op = nilfs_btree_shrink;
- stats->bs_nblocks += 2;
- level++;
- path[level].bp_op = nilfs_btree_nop;
- goto shrink_root_child;
+ } else if (deform) {
+ path[level].bp_op = nilfs_btree_discard;
} else {
path[level].bp_op = nilfs_btree_do_delete;
stats->bs_nblocks++;
goto out;
}
+ stats->bs_nblocks += 2;
+ level++;
+ path[level].bp_op = nilfs_btree_nop;
+ goto shrink_root_child;
}
}
@@ -1582,7 +1606,7 @@ static void nilfs_btree_commit_delete(st
nilfs_bmap_set_dirty(btree);
}
-static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key)
+static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key, bool deform)
{
struct nilfs_btree_path *path;
@@ -1602,7 +1626,8 @@ static int nilfs_btree_delete(struct nil
dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
- ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat);
+ ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat,
+ deform);
if (ret < 0)
goto out;
nilfs_btree_commit_delete(btree, path, level, dat);
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -144,7 +144,7 @@ static int nilfs_direct_insert(struct ni
return ret;
}
-static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key)
+static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key, bool deform)
{
union nilfs_bmap_ptr_req req;
struct inode *dat;
@@ -234,7 +234,7 @@ int nilfs_direct_delete_and_convert(stru
/* no need to allocate any resource for conversion */
/* delete */
- ret = bmap->b_ops->bop_delete(bmap, key);
+ ret = bmap->b_ops->bop_delete(bmap, key, true);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 029/935] of: fix out-of-bounds read in of_alias_scan() stem parser
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 028/935] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 030/935] ubifs: fix out-of-bounds read in signature length check Greg Kroah-Hartman
` (908 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdurrahman Hussain,
Geert Uytterhoeven, Rob Herring (Arm)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
commit 5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f upstream.
The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.
Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -2014,7 +2014,7 @@ void of_alias_scan(void * (*dt_alloc)(u6
/* walk the alias backwards to extract the id and work out
* the 'stem' string */
- while (isdigit(*(end-1)) && end > start)
+ while (end > start && isdigit(*(end - 1)))
end--;
len = end - start;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 030/935] ubifs: fix out-of-bounds read in signature length check
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 029/935] of: fix out-of-bounds read in of_alias_scan() stem parser Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 031/935] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Greg Kroah-Hartman
` (907 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Richard Weinberger,
Zhihao Cheng
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
commit 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf upstream.
ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
before handing the signature payload to verify_pkcs7_signature(), but the
check has the wrong sign:
if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))
The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,
64 bytes) into the node, so the payload is at most
snod->len - sizeof(struct ubifs_sig_node)
bytes long. Adding the header size instead of subtracting it accepts a
declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually
holds -- past the end of c->sbuf, which is vmalloc(c->leb_size).
verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()
is then handed that inflated length and reads beyond the allocation while
walking the DER headers. The node length comes straight from the mounted
image, so a crafted signed UBIFS image reaches this via
ubifs_read_superblock() before the signature is cryptographically checked.
snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner
(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected
subtraction cannot underflow. Legitimately signed images are unaffected: a
correct superblock never declares a signature longer than the node it is
embedded in.
Fixes: 817aa094842d ("ubifs: support offline signed images")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Reviewed-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ubifs/auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ubifs/auth.c
+++ b/fs/ubifs/auth.c
@@ -218,7 +218,7 @@ int ubifs_sb_verify_signature(struct ubi
signode = snod->node;
- if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node)) {
+ if (le32_to_cpu(signode->len) > snod->len - sizeof(struct ubifs_sig_node)) {
ubifs_err(c, "invalid signature len %d", le32_to_cpu(signode->len));
err = -EINVAL;
goto out_destroy;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 031/935] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 030/935] ubifs: fix out-of-bounds read in signature length check Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 032/935] NFSD: Fix off-by-one in DRC bucket pruning limit Greg Kroah-Hartman
` (906 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit ed4edddad19babf76b56882ad9600f5646b167a0 upstream.
The NFSv2 ACL GETACL reply is a union that carries file attributes
and ACL data only when the status is NFS_OK. All error cases are
void results. However, currently the NFSv2 ACL GETACL result encoder
decides whether to append the "OK" body by testing only whether the
file handle resolved to a positive dentry, not the actual reply
status.
A GETACL request that resolves its file handle but then fails for
another reason (an unsupported mask value, a getattr failure, or an
ACL retrieval error) therefore appends file attributes and ACL data
after the error status on the wire. Worse, when the mask is
rejected, fh_getattr() hasn't been called at all, so those
attributes are serialized from a zero-filled kstat and are junk.
The logic before the xdr_stream conversion used the reply status.
Revert to that approach (but keep the xdr_stream conversion in
place).
Fixes: f8cba47344f7 ("NFSD: Update the NFSv2 GETACL result encoder to use struct xdr_stream")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260712150911.48461-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs2acl.c | 31 +++++++++++++++----------------
1 file changed, 15 insertions(+), 16 deletions(-)
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -248,22 +248,21 @@ nfsaclsvc_encode_getaclres(struct svc_rq
if (!svcxdr_encode_stat(xdr, resp->status))
return false;
-
- if (dentry == NULL || d_really_is_negative(dentry))
- return true;
- inode = d_inode(dentry);
-
- if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
- return false;
- if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
- return false;
-
- if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
- resp->mask & NFS_ACL, 0))
- return false;
- if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
- resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
- return false;
+ switch (resp->status) {
+ case nfs_ok:
+ inode = d_inode(dentry);
+ if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
+ return false;
+ if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
+ return false;
+ if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
+ resp->mask & NFS_ACL, 0))
+ return false;
+ if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
+ resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
+ return false;
+ break;
+ }
return true;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 032/935] NFSD: Fix off-by-one in DRC bucket pruning limit
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 031/935] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 033/935] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Greg Kroah-Hartman
` (905 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, NeilBrown, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit d0728723c80dcb3432effd67c7e919b596004b1d upstream.
nfsd_prune_bucket_locked() evicts an entry before checking
the freed count against @max. The check uses "++freed > max",
which does not break until freed exceeds max, resulting in
max + 1 evictions. Use ">=" so the limit stated in the
function comment is honored.
Fixes: a9507f6af145 ("NFSD: Replace nfsd_prune_bucket()")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260717001232.438792-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfscache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -283,7 +283,7 @@ nfsd_prune_bucket_locked(struct nfsd_net
nfsd_cacherep_unlink_locked(nn, b, rp);
list_add(&rp->c_lru, dispose);
- if (max && ++freed > max)
+ if (max && ++freed >= max)
break;
}
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 033/935] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 032/935] NFSD: Fix off-by-one in DRC bucket pruning limit Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 034/935] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Greg Kroah-Hartman
` (904 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 036c1b182f4da65363e79ec0ac276edc6b7296e5 upstream.
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with
list_for_each_entry_safe(ni, tmp, ...). For each expired entry it
sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the
source vfsmount, then reacquires the lock to list_del + kfree the
entry and continue iterating via the macro's saved tmp pointer.
The nsui_busy flag protects the current ni from concurrent
nfsd4_ssc_setup_dul() finders during the lock-drop window, but it
does not pin tmp. Another nfsd RPC thread that fails its source-
server mount and reaches nfsd4_ssc_cancel_dul() will, during that
same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount
item, and release the lock. If that item is the saved tmp of the
expire walk, the next iteration dereferences a freed
nfsd4_ssc_umount_item.
Restart the walk from the head after the mntput() unlock window so
no saved next pointer survives the lock-drop. The list is bounded
by the number of active inter-server source mounts (typically small)
and the expire delayed-work runs periodically rather than per-IO,
so the restart is cheap.
Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260524130654.1924556-1-michael.bommarito@gmail.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 44 +++++++++++++++++++++++++-------------------
1 file changed, 25 insertions(+), 19 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6018,30 +6018,36 @@ static void nfsd4_ssc_shutdown_umount(st
static void nfsd4_ssc_expire_umount(struct nfsd_net *nn)
{
bool do_wakeup = false;
- struct nfsd4_ssc_umount_item *ni = NULL;
- struct nfsd4_ssc_umount_item *tmp;
+ struct nfsd4_ssc_umount_item *ni;
+restart:
spin_lock(&nn->nfsd_ssc_lock);
- list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
- if (time_after(jiffies, ni->nsui_expire)) {
- if (refcount_read(&ni->nsui_refcnt) > 1)
- continue;
+ list_for_each_entry(ni, &nn->nfsd_ssc_mount_list, nsui_list) {
+ if (!time_after(jiffies, ni->nsui_expire))
+ break;
+ if (refcount_read(&ni->nsui_refcnt) > 1)
+ continue;
- /* mark being unmount */
- ni->nsui_busy = true;
- spin_unlock(&nn->nfsd_ssc_lock);
- mntput(ni->nsui_vfsmount);
- spin_lock(&nn->nfsd_ssc_lock);
+ /* Prevent concurrent setup during unmount */
+ ni->nsui_busy = true;
+ spin_unlock(&nn->nfsd_ssc_lock);
+ mntput(ni->nsui_vfsmount);
+ spin_lock(&nn->nfsd_ssc_lock);
- /* waiters need to start from begin of list */
- list_del(&ni->nsui_list);
- kfree(ni);
+ /* Force concurrent scanners to restart */
+ list_del(&ni->nsui_list);
+ kfree(ni);
- /* wakeup ssc_connect waiters */
- do_wakeup = true;
- continue;
- }
- break;
+ /* wakeup ssc_connect waiters */
+ do_wakeup = true;
+ /*
+ * Concurrent nfsd4_ssc_cancel_dul() can free any item
+ * on the list under nfsd_ssc_lock while mntput() runs
+ * above. Restart from the head; the list is short and
+ * the expire worker is periodic, so this is cheap.
+ */
+ spin_unlock(&nn->nfsd_ssc_lock);
+ goto restart;
}
if (do_wakeup)
wake_up_all(&nn->nfsd_ssc_waitq);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 034/935] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 033/935] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 035/935] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Greg Kroah-Hartman
` (903 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
commit aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e upstream.
The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in
fh_verify of directories") details the assumption that justified
adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is
invalid (in the case of NFS reexport).
When NFSD exports an NFS filesystem it is very possible for
nfsd_mode_check() to encounter a @dentry that doesn't have
i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and
NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).
So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir
return on that branch must stay. It guards the subsequent
lookup_one_unlocked() -> __lookup_slow() path, which calls
inode->i_op->lookup() with no NULL check, so returning nfserr_notdir
is what keeps a client LOOKUP into such a @dentry from dereferencing
a NULL method pointer.
Fixes: e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Link: https://patch.msgid.link/20260612191410.50177-1-snitzer@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsfh.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -70,10 +70,8 @@ nfsd_mode_check(struct svc_rqst *rqstp,
if (requested == 0) /* the caller doesn't care */
return nfs_ok;
if (mode == requested) {
- if (mode == S_IFDIR && !d_can_lookup(dentry)) {
- WARN_ON_ONCE(1);
+ if (mode == S_IFDIR && !d_can_lookup(dentry))
return nfserr_notdir;
- }
return nfs_ok;
}
/*
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 035/935] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 034/935] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 036/935] nfsd: Reset write verifier when async COPY writeback fails Greg Kroah-Hartman
` (902 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Trond Myklebust
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit ee5a386cfe60f3f8286de16a9db8e1a08f0bc124 upstream.
When the server returns a new layout stateid while a valid one is still
held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on
the on-stack free_me list and jumps to out_forget. Segments whose
reference count drops to zero are unlinked from lo->plh_segs and moved
to free_me by mark_lseg_invalid(); for an idle cached segment the layout
header holds the only reference, so this happens on the first decrement.
out_forget never drains free_me -- only the success path calls
pnfs_free_lseg_list().
Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in
pnfs_layout_process()") added the drain; commit 08bd8dbe8882
("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()")
removed it while switching the destination to lo->plh_return_segs, which
is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout
return in pnfs_layout_process()") switched the destination back to
free_me without restoring the drain.
Restore the pnfs_free_lseg_list() call.
Fixes: fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2479,6 +2479,7 @@ out_forget:
spin_unlock(&ino->i_lock);
lseg->pls_layout = lo;
NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
+ pnfs_free_lseg_list(&free_me);
return ERR_PTR(-EAGAIN);
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 036/935] nfsd: Reset write verifier when async COPY writeback fails
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 035/935] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 037/935] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Greg Kroah-Hartman
` (901 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9 upstream.
Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread completes. When
the post-copy vfs_fsync_range() or filemap_check_wb_err() in
_nfsd_copy_file_range() reports an error, the worker correctly
leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes
wr_stable_how as NFS_UNSTABLE, but the server's write verifier is
not rotated.
A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with
COMMIT to make the copied data durable. With the verifier
unchanged, COMMIT returns the same value the client just received
via CB_OFFLOAD, and the client concludes the copy is durable --
silently dropping the data whose writeback in fact failed. This
violates the UNSTABLE+COMMIT durability contract (RFC 7862 section
15.1, RFC 8881 section 18.32) and matches the bug just fixed in
nfsd_vfs_write() and nfsd_commit().
Rotate nn->writeverf at the writeback-failure site. The async COPY
worker has no svc_rqst, so commit_reset_write_verifier() is not
available here; calling nfsd_reset_write_verifier() directly
mirrors the trace-less reset already used by
nfsd_file_check_write_error() for the same purpose. Filter out
-EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since
neither indicates a durable-storage failure.
Fixes: eac0b17a77fb ("NFSD add vfs_fsync after async copy is done")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260522203723.446841-1-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1628,6 +1628,8 @@ static ssize_t _nfsd_copy_file_range(str
status = filemap_check_wb_err(dst->f_mapping, since);
if (!status)
set_bit(NFSD4_COPY_F_COMMITTED, ©->cp_flags);
+ else if (status != -EAGAIN && status != -ESTALE)
+ nfsd_reset_write_verifier(copy->cp_nn);
}
return bytes_copied;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 037/935] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 036/935] nfsd: Reset write verifier when async COPY writeback fails Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 038/935] nfsd: sample writeback error cursor before async COPY loop Greg Kroah-Hartman
` (900 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 45b06a75086f331f52cbb81223a59421d43f8809 upstream.
nfsd4_decode_nl4_server() handled only NL4_NETADDR and returned
nfserr_bad_xdr for NL4_NAME and NL4_URL. Those forms are well-formed XDR,
so BADXDR is misleading -- the request is unsupported, not malformed.
Decode and discard the utf8str_cis for NL4_NAME and NL4_URL to keep the
stream consistent, and return nfserr_notsupp. nfsd4_proc_compound() honors
a decode-time op->status, so the op fails without executing.
Fixes: 84e1b21d5ec4 ("NFSD add ca_source_server<> to COPY")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-7-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1918,6 +1918,7 @@ static __be32 nfsd4_decode_nl4_server(st
{
struct nfs42_netaddr *naddr;
__be32 *p;
+ u32 str_len;
if (xdr_stream_decode_u32(argp->xdr, &ns->nl4_type) < 0)
return nfserr_bad_xdr;
@@ -1947,6 +1948,18 @@ static __be32 nfsd4_decode_nl4_server(st
return nfserr_bad_xdr;
memcpy(naddr->addr, p, naddr->addr_len);
break;
+ case NL4_NAME:
+ case NL4_URL:
+ /*
+ * Well-formed XDR, but only NL4_NETADDR is supported. Consume
+ * the utf8str_cis to keep the stream aligned, then return
+ * NFS4ERR_NOTSUPP rather than the misleading NFS4ERR_BADXDR.
+ */
+ if (xdr_stream_decode_u32(argp->xdr, &str_len) < 0)
+ return nfserr_bad_xdr;
+ if (!xdr_inline_decode(argp->xdr, str_len))
+ return nfserr_bad_xdr;
+ return nfserr_notsupp;
default:
return nfserr_bad_xdr;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 038/935] nfsd: sample writeback error cursor before async COPY loop
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 037/935] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 039/935] nfsd: validate symlink target length in NFSv4 CREATE Greg Kroah-Hartman
` (899 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 20a67a7d18221af736f124770c2c5e859b479046 upstream.
_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback errors
via filemap_check_wb_err() once vfs_fsync_range() returns.
Because the nfsd_file cache reuses a single struct file
across requests targeting the same inode, a concurrent
COMMIT or stable WRITE on dst advances dst->f_wb_err to the
current mapping->wb_err via file_check_and_advance_wb_err()
during its own vfs_fsync_range(). If that advancement lands
between the writeback error appearing in mapping->wb_err
and the COPY worker sampling "since", the worker captures
the already-advanced cursor, errseq_check() sees cur ==
since and returns zero, and NFSD4_COPY_F_COMMITTED is set
even though writeback failed. CB_OFFLOAD then encodes
wr_stable_how = FILE_SYNC4, the client treats the copied
data as durable, and the failure becomes silent data loss.
Sample since once at the start of the function. The cursor
then reflects state in effect before this COPY issues any
writes, and filemap_check_wb_err() detects any error that
occurs during the copy regardless of which thread first
observes it. This matches the pattern used by
nfsd_vfs_write() and nfsd4_clone_file_range().
Closes: https://sashiko.dev/#/patchset/20260522194441.436065-1-cel@kernel.org?part=1
Fixes: 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260522214558.460859-1-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1607,6 +1607,7 @@ static ssize_t _nfsd_copy_file_range(str
/* See RFC 7862 p.67: */
if (bytes_total == 0)
bytes_total = ULLONG_MAX;
+ since = READ_ONCE(dst->f_wb_err);
do {
if (kthread_should_stop())
break;
@@ -1621,7 +1622,6 @@ static ssize_t _nfsd_copy_file_range(str
} while (bytes_total > 0 && nfsd4_copy_is_async(copy));
/* for a non-zero asynchronous copy do a commit of data */
if (nfsd4_copy_is_async(copy) && copy->cp_res.wr_bytes_written > 0) {
- since = READ_ONCE(dst->f_wb_err);
end = copy->cp_dst_pos + copy->cp_res.wr_bytes_written - 1;
status = vfs_fsync_range(dst, copy->cp_dst_pos, end, 0);
if (!status)
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 039/935] nfsd: validate symlink target length in NFSv4 CREATE
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 038/935] nfsd: sample writeback error cursor before async COPY loop Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 040/935] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Greg Kroah-Hartman
` (898 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 041f57056e5fb9c80adc088269322d2c61074406 upstream.
nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for
NF4LNK symlink targets, allowing a client to force a kmalloc of up to
the maximum RPC payload size (several MiB) per COMPOUND op that persists
until compound teardown. The VFS rejects oversized targets with
ENAMETOOLONG, but the allocation has already occurred.
Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater
than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the
allocation.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-9-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -801,6 +801,10 @@ nfsd4_decode_create(struct nfsd4_compoun
case NF4LNK:
if (xdr_stream_decode_u32(argp->xdr, &create->cr_datalen) < 0)
return nfserr_bad_xdr;
+ if (create->cr_datalen == 0)
+ return nfserr_inval;
+ if (create->cr_datalen > NFS4_MAXPATHLEN)
+ return nfserr_nametoolong;
p = xdr_inline_decode(argp->xdr, create->cr_datalen);
if (!p)
return nfserr_bad_xdr;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 040/935] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 039/935] nfsd: validate symlink target length in NFSv4 CREATE Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 041/935] nfsd: add filehandle match check to nfsd4_delegreturn() Greg Kroah-Hartman
` (897 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 4e475be769aa9f7a2c1ce55a2b8592cfccacddcc upstream.
The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This causes nfsd_setattr() to skip
fh_want_write(), so notify_change() runs without a mount write
reference.
Add the missing fh_want_write() call after the early fh_verify().
Fixes: cc265089ce1b ("nfsd: Disable NFSv2 timestamp workaround for NFSv3+")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-11-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsproc.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -55,6 +55,7 @@ nfsd_proc_setattr(struct svc_rqst *rqstp
.na_iattr = iap,
};
struct svc_fh *fhp;
+ int hosterr;
dprintk("nfsd: SETATTR %s, valid=%x, size=%ld\n",
SVCFH_fmt(&argp->fh),
@@ -90,6 +91,12 @@ nfsd_proc_setattr(struct svc_rqst *rqstp
if (resp->status != nfs_ok)
goto out;
+ hosterr = fh_want_write(fhp);
+ if (hosterr) {
+ resp->status = nfserrno(hosterr);
+ goto out;
+ }
+
if (delta < 0)
delta = -delta;
if (delta < MAX_TOUCH_TIME_ERROR &&
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 041/935] nfsd: add filehandle match check to nfsd4_delegreturn()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 040/935] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 042/935] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Greg Kroah-Hartman
` (896 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 04cce9d79f2b1a114f7128e08bf60a473e10f1ec upstream.
nfsd4_delegreturn() is the only stateful NFSv4 operation that does
not call nfs4_check_fh() to verify the delegation's file matches
cstate->current_fh. A client can DELEGRETURN with a mismatched
filehandle, destroying the correct delegation but waking the wrong
inode's waiters.
Add the missing nfs4_check_fh() call after the generation check.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-6-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7119,6 +7119,10 @@ nfsd4_delegreturn(struct svc_rqst *rqstp
if (status)
goto put_stateid;
+ status = nfs4_check_fh(&cstate->current_fh, &dp->dl_stid);
+ if (status)
+ goto put_stateid;
+
trace_nfsd_deleg_return(stateid);
wake_up_var(d_inode(cstate->current_fh.fh_dentry));
destroy_delegation(dp);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 042/935] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 041/935] nfsd: add filehandle match check to nfsd4_delegreturn() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 043/935] nfsd: check client ownership when cancelling a copy-notify stateid Greg Kroah-Hartman
` (895 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit c59738a00aa51b16adc1b5ceb7c80877168efb4d upstream.
When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export both NULL if fh_verify() returns
nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag
is set, but the compound dispatch loop only uses this flag to bypass
the nfserr_nofilehandle check -- it does not prevent subsequent ops
from running with a NULL fh_dentry.
A remote client can exploit this by crafting a COMPOUND that includes
an inter-SSC COPY (which causes check_if_stalefh_allowed() to set
no_verify=true on the saved PUTFH) with an additional op inserted
between the source PUTFH and SAVEFH. For example, SETATTR calls
fh_want_write() which dereferences fh_export->ex_path.mnt without
calling fh_verify() first, causing a NULL pointer dereference in the
nfsd kthread.
Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set
and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow)
and ops with ALLOWED_WITHOUT_FH (which don't need a resolved
filehandle) may proceed. All other ops receive nfserr_stale, per
RFC 7862 Section 15.2.3 which specifies that foreign filehandle
validation is deferred to the consuming operation and NFS4ERR_STALE
returned at that point.
Fixes: b9e8638e3d9e ("NFSD: allow inter server COPY to have a STALE source server fh")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-putfh_foreign_fh_null_deref_consumers-v1-1-1b8a5aa28c59@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2642,9 +2642,22 @@ nfsd4_proc_compound(struct svc_rqst *rqs
op->status = nfsd4_open_omfg(rqstp, cstate, op);
goto encode_op;
}
- if (!current_fh->fh_dentry &&
- !HAS_FH_FLAG(current_fh, NFSD4_FH_FOREIGN)) {
- if (!(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
+ if (!current_fh->fh_dentry) {
+ if (HAS_FH_FLAG(current_fh, NFSD4_FH_FOREIGN)) {
+ /*
+ * FOREIGN fh from inter-SSC PUTFH: only
+ * SAVEFH may proceed with a NULL fh_dentry.
+ * Per RFC 7862 S15.2.3, validation of a
+ * foreign fh is deferred to the operation
+ * that consumes it, and NFS4ERR_STALE is
+ * returned at that point.
+ */
+ if (op->opnum != OP_SAVEFH &&
+ !(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
+ op->status = nfserr_stale;
+ goto encode_op;
+ }
+ } else if (!(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
op->status = nfserr_nofilehandle;
goto encode_op;
}
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 043/935] nfsd: check client ownership when cancelling a copy-notify stateid
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 042/935] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 044/935] nfsd: fix cpntf publish race in nfs4_init_cp_state Greg Kroah-Hartman
` (894 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf upstream.
On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the
target cpntf state without checking ownership. The lookup key
st->si_opaque.so_id is allocated cyclically (guessable) and the embedded
clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated
NFSv4.2 client could cancel and free another client's copy-notify
stateid.
Compare the creating clientid recorded in state->cp_p_clid against the
requesting client's cl_clientid and return nfserr_bad_stateid on a
mismatch instead of freeing the entry.
Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-5-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6616,10 +6616,20 @@ __be32 manage_cpntf_state(struct nfsd_ne
state = NULL;
goto unlock;
}
- if (!clp)
+ if (!clp) {
refcount_inc(&state->cp_stateid.cs_count);
- else
+ } else if (memcmp(&clp->cl_clientid, &state->cp_p_clid,
+ sizeof(clientid_t))) {
+ /*
+ * OFFLOAD_CANCEL: only the creating client may cancel.
+ * so_id is guessable, so without this check any client
+ * could free another's cpntf state.
+ */
+ state = NULL;
+ goto unlock;
+ } else {
_free_cpntf_state_locked(nn, state);
+ }
}
unlock:
spin_unlock(&nn->s2s_cp_lock);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 044/935] nfsd: fix cpntf publish race in nfs4_init_cp_state
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 043/935] nfsd: check client ownership when cancelling a copy-notify stateid Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 045/935] nfsd: fix version mismatch loops in nfsd_acl_init_request() Greg Kroah-Hartman
` (893 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit be3a5c1d857b0dcbc11796cea603ef25834f75b2 upstream.
nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then
took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap
the entry is reachable by so_id but cp_list is still {NULL,NULL} from
kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as
cnr_stateid, so any NFSv4.2 client can drive it) reaches
manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on
the zeroed list_head, oopsing the server.
Fold the cs_type assignment and the list_add() into the same critical
section as idr_alloc_cyclic(), so a concurrent lookup either misses the
entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after
allocation and switch _free_cpntf_state_locked() to list_del_init() so a
stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and
skips the list_add, preserving NFS4_COPY_STID semantics.
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-1-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 35 +++++++++++++++++++++++++----------
1 file changed, 25 insertions(+), 10 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -984,7 +984,7 @@ out_free:
* Create a unique stateid_t to represent each COPY.
*/
static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
- unsigned char cs_type)
+ unsigned char cs_type, struct nfs4_stid *p_stid)
{
int new_id;
@@ -994,19 +994,34 @@ static int nfs4_init_cp_state(struct nfs
idr_preload(GFP_KERNEL);
spin_lock(&nn->s2s_cp_lock);
new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, stid, 0, 0, GFP_NOWAIT);
- stid->cs_stid.si_opaque.so_id = new_id;
- stid->cs_stid.si_generation = 1;
+ if (new_id >= 0) {
+ stid->cs_stid.si_opaque.so_id = new_id;
+ stid->cs_stid.si_generation = 1;
+ /*
+ * Set cs_type and link onto sc_cp_list under the same lock
+ * that installed the IDR entry, so a concurrent
+ * manage_cpntf_state() sees either no entry or a fully
+ * linked cp_list.
+ */
+ stid->cs_type = cs_type;
+ if (p_stid) {
+ struct nfs4_cpntf_state *cps =
+ container_of(stid, struct nfs4_cpntf_state,
+ cp_stateid);
+
+ list_add(&cps->cp_list, &p_stid->sc_cp_list);
+ }
+ }
spin_unlock(&nn->s2s_cp_lock);
idr_preload_end();
if (new_id < 0)
return 0;
- stid->cs_type = cs_type;
return 1;
}
int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy)
{
- return nfs4_init_cp_state(nn, ©->cp_stateid, NFS4_COPY_STID);
+ return nfs4_init_cp_state(nn, ©->cp_stateid, NFS4_COPY_STID, NULL);
}
struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn,
@@ -1017,13 +1032,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init
cps = kzalloc(sizeof(struct nfs4_cpntf_state), GFP_KERNEL);
if (!cps)
return NULL;
+ /* So a stale list_del_init() before linking is a no-op. */
+ INIT_LIST_HEAD(&cps->cp_list);
cps->cpntf_time = ktime_get_boottime_seconds();
refcount_set(&cps->cp_stateid.cs_count, 1);
- if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID))
+ if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID,
+ p_stid))
goto out_free;
- spin_lock(&nn->s2s_cp_lock);
- list_add(&cps->cp_list, &p_stid->sc_cp_list);
- spin_unlock(&nn->s2s_cp_lock);
return cps;
out_free:
kfree(cps);
@@ -6588,7 +6603,7 @@ _free_cpntf_state_locked(struct nfsd_net
WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
if (!refcount_dec_and_test(&cps->cp_stateid.cs_count))
return;
- list_del(&cps->cp_list);
+ list_del_init(&cps->cp_list);
idr_remove(&nn->s2s_cp_stateids,
cps->cp_stateid.cs_stid.si_opaque.so_id);
kfree(cps);
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 045/935] nfsd: fix version mismatch loops in nfsd_acl_init_request()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 044/935] nfsd: fix cpntf publish race in nfs4_init_cp_state Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 046/935] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Greg Kroah-Hartman
` (892 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 9bc761051dcd9a4a8b59e64b2b185172d13c716d upstream.
The loops that compute the supported version range for PROG_MISMATCH
test nfsd_support_acl_version(rqstp->rq_vers) instead of
nfsd_support_acl_version(i), so every iteration fails and the
function returns rpc_prog_unavail instead of rpc_prog_mismatch.
Replace rqstp->rq_vers with the loop variable i, matching the
pattern used by the sibling nfsd_init_request() function.
Fixes: e333f3bbefe3 ("nfsd: Allow containers to set supported nfs versions")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-9-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfssvc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -859,7 +859,7 @@ nfsd_acl_init_request(struct svc_rqst *r
ret->mismatch.lovers = NFSD_ACL_NRVERS;
for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++) {
- if (nfsd_support_acl_version(rqstp->rq_vers) &&
+ if (nfsd_support_acl_version(i) &&
nfsd_vers(nn, i, NFSD_TEST)) {
ret->mismatch.lovers = i;
break;
@@ -869,7 +869,7 @@ nfsd_acl_init_request(struct svc_rqst *r
return rpc_prog_unavail;
ret->mismatch.hivers = NFSD_ACL_MINVERS;
for (i = NFSD_ACL_NRVERS - 1; i >= NFSD_ACL_MINVERS; i--) {
- if (nfsd_support_acl_version(rqstp->rq_vers) &&
+ if (nfsd_support_acl_version(i) &&
nfsd_vers(nn, i, NFSD_TEST)) {
ret->mismatch.hivers = i;
break;
^ permalink raw reply [flat|nested] 945+ messages in thread
* [PATCH 5.15 046/935] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 045/935] nfsd: fix version mismatch loops in nfsd_acl_init_request() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 047/935] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Greg Kroah-Hartman
` (891 subsequent siblings)
937 siblings, 0 replies; 945+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f9868174af49d207fbaf0c5e055d088a983684af upstream.
The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has
multiple errors that can result in either an out-of-bounds write or
leaking uninitialized kernel memory to the client:
- fh_len doesn't account for XDR padding o