* [PATCH 5.15 001/935] ALSA: aloop: Fix racy access at PCM trigger
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 002/935] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Greg Kroah-Hartman
` (939 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+5f8f3acdee1ec7a7ef7b,
Takashi Iwai, Karl Mehltretter, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 826af7fa62e347464b1b4e0ba2fe19a92438084f ]
The PCM trigger callback of aloop driver tries to check the PCM state
and stop the stream of the tied substream in the corresponding cable.
Since both check and stop operations are performed outside the cable
lock, this may result in UAF when a program attempts to trigger
frequently while opening/closing the tied stream, as spotted by
fuzzers.
For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with
cable->lock spinlock, and add the proper NULL checks. This avoids
already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream
that may be stopped in this function, which was the major pain point
leading to UAF.
Reported-by: syzbot+5f8f3acdee1ec7a7ef7b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/69783ba1.050a0220.c9109.0011.GAE@google.com
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260203141003.116584-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ Karl Mehltretter: open-coded spin_lock_irqsave() instead of scoped_guard();
used snd_pcm_running() instead of cruntime->state; dropped the access-mode
comparison and notification (462494565c27, e299a9fd433f, cdac6e1f7164);
kept the stop_count handling from the e5c33cdc6f40 backport. ]
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/drivers/aloop.c | 99 ++++++++++++++++++++++++++-----------------
1 file changed, 59 insertions(+), 40 deletions(-)
diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c
index c083b223df85c..74cfd9119ccf6 100644
--- a/sound/drivers/aloop.c
+++ b/sound/drivers/aloop.c
@@ -322,56 +322,75 @@ static int loopback_snd_timer_close_cable(struct loopback_pcm *dpcm)
static int loopback_check_format(struct loopback_cable *cable, int stream)
{
+ struct loopback_pcm *dpcm_play, *dpcm_capt;
struct snd_pcm_runtime *runtime, *cruntime;
struct loopback_setup *setup;
struct snd_card *card;
- int check;
+ unsigned long flags;
+ bool stop_capture = false;
+ int check, err = 0;
+
+ spin_lock_irqsave(&cable->lock, flags);
+ dpcm_play = cable->streams[SNDRV_PCM_STREAM_PLAYBACK];
+ dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE];
if (cable->valid != CABLE_VALID_BOTH) {
- if (stream == SNDRV_PCM_STREAM_PLAYBACK)
- goto __notify;
- return 0;
- }
- runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
- substream->runtime;
- cruntime = cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
- substream->runtime;
- check = runtime->format != cruntime->format ||
- runtime->rate != cruntime->rate ||
- runtime->channels != cruntime->channels;
- if (!check)
- return 0;
- if (stream == SNDRV_PCM_STREAM_CAPTURE) {
- return -EIO;
+ if (stream == SNDRV_PCM_STREAM_CAPTURE || !dpcm_play)
+ goto unlock;
} else {
- /* close must not free the peer runtime below */
- atomic_inc(&cable->stop_count);
- snd_pcm_stop(cable->streams[SNDRV_PCM_STREAM_CAPTURE]->
- substream, SNDRV_PCM_STATE_DRAINING);
- if (atomic_dec_and_test(&cable->stop_count))
- wake_up(&cable->stop_wait);
- __notify:
- runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->
- substream->runtime;
- setup = get_setup(cable->streams[SNDRV_PCM_STREAM_PLAYBACK]);
- card = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->loopback->card;
- if (setup->format != runtime->format) {
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
- &setup->format_id);
- setup->format = runtime->format;
+ if (!dpcm_play || !dpcm_capt) {
+ err = -EIO;
+ goto unlock;
}
- if (setup->rate != runtime->rate) {
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
- &setup->rate_id);
- setup->rate = runtime->rate;
+ runtime = dpcm_play->substream->runtime;
+ cruntime = dpcm_capt->substream->runtime;
+ if (!runtime || !cruntime) {
+ err = -EIO;
+ goto unlock;
}
- if (setup->channels != runtime->channels) {
- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
- &setup->channels_id);
- setup->channels = runtime->channels;
+ check = runtime->format != cruntime->format ||
+ runtime->rate != cruntime->rate ||
+ runtime->channels != cruntime->channels;
+ if (!check)
+ goto unlock;
+ if (stream == SNDRV_PCM_STREAM_CAPTURE) {
+ err = -EIO;
+ goto unlock;
+ } else if (snd_pcm_running(dpcm_capt->substream)) {
+ /* close must not free the peer runtime below */
+ atomic_inc(&cable->stop_count);
+ stop_capture = true;
}
}
- return 0;
+
+ setup = get_setup(dpcm_play);
+ card = dpcm_play->loopback->card;
+ runtime = dpcm_play->substream->runtime;
+ if (setup->format != runtime->format) {
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &setup->format_id);
+ setup->format = runtime->format;
+ }
+ if (setup->rate != runtime->rate) {
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &setup->rate_id);
+ setup->rate = runtime->rate;
+ }
+ if (setup->channels != runtime->channels) {
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &setup->channels_id);
+ setup->channels = runtime->channels;
+ }
+
+unlock:
+ spin_unlock_irqrestore(&cable->lock, flags);
+ if (stop_capture) {
+ snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING);
+ if (atomic_dec_and_test(&cable->stop_count))
+ wake_up(&cable->stop_wait);
+ }
+
+ return err;
}
static void loopback_active_notify(struct loopback_pcm *dpcm)
--
2.53.0
^ permalink raw reply related [flat|nested] 972+ messages in thread* [PATCH 5.15 002/935] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 001/935] ALSA: aloop: Fix racy access at PCM trigger Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 003/935] alpha: dont leak hardware-fabricated FP exception bits to user space Greg Kroah-Hartman
` (938 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit 49672d026cc4773608e1222b69b29fd70f41336b upstream.
ieee_swcr_to_fpcr() converts the software IEEE trap-enable and status
bits kept in thread_info.ieee_state into the hardware FPCR format. It
contained:
fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;
FPCR_DNOD (bit 47) disables denormal operand traps: with it set the
hardware handles a denormal operand itself, treating it as zero, instead
of trapping for software completion. The intent was to set DNOD when the
user has not asked for SIGFPE on denormal operands, but
IEEE_TRAP_ENABLE_DNO is clear by default, so ieee_swcr_to_fpcr(0) always
set DNOD.
Instructions built with the software completion suffix therefore never
trapped on a denormal operand. The hardware silently substituted zero
and produced wrong results, affecting every program compiled with -mieee
and default FPU settings, glibc included.
Set FPCR_DNOD only when IEEE_MAP_DMZ is requested, which is exactly the
case where flushing denormal inputs to zero is what the user asked for.
DNOD then encodes MAP_DMZ, which ieee_fpcr_to_swcr() already recovers
from FPCR_DNZ, so drop its attempt to recover IEEE_TRAP_ENABLE_DNO from
DNOD; the DNO trap enable lives solely in ieee_state.
Both functions are in a uapi header, so the encoding change is visible to
userspace, but nothing outside the kernel is known to depend on DNOD
carrying the DNO trap enable, and the kernel is the only writer of the
FPCR.
This must not be backported on its own. Re-enabling denormal operand
traps exposes a second bug, fixed in the following patch: those traps
usually find an exact result, and for an exact result the emulator did
not write the FPCR back, leaving hardware-fabricated exception bits
visible to user space. Taken alone this change would make spurious
exception flags more common.
The bug predates the git history, so there is no commit to reference in a
Fixes tag.
Cc: stable@vger.kernel.org # 5.15+
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-1-c99d75608e60@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/include/uapi/asm/fpu.h | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/alpha/include/uapi/asm/fpu.h
+++ b/arch/alpha/include/uapi/asm/fpu.h
@@ -101,7 +101,12 @@ ieee_swcr_to_fpcr(unsigned long sw)
| IEEE_TRAP_ENABLE_OVF)) << 48;
fp |= (~sw & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE)) << 57;
fp |= (sw & IEEE_MAP_UMZ ? FPCR_UNDZ | FPCR_UNFD : 0);
- fp |= (~sw & IEEE_TRAP_ENABLE_DNO) << 41;
+ /*
+ * Disable denormal operand traps only when denormal inputs are to be
+ * flushed to zero. Otherwise they must keep trapping, so that /S
+ * instructions reach the kernel emulation handler.
+ */
+ fp |= (sw & IEEE_MAP_DMZ ? FPCR_DNOD : 0);
return fp;
}
@@ -116,7 +121,6 @@ ieee_fpcr_to_swcr(unsigned long fp)
| IEEE_TRAP_ENABLE_OVF);
sw |= (~fp >> 57) & (IEEE_TRAP_ENABLE_UNF | IEEE_TRAP_ENABLE_INE);
sw |= (fp >> 47) & IEEE_MAP_UMZ;
- sw |= (~fp >> 41) & IEEE_TRAP_ENABLE_DNO;
return sw;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 003/935] alpha: dont leak hardware-fabricated FP exception bits to user space
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 001/935] ALSA: aloop: Fix racy access at PCM trigger Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 002/935] alpha: fix ieee_swcr_to_fpcr setting FPCR_DNOD unconditionally Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 004/935] clocksource/drivers/timer-sun4i: Advertise a real minimum delta Greg Kroah-Hartman
` (937 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit bcfe3187412e342b4619efb92c945f073855ebc0 upstream.
On EV6 and later the hardware records exception status bits in the FPCR
before delivering a software completion trap, and those bits can be wrong
for the instruction that trapped. Converting a double that is exactly
representable as a subnormal float sets FPCR_UNF even though the result
is exact, and an underflow trap additionally sets FPCR_INE even when the
emulated operation turns out to be exact.
alpha_fp_emul() only wrote the FPCR when soft-fp raised an exception, so
whenever it determined that the instruction was exact the fabricated bits
stayed in the FPCR and were reported to user space by fetestexcept().
Pass the exception summary register down from do_entArith() so the
handler can tell which exceptions the hardware attributed to the trapping
instruction, and always write the FPCR. Clear the exceptions that the
trap reported but that soft-fp did not raise. EXC_SUM reports only the
underflow or overflow when the hardware also set INE, so treat INE as a
candidate in that case, and treat a trap with no reported exception as a
denormal operand trap, for which the hardware can fabricate INE and UNF
as well. Bits that software has already confirmed in ieee_state belong
to this or an earlier instruction and are never cleared.
The imprecise path passes no summary. There the trap was taken somewhere
in the trap shadow, so EXC_SUM is not attribution for the instruction
being re-executed -- and only EV6, which traps precisely and so never
takes that path, has fabricated bits to clear. For the same reason the
clearing is guarded by implver(), matching swcr_update_status().
On an UP1500 (EV68) this takes the glibc math testsuite from 831 failures
to 28, the remainder being unrelated to exception status.
This belongs with the preceding fix to ieee_swcr_to_fpcr(), and should
not be backported without it -- nor it without this. That fix stops
FPCR_DNOD being set unconditionally, so denormal operand traps start
firing again. Those traps very often find an exact result, which is
precisely the case where the old code left the FPCR unwritten and the
fabricated bits visible. Applied alone it would make spurious exception
flags more common, not less.
One case cannot be resolved here: an inexact instruction without the
software completion suffix never traps, so its INE reaches the FPCR
without being recorded anywhere else. Such a bit is indistinguishable
from an INE the hardware fabricated for a trapping instruction, and is
lost if an underflow or overflow trap with an exact result follows it.
The FPCR is the only record of those instructions and it carries no
attribution.
The bug predates the git history, so there is no commit to reference in a
Fixes tag.
Cc: stable@vger.kernel.org # 5.15+
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260803-alpha-fp-exceptions-v1-2-c99d75608e60@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/traps.c | 6 +--
arch/alpha/math-emu/math.c | 88 +++++++++++++++++++++++++++++++++++++++------
2 files changed, 80 insertions(+), 14 deletions(-)
--- a/arch/alpha/kernel/traps.c
+++ b/arch/alpha/kernel/traps.c
@@ -200,12 +200,12 @@ static long dummy_emul(void) { return 0;
long (*alpha_fp_emul_imprecise)(struct pt_regs *regs, unsigned long writemask)
= (void *)dummy_emul;
EXPORT_SYMBOL_GPL(alpha_fp_emul_imprecise);
-long (*alpha_fp_emul) (unsigned long pc)
+long (*alpha_fp_emul) (unsigned long pc, unsigned long summary)
= (void *)dummy_emul;
EXPORT_SYMBOL_GPL(alpha_fp_emul);
#else
long alpha_fp_emul_imprecise(struct pt_regs *regs, unsigned long writemask);
-long alpha_fp_emul (unsigned long pc);
+long alpha_fp_emul (unsigned long pc, unsigned long summary);
#endif
asmlinkage void
@@ -219,7 +219,7 @@ do_entArith(unsigned long summary, unsig
emulate the instruction. If the processor supports
precise exceptions, we don't have to search. */
if (!amask(AMASK_PRECISE_TRAP))
- si_code = alpha_fp_emul(regs->pc - 4);
+ si_code = alpha_fp_emul(regs->pc - 4, summary);
else
si_code = alpha_fp_emul_imprecise(regs, write_mask);
if (si_code == 0)
--- a/arch/alpha/math-emu/math.c
+++ b/arch/alpha/math-emu/math.c
@@ -57,13 +57,13 @@ MODULE_DESCRIPTION("FP Software completi
MODULE_LICENSE("GPL v2");
extern long (*alpha_fp_emul_imprecise)(struct pt_regs *, unsigned long);
-extern long (*alpha_fp_emul) (unsigned long pc);
+extern long (*alpha_fp_emul) (unsigned long pc, unsigned long summary);
static long (*save_emul_imprecise)(struct pt_regs *, unsigned long);
-static long (*save_emul) (unsigned long pc);
+static long (*save_emul) (unsigned long pc, unsigned long summary);
long do_alpha_fp_emul_imprecise(struct pt_regs *, unsigned long);
-long do_alpha_fp_emul(unsigned long);
+long do_alpha_fp_emul(unsigned long, unsigned long);
static int alpha_fp_emul_init_module(void)
{
@@ -91,7 +91,22 @@ module_exit(alpha_fp_emul_cleanup_module
/*
- * Emulate the floating point instruction at address PC. Returns -1 if the
+ * Exception bits of the exception summary register (EXC_SUM). Bit 0 is the
+ * software completion bit; bits 1 through 5 report the exceptions the
+ * hardware attributed to the trapping instruction, and lie at the same
+ * positions as the corresponding IEEE_TRAP_ENABLE_* bits.
+ */
+#define EXC_SUM_INV (1UL << 1)
+#define EXC_SUM_DZE (1UL << 2)
+#define EXC_SUM_OVF (1UL << 3)
+#define EXC_SUM_UNF (1UL << 4)
+#define EXC_SUM_INE (1UL << 5)
+#define EXC_SUM_MASK (EXC_SUM_INV | EXC_SUM_DZE | EXC_SUM_OVF \
+ | EXC_SUM_UNF | EXC_SUM_INE)
+
+/*
+ * Emulate the floating point instruction at address PC. SUMMARY is the
+ * exception summary register the trap was delivered with. Returns -1 if the
* instruction to be emulated is illegal (such as with the opDEC trap), else
* the SI_CODE for a SIGFPE signal, else 0 if everything's ok.
*
@@ -100,7 +115,7 @@ module_exit(alpha_fp_emul_cleanup_module
* stick the result of the operation into the appropriate register.
*/
long
-alpha_fp_emul (unsigned long pc)
+alpha_fp_emul (unsigned long pc, unsigned long summary)
{
FP_DECL_EX;
FP_DECL_S(SA); FP_DECL_S(SB); FP_DECL_S(SR);
@@ -305,12 +320,56 @@ done:
swcr |= (_fex << IEEE_STATUS_TO_EXCSUM_SHIFT);
current_thread_info()->ieee_state
|= (_fex << IEEE_STATUS_TO_EXCSUM_SHIFT);
+ }
- /* Update hardware control register. */
- fpcr &= (~FPCR_MASK | FPCR_DYN_MASK);
- fpcr |= ieee_swcr_to_fpcr(swcr);
- wrfpcr(fpcr);
+ /*
+ * EV6 records exception status bits in the FPCR before delivering the
+ * software completion trap, and swcr_update_status() above merged them
+ * into SWCR. Some can be wrong for the instruction we just emulated:
+ * a CVTTS of a value exactly representable as a subnormal sets FPCR_UNF
+ * even though the result is exact. Clear the exceptions the trap
+ * reported but that soft-fp did not raise.
+ */
+ if (implver() == IMPLVER_EV6) {
+ unsigned long spurious = summary & EXC_SUM_MASK;
+
+ if (spurious & (EXC_SUM_UNF | EXC_SUM_OVF)) {
+ /*
+ * EXC_SUM reports only the underflow or overflow,
+ * but the hardware sets INE alongside it in the FPCR.
+ */
+ spurious |= EXC_SUM_INE;
+ } else if (!spurious) {
+ /*
+ * No exception reported, so this was a denormal
+ * operand trap, for which INE and UNF can be
+ * fabricated as well.
+ */
+ spurious = EXC_SUM_INE | EXC_SUM_UNF;
+ }
+ /*
+ * Never clear an exception software has confirmed. Every
+ * instruction that genuinely raises one traps for software
+ * completion and is recorded in ieee_state above, so a bit
+ * found there -- including one just set from _fex -- belongs
+ * to this or an earlier instruction and must survive.
+ */
+ spurious &= ~(current_thread_info()->ieee_state
+ >> IEEE_STATUS_TO_EXCSUM_SHIFT);
+
+ swcr &= ~(spurious << IEEE_STATUS_TO_EXCSUM_SHIFT);
+ }
+
+ /*
+ * Update hardware control register. This has to happen even when
+ * soft-fp raised nothing, to clear any fabricated bits.
+ */
+ fpcr &= (~FPCR_MASK | FPCR_DYN_MASK);
+ fpcr |= ieee_swcr_to_fpcr(swcr);
+ wrfpcr(fpcr);
+
+ if (_fex) {
/* Do we generate a signal? */
_fex = _fex & swcr & IEEE_TRAP_ENABLE_MASK;
si_code = 0;
@@ -392,9 +451,16 @@ alpha_fp_emul_imprecise (struct pt_regs
break;
}
if (!write_mask) {
- /* Re-execute insns in the trap-shadow. */
+ /*
+ * Re-execute insns in the trap-shadow. Pass no
+ * exception summary: it describes the trap, which
+ * was taken anywhere in the shadow, and so is not
+ * attribution for this instruction. Nothing is
+ * lost, since only EV6 -- which traps precisely and
+ * never comes this way -- needs it.
+ */
regs->pc = trigger_pc + 4;
- si_code = alpha_fp_emul(trigger_pc);
+ si_code = alpha_fp_emul(trigger_pc, 0);
goto egress;
}
trigger_pc -= 4;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 004/935] clocksource/drivers/timer-sun4i: Advertise a real minimum delta
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 003/935] alpha: dont leak hardware-fabricated FP exception bits to user space Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 005/935] timers/itimer: Zero-init old itimerval before copy to userspace Greg Kroah-Hartman
` (936 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Indrek Kruusa, Felix Yan,
Daniel Lezcano, Jernej Skrabec
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Yan <felixonmars@archlinux.org>
commit d21808328225ab8cee46885bf9a0dffcefbe630e upstream.
sun4i_clkevt_next_event() compensates for the timer stop/start
synchronization delay by programming evt - TIMER_SYNC_TICKS into the
hardware interval register. The clockevent device currently advertises
TIMER_SYNC_TICKS as min_delta_ticks, so the clockevents core is allowed
to call set_next_event() with evt == TIMER_SYNC_TICKS.
That programs a zero-tick interval. With oneshot/highres/nohz timer
operation this can leave the next event stuck, which was observed as a
boot hang on Allwinner D1 after the clockevents core started reusing
forced minimum-delta events.
Advertise one extra tick instead, so the smallest event accepted by the
core still programs at least one hardware tick after the synchronization
compensation.
Fixes: 12e1480bcb49 ("clocksource: sun4i: Report the minimum tick that we can program")
Reported-by: Indrek Kruusa <indrek.kruusa@gmail.com>
Closes: https://lore.kernel.org/linux-riscv/CA+fTLhgLmTY+exGujKf8OYYQvcEW5X5NJ_5sLq2AYL6zER2c0A@mail.gmail.com/
Assisted-by: Codex:gpt-5.5
Signed-off-by: Felix Yan <felixonmars@archlinux.org>
Signed-off-by: Daniel Lezcano <daniel.lezcano@kernel.org>
Tested-by: Indrek Kruusa <indrek.kruusa@gmail.com>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-riscv/CA+fTLhgLmTY+exGujKf8OYYQvcEW5X5NJ_5sLq2AYL6zER2c0A@mail.gmail.com/
Link: https://patch.msgid.link/20260624220434.4183732-1-felixonmars@archlinux.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clocksource/timer-sun4i.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clocksource/timer-sun4i.c
+++ b/drivers/clocksource/timer-sun4i.c
@@ -209,7 +209,7 @@ static int __init sun4i_timer_init(struc
sun4i_timer_clear_interrupt(timer_of_base(&to));
clockevents_config_and_register(&to.clkevt, timer_of_rate(&to),
- TIMER_SYNC_TICKS, 0xffffffff);
+ TIMER_SYNC_TICKS + 1, 0xffffffff);
/* Enable timer0 interrupt */
val = readl(timer_of_base(&to) + TIMER_IRQ_EN_REG);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 005/935] timers/itimer: Zero-init old itimerval before copy to userspace
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 004/935] clocksource/drivers/timer-sun4i: Advertise a real minimum delta Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 006/935] include/linux/list.h: mark list_add and __list_add as __always_inline Greg Kroah-Hartman
` (935 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jérémy Jean,
Thomas Gleixner
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8 upstream.
On native sparc64, struct __kernel_old_timeval contains a four-byte hole
after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit.
put_itimerval() fills only the named fields in a stack-allocated
__kernel_old_itimerval and copies the entire object to userspace, so
getitimer() can expose the two padding holes.
Zero-initialize the aggregate before assigning the fields so implicit
padding is deterministic before it crosses the user/kernel boundary.
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: Codex:gpt-5
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260809190428.1523014-1-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/itimer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/time/itimer.c
+++ b/kernel/time/itimer.c
@@ -100,7 +100,7 @@ static int do_getitimer(int which, struc
static int put_itimerval(struct __kernel_old_itimerval __user *o,
const struct itimerspec64 *i)
{
- struct __kernel_old_itimerval v;
+ struct __kernel_old_itimerval v = {};
v.it_interval.tv_sec = i->it_interval.tv_sec;
v.it_interval.tv_usec = i->it_interval.tv_nsec / NSEC_PER_USEC;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 006/935] include/linux/list.h: mark list_add and __list_add as __always_inline
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 005/935] timers/itimer: Zero-init old itimerval before copy to userspace Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 007/935] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Greg Kroah-Hartman
` (934 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jordan R Abrahams-Whitehead,
Nathan Chancellor, Eric Dumazet, Nick Desaulniers,
Giuliano Procida, Yabin Cui, Bill Wendling, Justin Stitt,
Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan R Abrahams-Whitehead <ajordanr@google.com>
commit 2780860eddecba9ffe210bb9436eee3cf22bfcdd upstream.
This commit resolves an issue where modpost section verification fails due
to section mismatches between list_add and its callers.
At present, list_add (and its internal __list_add) are called from both
.text and .init code sections. Since inlining can vary per call site,
list_add can be 4 different states:
list_add in text with arguments to non-.init.data values
list_add in init with arguments to static .init.data values
list_add in init with arguments to non-.init.data values
list_add in text with arguments to static .init.data values
It is last instance that ends up causing the section mismatch caused by
constant propagation of the address of static libs inside the `dir_add` as
seen below (with the dir_list being defined statically in initramfs.c,
resting in .init.data).
WARNING: modpost: vmlinux.o: section mismatch in reference: __list_add
(section: .text.unlikely.) -> dir_list (section: .init.data)
Because of these section matching requirements, semantically, __list_add
and list_add MUST be inlined. This will then ensure callers inside .init
will receive a list_add that exists and refers to only .init data, and
list_add code in .text sections will only refer to non-init data.
This issue manifests predominently in AutoFDO with clang, which is very
hesitant to inline cold functions such as list_add even when marked
`inline`. Marking them as `__always_inline` therefore matches the
existing semantic constraints imposed by modpost's section mismatch
checks.
Link: https://lore.kernel.org/20260731-always-inline-list-add-v1-1-d29f54ce5477@google.com
Link: https://lore.kernel.org/all/CANn89iJVQe=wedLheJmjZjOTJsWHijT0jZs=iRxKssJZbjAxHw@mail.gmail.com/
Signed-off-by: Jordan R Abrahams-Whitehead <ajordanr@google.com>
Suggested-by: Nathan Chancellor <nathan@kernel.org>
Suggested-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reported-by: Giuliano Procida <gprocida@google.com>
Reported-by: Yabin Cui <yabinc@google.com>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2173
Cc: Bill Wendling <morbo@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/list.h | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/include/linux/list.h
+++ b/include/linux/list.h
@@ -59,10 +59,13 @@ static inline bool __list_del_entry_vali
*
* This is only for internal list manipulation where we know
* the prev/next entries already!
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
*/
-static inline void __list_add(struct list_head *new,
- struct list_head *prev,
- struct list_head *next)
+static __always_inline void __list_add(struct list_head *new,
+ struct list_head *prev,
+ struct list_head *next)
{
if (!__list_add_valid(new, prev, next))
return;
@@ -80,8 +83,12 @@ static inline void __list_add(struct lis
*
* Insert a new entry after the specified head.
* This is good for implementing stacks.
+ *
+ * Must be inlined to ensure it can be safely called
+ * with initdata arguments.
*/
-static inline void list_add(struct list_head *new, struct list_head *head)
+static __always_inline void list_add(struct list_head *new,
+ struct list_head *head)
{
__list_add(new, head, head->next);
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 007/935] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 006/935] include/linux/list.h: mark list_add and __list_add as __always_inline Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 008/935] mm: memcg: stop reclaim when a limit update is superseded Greg Kroah-Hartman
` (933 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Breno Leitao, Paul E. McKenney,
Johannes Weiner, Shakeel Butt, Axel Rasmussen, Barry Song,
David Hildenbrand, Kairui Song, Lorenzo Stoakes, Michal Hocko,
Wei Xu, Yuanchu Xie, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
commit 25f52e81216884a7444bf07a606691feb09a94e3 upstream.
I am seeing some rcu_tasks stalls in the Meta fleet during reclaim.
INFO: rcu_tasks detected stalls on tasks:
0000000088620d09: .. nvcsw: 6735/6735 holdout: 1 idle_cpu: -1/8
task:GlobalCPUThread state:R running task pid:2552016 tgid:2524552
Call Trace:
shrink_lruvec
mem_cgroup_iter
shrink_node
do_try_to_free_pages
try_to_free_pages
__alloc_frozen_pages_noprof
alloc_pages_noprof
pte_alloc_one
__pte_alloc
handle_mm_fault
Nothing promises direct reclaim returns in bounded time, and the scan loop
in shrink_lruvec() only calls cond_resched(), which is a no-op on
PREEMPTION kernels. Involuntary preemption is not a Tasks-RCU quiescent
state, so the reclaiming task never reports one and becomes a holdout.
Upgrade it to cond_resched_tasks_rcu_qs(), which reports a quiescent state
even when cond_resched() does nothing.
PS: This has been discussed in [1]
Link: https://lore.kernel.org/20260810-rcu_task_shrink_lruvec-v1-1-4d9f7d5251cb@debian.org
Link: https://lore.kernel.org/all/amdWVTs0WKOxguxP@gmail.com/ [1]
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmscan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2771,7 +2771,7 @@ static void shrink_lruvec(struct lruvec
}
}
- cond_resched();
+ cond_resched_tasks_rcu_qs();
if (nr_reclaimed < nr_to_reclaim || proportional_reclaim)
continue;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 008/935] mm: memcg: stop reclaim when a limit update is superseded
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 007/935] mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 009/935] tools/compiler: match glibc 2.42 definition of __attribute_const__ Greg Kroah-Hartman
` (932 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guopeng Zhang, Tao Cui,
Johannes Weiner, Michal Hocko, Muchun Song, Roman Gushchin,
Shakeel Butt, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guopeng Zhang <zhangguopeng@kylinos.cn>
commit 9477820c63cbf4d97114238f3d1ff10dfd6bee3f upstream.
kernfs serializes file operations only per open file, so separate open
files can update the same memory.high or memory.max file concurrently.
Both handlers store the new limit before synchronous reclaim, but continue
to use the writer's local target in the reclaim loop. If another writer
raises or removes the limit, the first writer can continue reclaiming
toward a stale target.
For memory.max, this can leave the writer looping indefinitely once
reclaim retries are exhausted. The OOM path sees sufficient margin under
the current limit and returns true without killing, while the writer still
compares usage against its stale target and records another OOM event.
Check the current limit at the start of each reclaim iteration and stop if
it no longer matches the writer's target.
Reproducer:
Populate a cgroup with anonymous memory and disable swapping. Lower
memory.max from one open file, then restore it to "max" through another
open file after the new limit becomes visible.
Without the patch, the first writer remains blocked and repeatedly
increments the OOM event counter. With the patch, it returns normally.
This was not motivated by a reported production workload. We found it
through automated randomized testing for our cgroup observability work
and reduced it to the reproducer above.
Link: https://lore.kernel.org/20260724021805.1234583-1-guopeng.zhang@linux.dev
Fixes: 8c8c383c04f6 ("mm: memcontrol: try harder to set a new memory.high")
Fixes: b6e6edcfa405 ("mm: memcontrol: reclaim and OOM kill when shrinking memory.max below usage")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Tao Cui <cuitao@kylinos.cn>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6323,6 +6323,9 @@ static ssize_t memory_high_write(struct
unsigned long nr_pages = page_counter_read(&memcg->memory);
unsigned long reclaimed;
+ if (high != READ_ONCE(memcg->memory.high))
+ break;
+
if (nr_pages <= high)
break;
@@ -6371,6 +6374,9 @@ static ssize_t memory_max_write(struct k
for (;;) {
unsigned long nr_pages = page_counter_read(&memcg->memory);
+ if (max != READ_ONCE(memcg->memory.max))
+ break;
+
if (nr_pages <= max)
break;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 009/935] tools/compiler: match glibc 2.42 definition of __attribute_const__
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 008/935] mm: memcg: stop reclaim when a limit update is superseded Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 010/935] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Greg Kroah-Hartman
` (931 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joy H.J. Lee, Nathan Chancellor,
David Laight, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy H.J. Lee <rkr0k0r@gmail.com>
commit 8700a4761beb219873956666cf91776a2c61e698 upstream.
glibc 2.42 added __attribute_const__ to sys/cdefs.h:
# define __attribute_const__ __attribute__ ((__const__))
GCC 15 warns when a macro is redefined to a different replacement list
(-Wbuiltin-macro-redefined). Since host tool Makefiles (resolve_btfids,
objtool) pass -Werror, this conflict becomes fatal.
The warning is suppressed on standard native builds because GCC treats
/usr/include as a system header path (-isystem), and macro-redefinition
warnings from system headers are silently suppressed by GCC. It fires
when glibc headers are on a regular include path (-I) instead, which
is the case in cross-compilation setups such as NixOS, where the
sysroot's glibc is passed explicitly via -I rather than -isystem.
Per (C11 6.10.3), identical replacement lists are accepted silently.
Match the glibc definition exactly, including the space before "((", so
the redefinition is accepted without warning regardless of whether
glibc headers are treated as system or non-system includes.
Link: https://lore.kernel.org/20260701200635.3992767-1-rkr0k0r@gmail.com
Signed-off-by: Joy H.J. Lee <rkr0k0r@gmail.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: David Laight <david.laight.linux@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/include/linux/compiler.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/include/linux/compiler.h
+++ b/tools/include/linux/compiler.h
@@ -67,7 +67,7 @@
#define __read_mostly
#ifndef __attribute_const__
-# define __attribute_const__
+# define __attribute_const__ __attribute__ ((__const__))
#endif
#ifndef __maybe_unused
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 010/935] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 009/935] tools/compiler: match glibc 2.42 definition of __attribute_const__ Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 011/935] tracing: Fix crash passing ERR_PTR to kthread_stop() Greg Kroah-Hartman
` (930 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kiryl Shutsemau (Meta), Dave Hansen,
Sean Christopherson
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kiryl Shutsemau (Meta) <kas@kernel.org>
commit 1fe104b048d77d6cb25bd938e6a67450fb50e61d upstream.
KVM's instruction emulator has a small helper, assign_register(), that
writes a value into a register following the x86 rules for writes to
general-purpose registers: an 8- or 16-bit write leaves the rest of the
register untouched, a 32-bit write zero-extends the result to 64 bits,
and a 64-bit write replaces the whole register.
The TDX guest #VE handler needs the same logic for port I/O emulation
to get 32-bit zero-extension right. Rather than add a third copy of
the same switch, move the helper verbatim to <asm/insn-eval.h>, rename
it to insn_assign_reg(), and route KVM's callers through it.
Add <asm/insn.h> to the header's includes so it builds standalone in
callers that have not pulled it in transitively.
No functional change.
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Sean Christopherson <seanjc@google.com>
Cc:stable@vger.kernel.org
Link: https://patch.msgid.link/20260713133753.223947-3-kirill@shutemov.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/insn-eval.h | 36 ++++++++++++++++++++++++++++++++++++
arch/x86/kvm/emulate.c | 26 ++++----------------------
2 files changed, 40 insertions(+), 22 deletions(-)
--- a/arch/x86/include/asm/insn-eval.h
+++ b/arch/x86/include/asm/insn-eval.h
@@ -9,6 +9,7 @@
#include <linux/compiler.h>
#include <linux/bug.h>
#include <linux/err.h>
+#include <asm/insn.h>
#include <asm/ptrace.h>
#define INSN_CODE_SEG_ADDR_SZ(params) ((params >> 4) & 0xf)
@@ -31,4 +32,39 @@ int insn_fetch_from_user_inatomic(struct
bool insn_decode_from_regs(struct insn *insn, struct pt_regs *regs,
unsigned char buf[MAX_INSN_SIZE], int buf_size);
+/*
+ * Write @val into *@reg following the x86 rules for writes to
+ * general-purpose registers (Intel SDM Vol. 1, "General-Purpose
+ * Registers in 64-Bit Mode"): an 8- or 16-bit write leaves the rest of
+ * the register untouched, a 32-bit write zero-extends the result into
+ * the upper 32 bits, and a 64-bit write replaces the whole register.
+ *
+ * @bytes is the width of the write, not a property of the instruction:
+ * an instruction that, say, sign-extends a 32-bit immediate into a
+ * 64-bit register does a 64-bit write here.
+ *
+ * @reg need not be 8-byte aligned: KVM's instruction emulator offsets
+ * the pointer by one byte to address the high-byte registers (AH, CH,
+ * DH, BH). Use narrow stores for the sub-word cases so the access
+ * width matches @bytes and the adjacent bytes are left alone.
+ */
+static inline void insn_assign_reg(unsigned long *reg, u64 val, int bytes)
+{
+ switch (bytes) {
+ case 1:
+ *(u8 *)reg = (u8)val;
+ break;
+ case 2:
+ *(u16 *)reg = (u16)val;
+ break;
+ case 4:
+ /* A 32-bit write zero-extends into the upper 32 bits. */
+ *reg = (u32)val;
+ break;
+ case 8:
+ *reg = val;
+ break;
+ }
+}
+
#endif /* _ASM_X86_INSN_EVAL_H */
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -23,6 +23,7 @@
#include "kvm_emulate.h"
#include <linux/stringify.h>
#include <asm/debugreg.h>
+#include <asm/insn-eval.h>
#include <asm/nospec-branch.h>
#include "x86.h"
@@ -525,25 +526,6 @@ static void assign_masked(ulong *dest, u
*dest = (*dest & ~mask) | (src & mask);
}
-static void assign_register(unsigned long *reg, u64 val, int bytes)
-{
- /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
- switch (bytes) {
- case 1:
- *(u8 *)reg = (u8)val;
- break;
- case 2:
- *(u16 *)reg = (u16)val;
- break;
- case 4:
- *reg = (u32)val;
- break; /* 64b: zero-extend */
- case 8:
- *reg = val;
- break;
- }
-}
-
static inline unsigned long ad_mask(struct x86_emulate_ctxt *ctxt)
{
return (1UL << (ctxt->ad_bytes << 3)) - 1;
@@ -591,7 +573,7 @@ register_address_increment(struct x86_em
{
ulong *preg = reg_rmw(ctxt, reg);
- assign_register(preg, *preg + inc, ctxt->ad_bytes);
+ insn_assign_reg(preg, *preg + inc, ctxt->ad_bytes);
}
static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)
@@ -1781,7 +1763,7 @@ static int load_segment_descriptor(struc
static void write_register_operand(struct operand *op)
{
- return assign_register(op->addr.reg, op->val, op->bytes);
+ return insn_assign_reg(op->addr.reg, op->val, op->bytes);
}
static int writeback(struct x86_emulate_ctxt *ctxt, struct operand *op)
@@ -2015,7 +1997,7 @@ static int em_popa(struct x86_emulate_ct
rc = emulate_pop(ctxt, &val, ctxt->op_bytes);
if (rc != X86EMUL_CONTINUE)
break;
- assign_register(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
+ insn_assign_reg(reg_rmw(ctxt, reg), val, ctxt->op_bytes);
--reg;
}
return rc;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 011/935] tracing: Fix crash passing ERR_PTR to kthread_stop()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 010/935] x86/insn-eval: Move assign_register() out of KVM as insn_assign_reg() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 012/935] powerpc/powermac: fix OF node refcount Greg Kroah-Hartman
` (929 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Steven Rostedt
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 649bc7df3e5d7be6f7996a95084037dbf3cad1e5 upstream.
event_test_stuff() calls kthread_run() and unconditionally passes the
returned task_struct pointer to kthread_stop(). kthread_run() returns an
error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for
example under memory pressure during the boot-time event self-test.
kthread_stop() then dereferences the invalid pointer, crashing the kernel.
Check the result of kthread_run() before passing it to kthread_stop(). Use
WARN_ON() so that a failure to create the self-test thread does not go
unnoticed, matching the ring-buffer self-test fix in commit
91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()").
Cc: stable@vger.kernel.org
Fixes: e6187007d6c3 ("tracing/events: add startup tests for events")
Link: https://patch.msgid.link/20260817120642.668375-3-sh_def@163.com
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -4032,6 +4032,8 @@ static __init void event_test_stuff(void
struct task_struct *test_thread;
test_thread = kthread_run(event_test_thread, NULL, "test-events");
+ if (WARN_ON(IS_ERR(test_thread)))
+ return;
msleep(1);
kthread_stop(test_thread);
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 012/935] powerpc/powermac: fix OF node refcount
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 011/935] tracing: Fix crash passing ERR_PTR to kthread_stop() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 013/935] rapidio: mport_cdev: fix use-after-free in dma_req_free() Greg Kroah-Hartman
` (928 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Bartosz Golaszewski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
commit bd0abfe6b013aeb2a1aebc5fbc7ceeb50355bda3 upstream.
Platform devices created with platform_device_alloc() call
platform_device_release() when the last reference to the device's
kobject is dropped. This function calls of_node_put() unconditionally.
This works fine for devices created with platform_device_register_full()
but users of the split approach (platform_device_alloc() +
platform_device_add()) must bump the reference of the of_node they
assign manually. Add the missing call to of_node_get().
Cc: stable@vger.kernel.org
Fixes: 81e5d8646ff6 ("i2c/powermac: Register i2c devices from device-tree")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260706-pdev-fwnode-ref-v3-1-1ff028e33779@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powermac/low_i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/platforms/powermac/low_i2c.c
+++ b/arch/powerpc/platforms/powermac/low_i2c.c
@@ -1501,7 +1501,7 @@ static int __init pmac_i2c_create_platfo
if (bus->platform_dev == NULL)
return -ENOMEM;
bus->platform_dev->dev.platform_data = bus;
- bus->platform_dev->dev.of_node = bus->busnode;
+ bus->platform_dev->dev.of_node = of_node_get(bus->busnode);
platform_device_add(bus->platform_dev);
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 013/935] rapidio: mport_cdev: fix use-after-free in dma_req_free()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 012/935] powerpc/powermac: fix OF node refcount Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 014/935] Revert "media: v4l2-dev: fix error handling in __video_register_device()" Greg Kroah-Hartman
` (927 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Kim, Dan Carpenter,
Alexandre Bounine, Matt Porter, Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Kim <james010kim@gmail.com>
commit 5cbef379a94b161726c5f504598bf4791d45cedc upstream.
dma_req_free() acquires buf_mutex through req->map, drops the mapping
reference with kref_put(), and then dereferences req->map again to unlock
the mutex.
If kref_put() drops the last reference, mport_release_mapping() frees the
mapping, and the subsequent mutex_unlock() dereferences a freed object.
This is a use-after-free.
Fix this by caching map and md before kref_put(), clearing req->map while
holding buf_mutex, and using the cached md for mutex unlocking.
The bug is reachable from userspace via the RapidIO mport character device
interface.
Link: https://lore.kernel.org/20260723235220.588424-1-james010kim@gmail.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: James Kim <james010kim@gmail.com>
Reviewed-by: Dan Carpenter <error27@gmail.com>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rapidio/devices/rio_mport_cdev.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -582,9 +582,13 @@ static void dma_req_free(struct kref *re
}
if (req->map) {
- mutex_lock(&req->map->md->buf_mutex);
- kref_put(&req->map->ref, mport_release_mapping);
- mutex_unlock(&req->map->md->buf_mutex);
+ struct rio_mport_mapping *map = req->map;
+ struct mport_dev *md = map->md;
+
+ mutex_lock(&md->buf_mutex);
+ req->map = NULL;
+ kref_put(&map->ref, mport_release_mapping);
+ mutex_unlock(&md->buf_mutex);
}
kref_put(&priv->dma_ref, mport_release_dma);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 014/935] Revert "media: v4l2-dev: fix error handling in __video_register_device()"
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 013/935] rapidio: mport_cdev: fix use-after-free in dma_req_free() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 015/935] staging: greybus: hid: fix SET_REPORT return value Greg Kroah-Hartman
` (926 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Hans Verkuil
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hverkuil+cisco@kernel.org>
commit e7600f5cee5de14065f950807931d6e6d40fb2d7 upstream.
This reverts commit 2a934fdb01db6458288fc9386d3d8ceba6dd551a.
The intentions of that patch were good, but it doesn't work.
The idea is that if device_register fails, you have to do a put_device
to let the ref counter release resources.
However, the V4L2 API says that if video_register_device() fails, then
you have to call video_device_release(), which kfree()s the video_device
struct.
But the put_device() will already have freed the struct, so you end
up in a double-free scenario.
There is not really a good way of fixing this without breaking
video_register_device() into two parts, one that initializes everything,
and one that does the actual device_register, and then converting all
V4L2 drivers to this new model.
That is a massive job, and it is very unlikely that device_register
will fail.
So rather than ending up in a double-free scenario, just revert this
patch, and in that case we'll have a small memory leak. Which is a lot
more robust.
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Fixes: 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-media/20260520090624.1071139-1-lgs201920130244@gmail.com/
Link: https://lore.kernel.org/all/2026042058-charm-storable-4ad8@gregkh/
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/v4l2-core/v4l2-dev.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c
@@ -1032,25 +1032,25 @@ int __video_register_device(struct video
vdev->dev.class = &video_class;
vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
vdev->dev.parent = vdev->dev_parent;
- vdev->dev.release = v4l2_device_release;
dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num);
-
- /* Increase v4l2_device refcount */
- v4l2_device_get(vdev->v4l2_dev);
-
mutex_lock(&videodev_lock);
ret = device_register(&vdev->dev);
if (ret < 0) {
mutex_unlock(&videodev_lock);
pr_err("%s: device_register failed\n", __func__);
- put_device(&vdev->dev);
- return ret;
+ goto cleanup;
}
+ /* Register the release callback that will be called when the last
+ reference to the device goes away. */
+ vdev->dev.release = v4l2_device_release;
if (nr != -1 && nr != vdev->num && warn_if_nr_in_use)
pr_warn("%s: requested %s%d, got %s\n", __func__,
name_base, nr, video_device_node_name(vdev));
+ /* Increase v4l2_device refcount */
+ v4l2_device_get(vdev->v4l2_dev);
+
/* Part 5: Register the entity. */
ret = video_register_media_controller(vdev);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 015/935] staging: greybus: hid: fix SET_REPORT return value
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 014/935] Revert "media: v4l2-dev: fix error handling in __video_register_device()" Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 016/935] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Greg Kroah-Hartman
` (925 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hao-Qun Huang
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao-Qun Huang <alvinhuang0603@gmail.com>
commit 6d45195a9626d8aaaaed212c55638829a9c624a3 upstream.
__gb_hid_output_raw_report() stores the result of gb_hid_set_report()
in ret and even adjusts it to account for the report ID byte, but then
always returns 0.
This hides Greybus transport errors from HID_REQ_SET_REPORT callers,
and makes hidraw report zero bytes written to user space on success,
although hid_hw_raw_request() is expected to return the number of
bytes transferred or a negative errno. The sibling GET_REPORT path,
__gb_hid_get_raw_report(), already follows this convention.
Return ret like the other HID transport drivers do.
Fixes: 96eab779e198 ("greybus: hid: add HID class driver")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Hao-Qun Huang <alvinhuang0603@gmail.com>
Link: https://patch.msgid.link/20260704081613.434445-1-alvinhuang0603@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/greybus/hid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -256,7 +256,7 @@ static int __gb_hid_output_raw_report(st
if (report_id && ret >= 0)
ret++; /* add report_id to the number of transferred bytes */
- return 0;
+ return ret;
}
static int gb_hid_raw_request(struct hid_device *hid, unsigned char reportnum,
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 016/935] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 015/935] staging: greybus: hid: fix SET_REPORT return value Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 017/935] USB: phy: fsl-usb: fix missing static keywords Greg Kroah-Hartman
` (924 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Francesco Lavra
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
commit bf1e90189a98ca4a824fd64b4f3c6043d13c98ea upstream.
When a USB host suspends a connected device, the DWC2 USB device controller
enters a partial power down state where controller registers are not
accessible. If the USB gadget is then disconnected or deactivated
(e.g. when a gadget function is unbound from the controller), the `pullup`
callback in struct usb_gadget_ops is invoked; if the controller is kept in
partial power down, the register write in dwc2_hsotg_core_disconnect() does
not take effect; as a result, the USB host keeps seeing the device as
connected, even though the device is disabled.
Properly exit partial power down state in the pullup callback, so that the
USB host detects a device disconnection as intended.
Fixes: 97861781daff ("usb: dwc2: Allow entering hibernation from USB_SUSPEND interrupt")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Link: https://patch.msgid.link/20260728154420.2021519-1-flavra@baylibre.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/gadget.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -4678,6 +4678,7 @@ static int dwc2_hsotg_pullup(struct usb_
{
struct dwc2_hsotg *hsotg = to_hsotg(gadget);
unsigned long flags;
+ int ret = 0;
dev_dbg(hsotg->dev, "%s: is_on: %d op_state: %d\n", __func__, is_on,
hsotg->op_state);
@@ -4689,6 +4690,13 @@ static int dwc2_hsotg_pullup(struct usb_
}
spin_lock_irqsave(&hsotg->lock, flags);
+ if (hsotg->in_ppd) {
+ ret = dwc2_exit_partial_power_down(hsotg, 0, true);
+ if (ret) {
+ dev_err(hsotg->dev, "exit partial_power_down failed\n");
+ goto exit;
+ }
+ }
if (is_on) {
hsotg->enabled = 1;
dwc2_hsotg_core_init_disconnected(hsotg, false);
@@ -4702,9 +4710,10 @@ static int dwc2_hsotg_pullup(struct usb_
}
hsotg->gadget.speed = USB_SPEED_UNKNOWN;
+exit:
spin_unlock_irqrestore(&hsotg->lock, flags);
- return 0;
+ return ret;
}
static int dwc2_hsotg_vbus_session(struct usb_gadget *gadget, int is_active)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 017/935] USB: phy: fsl-usb: fix missing static keywords
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 016/935] usb: dwc2: gadget: Exit partial power down state when changing USB pull-up Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 018/935] usb: gadget: u_audio: Fix use-after-free on sound card disconnect Greg Kroah-Hartman
` (923 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Brown, Johan Hovold
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 80574c40598aedbc1751c528e414d7e224bc6313 upstream.
A recent change enabling compile testing of a Freescale dual-role
controller indirectly enabled a USB PHY driver to be built. That driver
in turn is missing a bunch of static keywords which results in warnings
like:
drivers/usb/phy/phy-fsl-usb.c:105:5: error: no previous prototype for 'write_ulpi' [-Werror=missing-prototypes]
105 | int write_ulpi(u8 addr, u8 data)
| ^~~~~~~~~~
which consequently breaks -Werror builds.
Add the missing static keywords.
Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
Cc: stable@vger.kernel.org # 3.0
Reported-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/4f9f5ff9-8eaa-4bd5-9331-37119f78e13f@sirena.org.uk
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260717154957.1853976-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy-fsl-usb.c | 52 +++++++++++++++++++++---------------------
drivers/usb/phy/phy-fsl-usb.h | 6 ++--
2 files changed, 29 insertions(+), 29 deletions(-)
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -45,7 +45,7 @@
static const char driver_name[] = "fsl-usb2-otg";
-const pm_message_t otg_suspend_state = {
+static const pm_message_t otg_suspend_state = {
.event = 1,
};
@@ -56,11 +56,11 @@ static struct fsl_otg *fsl_otg_dev;
static int srp_wait_done;
/* FSM timers */
-struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
+static struct fsl_otg_timer *a_wait_vrise_tmr, *a_wait_bcon_tmr, *a_aidl_bdis_tmr,
*b_ase0_brst_tmr, *b_se0_srp_tmr;
/* Driver specific timers */
-struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
+static struct fsl_otg_timer *b_data_pulse_tmr, *b_vbus_pulse_tmr, *b_srp_fail_tmr,
*b_srp_wait_tmr, *a_wait_enum_tmr;
static struct list_head active_timers;
@@ -101,7 +101,7 @@ static void (*_fsl_writel)(u32 v, unsign
#define fsl_writel(val, addr) writel(val, addr)
#endif /* CONFIG_PPC32 */
-int write_ulpi(u8 addr, u8 data)
+static int write_ulpi(u8 addr, u8 data)
{
u32 temp;
@@ -114,7 +114,7 @@ int write_ulpi(u8 addr, u8 data)
/* Operations that will be called from OTG Finite State Machine */
/* Charge vbus for vbus pulsing in SRP */
-void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_chrg_vbus(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -132,7 +132,7 @@ void fsl_otg_chrg_vbus(struct otg_fsm *f
}
/* Discharge vbus through a resistor to ground */
-void fsl_otg_dischrg_vbus(int on)
+static void fsl_otg_dischrg_vbus(int on)
{
u32 tmp;
@@ -150,7 +150,7 @@ void fsl_otg_dischrg_vbus(int on)
}
/* A-device driver vbus, controlled through PP bit in PORTSC */
-void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
+static void fsl_otg_drv_vbus(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -168,7 +168,7 @@ void fsl_otg_drv_vbus(struct otg_fsm *fs
* Pull-up D+, signalling connect by periperal. Also used in
* data-line pulsing in SRP
*/
-void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_conn(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -187,7 +187,7 @@ void fsl_otg_loc_conn(struct otg_fsm *fs
* port. In host mode, controller will automatically send SOF.
* Suspend will block the data on the port.
*/
-void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
+static void fsl_otg_loc_sof(struct otg_fsm *fsm, int on)
{
u32 tmp;
@@ -202,7 +202,7 @@ void fsl_otg_loc_sof(struct otg_fsm *fsm
}
/* Start SRP pulsing by data-line pulsing, followed with v-bus pulsing. */
-void fsl_otg_start_pulse(struct otg_fsm *fsm)
+static void fsl_otg_start_pulse(struct otg_fsm *fsm)
{
u32 tmp;
@@ -218,7 +218,7 @@ void fsl_otg_start_pulse(struct otg_fsm
fsl_otg_add_timer(fsm, b_data_pulse_tmr);
}
-void b_data_pulse_end(unsigned long foo)
+static void b_data_pulse_end(unsigned long foo)
{
#ifdef HA_DATA_PULSE
#else
@@ -229,7 +229,7 @@ void b_data_pulse_end(unsigned long foo)
fsl_otg_pulse_vbus();
}
-void fsl_otg_pulse_vbus(void)
+static void fsl_otg_pulse_vbus(void)
{
srp_wait_done = 0;
fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 1);
@@ -237,7 +237,7 @@ void fsl_otg_pulse_vbus(void)
fsl_otg_add_timer(&fsl_otg_dev->fsm, b_vbus_pulse_tmr);
}
-void b_vbus_pulse_end(unsigned long foo)
+static void b_vbus_pulse_end(unsigned long foo)
{
fsl_otg_chrg_vbus(&fsl_otg_dev->fsm, 0);
@@ -250,7 +250,7 @@ void b_vbus_pulse_end(unsigned long foo)
fsl_otg_add_timer(&fsl_otg_dev->fsm, b_srp_wait_tmr);
}
-void b_srp_end(unsigned long foo)
+static void b_srp_end(unsigned long foo)
{
fsl_otg_dischrg_vbus(0);
srp_wait_done = 1;
@@ -265,7 +265,7 @@ void b_srp_end(unsigned long foo)
* a_host will start by SRP. It needs to set b_hnp_enable before
* actually suspending to start HNP
*/
-void a_wait_enum(unsigned long foo)
+static void a_wait_enum(unsigned long foo)
{
VDBG("a_wait_enum timeout\n");
if (!fsl_otg_dev->phy.otg->host->b_hnp_enable)
@@ -275,13 +275,13 @@ void a_wait_enum(unsigned long foo)
}
/* The timeout callback function to set time out bit */
-void set_tmout(unsigned long indicator)
+static void set_tmout(unsigned long indicator)
{
*(int *)indicator = 1;
}
/* Initialize timers */
-int fsl_otg_init_timers(struct otg_fsm *fsm)
+static int fsl_otg_init_timers(struct otg_fsm *fsm)
{
/* FSM used timers */
a_wait_vrise_tmr = otg_timer_initializer(&set_tmout, TA_WAIT_VRISE,
@@ -338,7 +338,7 @@ int fsl_otg_init_timers(struct otg_fsm *
}
/* Uninitialize timers */
-void fsl_otg_uninit_timers(void)
+static void fsl_otg_uninit_timers(void)
{
/* FSM used timers */
kfree(a_wait_vrise_tmr);
@@ -390,7 +390,7 @@ static struct fsl_otg_timer *fsl_otg_get
}
/* Add timer to timer list */
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *gtimer)
{
struct fsl_otg_timer *timer = gtimer;
struct fsl_otg_timer *tmp_timer;
@@ -420,7 +420,7 @@ static void fsl_otg_fsm_add_timer(struct
}
/* Remove timer from the timer list; clear timeout status */
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *gtimer)
{
struct fsl_otg_timer *timer = gtimer;
struct fsl_otg_timer *tmp_timer, *del_tmp;
@@ -442,7 +442,7 @@ static void fsl_otg_fsm_del_timer(struct
}
/* Reset controller, not reset the bus */
-void otg_reset_controller(void)
+static void otg_reset_controller(void)
{
u32 command;
@@ -454,7 +454,7 @@ void otg_reset_controller(void)
}
/* Call suspend/resume routines in host driver */
-int fsl_otg_start_host(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_host(struct otg_fsm *fsm, int on)
{
struct usb_otg *otg = fsm->otg;
struct device *dev;
@@ -521,7 +521,7 @@ end:
* Call suspend and resume function in udc driver
* to stop and start udc driver.
*/
-int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
+static int fsl_otg_start_gadget(struct otg_fsm *fsm, int on)
{
struct usb_otg *otg = fsm->otg;
struct device *dev;
@@ -703,7 +703,7 @@ static int fsl_otg_start_hnp(struct usb_
* intact. It needs to have knowledge of some USB interrupts
* such as port change.
*/
-irqreturn_t fsl_otg_isr(int irq, void *dev_id)
+static irqreturn_t fsl_otg_isr(int irq, void *dev_id)
{
struct otg_fsm *fsm = &((struct fsl_otg *)dev_id)->fsm;
struct usb_otg *otg = ((struct fsl_otg *)dev_id)->phy.otg;
@@ -829,7 +829,7 @@ err:
}
/* OTG Initialization */
-int usb_otg_start(struct platform_device *pdev)
+static int usb_otg_start(struct platform_device *pdev)
{
struct fsl_otg *p_otg;
struct usb_phy *otg_trans = usb_get_phy(USB_PHY_TYPE_USB2);
@@ -1002,7 +1002,7 @@ static int fsl_otg_remove(struct platfor
return 0;
}
-struct platform_driver fsl_otg_driver = {
+static struct platform_driver fsl_otg_driver = {
.probe = fsl_otg_probe,
.remove = fsl_otg_remove,
.driver = {
--- a/drivers/usb/phy/phy-fsl-usb.h
+++ b/drivers/usb/phy/phy-fsl-usb.h
@@ -373,6 +373,6 @@ struct fsl_otg_config {
#define FSL_OTG_NAME "fsl-usb2-otg"
-void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
-void fsl_otg_pulse_vbus(void);
+static void fsl_otg_add_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_del_timer(struct otg_fsm *fsm, void *timer);
+static void fsl_otg_pulse_vbus(void);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 018/935] usb: gadget: u_audio: Fix use-after-free on sound card disconnect
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 017/935] USB: phy: fsl-usb: fix missing static keywords Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 019/935] usb: gadget: snps_udc_plat: clean up PHY on probe deferral Greg Kroah-Hartman
` (922 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sonali Pradhan
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonali Pradhan <sonalipradhan@google.com>
commit 858965947081d10d41d9a1010a540d3d5eea958b upstream.
g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
card teardown and immediately frees the underlying struct snd_uac_chip
context. However, snd_card_free_when_closed() returns asynchronously
while ALSA control elements (kctls) remain open in userspace.
When userspace control applications access or close these open file
descriptors, kctl callbacks attempt to dereference kctl->private_data
pointing to &uac->c_prm or &uac->p_prm within the freed uac structure,
resulting in a use-after-free (UAF) memory corruption.
Fix this issue by deferring the destruction of struct snd_uac_chip until
all references to the ALSA sound card are released. Register a custom
card->private_free callback (u_audio_card_free) during g_audio_setup()
that frees uac and its associated playback/capture request and ring
buffers only when the sound card reference count drops to zero.
Fixes: 6c67ed9ad9b8 ("usb: gadget: u_audio: don't let userspace block driver unbind")
Cc: stable@vger.kernel.org
Signed-off-by: Sonali Pradhan <sonalipradhan@google.com>
Link: https://patch.msgid.link/20260810071237.2207680-1-sonalipradhan@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/u_audio.c | 24 ++++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -967,6 +967,20 @@ static struct snd_kcontrol_new u_audio_c
},
};
+static void u_audio_card_free(struct snd_card *card)
+{
+ struct snd_uac_chip *uac = card->private_data;
+
+ if (!uac)
+ return;
+
+ kfree(uac->p_prm.reqs);
+ kfree(uac->c_prm.reqs);
+ kfree(uac->p_prm.rbuf);
+ kfree(uac->c_prm.rbuf);
+ kfree(uac);
+}
+
int g_audio_setup(struct g_audio *g_audio, const char *pcm_name,
const char *card_name)
{
@@ -1046,6 +1060,8 @@ int g_audio_setup(struct g_audio *g_audi
goto fail;
uac->card = card;
+ card->private_data = uac;
+ card->private_free = u_audio_card_free;
/*
* Create first PCM device
@@ -1178,6 +1194,8 @@ int g_audio_setup(struct g_audio *g_audi
snd_fail:
snd_card_free(card);
+ return err;
+
fail:
kfree(uac->p_prm.reqs);
kfree(uac->c_prm.reqs);
@@ -1203,12 +1221,6 @@ void g_audio_cleanup(struct g_audio *g_a
card = uac->card;
if (card)
snd_card_free_when_closed(card);
-
- kfree(uac->p_prm.reqs);
- kfree(uac->c_prm.reqs);
- kfree(uac->p_prm.rbuf);
- kfree(uac->c_prm.rbuf);
- kfree(uac);
}
EXPORT_SYMBOL_GPL(g_audio_cleanup);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 019/935] usb: gadget: snps_udc_plat: clean up PHY on probe deferral
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 018/935] usb: gadget: u_audio: Fix use-after-free on sound card disconnect Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 020/935] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Greg Kroah-Hartman
` (921 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit 886338ea7d40e4ba5123c58204d7f7e53d825825 upstream.
When the referenced extcon device has not registered yet,
extcon_get_edev_by_phandle() returns -EPROBE_DEFER after the driver has
initialized and powered on the PHY. The direct return bypasses the common
cleanup path and leaves both operations unbalanced.
Store the lookup error first and route deferred probing through exit_phy,
while retaining the existing behavior of suppressing the error message for
deferral.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 1b9f35adb0ff ("usb: gadget: udc: Add Synopsys UDC Platform driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Link: https://patch.msgid.link/20260804140510.37639-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/snps_udc_plat.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/udc/snps_udc_plat.c
+++ b/drivers/usb/gadget/udc/snps_udc_plat.c
@@ -161,10 +161,9 @@ static int udc_plat_probe(struct platfor
if (of_get_property(dev->of_node, "extcon", NULL)) {
udc->edev = extcon_get_edev_by_phandle(dev, 0);
if (IS_ERR(udc->edev)) {
- if (PTR_ERR(udc->edev) == -EPROBE_DEFER)
- return -EPROBE_DEFER;
- dev_err(dev, "Invalid or missing extcon\n");
ret = PTR_ERR(udc->edev);
+ if (ret != -EPROBE_DEFER)
+ dev_err(dev, "Invalid or missing extcon\n");
goto exit_phy;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 020/935] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 019/935] usb: gadget: snps_udc_plat: clean up PHY on probe deferral Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 021/935] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Greg Kroah-Hartman
` (920 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot+c9f9d646b08f3b6032fe,
Yun Zhou
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yun Zhou <yun.zhou@windriver.com>
commit 9dbf74f4022f80f7669d2b3c22c5deb46c1b5674 upstream.
usbg_make_tpg() held dep_lock while calling
configfs_depend_item_unlocked(), which acquires the configfs root
inode lock when operating across subsystems. This creates a circular
lock dependency with configfs_rmdir():
dep_lock -> configfs root inode lock -> su_mutex -> dep_lock
In usbg_make_tpg(), dep_lock only serialized the read of opts->ready,
which is a monotonic flag that transitions from false to true exactly
once (in tcm_set_name()) and never reverts. Remove dep_lock from
usbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access
opts->ready locklessly instead.
Reported-by: syzbot+c9f9d646b08f3b6032fe@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c9f9d646b08f3b6032fe
Fixes: 4bb8548df632 ("usb: gadget: f_tcm: add configfs support")
Cc: stable@vger.kernel.org
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260731081151.285599-1-yun.zhou@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_tcm.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- a/drivers/usb/gadget/function/f_tcm.c
+++ b/drivers/usb/gadget/function/f_tcm.c
@@ -1340,19 +1340,25 @@ static struct se_portal_group *usbg_make
opts = container_of(tpg_instances[i].func_inst, struct f_tcm_opts,
func_inst);
- mutex_lock(&opts->dep_lock);
- if (!opts->ready)
- goto unlock_dep;
+ if (!READ_ONCE(opts->ready))
+ goto unlock_inst;
if (opts->has_dep) {
if (!try_module_get(opts->dependent))
- goto unlock_dep;
+ goto unlock_inst;
} else {
+ /*
+ * configfs_depend_item_unlocked() may acquire the configfs
+ * root inode lock when the target belongs to a different
+ * subsystem. Calling it under dep_lock would create a
+ * circular dependency:
+ * dep_lock -> configfs inode lock -> su_mutex -> dep_lock
+ */
ret = configfs_depend_item_unlocked(
wwn->wwn_group.cg_subsys,
&opts->func_inst.group.cg_item);
if (ret)
- goto unlock_dep;
+ goto unlock_inst;
}
tpg = kzalloc(sizeof(struct usbg_tpg), GFP_KERNEL);
@@ -1378,7 +1384,6 @@ static struct se_portal_group *usbg_make
tpg_instances[i].tpg = tpg;
tpg->fi = tpg_instances[i].func_inst;
- mutex_unlock(&opts->dep_lock);
mutex_unlock(&tpg_instances_lock);
return &tpg->se_tpg;
@@ -1391,8 +1396,6 @@ unref_dep:
module_put(opts->dependent);
else
configfs_undepend_item_unlocked(&opts->func_inst.group.cg_item);
-unlock_dep:
- mutex_unlock(&opts->dep_lock);
unlock_inst:
mutex_unlock(&tpg_instances_lock);
@@ -2350,9 +2353,7 @@ static int tcm_set_name(struct usb_funct
pr_debug("tcm: Activating %s\n", name);
- mutex_lock(&opts->dep_lock);
- opts->ready = true;
- mutex_unlock(&opts->dep_lock);
+ WRITE_ONCE(opts->ready, true);
return 0;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 021/935] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 020/935] usb: gadget: f_tcm: fix deadlock in usbg_make_tpg() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 022/935] usb: gadget: f_fs: Prevent deadlock during ep0 read loop Greg Kroah-Hartman
` (919 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+de553c19cb054f174a35,
Jeffin Philip
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffin Philip <jeffinphilip14@gmail.com>
commit bdab5605259ba5d6ff927c1a85cc83eb3ecfdacc upstream.
In uvc_function_bind() error path, we use usb_ep_free_request which
uses uvc->control_req but does not set it to NULL afterwards. Thus,
uvc->control_req is a dangling pointer causing a UAF. Also we do not set
the uvc->control_buf pointer to NULL after freeing it, which is another
dangling pointer. Fix it by setting uvc->control_req to NULL after we run
usb_ep_free_request() and uvc->control_buf to NULL after kfree. Do the
same for uvc_function_unbind().
Reported-by: syzbot+de553c19cb054f174a35@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de553c19cb054f174a35
Fixes: 0f9df9393855 ("usb: gadget: uvc: fix error path in uvc_function_bind()")
Fixes: 6d11ed76c45d ("usb: gadget: f_uvc: convert f_uvc to new function interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jeffin Philip <jeffinphilip14@gmail.com>
Link: https://patch.msgid.link/20260813174311.130823-1-jeffinphilip14@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_uvc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -781,9 +781,12 @@ uvc_function_bind(struct usb_configurati
v4l2_error:
v4l2_device_unregister(&uvc->v4l2_dev);
error:
- if (uvc->control_req)
+ if (uvc->control_req) {
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ uvc->control_req = NULL;
+ }
kfree(uvc->control_buf);
+ uvc->control_buf = NULL;
usb_free_all_descriptors(f);
return ret;
@@ -958,7 +961,9 @@ static void uvc_function_unbind(struct u
uvc->vdev_release_done = NULL;
usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ uvc->control_req = NULL;
kfree(uvc->control_buf);
+ uvc->control_buf = NULL;
usb_free_all_descriptors(f);
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 022/935] usb: gadget: f_fs: Prevent deadlock during ep0 read loop
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 021/935] usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 023/935] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Greg Kroah-Hartman
` (918 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neill Kapron
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neill Kapron <nkapron@google.com>
commit 569dd7e5dcffe1e1c6b26ca2cd3be57eb433e082 upstream.
Currently, ffs_ep0_read() holds ffs->mutex when it prepares to go to
sleep waiting for an event. When no setup events are pending, it calls
wait_event_interruptible_exclusive_locked_irq() with the mutex still
held. The wait macro deliberately drops the waitqueue spinlock before
sleeping but does not drop the mutex.
If a userspace daemon is polling ep0 via read() and the gadget is
asynchronously torn down via configfs (e.g., echo "" > UDC), a
deadlock can occur:
1. The configfs teardown calls functionfs_unbind(), which queues a
FUNCTIONFS_UNBIND event.
2. The daemon wakes up, consumes the event, and drops the mutex.
3. However, if the daemon loops and immediately issues another read()
before exiting, it reacquires ffs->mutex and again goes into an
interruptible sleep.
4. Meanwhile, functionfs_unbind() continues execution and attempts to
acquire ffs->mutex to tear down ep0req.
5. The kernel deadlocks because the configfs thread is stuck in an
uninterruptible sleep waiting for the mutex, while the userspace
daemon is in an interruptible sleep holding the mutex forever
because no more events will arrive.
To fix this, we drop both the waitqueue spinlock and ffs->mutex before
going to sleep, and use wait_event_interruptible_exclusive() instead.
Upon waking up, we jump back to the `retry` label to safely reacquire
the mutex and re-evaluate the state machine. By not sleeping with
ffs->mutex held, we natively decouple gadget teardowns (which require
the mutex) from userspace polling.
Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver")
Cc: stable@vger.kernel.org
Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Neill Kapron <nkapron@google.com>
Link: https://patch.msgid.link/20260724204117.4036015-1-nkapron@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -519,6 +519,7 @@ static ssize_t ffs_ep0_read(struct file
if (ffs_setup_state_clear_cancelled(ffs) == FFS_SETUP_CANCELLED)
return -EIDRM;
+retry:
/* Acquire mutex */
ret = ffs_mutex_lock(&ffs->mutex, file->f_flags & O_NONBLOCK);
if (ret < 0)
@@ -553,10 +554,15 @@ static ssize_t ffs_ep0_read(struct file
break;
}
- if (wait_event_interruptible_exclusive_locked_irq(ffs->ev.waitq,
- ffs->ev.count)) {
- ret = -EINTR;
- break;
+ if (!ffs->ev.count) {
+ spin_unlock_irq(&ffs->ev.waitq.lock);
+ mutex_unlock(&ffs->mutex);
+
+ if (wait_event_interruptible_exclusive(ffs->ev.waitq,
+ ffs->ev.count))
+ return -EINTR;
+
+ goto retry;
}
/* unlocks spinlock */
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 023/935] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 022/935] usb: gadget: f_fs: Prevent deadlock during ep0 read loop Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 024/935] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Greg Kroah-Hartman
` (917 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daisuke Matsuda, Xu Yilun, Xu Yilun
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daisuke Matsuda <matsuda@preferred.jp>
commit 9da70a43b5fea60d758137f7f0ccfe19356cb5bb upstream.
The trailing byte path in altera_cvp_send_block() dereferences a u32
pointer even when only 1-3 bytes remain in the input buffer. If the buffer
ends at a page or scatterlist boundary, this can read past the valid image
data and fault.
Copy the remaining bytes into a zero-initialized u32 before writing the
final word so only valid bytes are read from the input buffer.
Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daisuke Matsuda <matsuda@preferred.jp>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260723081912.74082-1-dskmtsd@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/fpga/altera-cvp.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -16,6 +16,7 @@
#include <linux/module.h>
#include <linux/pci.h>
#include <linux/sizes.h>
+#include <linux/string.h>
#define CVP_BAR 0 /* BAR used for data transfer in memory mode */
#define CVP_DUMMY_WR 244 /* dummy writes to clear CvP state machine */
@@ -265,7 +266,7 @@ static int altera_cvp_v2_wait_for_credit
static int altera_cvp_send_block(struct altera_cvp_conf *conf,
const u32 *data, size_t len)
{
- u32 mask, words = len / sizeof(u32);
+ u32 words = len / sizeof(u32);
int i, remainder;
for (i = 0; i < words; i++)
@@ -274,9 +275,10 @@ static int altera_cvp_send_block(struct
/* write up to 3 trailing bytes, if any */
remainder = len % sizeof(u32);
if (remainder) {
- mask = BIT(remainder * 8) - 1;
- if (mask)
- conf->write_data(conf, *data & mask);
+ u32 word = 0;
+
+ memcpy(&word, data, remainder);
+ conf->write_data(conf, word);
}
return 0;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 024/935] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 023/935] fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 025/935] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Greg Kroah-Hartman
` (916 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Xingrui Li,
Srinivas Pandruvada, Jiri Kosina
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingrui Li <baka9@bakabaka9.tech>
commit c92693f3ed099401d0383ef35ca1fe1e6ba033de upstream.
sensor_hub_get_feature() clamps its return value to the caller's buffer
size, but the copy loop still copies field->report_size / 8 bytes for
each report value. A malicious HID descriptor can advertise a large
feature field size while an IIO caller supplies a small stack buffer,
such as a single s32, causing an out-of-bounds write.
HID core stores parsed report values in __s32 slots and clamps extracted
values to 32 bits. Reject feature fields that require more than one slot
per value, guard the total byte count calculation, and clamp each
per-value copy to the remaining caller buffer.
Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer for feature report")
Cc: stable@kernel.org
Assisted-by: OpenAI:GPT-5.5-Cyber
Signed-off-by: Xingrui Li <baka9@bakabaka9.tech>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-hub.c | 44 +++++++++++++++++++++++++------------------
1 file changed, 26 insertions(+), 18 deletions(-)
--- a/drivers/hid/hid-sensor-hub.c
+++ b/drivers/hid/hid-sensor-hub.c
@@ -239,12 +239,17 @@ int sensor_hub_get_feature(struct hid_se
u32 field_index, int buffer_size, void *buffer)
{
struct hid_report *report;
+ struct hid_field *field;
struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev);
- int report_size;
+ size_t field_size;
+ size_t report_size;
+ size_t copied = 0;
+ size_t to_copy;
int ret = 0;
- u8 *val_ptr;
- int buffer_index = 0;
- int i;
+ unsigned int i;
+
+ if (!buffer || buffer_size <= 0)
+ return -EINVAL;
memset(buffer, 0, buffer_size);
@@ -258,26 +263,29 @@ int sensor_hub_get_feature(struct hid_se
hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT);
hid_hw_wait(hsdev->hdev);
+ field = report->field[field_index];
+
/* calculate number of bytes required to read this field */
- report_size = DIV_ROUND_UP(report->field[field_index]->report_size,
- 8) *
- report->field[field_index]->report_count;
- if (!report_size) {
+ field_size = DIV_ROUND_UP(field->report_size, 8);
+ /* HID core stores each parsed report value in a __s32 slot. */
+ if (!field_size || field_size > sizeof(field->value[0])) {
+ ret = -EINVAL;
+ goto done_proc;
+ }
+ if (field->report_count > SIZE_MAX / field_size) {
ret = -EINVAL;
goto done_proc;
}
- ret = min(report_size, buffer_size);
- val_ptr = (u8 *)report->field[field_index]->value;
- for (i = 0; i < report->field[field_index]->report_count; ++i) {
- if (buffer_index >= ret)
- break;
-
- memcpy(&((u8 *)buffer)[buffer_index], val_ptr,
- report->field[field_index]->report_size / 8);
- val_ptr += sizeof(__s32);
- buffer_index += (report->field[field_index]->report_size / 8);
+ report_size = field_size * field->report_count;
+ report_size = min_t(size_t, report_size, buffer_size);
+
+ for (i = 0; i < field->report_count && copied < report_size; ++i) {
+ to_copy = min(field_size, report_size - copied);
+ memcpy(&((u8 *)buffer)[copied], &field->value[i], to_copy);
+ copied += to_copy;
}
+ ret = copied;
done_proc:
mutex_unlock(&data->mutex);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 025/935] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 024/935] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 026/935] media: cec: stm32: prevent out-of-bounds write on RX overflow Greg Kroah-Hartman
` (915 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Kees Cook,
Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol@kernel.org>
commit cec0d03fe785380540dc1b4d07c80f67ae2ffc78 upstream.
Patch series "lib/ucs2_string.c: fix out-of-bounds read in
ucs2_strnlen()", v2.
This series fixes an off-by-one out-of-bounds read in ucs2_strnlen().
The first patch is the real fix, the second patch comes as a bonus and
fixes the code indentation.
This patch (of 2):
ucs2_strnlen() checks the current character before checking whether the
caller-provided maximum length has been reached. If the input is not
NUL-terminated within that bound, the loop can read one ucs2_char_t past
the limit.
Test the length before dereferencing to prevent an off-by-one
out-of-bounds read.
Link: https://lore.kernel.org/20260723-fix-ucs2_strnlen-v2-0-9ea94e32a358@kernel.org
Link: https://lore.kernel.org/20260723-fix-ucs2_strnlen-v2-1-9ea94e32a358@kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Cc: Kees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/ucs2_string.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/ucs2_string.c
+++ b/lib/ucs2_string.c
@@ -8,7 +8,7 @@ ucs2_strnlen(const ucs2_char_t *s, size_
{
unsigned long length = 0;
- while (*s++ != 0 && length < maxlength)
+ while (length < maxlength && *s++ != 0)
length++;
return length;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 026/935] media: cec: stm32: prevent out-of-bounds write on RX overflow
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 025/935] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 027/935] media: vicodec: fix out-of-bounds write in FWHT encoder Greg Kroah-Hartman
` (914 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weigang He, Hans Verkuil
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weigang He <geoffreyhe2@gmail.com>
commit fb9dda38d4b9e90db07ed9a0ee2d35bf85494035 upstream.
stm32_rx_done() appends each received CEC byte to rx_msg.msg[] using
rx_msg.len as the write index, incrementing it on every RXBR
(receive-byte-ready) interrupt without checking it against the buffer
size:
cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
rx_msg.msg[] is a fixed CEC_MAX_MSG_SIZE (16) byte array in struct
cec_msg, and rx_msg.len is only reset on RXACKE/RXOVR or after a
completed message (RXEND). The number of bytes received before RXEND is
decided by the remote CEC device (it sets EOM), not by the driver. A
peer that keeps sending bytes without ending the message drives RXBR
repeatedly, pushing rx_msg.len past 16 and writing peer-controlled bytes
out of bounds into the surrounding memory. This is reachable in normal
operation once the driver has probed and receiving is enabled, from the
IRQ thread, without any local privilege.
The length check in the CEC core runs on the consumer side, after the
byte has been stored, so it does not prevent the overflow. Bound the
index in the driver before the store, as the other platform CEC drivers
already do (e.g. tegra_cec), dropping the excess bytes of an overlong
frame.
Found by static analysis tool CodeQL.
Fixes: d69ae57453c8 ("[media] cec: add STM32 cec driver")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/cec/platform/stm32/stm32-cec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/media/cec/platform/stm32/stm32-cec.c
+++ b/drivers/media/cec/platform/stm32/stm32-cec.c
@@ -133,7 +133,8 @@ static void stm32_rx_done(struct stm32_c
u32 val;
regmap_read(cec->regmap, CEC_RXDR, &val);
- cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
+ if (cec->rx_msg.len < CEC_MAX_MSG_SIZE)
+ cec->rx_msg.msg[cec->rx_msg.len++] = val & 0xFF;
}
if (cec->irq_status & RXEND) {
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 027/935] media: vicodec: fix out-of-bounds write in FWHT encoder
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 026/935] media: cec: stm32: prevent out-of-bounds write on RX overflow Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 028/935] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Greg Kroah-Hartman
` (913 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Hans Verkuil
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit cf4500ebf6fb57bf4ab83c3dd349a40257dbe2a9 upstream.
vidioc_s_fmt_vid_out() sizes the encoder CAPTURE buffer from the
compressed descriptor pixfmt_fwht, whose sizeimage_mult is 3:
coded_w * coded_h * 3 + sizeof(struct fwht_cframe_hdr). fwht_encode_frame()
encodes one plane per component, and an incompressible plane takes the
FWHT_FRAME_UNENCODED path in encode_plane(), copying the plane verbatim.
For a 4-component pixel format all four planes are full resolution
(width_div == height_div == 1), so a frame that forces every plane
through the unencoded fallback writes
sizeof(struct fwht_cframe_hdr) + 4 * coded_w * coded_h bytes, overrunning
the plane by coded_w * coded_h, which can result in corruption
of adjacent kernel heap memory.
Bump pixfmt_fwht.sizeimage_mult from 3 to 4, matching the largest
components_num among the supported raw formats, so the capture buffer is
always large enough for the unencoded fallback.
Fixes: 16ecf6dff97c ("media: vicodec: Add support for 4 planes formats")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/test-drivers/vicodec/vicodec-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/test-drivers/vicodec/vicodec-core.c
+++ b/drivers/media/test-drivers/vicodec/vicodec-core.c
@@ -61,11 +61,11 @@ struct pixfmt_info {
};
static const struct v4l2_fwht_pixfmt_info pixfmt_fwht = {
- V4L2_PIX_FMT_FWHT, 0, 3, 1, 1, 1, 1, 1, 0, 1
+ V4L2_PIX_FMT_FWHT, 0, 4, 1, 1, 1, 1, 1, 0, 1
};
static const struct v4l2_fwht_pixfmt_info pixfmt_stateless_fwht = {
- V4L2_PIX_FMT_FWHT_STATELESS, 0, 3, 1, 1, 1, 1, 1, 0, 1
+ V4L2_PIX_FMT_FWHT_STATELESS, 0, 4, 1, 1, 1, 1, 1, 0, 1
};
static void vicodec_dev_release(struct device *dev)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 028/935] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 027/935] media: vicodec: fix out-of-bounds write in FWHT encoder Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:50 ` [PATCH 5.15 029/935] of: fix out-of-bounds read in of_alias_scan() stem parser Greg Kroah-Hartman
` (912 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuangpeng Bai, Ryusuke Konishi,
Viacheslav Dubeyko
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit 45662dedb8f272ef7f16e69f13424c4bd0399240 upstream.
Shuangpeng Bai reported that KASAN detected a slab-out-of-bounds error
in nilfs_direct_propagate() during testing.
Analysis revealed that after truncating a file, a node block immediately
below the B-tree root was not deleted. Instead, it remained in the B-tree
node cache in a dirty state. The log writer subsequently detected this
block and incorrectly invoked nilfs_direct_propagate() on it, which is
designed to handle only data blocks in direct mapping.
B-tree nodes in the cache are managed by virtual block numbers, and their
logical keys typically exceed the range expected by direct mapping.
Consequently, processing such a node as a direct mapping entry triggers
a slab-out-of-bounds access.
The root cause is that when a B-tree mapping collapses into a direct
mapping during truncation, an intermediate node block pointed to by the
root node is left behind as garbage instead of being explicitly deleted.
This resolves the issue by adding a nilfs_btree_discard() operation
to delete the remaining intermediate node block during the conversion.
A 'deform' flag is added to the bop_delete interface to explicitly signal
that the deletion is part of a mapping transformation. This allows the
B-tree mapping implementation to perform the necessary cleanup and
discarding of the residual node structure that would be otherwise be left
orphaned after the transition.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Closes: https://lore.kernel.org/r/08A3603A-ADB6-484C-9015-9AC1340E6FB8@gmail.com
Fixes: 36a580eb489f ("nilfs2: direct block mapping")
Cc: stable@vger.kernel.org
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/bmap.c | 2 +-
fs/nilfs2/bmap.h | 2 +-
fs/nilfs2/btree.c | 39 ++++++++++++++++++++++++++++++++-------
fs/nilfs2/direct.c | 4 ++--
4 files changed, 36 insertions(+), 11 deletions(-)
--- a/fs/nilfs2/bmap.c
+++ b/fs/nilfs2/bmap.c
@@ -181,7 +181,7 @@ static int nilfs_bmap_do_delete(struct n
return ret;
}
- return bmap->b_ops->bop_delete(bmap, key);
+ return bmap->b_ops->bop_delete(bmap, key, false);
}
/**
--- a/fs/nilfs2/bmap.h
+++ b/fs/nilfs2/bmap.h
@@ -50,7 +50,7 @@ struct nilfs_bmap_operations {
int (*bop_lookup_contig)(const struct nilfs_bmap *, __u64, __u64 *,
unsigned int);
int (*bop_insert)(struct nilfs_bmap *, __u64, __u64);
- int (*bop_delete)(struct nilfs_bmap *, __u64);
+ int (*bop_delete)(struct nilfs_bmap *bmap, __u64 key, bool deform);
void (*bop_clear)(struct nilfs_bmap *);
int (*bop_propagate)(struct nilfs_bmap *, struct buffer_head *);
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1426,6 +1426,28 @@ static void nilfs_btree_shrink(struct ni
path[level].bp_bh = NULL;
}
+/**
+ * nilfs_btree_discard - discard the last node for the mapping transformation
+ * @btree: bmap struct of btree
+ * @path: array of nilfs_btree_path struct
+ * @level: level of the B-tree node being operated on
+ * @keyp: argument for passing a key (unused)
+ * @ptrp: argument for passing a pointer (unused)
+ */
+static void nilfs_btree_discard(struct nilfs_bmap *btree,
+ struct nilfs_btree_path *path, int level,
+ __u64 *keyp, __u64 *ptrp)
+{
+ struct nilfs_btree_node *root = nilfs_btree_get_root(btree);
+
+ nilfs_btree_node_delete(root, 0, NULL, NULL,
+ NILFS_BTREE_ROOT_NCHILDREN_MAX);
+ nilfs_btree_node_set_level(root, level);
+
+ nilfs_btnode_delete(path[level].bp_bh);
+ path[level].bp_bh = NULL;
+}
+
static void nilfs_btree_nop(struct nilfs_bmap *btree,
struct nilfs_btree_path *path,
int level, __u64 *keyp, __u64 *ptrp)
@@ -1436,7 +1458,7 @@ static int nilfs_btree_prepare_delete(st
struct nilfs_btree_path *path,
int *levelp,
struct nilfs_bmap_stats *stats,
- struct inode *dat)
+ struct inode *dat, bool deform)
{
struct buffer_head *bh;
struct nilfs_btree_node *node, *parent, *sib;
@@ -1523,15 +1545,17 @@ static int nilfs_btree_prepare_delete(st
if (nilfs_btree_node_get_nchildren(node) - 1 <=
NILFS_BTREE_ROOT_NCHILDREN_MAX) {
path[level].bp_op = nilfs_btree_shrink;
- stats->bs_nblocks += 2;
- level++;
- path[level].bp_op = nilfs_btree_nop;
- goto shrink_root_child;
+ } else if (deform) {
+ path[level].bp_op = nilfs_btree_discard;
} else {
path[level].bp_op = nilfs_btree_do_delete;
stats->bs_nblocks++;
goto out;
}
+ stats->bs_nblocks += 2;
+ level++;
+ path[level].bp_op = nilfs_btree_nop;
+ goto shrink_root_child;
}
}
@@ -1582,7 +1606,7 @@ static void nilfs_btree_commit_delete(st
nilfs_bmap_set_dirty(btree);
}
-static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key)
+static int nilfs_btree_delete(struct nilfs_bmap *btree, __u64 key, bool deform)
{
struct nilfs_btree_path *path;
@@ -1602,7 +1626,8 @@ static int nilfs_btree_delete(struct nil
dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
- ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat);
+ ret = nilfs_btree_prepare_delete(btree, path, &level, &stats, dat,
+ deform);
if (ret < 0)
goto out;
nilfs_btree_commit_delete(btree, path, level, dat);
--- a/fs/nilfs2/direct.c
+++ b/fs/nilfs2/direct.c
@@ -144,7 +144,7 @@ static int nilfs_direct_insert(struct ni
return ret;
}
-static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key)
+static int nilfs_direct_delete(struct nilfs_bmap *bmap, __u64 key, bool deform)
{
union nilfs_bmap_ptr_req req;
struct inode *dat;
@@ -234,7 +234,7 @@ int nilfs_direct_delete_and_convert(stru
/* no need to allocate any resource for conversion */
/* delete */
- ret = bmap->b_ops->bop_delete(bmap, key);
+ ret = bmap->b_ops->bop_delete(bmap, key, true);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 029/935] of: fix out-of-bounds read in of_alias_scan() stem parser
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 028/935] nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation Greg Kroah-Hartman
@ 2026-09-12 6:50 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 030/935] ubifs: fix out-of-bounds read in signature length check Greg Kroah-Hartman
` (911 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abdurrahman Hussain,
Geert Uytterhoeven, Rob Herring (Arm)
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdurrahman Hussain <abdurrahman@nexthop.ai>
commit 5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f upstream.
The stem parser tests isdigit(*(end - 1)) before checking end > start
and so reads one byte before the property name when the name is empty
or all digits. Check the bound first.
Fixes: 611cad720148 ("dt: add of_alias_scan and of_alias_get_id")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5 [Claude Code]
Signed-off-by: Abdurrahman Hussain <abdurrahman@nexthop.ai>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260805-nh-of-alias-overlay-v6-1-74f21d440819@nexthop.ai
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/of/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -2014,7 +2014,7 @@ void of_alias_scan(void * (*dt_alloc)(u6
/* walk the alias backwards to extract the id and work out
* the 'stem' string */
- while (isdigit(*(end-1)) && end > start)
+ while (end > start && isdigit(*(end - 1)))
end--;
len = end - start;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 030/935] ubifs: fix out-of-bounds read in signature length check
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-09-12 6:50 ` [PATCH 5.15 029/935] of: fix out-of-bounds read in of_alias_scan() stem parser Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 031/935] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Greg Kroah-Hartman
` (910 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Richard Weinberger,
Zhihao Cheng
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
commit 95d27c1708bb6e8823c8e7c623f9abc2a91bf4bf upstream.
ubifs_sb_verify_signature() bounds the on-disk ubifs_sig_node->len field
before handing the signature payload to verify_pkcs7_signature(), but the
check has the wrong sign:
if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node))
The signature bytes start sizeof(struct ubifs_sig_node) (UBIFS_SIG_NODE_SZ,
64 bytes) into the node, so the payload is at most
snod->len - sizeof(struct ubifs_sig_node)
bytes long. Adding the header size instead of subtracting it accepts a
declared length up to 2 * UBIFS_SIG_NODE_SZ larger than the node actually
holds -- past the end of c->sbuf, which is vmalloc(c->leb_size).
verify_pkcs7_signature() -> pkcs7_parse_message() -> asn1_ber_decoder()
is then handed that inflated length and reads beyond the allocation while
walking the DER headers. The node length comes straight from the mounted
image, so a crafted signed UBIFS image reaches this via
ubifs_read_superblock() before the signature is cryptographically checked.
snod->len is guaranteed to be >= UBIFS_SIG_NODE_SZ by the node scanner
(c->ranges[UBIFS_SIG_NODE].min_len == UBIFS_SIG_NODE_SZ), so the corrected
subtraction cannot underflow. Legitimately signed images are unaffected: a
correct superblock never declares a signature longer than the node it is
embedded in.
Fixes: 817aa094842d ("ubifs: support offline signed images")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Reviewed-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ubifs/auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ubifs/auth.c
+++ b/fs/ubifs/auth.c
@@ -218,7 +218,7 @@ int ubifs_sb_verify_signature(struct ubi
signode = snod->node;
- if (le32_to_cpu(signode->len) > snod->len + sizeof(struct ubifs_sig_node)) {
+ if (le32_to_cpu(signode->len) > snod->len - sizeof(struct ubifs_sig_node)) {
ubifs_err(c, "invalid signature len %d", le32_to_cpu(signode->len));
err = -EINVAL;
goto out_destroy;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 031/935] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 030/935] ubifs: fix out-of-bounds read in signature length check Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 032/935] NFSD: Fix off-by-one in DRC bucket pruning limit Greg Kroah-Hartman
` (909 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit ed4edddad19babf76b56882ad9600f5646b167a0 upstream.
The NFSv2 ACL GETACL reply is a union that carries file attributes
and ACL data only when the status is NFS_OK. All error cases are
void results. However, currently the NFSv2 ACL GETACL result encoder
decides whether to append the "OK" body by testing only whether the
file handle resolved to a positive dentry, not the actual reply
status.
A GETACL request that resolves its file handle but then fails for
another reason (an unsupported mask value, a getattr failure, or an
ACL retrieval error) therefore appends file attributes and ACL data
after the error status on the wire. Worse, when the mask is
rejected, fh_getattr() hasn't been called at all, so those
attributes are serialized from a zero-filled kstat and are junk.
The logic before the xdr_stream conversion used the reply status.
Revert to that approach (but keep the xdr_stream conversion in
place).
Fixes: f8cba47344f7 ("NFSD: Update the NFSv2 GETACL result encoder to use struct xdr_stream")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260712150911.48461-1-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs2acl.c | 31 +++++++++++++++----------------
1 file changed, 15 insertions(+), 16 deletions(-)
--- a/fs/nfsd/nfs2acl.c
+++ b/fs/nfsd/nfs2acl.c
@@ -248,22 +248,21 @@ nfsaclsvc_encode_getaclres(struct svc_rq
if (!svcxdr_encode_stat(xdr, resp->status))
return false;
-
- if (dentry == NULL || d_really_is_negative(dentry))
- return true;
- inode = d_inode(dentry);
-
- if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
- return false;
- if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
- return false;
-
- if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
- resp->mask & NFS_ACL, 0))
- return false;
- if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
- resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
- return false;
+ switch (resp->status) {
+ case nfs_ok:
+ inode = d_inode(dentry);
+ if (!svcxdr_encode_fattr(rqstp, xdr, &resp->fh, &resp->stat))
+ return false;
+ if (xdr_stream_encode_u32(xdr, resp->mask) < 0)
+ return false;
+ if (!nfs_stream_encode_acl(xdr, inode, resp->acl_access,
+ resp->mask & NFS_ACL, 0))
+ return false;
+ if (!nfs_stream_encode_acl(xdr, inode, resp->acl_default,
+ resp->mask & NFS_DFACL, NFS_ACL_DEFAULT))
+ return false;
+ break;
+ }
return true;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 032/935] NFSD: Fix off-by-one in DRC bucket pruning limit
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 031/935] NFSD: Encode only the status in NFS-ACL v2 GETACL error replies Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 033/935] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Greg Kroah-Hartman
` (908 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, NeilBrown, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit d0728723c80dcb3432effd67c7e919b596004b1d upstream.
nfsd_prune_bucket_locked() evicts an entry before checking
the freed count against @max. The check uses "++freed > max",
which does not break until freed exceeds max, resulting in
max + 1 evictions. Use ">=" so the limit stated in the
function comment is honored.
Fixes: a9507f6af145 ("NFSD: Replace nfsd_prune_bucket()")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/20260717001232.438792-2-cel@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfscache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfscache.c
+++ b/fs/nfsd/nfscache.c
@@ -283,7 +283,7 @@ nfsd_prune_bucket_locked(struct nfsd_net
nfsd_cacherep_unlink_locked(nn, b, rp);
list_add(&rp->c_lru, dispose);
- if (max && ++freed > max)
+ if (max && ++freed >= max)
break;
}
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 033/935] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 032/935] NFSD: Fix off-by-one in DRC bucket pruning limit Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 034/935] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Greg Kroah-Hartman
` (907 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Bommarito, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 036c1b182f4da65363e79ec0ac276edc6b7296e5 upstream.
nfsd4_ssc_expire_umount() walks nn->nfsd_ssc_mount_list with
list_for_each_entry_safe(ni, tmp, ...). For each expired entry it
sets nsui_busy = true, drops nfsd_ssc_lock to run mntput() on the
source vfsmount, then reacquires the lock to list_del + kfree the
entry and continue iterating via the macro's saved tmp pointer.
The nsui_busy flag protects the current ni from concurrent
nfsd4_ssc_setup_dul() finders during the lock-drop window, but it
does not pin tmp. Another nfsd RPC thread that fails its source-
server mount and reaches nfsd4_ssc_cancel_dul() will, during that
same window, take nfsd_ssc_lock, list_del + kfree its own ssc_umount
item, and release the lock. If that item is the saved tmp of the
expire walk, the next iteration dereferences a freed
nfsd4_ssc_umount_item.
Restart the walk from the head after the mntput() unlock window so
no saved next pointer survives the lock-drop. The list is bounded
by the number of active inter-server source mounts (typically small)
and the expire delayed-work runs periodically rather than per-IO,
so the restart is cheap.
Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260524130654.1924556-1-michael.bommarito@gmail.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 44 +++++++++++++++++++++++++-------------------
1 file changed, 25 insertions(+), 19 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6018,30 +6018,36 @@ static void nfsd4_ssc_shutdown_umount(st
static void nfsd4_ssc_expire_umount(struct nfsd_net *nn)
{
bool do_wakeup = false;
- struct nfsd4_ssc_umount_item *ni = NULL;
- struct nfsd4_ssc_umount_item *tmp;
+ struct nfsd4_ssc_umount_item *ni;
+restart:
spin_lock(&nn->nfsd_ssc_lock);
- list_for_each_entry_safe(ni, tmp, &nn->nfsd_ssc_mount_list, nsui_list) {
- if (time_after(jiffies, ni->nsui_expire)) {
- if (refcount_read(&ni->nsui_refcnt) > 1)
- continue;
+ list_for_each_entry(ni, &nn->nfsd_ssc_mount_list, nsui_list) {
+ if (!time_after(jiffies, ni->nsui_expire))
+ break;
+ if (refcount_read(&ni->nsui_refcnt) > 1)
+ continue;
- /* mark being unmount */
- ni->nsui_busy = true;
- spin_unlock(&nn->nfsd_ssc_lock);
- mntput(ni->nsui_vfsmount);
- spin_lock(&nn->nfsd_ssc_lock);
+ /* Prevent concurrent setup during unmount */
+ ni->nsui_busy = true;
+ spin_unlock(&nn->nfsd_ssc_lock);
+ mntput(ni->nsui_vfsmount);
+ spin_lock(&nn->nfsd_ssc_lock);
- /* waiters need to start from begin of list */
- list_del(&ni->nsui_list);
- kfree(ni);
+ /* Force concurrent scanners to restart */
+ list_del(&ni->nsui_list);
+ kfree(ni);
- /* wakeup ssc_connect waiters */
- do_wakeup = true;
- continue;
- }
- break;
+ /* wakeup ssc_connect waiters */
+ do_wakeup = true;
+ /*
+ * Concurrent nfsd4_ssc_cancel_dul() can free any item
+ * on the list under nfsd_ssc_lock while mntput() runs
+ * above. Restart from the head; the list is short and
+ * the expire worker is periodic, so this is cheap.
+ */
+ spin_unlock(&nn->nfsd_ssc_lock);
+ goto restart;
}
if (do_wakeup)
wake_up_all(&nn->nfsd_ssc_waitq);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 034/935] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 033/935] NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 035/935] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Greg Kroah-Hartman
` (906 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Snitzer, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@kernel.org>
commit aa0cf48a448c5a9fe1a1e880899ecd589ce39e6e upstream.
The header for commit e75b23f9e323 ("nfsd: check d_can_lookup in
fh_verify of directories") details the assumption that justified
adding the WARN_ON_ONCE to nfsd_mode_check(), that assumption is
invalid (in the case of NFS reexport).
When NFSD exports an NFS filesystem it is very possible for
nfsd_mode_check() to encounter a @dentry that doesn't have
i_op->lookup (see nfs_fhget()'s NFS_ATTR_FATTR_MOUNTPOINT and
NFS_ATTR_FATTR_V4_REFERRAL handling, and d_flags_for_inode()).
So remove nfsd_mode_check()'s WARN_ON_ONCE(). The nfserr_notdir
return on that branch must stay. It guards the subsequent
lookup_one_unlocked() -> __lookup_slow() path, which calls
inode->i_op->lookup() with no NULL check, so returning nfserr_notdir
is what keeps a client LOOKUP into such a @dentry from dereferencing
a NULL method pointer.
Fixes: e75b23f9e323 ("nfsd: check d_can_lookup in fh_verify of directories")
Cc: stable@vger.kernel.org
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Link: https://patch.msgid.link/20260612191410.50177-1-snitzer@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsfh.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/nfsd/nfsfh.c
+++ b/fs/nfsd/nfsfh.c
@@ -70,10 +70,8 @@ nfsd_mode_check(struct svc_rqst *rqstp,
if (requested == 0) /* the caller doesn't care */
return nfs_ok;
if (mode == requested) {
- if (mode == S_IFDIR && !d_can_lookup(dentry)) {
- WARN_ON_ONCE(1);
+ if (mode == S_IFDIR && !d_can_lookup(dentry))
return nfserr_notdir;
- }
return nfs_ok;
}
/*
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 035/935] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 034/935] NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 036/935] nfsd: Reset write verifier when async COPY writeback fails Greg Kroah-Hartman
` (905 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Junrui Luo,
Trond Myklebust
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junrui Luo <moonafterrain@outlook.com>
commit ee5a386cfe60f3f8286de16a9db8e1a08f0bc124 upstream.
When the server returns a new layout stateid while a valid one is still
held, pnfs_layout_process() calls pnfs_mark_matching_lsegs_return() on
the on-stack free_me list and jumps to out_forget. Segments whose
reference count drops to zero are unlinked from lo->plh_segs and moved
to free_me by mark_lseg_invalid(); for an idle cached segment the layout
header holds the only reference, so this happens on the first decrement.
out_forget never drains free_me -- only the success path calls
pnfs_free_lseg_list().
Commit 814b84971388 ("pNFS/NFSv4: Fix a layout segment leak in
pnfs_layout_process()") added the drain; commit 08bd8dbe8882
("pNFS/NFSv4: Try to return invalid layout in pnfs_layout_process()")
removed it while switching the destination to lo->plh_return_segs, which
is drained elsewhere. Commit fb700ef02676 ("NFSv4.1: Simplify layout
return in pnfs_layout_process()") switched the destination back to
free_me without restoring the drain.
Restore the pnfs_free_lseg_list() call.
Fixes: fb700ef02676 ("NFSv4.1: Simplify layout return in pnfs_layout_process()")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2479,6 +2479,7 @@ out_forget:
spin_unlock(&ino->i_lock);
lseg->pls_layout = lo;
NFS_SERVER(ino)->pnfs_curr_ld->free_lseg(lseg);
+ pnfs_free_lseg_list(&free_me);
return ERR_PTR(-EAGAIN);
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 036/935] nfsd: Reset write verifier when async COPY writeback fails
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 035/935] NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 037/935] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Greg Kroah-Hartman
` (904 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit f5cb2276954cb80987a93ef9f9dfbfdbfc0f10b9 upstream.
Async COPY captures nn->writeverf at request time and reports it to
the client via CB_OFFLOAD after the worker kthread completes. When
the post-copy vfs_fsync_range() or filemap_check_wb_err() in
_nfsd_copy_file_range() reports an error, the worker correctly
leaves NFSD4_COPY_F_COMMITTED clear so that CB_OFFLOAD encodes
wr_stable_how as NFS_UNSTABLE, but the server's write verifier is
not rotated.
A client that receives NFS_UNSTABLE in CB_OFFLOAD follows up with
COMMIT to make the copied data durable. With the verifier
unchanged, COMMIT returns the same value the client just received
via CB_OFFLOAD, and the client concludes the copy is durable --
silently dropping the data whose writeback in fact failed. This
violates the UNSTABLE+COMMIT durability contract (RFC 7862 section
15.1, RFC 8881 section 18.32) and matches the bug just fixed in
nfsd_vfs_write() and nfsd_commit().
Rotate nn->writeverf at the writeback-failure site. The async COPY
worker has no svc_rqst, so commit_reset_write_verifier() is not
available here; calling nfsd_reset_write_verifier() directly
mirrors the trace-less reset already used by
nfsd_file_check_write_error() for the same purpose. Filter out
-EAGAIN and -ESTALE, matching commit_reset_write_verifier(), since
neither indicates a durable-storage failure.
Fixes: eac0b17a77fb ("NFSD add vfs_fsync after async copy is done")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260522203723.446841-1-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1628,6 +1628,8 @@ static ssize_t _nfsd_copy_file_range(str
status = filemap_check_wb_err(dst->f_mapping, since);
if (!status)
set_bit(NFSD4_COPY_F_COMMITTED, ©->cp_flags);
+ else if (status != -EAGAIN && status != -ESTALE)
+ nfsd_reset_write_verifier(copy->cp_nn);
}
return bytes_copied;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 037/935] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 036/935] nfsd: Reset write verifier when async COPY writeback fails Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 038/935] nfsd: sample writeback error cursor before async COPY loop Greg Kroah-Hartman
` (903 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 45b06a75086f331f52cbb81223a59421d43f8809 upstream.
nfsd4_decode_nl4_server() handled only NL4_NETADDR and returned
nfserr_bad_xdr for NL4_NAME and NL4_URL. Those forms are well-formed XDR,
so BADXDR is misleading -- the request is unsupported, not malformed.
Decode and discard the utf8str_cis for NL4_NAME and NL4_URL to keep the
stream consistent, and return nfserr_notsupp. nfsd4_proc_compound() honors
a decode-time op->status, so the op fails without executing.
Fixes: 84e1b21d5ec4 ("NFSD add ca_source_server<> to COPY")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-7-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -1918,6 +1918,7 @@ static __be32 nfsd4_decode_nl4_server(st
{
struct nfs42_netaddr *naddr;
__be32 *p;
+ u32 str_len;
if (xdr_stream_decode_u32(argp->xdr, &ns->nl4_type) < 0)
return nfserr_bad_xdr;
@@ -1947,6 +1948,18 @@ static __be32 nfsd4_decode_nl4_server(st
return nfserr_bad_xdr;
memcpy(naddr->addr, p, naddr->addr_len);
break;
+ case NL4_NAME:
+ case NL4_URL:
+ /*
+ * Well-formed XDR, but only NL4_NETADDR is supported. Consume
+ * the utf8str_cis to keep the stream aligned, then return
+ * NFS4ERR_NOTSUPP rather than the misleading NFS4ERR_BADXDR.
+ */
+ if (xdr_stream_decode_u32(argp->xdr, &str_len) < 0)
+ return nfserr_bad_xdr;
+ if (!xdr_inline_decode(argp->xdr, str_len))
+ return nfserr_bad_xdr;
+ return nfserr_notsupp;
default:
return nfserr_bad_xdr;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 038/935] nfsd: sample writeback error cursor before async COPY loop
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 037/935] nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 039/935] nfsd: validate symlink target length in NFSv4 CREATE Greg Kroah-Hartman
` (902 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit 20a67a7d18221af736f124770c2c5e859b479046 upstream.
_nfsd_copy_file_range() samples dst->f_wb_err into "since"
after the copy loop, then uses it to detect writeback errors
via filemap_check_wb_err() once vfs_fsync_range() returns.
Because the nfsd_file cache reuses a single struct file
across requests targeting the same inode, a concurrent
COMMIT or stable WRITE on dst advances dst->f_wb_err to the
current mapping->wb_err via file_check_and_advance_wb_err()
during its own vfs_fsync_range(). If that advancement lands
between the writeback error appearing in mapping->wb_err
and the COPY worker sampling "since", the worker captures
the already-advanced cursor, errseq_check() sees cur ==
since and returns zero, and NFSD4_COPY_F_COMMITTED is set
even though writeback failed. CB_OFFLOAD then encodes
wr_stable_how = FILE_SYNC4, the client treats the copied
data as durable, and the failure becomes silent data loss.
Sample since once at the start of the function. The cursor
then reflects state in effect before this COPY issues any
writes, and filemap_check_wb_err() detects any error that
occurs during the copy regardless of which thread first
observes it. This matches the pattern used by
nfsd_vfs_write() and nfsd4_clone_file_range().
Closes: https://sashiko.dev/#/patchset/20260522194441.436065-1-cel@kernel.org?part=1
Fixes: 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260522214558.460859-1-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1607,6 +1607,7 @@ static ssize_t _nfsd_copy_file_range(str
/* See RFC 7862 p.67: */
if (bytes_total == 0)
bytes_total = ULLONG_MAX;
+ since = READ_ONCE(dst->f_wb_err);
do {
if (kthread_should_stop())
break;
@@ -1621,7 +1622,6 @@ static ssize_t _nfsd_copy_file_range(str
} while (bytes_total > 0 && nfsd4_copy_is_async(copy));
/* for a non-zero asynchronous copy do a commit of data */
if (nfsd4_copy_is_async(copy) && copy->cp_res.wr_bytes_written > 0) {
- since = READ_ONCE(dst->f_wb_err);
end = copy->cp_dst_pos + copy->cp_res.wr_bytes_written - 1;
status = vfs_fsync_range(dst, copy->cp_dst_pos, end, 0);
if (!status)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 039/935] nfsd: validate symlink target length in NFSv4 CREATE
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 038/935] nfsd: sample writeback error cursor before async COPY loop Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 040/935] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Greg Kroah-Hartman
` (901 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 041f57056e5fb9c80adc088269322d2c61074406 upstream.
nfsd4_decode_create() accepts an unbounded cr_datalen from the wire for
NF4LNK symlink targets, allowing a client to force a kmalloc of up to
the maximum RPC payload size (several MiB) per COMPOUND op that persists
until compound teardown. The VFS rejects oversized targets with
ENAMETOOLONG, but the allocation has already occurred.
Reject cr_datalen == 0 early with nfserr_inval and cr_datalen greater
than NFS4_MAXPATHLEN (PATH_MAX) with nfserr_nametoolong to bound the
allocation.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-9-f27e8eb4d974@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -801,6 +801,10 @@ nfsd4_decode_create(struct nfsd4_compoun
case NF4LNK:
if (xdr_stream_decode_u32(argp->xdr, &create->cr_datalen) < 0)
return nfserr_bad_xdr;
+ if (create->cr_datalen == 0)
+ return nfserr_inval;
+ if (create->cr_datalen > NFS4_MAXPATHLEN)
+ return nfserr_nametoolong;
p = xdr_inline_decode(argp->xdr, create->cr_datalen);
if (!p)
return nfserr_bad_xdr;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 040/935] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 039/935] nfsd: validate symlink target length in NFSv4 CREATE Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 041/935] nfsd: add filehandle match check to nfsd4_delegreturn() Greg Kroah-Hartman
` (900 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 4e475be769aa9f7a2c1ce55a2b8592cfccacddcc upstream.
The BOTH_TIME_SET branch calls fh_verify() early so setattr_prepare()
can inspect the dentry. This causes nfsd_setattr() to skip
fh_want_write(), so notify_change() runs without a mount write
reference.
Add the missing fh_want_write() call after the early fh_verify().
Fixes: cc265089ce1b ("nfsd: Disable NFSv2 timestamp workaround for NFSv3+")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-11-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsproc.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -55,6 +55,7 @@ nfsd_proc_setattr(struct svc_rqst *rqstp
.na_iattr = iap,
};
struct svc_fh *fhp;
+ int hosterr;
dprintk("nfsd: SETATTR %s, valid=%x, size=%ld\n",
SVCFH_fmt(&argp->fh),
@@ -90,6 +91,12 @@ nfsd_proc_setattr(struct svc_rqst *rqstp
if (resp->status != nfs_ok)
goto out;
+ hosterr = fh_want_write(fhp);
+ if (hosterr) {
+ resp->status = nfserrno(hosterr);
+ goto out;
+ }
+
if (delta < 0)
delta = -delta;
if (delta < MAX_TOUCH_TIME_ERROR &&
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 041/935] nfsd: add filehandle match check to nfsd4_delegreturn()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 040/935] nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 042/935] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Greg Kroah-Hartman
` (899 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 04cce9d79f2b1a114f7128e08bf60a473e10f1ec upstream.
nfsd4_delegreturn() is the only stateful NFSv4 operation that does
not call nfs4_check_fh() to verify the delegation's file matches
cstate->current_fh. A client can DELEGRETURN with a mismatched
filehandle, destroying the correct delegation but waking the wrong
inode's waiters.
Add the missing nfs4_check_fh() call after the generation check.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-6-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7119,6 +7119,10 @@ nfsd4_delegreturn(struct svc_rqst *rqstp
if (status)
goto put_stateid;
+ status = nfs4_check_fh(&cstate->current_fh, &dp->dl_stid);
+ if (status)
+ goto put_stateid;
+
trace_nfsd_deleg_return(stateid);
wake_up_var(d_inode(cstate->current_fh.fh_dentry));
destroy_delegation(dp);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 042/935] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 041/935] nfsd: add filehandle match check to nfsd4_delegreturn() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 043/935] nfsd: check client ownership when cancelling a copy-notify stateid Greg Kroah-Hartman
` (898 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit c59738a00aa51b16adc1b5ceb7c80877168efb4d upstream.
When CONFIG_NFSD_V4_2_INTER_SSC is enabled, nfsd4_putfh() can return
success with fh_dentry and fh_export both NULL if fh_verify() returns
nfserr_stale and putfh->no_verify is true. The NFSD4_FH_FOREIGN flag
is set, but the compound dispatch loop only uses this flag to bypass
the nfserr_nofilehandle check -- it does not prevent subsequent ops
from running with a NULL fh_dentry.
A remote client can exploit this by crafting a COMPOUND that includes
an inter-SSC COPY (which causes check_if_stalefh_allowed() to set
no_verify=true on the saved PUTFH) with an additional op inserted
between the source PUTFH and SAVEFH. For example, SETATTR calls
fh_want_write() which dereferences fh_export->ex_path.mnt without
calling fh_verify() first, causing a NULL pointer dereference in the
nfsd kthread.
Fix this by gating the dispatch loop: when NFSD4_FH_FOREIGN is set
and fh_dentry is NULL, only OP_SAVEFH (needed for the inter-SSC flow)
and ops with ALLOWED_WITHOUT_FH (which don't need a resolved
filehandle) may proceed. All other ops receive nfserr_stale, per
RFC 7862 Section 15.2.3 which specifies that foreign filehandle
validation is deferred to the consuming operation and NFS4ERR_STALE
returned at that point.
Fixes: b9e8638e3d9e ("NFSD: allow inter server COPY to have a STALE source server fh")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-putfh_foreign_fh_null_deref_consumers-v1-1-1b8a5aa28c59@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 19 ++++++++++++++++---
1 file changed, 16 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -2642,9 +2642,22 @@ nfsd4_proc_compound(struct svc_rqst *rqs
op->status = nfsd4_open_omfg(rqstp, cstate, op);
goto encode_op;
}
- if (!current_fh->fh_dentry &&
- !HAS_FH_FLAG(current_fh, NFSD4_FH_FOREIGN)) {
- if (!(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
+ if (!current_fh->fh_dentry) {
+ if (HAS_FH_FLAG(current_fh, NFSD4_FH_FOREIGN)) {
+ /*
+ * FOREIGN fh from inter-SSC PUTFH: only
+ * SAVEFH may proceed with a NULL fh_dentry.
+ * Per RFC 7862 S15.2.3, validation of a
+ * foreign fh is deferred to the operation
+ * that consumes it, and NFS4ERR_STALE is
+ * returned at that point.
+ */
+ if (op->opnum != OP_SAVEFH &&
+ !(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
+ op->status = nfserr_stale;
+ goto encode_op;
+ }
+ } else if (!(op->opdesc->op_flags & ALLOWED_WITHOUT_FH)) {
op->status = nfserr_nofilehandle;
goto encode_op;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 043/935] nfsd: check client ownership when cancelling a copy-notify stateid
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 042/935] nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 044/935] nfsd: fix cpntf publish race in nfs4_init_cp_state Greg Kroah-Hartman
` (897 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 6bdbfab96e0cf25e5f57dac5c09dc1749751a4bf upstream.
On the OFFLOAD_CANCEL path (clp != NULL), manage_cpntf_state() freed the
target cpntf state without checking ownership. The lookup key
st->si_opaque.so_id is allocated cyclically (guessable) and the embedded
clientid is the fixed per-net nn->s2s_cp_cl_id, so any authenticated
NFSv4.2 client could cancel and free another client's copy-notify
stateid.
Compare the creating clientid recorded in state->cp_p_clid against the
requesting client's cl_clientid and return nfserr_bad_stateid on a
mismatch instead of freeing the entry.
Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-5-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -6616,10 +6616,20 @@ __be32 manage_cpntf_state(struct nfsd_ne
state = NULL;
goto unlock;
}
- if (!clp)
+ if (!clp) {
refcount_inc(&state->cp_stateid.cs_count);
- else
+ } else if (memcmp(&clp->cl_clientid, &state->cp_p_clid,
+ sizeof(clientid_t))) {
+ /*
+ * OFFLOAD_CANCEL: only the creating client may cancel.
+ * so_id is guessable, so without this check any client
+ * could free another's cpntf state.
+ */
+ state = NULL;
+ goto unlock;
+ } else {
_free_cpntf_state_locked(nn, state);
+ }
}
unlock:
spin_unlock(&nn->s2s_cp_lock);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 044/935] nfsd: fix cpntf publish race in nfs4_init_cp_state
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 043/935] nfsd: check client ownership when cancelling a copy-notify stateid Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 045/935] nfsd: fix version mismatch loops in nfsd_acl_init_request() Greg Kroah-Hartman
` (896 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit be3a5c1d857b0dcbc11796cea603ef25834f75b2 upstream.
nfs4_alloc_init_cpntf_state() published the new cpntf entry into the
s2s_cp_stateids IDR (with cs_type set) in one s2s_cp_lock section, then
took the lock again to list_add() it onto p_stid->sc_cp_list. In the gap
the entry is reachable by so_id but cp_list is still {NULL,NULL} from
kzalloc. A racing OFFLOAD_CANCEL (so_id is echoed to the client as
cnr_stateid, so any NFSv4.2 client can drive it) reaches
manage_cpntf_state() -> _free_cpntf_state_locked() and does list_del() on
the zeroed list_head, oopsing the server.
Fold the cs_type assignment and the list_add() into the same critical
section as idr_alloc_cyclic(), so a concurrent lookup either misses the
entry or sees a fully linked cp_list. INIT_LIST_HEAD() the entry after
allocation and switch _free_cpntf_state_locked() to list_del_init() so a
stale unlink is a no-op. nfs4_init_copy_state() passes NULL p_stid and
skips the list_add, preserving NFS4_COPY_STID semantics.
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-1-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 35 +++++++++++++++++++++++++----------
1 file changed, 25 insertions(+), 10 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -984,7 +984,7 @@ out_free:
* Create a unique stateid_t to represent each COPY.
*/
static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid,
- unsigned char cs_type)
+ unsigned char cs_type, struct nfs4_stid *p_stid)
{
int new_id;
@@ -994,19 +994,34 @@ static int nfs4_init_cp_state(struct nfs
idr_preload(GFP_KERNEL);
spin_lock(&nn->s2s_cp_lock);
new_id = idr_alloc_cyclic(&nn->s2s_cp_stateids, stid, 0, 0, GFP_NOWAIT);
- stid->cs_stid.si_opaque.so_id = new_id;
- stid->cs_stid.si_generation = 1;
+ if (new_id >= 0) {
+ stid->cs_stid.si_opaque.so_id = new_id;
+ stid->cs_stid.si_generation = 1;
+ /*
+ * Set cs_type and link onto sc_cp_list under the same lock
+ * that installed the IDR entry, so a concurrent
+ * manage_cpntf_state() sees either no entry or a fully
+ * linked cp_list.
+ */
+ stid->cs_type = cs_type;
+ if (p_stid) {
+ struct nfs4_cpntf_state *cps =
+ container_of(stid, struct nfs4_cpntf_state,
+ cp_stateid);
+
+ list_add(&cps->cp_list, &p_stid->sc_cp_list);
+ }
+ }
spin_unlock(&nn->s2s_cp_lock);
idr_preload_end();
if (new_id < 0)
return 0;
- stid->cs_type = cs_type;
return 1;
}
int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy)
{
- return nfs4_init_cp_state(nn, ©->cp_stateid, NFS4_COPY_STID);
+ return nfs4_init_cp_state(nn, ©->cp_stateid, NFS4_COPY_STID, NULL);
}
struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn,
@@ -1017,13 +1032,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init
cps = kzalloc(sizeof(struct nfs4_cpntf_state), GFP_KERNEL);
if (!cps)
return NULL;
+ /* So a stale list_del_init() before linking is a no-op. */
+ INIT_LIST_HEAD(&cps->cp_list);
cps->cpntf_time = ktime_get_boottime_seconds();
refcount_set(&cps->cp_stateid.cs_count, 1);
- if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID))
+ if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID,
+ p_stid))
goto out_free;
- spin_lock(&nn->s2s_cp_lock);
- list_add(&cps->cp_list, &p_stid->sc_cp_list);
- spin_unlock(&nn->s2s_cp_lock);
return cps;
out_free:
kfree(cps);
@@ -6588,7 +6603,7 @@ _free_cpntf_state_locked(struct nfsd_net
WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
if (!refcount_dec_and_test(&cps->cp_stateid.cs_count))
return;
- list_del(&cps->cp_list);
+ list_del_init(&cps->cp_list);
idr_remove(&nn->s2s_cp_stateids,
cps->cp_stateid.cs_stid.si_opaque.so_id);
kfree(cps);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 045/935] nfsd: fix version mismatch loops in nfsd_acl_init_request()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 044/935] nfsd: fix cpntf publish race in nfs4_init_cp_state Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 046/935] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Greg Kroah-Hartman
` (895 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 9bc761051dcd9a4a8b59e64b2b185172d13c716d upstream.
The loops that compute the supported version range for PROG_MISMATCH
test nfsd_support_acl_version(rqstp->rq_vers) instead of
nfsd_support_acl_version(i), so every iteration fails and the
function returns rpc_prog_unavail instead of rpc_prog_mismatch.
Replace rqstp->rq_vers with the loop variable i, matching the
pattern used by the sibling nfsd_init_request() function.
Fixes: e333f3bbefe3 ("nfsd: Allow containers to set supported nfs versions")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-9-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfssvc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -859,7 +859,7 @@ nfsd_acl_init_request(struct svc_rqst *r
ret->mismatch.lovers = NFSD_ACL_NRVERS;
for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++) {
- if (nfsd_support_acl_version(rqstp->rq_vers) &&
+ if (nfsd_support_acl_version(i) &&
nfsd_vers(nn, i, NFSD_TEST)) {
ret->mismatch.lovers = i;
break;
@@ -869,7 +869,7 @@ nfsd_acl_init_request(struct svc_rqst *r
return rpc_prog_unavail;
ret->mismatch.hivers = NFSD_ACL_MINVERS;
for (i = NFSD_ACL_NRVERS - 1; i >= NFSD_ACL_MINVERS; i--) {
- if (nfsd_support_acl_version(rqstp->rq_vers) &&
+ if (nfsd_support_acl_version(i) &&
nfsd_vers(nn, i, NFSD_TEST)) {
ret->mismatch.hivers = i;
break;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 046/935] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 045/935] nfsd: fix version mismatch loops in nfsd_acl_init_request() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 047/935] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Greg Kroah-Hartman
` (894 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f9868174af49d207fbaf0c5e055d088a983684af upstream.
The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has
multiple errors that can result in either an out-of-bounds write or
leaking uninitialized kernel memory to the client:
- fh_len doesn't account for XDR padding on the file handle data
- uid and gid lengths use "8 + len" but xdr_encode_opaque() actually
writes "4 + xdr_align_size(len)" bytes
- ds_len omits the flags and stats_collect_hint fields (8 bytes),
while len's header constant overestimates by 8 bytes -- these
partially cancel but leave a net mismatch
The worst case occurs with short strings (e.g. uid=0, gid=0 with an
odd-sized file handle), where the function writes up to 5 bytes past
the reserved XDR buffer. Conversely, when string lengths happen to be
4-byte aligned, the reservation is too large and stale buffer content
is sent to the client.
Fix this by breaking out every encoded field explicitly in the ds_len
calculation, using xdr_align_size() for all variable-length opaque
fields, and correcting the header constants.
Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-pnfs-fixes-v1-1-8a1255ae2f16@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/flexfilelayoutxdr.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/fs/nfsd/flexfilelayoutxdr.c
+++ b/fs/nfsd/flexfilelayoutxdr.c
@@ -30,19 +30,24 @@ nfsd4_ff_encode_layoutget(struct xdr_str
struct ff_idmap uid;
struct ff_idmap gid;
- fh_len = 4 + fl->fh.size;
+ fh_len = 4 + xdr_align_size(fl->fh.size);
uid.len = sprintf(uid.buf, "%u", from_kuid(&init_user_ns, fl->uid));
gid.len = sprintf(gid.buf, "%u", from_kgid(&init_user_ns, fl->gid));
- /* 8 + len for recording the length, name, and padding */
- ds_len = 20 + sizeof(stateid_opaque_t) + 4 + fh_len +
- 8 + uid.len + 8 + gid.len;
+ /* data server entry: deviceid + efficiency + stateid + fh list +
+ * user + group + flags + stats_collect_hint
+ */
+ ds_len = 16 + 4 + 4 + sizeof(stateid_opaque_t) + 4 + fh_len +
+ 4 + xdr_align_size(uid.len) +
+ 4 + xdr_align_size(gid.len) +
+ 4 + 4;
+ /* mirror: ds_count + ds */
mirror_len = 4 + ds_len;
- /* The layout segment */
- len = 20 + mirror_len;
+ /* stripe_unit + mirror_count + mirror */
+ len = 12 + mirror_len;
p = xdr_reserve_space(xdr, sizeof(__be32) + len);
if (!p)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 047/935] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 046/935] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 048/935] nfsd: initialize copy-notify stateid before publishing it Greg Kroah-Hartman
` (893 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 8b989aaec85e1293a871d602590c951fe44b8647 upstream.
nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation
as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque()
calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes.
The mismatch means the declared da_addr_body length exceeds the actual
encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply,
leaking stale reply-page content to the client and mis-aligning the
subsequent version list decode.
Use xdr_align_size() for each string length to match what
xdr_encode_opaque() actually writes.
Fixes: efcae97fa425 ("NFSD: da_addr_body field missing in some GETDEVICEINFO replies")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260527-pnfs-fixes-v1-1-784f39dc1eca@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/flexfilelayoutxdr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfsd/flexfilelayoutxdr.c
+++ b/fs/nfsd/flexfilelayoutxdr.c
@@ -99,7 +99,8 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr
}
/* len + padding for two strings */
- addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len;
+ addr_len = 8 + xdr_align_size(da->netaddr.netid_len) +
+ xdr_align_size(da->netaddr.addr_len);
ver_len = 20;
len = 4 + ver_len + 4 + addr_len;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 048/935] nfsd: initialize copy-notify stateid before publishing it
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 047/935] nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 049/935] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Greg Kroah-Hartman
` (892 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 129643893b79f8a3c6b72045f933fbab5ee424ca upstream.
nfsd4_copy_notify() finished initializing the cpntf state after
nfs4_alloc_init_cpntf_state() had already linked it into the
s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the
membership reference) and none held for the caller. A racing
OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable
so_id) could reach manage_cpntf_state() and free the entry, turning the
caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid
writes into use-after-free. The owning clientid was also only recorded
after publication, so it could not gate an ownership check in that window.
Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state()
before nfs4_init_cp_state() publishes the entry, and return it with an
extra reference. The caller reads the stateid under that reference and
drops it with nfs4_put_cpntf_state(); on a late error the laundromat
reaps the entry.
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-4-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 16 +++++++++-------
fs/nfsd/nfs4state.c | 10 +++++++++-
2 files changed, 18 insertions(+), 8 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1885,7 +1885,6 @@ nfsd4_copy_notify(struct svc_rqst *rqstp
struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id);
struct nfs4_stid *stid;
struct nfs4_cpntf_state *cps;
- struct nfs4_client *clp = cstate->clp;
status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh,
&cn->cpn_src_stateid, RD_STATE, NULL,
@@ -1897,12 +1896,14 @@ nfsd4_copy_notify(struct svc_rqst *rqstp
cn->cpn_nsec = 0;
status = nfserrno(-ENOMEM);
+ /*
+ * The returned cps is published and fully initialized, and carries an
+ * extra reference for us; drop it once we are done with it.
+ */
cps = nfs4_alloc_init_cpntf_state(nn, stid);
if (!cps)
goto out;
memcpy(&cn->cpn_cnr_stateid, &cps->cp_stateid.cs_stid, sizeof(stateid_t));
- memcpy(&cps->cp_p_stateid, &stid->sc_stateid, sizeof(stateid_t));
- memcpy(&cps->cp_p_clid, &clp->cl_clientid, sizeof(clientid_t));
/* For now, only return one server address in cpn_src, the
* address used by the client to connect to this server.
@@ -1911,10 +1912,11 @@ nfsd4_copy_notify(struct svc_rqst *rqstp
status = nfsd4_set_netaddr((struct sockaddr *)&rqstp->rq_daddr,
&cn->cpn_src->u.nl4_addr);
WARN_ON_ONCE(status);
- if (status) {
- nfs4_put_cpntf_state(nn, cps);
- goto out;
- }
+ /*
+ * Drop our extra reference. The membership reference keeps the entry
+ * alive for a later inter-server READ, or until the laundromat reaps it.
+ */
+ nfs4_put_cpntf_state(nn, cps);
out:
nfs4_put_stid(stid);
return status;
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1035,7 +1035,15 @@ struct nfs4_cpntf_state *nfs4_alloc_init
/* So a stale list_del_init() before linking is a no-op. */
INIT_LIST_HEAD(&cps->cp_list);
cps->cpntf_time = ktime_get_boottime_seconds();
- refcount_set(&cps->cp_stateid.cs_count, 1);
+ /*
+ * Fully initialize the entry before nfs4_init_cp_state() publishes it,
+ * since a concurrent OFFLOAD_CANCEL could then free it. Take an extra
+ * reference for the caller (dropped with nfs4_put_cpntf_state()).
+ */
+ memcpy(&cps->cp_p_stateid, &p_stid->sc_stateid, sizeof(stateid_t));
+ memcpy(&cps->cp_p_clid, &p_stid->sc_client->cl_clientid,
+ sizeof(clientid_t));
+ refcount_set(&cps->cp_stateid.cs_count, 2);
if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID,
p_stid))
goto out_free;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 049/935] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 048/935] nfsd: initialize copy-notify stateid before publishing it Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 050/935] nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Greg Kroah-Hartman
` (891 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Robbie Ko, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <robbieko@synology.com>
commit 26709c8ffe73772eb69e68d553ac71d91228dccc upstream.
The NFSv2 sattr decoder converts the wire useconds to nanoseconds in
svcxdr_decode_sattr():
iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;
tmp2 is a u32 and NSEC_PER_USEC is 1000, so the product is computed in
unsigned long. On ILP32 that is 32 bits, and an out-of-range useconds
value such as 4294968 wraps to tv_nsec == 704. The corruption therefore
happens during decode, before any proc function can inspect the value,
and a later range check on tv_nsec would see an in-range result and
accept it. Rejecting in the decoder yields an RPC GARBAGE_ARGS reply.
NFSv2 defines no NFSERR_INVAL, so there is no NFS-level status to return
for a malformed time argument, and the check cannot move to the proc
function the way the v3/v4 nsec range checks do.
Guard the raw useconds before the multiplication and reject values
greater than 1000000. useconds == 1000000 is kept: it is the Sun
convention for "set to the current server time", and the in-tree Linux
NFSv2 client emits it in both the atime and the mtime field for a plain
touch / utimes(file, NULL) (see encode_sattr() and
xdr_encode_current_server_time() in fs/nfs/nfs2xdr.c). Rejecting 1000000
would turn that common operation into a hard decode failure for both
SETATTR and CREATE. 1000000 * NSEC_PER_USEC is 10^9, which does not wrap
on ILP32, so the Sun convention value passes through safely. Only
genuinely out-of-range values (> 1000000) are rejected. The atime and
mtime guards are therefore symmetric.
The decoder only applied the Sun convention in the mtime block, which
clears ATTR_ATIME_SET|ATTR_MTIME_SET when mtime useconds == 1000000. If a
client puts 1000000 in the atime field but not in the mtime field, the
atime block stored an out-of-range tv_nsec (10^9) and left ATTR_ATIME_SET
set, so the bogus value reached the filesystem. Apply the convention in
the atime block as well, clearing ATTR_ATIME_SET so the server uses its
current time and ignores the value. Only ATTR_ATIME_SET is cleared there.
The mtime block keeps its existing behavior, where 1000000 means "set
both atime and mtime to now".
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Robbie Ko <robbieko@synology.com>
[ cel: various tweaks, addenda, and clean-ups ]
Link: https://patch.msgid.link/20260616054027.2360930-1-robbieko@synology.com
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsxdr.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
--- a/fs/nfsd/nfsxdr.c
+++ b/fs/nfsd/nfsxdr.c
@@ -10,6 +10,16 @@
#include "auth.h"
/*
+ * Sun convention: a sattr time-useconds field of one full second (an
+ * otherwise out-of-range value) means "set this time to the current
+ * server time." It's needed to make permissions checks for the "touch"
+ * program across NFSv2 mounts work correctly. See description of
+ * sattr in section 6.1 of "NFS Illustrated" by Brent Callaghan,
+ * Addison-Wesley, ISBN 0-201-32750-5
+ */
+#define NFS2_SATTR_SET_TO_SERVER_TIME (1000000)
+
+/*
* Mapping of S_IF* types to NFS file types
*/
static const u32 nfs_ftypes[] = {
@@ -172,27 +182,29 @@ svcxdr_decode_sattr(struct svc_rqst *rqs
tmp1 = be32_to_cpup(p++);
tmp2 = be32_to_cpup(p++);
if (tmp1 != (u32)-1 && tmp2 != (u32)-1) {
+ /*
+ * Range test here to prevent the multiplication from
+ * wrapping to a valid (but incorrect) value on 32-bit
+ * platforms.
+ */
+ if (tmp2 > NFS2_SATTR_SET_TO_SERVER_TIME)
+ return false;
iap->ia_valid |= ATTR_ATIME | ATTR_ATIME_SET;
iap->ia_atime.tv_sec = tmp1;
iap->ia_atime.tv_nsec = tmp2 * NSEC_PER_USEC;
+ if (tmp2 == NFS2_SATTR_SET_TO_SERVER_TIME)
+ iap->ia_valid &= ~ATTR_ATIME_SET;
}
tmp1 = be32_to_cpup(p++);
tmp2 = be32_to_cpup(p++);
if (tmp1 != (u32)-1 && tmp2 != (u32)-1) {
+ if (tmp2 > NFS2_SATTR_SET_TO_SERVER_TIME)
+ return false;
iap->ia_valid |= ATTR_MTIME | ATTR_MTIME_SET;
iap->ia_mtime.tv_sec = tmp1;
iap->ia_mtime.tv_nsec = tmp2 * NSEC_PER_USEC;
- /*
- * Passing the invalid value useconds=1000000 for mtime
- * is a Sun convention for "set both mtime and atime to
- * current server time". It's needed to make permissions
- * checks for the "touch" program across v2 mounts to
- * Solaris and Irix boxes work correctly. See description of
- * sattr in section 6.1 of "NFS Illustrated" by
- * Brent Callaghan, Addison-Wesley, ISBN 0-201-32750-5
- */
- if (tmp2 == 1000000)
+ if (tmp2 == NFS2_SATTR_SET_TO_SERVER_TIME)
iap->ia_valid &= ~(ATTR_ATIME_SET|ATTR_MTIME_SET);
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 050/935] nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 049/935] nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 051/935] nfsd: revoke copy-notify stateids before dropping their reference Greg Kroah-Hartman
` (890 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 2327ba1d9546727a35b17888777e991f68a9b305 upstream.
nfsd4_lock() only checks the namespace-wide grace flag when deciding
whether to accept a reclaim LOCK. It does not check the per-client
NFSD4_CLIENT_RECLAIM_COMPLETE bit. An NFSv4.1+ client that has
already sent RECLAIM_COMPLETE can submit lk_reclaim=1 while grace is
still active (e.g. lockd holds the grace list open), and the server
accepts it instead of returning NFS4ERR_NO_GRACE as required by
RFC 8881 section 18.51.3.
The OPEN path already enforces both tiers: the grace check plus the
per-client RECLAIM_COMPLETE check in nfs4_check_open_reclaim(). Add
the equivalent per-client check to the LOCK path.
Fixes: 3b3e7b72239a ("nfsd: reject reclaim request when client has already sent RECLAIM_COMPLETE")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
[ cel: Correct the RFC citations in the commit message ]
Link: https://patch.msgid.link/20260611-nfsd-testing-v2-14-5b90e276f2d9@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -7619,6 +7619,9 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
status = nfserr_no_grace;
if (!locks_in_grace(net) && lock->lk_reclaim)
goto out;
+ if (lock->lk_reclaim &&
+ test_bit(NFSD4_CLIENT_RECLAIM_COMPLETE, &cstate->clp->cl_flags))
+ goto out;
if (lock->lk_reclaim)
fl_flags |= FL_RECLAIM;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 051/935] nfsd: revoke copy-notify stateids before dropping their reference
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 050/935] nfsd: reject reclaim LOCK after RECLAIM_COMPLETE Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 052/935] NFSD: Prevent lock owner use-after-free during client teardown Greg Kroah-Hartman
` (889 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 3b0c3595db99bb4bebd7c8aa8a36f3c50e411bb7 upstream.
Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent
stid's sc_cp_list, pinned by a single membership reference.
_free_cpntf_state_locked() only unlinks an entry once its refcount reaches
zero, so any revoke path that runs while a concurrent
find_cpntf_state()/manage_cpntf_state() holder has elevated cs_count drops
the reference without unlinking, leaving the entry discoverable with its
membership reference already consumed. A second revoke or a laundromat tick
then frees it while the reader still holds the pointer -- a
KASAN-detectable use-after-free at the reader's nfs4_put_cpntf_state().
This affected all three revoke paths:
- The parent-stid drain (nfs4_free_cpntf_statelist()) repeatedly called
_free_cpntf_state_locked() on the first list entry; a holder that had
bumped cs_count made it return early, so the next iteration
re-decremented and burned the holder's reference.
- OFFLOAD_CANCEL (manage_cpntf_state()) and laundromat expiry likewise
used _free_cpntf_state_locked() and could drop 2->1 without unlinking.
Add revoke_cpntf_state_locked(), which unhashes the entry from the IDR and
sc_cp_list first (deferring the final free to any holder), and use it from
all three revoke paths. The drain now walks with list_for_each_entry_safe()
and revokes each entry unconditionally, so it terminates in one pass per
entry regardless of cs_count. The unhash is gated on
!list_empty(&cps->cp_list); the idr_remove() gate matters because
idr_alloc_cyclic() may have recycled the so_id by then. Keep
_free_cpntf_state_locked() for the reference-holder put path only, where a
concurrent revoke may already have unlinked the entry (its list_del_init()
then a no-op).
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-7
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260710-nfsd-testing-v3-6-a0ff7db6aa3e@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 78 +++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 62 insertions(+), 16 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1066,18 +1066,66 @@ void nfs4_free_copy_state(struct nfsd4_c
spin_unlock(&nn->s2s_cp_lock);
}
+/*
+ * Drop the parent's reference on an already-unlinked cpntf entry. If a
+ * concurrent holder still owns a reference, its nfs4_put_cpntf_state() does
+ * the final free.
+ *
+ * nn->s2s_cp_lock must be held.
+ */
+static void put_cpntf_state_unlinked_locked(struct nfs4_cpntf_state *cps)
+{
+ WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
+ WARN_ON_ONCE(!list_empty(&cps->cp_list));
+
+ if (refcount_dec_and_test(&cps->cp_stateid.cs_count))
+ kfree(cps);
+}
+
+/*
+ * Unhash from the IDR and sc_cp_list. Gated on list_empty() to avoid
+ * evicting a recycled so_id.
+ */
+static void nfsd4_unhash_cpntf_state(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
+{
+ lockdep_assert_held(&nn->s2s_cp_lock);
+
+ if (!list_empty(&cps->cp_list)) {
+ list_del_init(&cps->cp_list);
+ idr_remove(&nn->s2s_cp_stateids, cps->cp_stateid.cs_stid.si_opaque.so_id);
+ }
+}
+
+/*
+ * Revoke a copy-notify stateid: unlink it from the IDR and sc_cp_list first
+ * so no new finder can discover it, then drop the membership reference. Every
+ * revoke path (cancel, laundromat, drain) must use this rather than
+ * _free_cpntf_state_locked(), which unlinks only at refcount zero and so could
+ * let a second revoke free the entry under a concurrent reader.
+ *
+ * nn->s2s_cp_lock must be held.
+ */
+static void revoke_cpntf_state_locked(struct nfsd_net *nn,
+ struct nfs4_cpntf_state *cps)
+{
+ nfsd4_unhash_cpntf_state(nn, cps);
+ put_cpntf_state_unlinked_locked(cps);
+}
+
static void nfs4_free_cpntf_statelist(struct net *net, struct nfs4_stid *stid)
{
- struct nfs4_cpntf_state *cps;
+ struct nfs4_cpntf_state *cps, *tmp;
struct nfsd_net *nn;
nn = net_generic(net, nfsd_net_id);
spin_lock(&nn->s2s_cp_lock);
- while (!list_empty(&stid->sc_cp_list)) {
- cps = list_first_entry(&stid->sc_cp_list,
- struct nfs4_cpntf_state, cp_list);
- _free_cpntf_state_locked(nn, cps);
- }
+ /*
+ * Revoke unlinks each entry before dropping the parent's reference, so
+ * the drain terminates in one pass per entry regardless of cs_count; a
+ * concurrent holder does the final kfree via nfs4_put_cpntf_state().
+ */
+ list_for_each_entry_safe(cps, tmp, &stid->sc_cp_list, cp_list)
+ revoke_cpntf_state_locked(nn, cps);
spin_unlock(&nn->s2s_cp_lock);
}
@@ -6227,7 +6275,7 @@ nfs4_laundromat(struct nfsd_net *nn)
cps = container_of(cps_t, struct nfs4_cpntf_state, cp_stateid);
if (cps->cp_stateid.cs_type == NFS4_COPYNOTIFY_STID &&
state_expired(<, cps->cpntf_time))
- _free_cpntf_state_locked(nn, cps);
+ revoke_cpntf_state_locked(nn, cps);
}
spin_unlock(&nn->s2s_cp_lock);
nfs4_get_client_reaplist(nn, &reaplist, <);
@@ -6605,16 +6653,14 @@ nfs4_check_file(struct svc_rqst *rqstp,
out:
return status;
}
-static void
-_free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
+
+static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps)
{
WARN_ON_ONCE(cps->cp_stateid.cs_type != NFS4_COPYNOTIFY_STID);
- if (!refcount_dec_and_test(&cps->cp_stateid.cs_count))
- return;
- list_del_init(&cps->cp_list);
- idr_remove(&nn->s2s_cp_stateids,
- cps->cp_stateid.cs_stid.si_opaque.so_id);
- kfree(cps);
+ if (refcount_dec_and_test(&cps->cp_stateid.cs_count)) {
+ nfsd4_unhash_cpntf_state(nn, cps);
+ kfree(cps);
+ }
}
/*
* A READ from an inter server to server COPY will have a
@@ -6651,7 +6697,7 @@ __be32 manage_cpntf_state(struct nfsd_ne
state = NULL;
goto unlock;
} else {
- _free_cpntf_state_locked(nn, state);
+ revoke_cpntf_state_locked(nn, state);
}
}
unlock:
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 052/935] NFSD: Prevent lock owner use-after-free during client teardown
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 051/935] nfsd: revoke copy-notify stateids before dropping their reference Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 053/935] libceph: reject buckets with mismatched CRUSH ids Greg Kroah-Hartman
` (888 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfgang Walter, NeilBrown,
Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <cel@kernel.org>
commit 5e2fa29d223a9a1e6a948e40b109d09081d1decd upstream.
__destroy_client() releases a client's open owners, but a lock owner
whose only reference is a blocked lock (nbl) stays on
cl_ownerstr_hashtbl. client_has_state() does not count a bare owner,
so DESTROY_CLIENTID can reach __destroy_client() with such owners
present.
__destroy_client() then walks the table, calling remove_blocked_locks()
on each owner without a reference. Freeing a blocked lock drops the
owner reference held via flc_owner. The per-net laundromat reaps
blocked locks from nn->blocked_locks_lru independently of client state.
The two paths share blocked_locks_lock only for the list splice, not
the owner's lifetime. The laundromat therefore frees the owner as
__destroy_client() dereferences it, a NULL dereference in
remove_blocked_locks().
nfsd4_release_lockowner() holds a reference across the same call;
__destroy_client() does not. Hold cl_lock across the walk, taking a
reference and unhashing each owner, then drop it before
remove_blocked_locks() and nfs4_put_stateowner(), which take
blocked_locks_lock and cl_lock.
Reported-by: Wolfgang Walter <linux@stwm.de>
Closes: https://lore.kernel.org/linux-nfs/6eccafaaaa60651ef091257c3439c46b@stwm.de/
Fixes: 68ef3bc31664 ("nfsd: remove blocked locks on client teardown")
Cc: stable@vger.kernel.org
Reviewed-by: NeilBrown <neil@brown.name>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260709-cel-v4-1-1d519d9be0cb@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2336,14 +2336,24 @@ __destroy_client(struct nfs4_client *clp
release_openowner(oo);
}
for (i = 0; i < OWNER_HASH_SIZE; i++) {
- struct nfs4_stateowner *so, *tmp;
+ struct nfs4_stateowner *so;
- list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i],
- so_strhash) {
+ spin_lock(&clp->cl_lock);
+ while (!list_empty(&clp->cl_ownerstr_hashtbl[i])) {
+ so = list_first_entry(&clp->cl_ownerstr_hashtbl[i],
+ struct nfs4_stateowner, so_strhash);
/* Should be no openowners at this point */
WARN_ON_ONCE(so->so_is_open_owner);
+ nfs4_get_stateowner(so);
+ unhash_lockowner_locked(lockowner(so));
+ spin_unlock(&clp->cl_lock);
+
remove_blocked_locks(lockowner(so));
+ nfs4_put_stateowner(so);
+
+ spin_lock(&clp->cl_lock);
}
+ spin_unlock(&clp->cl_lock);
}
nfsd4_return_all_client_layouts(clp);
nfsd4_shutdown_copy(clp);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 053/935] libceph: reject buckets with mismatched CRUSH ids
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 052/935] NFSD: Prevent lock owner use-after-free during client teardown Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 054/935] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Greg Kroah-Hartman
` (887 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Alex Markuze,
Ilya Dryomov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 3cde4a8302301679937474a5f7a851394cc1bd11 upstream.
crush_decode() stores bucket data by array slot, and the mapper later
derives the per-bucket workspace index from the decoded bucket id. A
malformed map can therefore make one bucket reuse another bucket's
workspace by encoding an id different from -1 - slot.
For uniform buckets, the second replica selection expands the source
bucket's permutation into that aliased workspace buffer. If the source
bucket is larger than the aliased bucket, the write runs past the smaller
permutation array and can escape the kvmalloc'd CRUSH workspace. KASAN
reports a slab OOB write of 4 bytes in bucket_perm_choose().
Reject buckets whose encoded id does not match their array slot. Valid
CRUSH maps already use the canonical negative id corresponding to the
bucket slot, so this restores the invariant expected by
work->work[-1 - in->id] without changing valid map behavior.
Cc: stable@vger.kernel.org
Fixes: 66a0e2d579db ("crush: remove mutable part of CRUSH map")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/osdmap.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -503,6 +503,8 @@ static struct crush_map *crush_decode(vo
ceph_decode_need(p, end, 4*sizeof(u32), bad);
b->id = ceph_decode_32(p);
+ if (b->id != -1 - i)
+ goto bad;
b->type = ceph_decode_16(p);
if (b->type == 0)
goto bad;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 054/935] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 053/935] libceph: reject buckets with mismatched CRUSH ids Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 055/935] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Greg Kroah-Hartman
` (886 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiubo Li, Viacheslav Dubeyko,
Ilya Dryomov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <xiubo.li@clyso.com>
commit 7af4c4f01305b0935adf6d4301b1ec407025485d upstream.
list_for_each_entry() iterates ci->i_cap_flush_list but drops
i_ceph_lock to send cap messages. During the unlock window,
handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries
with tid <= flush_tid from the list, release i_ceph_lock, and free
them via ceph_free_cap_flush() outside any lock. When the original
thread reacquires i_ceph_lock and the for-loop macro advances via
cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next
on freed memory.
The race timeline:
__kick_flushing_caps() handle_cap_flush_ack()
----------------------- -----------------------
holds i_ceph_lock <---
iterates to cf (tid=10)
prepares FLUSH message
drops i_ceph_lock <---
__send_cap() ── FLUSH(tid=10)
MDS sends FLUSH_ACK(tid=10)
---> acquires i_ceph_lock
cf->tid(10) <= flush_tid(10),
detaches cf from i_cap_flush_list
drops i_ceph_lock
ceph_free_cap_flush(cf) <- frees it!
acquires i_ceph_lock <---
for-loop advances:
cf = list_next_entry(cf, i_list)
-- UAF on freed cf->i_list.next
The cf was just sent by __kick_flushing_caps itself via __send_cap().
The MDS may respond with FLUSH_ACK quickly enough that
handle_cap_flush_ack() frees cf before __kick_flushing_caps can
finish the iteration.
Fix by converting to a manual while loop: save the next pointer
under i_ceph_lock before dropping it, then use the saved pointer
after reacquiring, so the potentially-freed cf is never accessed again.
Cc: stable@vger.kernel.org
Signed-off-by: Xiubo Li <xiubo.li@clyso.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/caps.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -2433,9 +2433,14 @@ static void __kick_flushing_caps(struct
}
}
- list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) {
- if (cf->tid < first_tid)
+ cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list);
+ while (&cf->i_list != &ci->i_cap_flush_list) {
+ struct ceph_cap_flush *next;
+
+ if (cf->tid < first_tid) {
+ cf = list_next_entry(cf, i_list);
continue;
+ }
cap = ci->i_auth_cap;
if (!(cap && cap->session == session)) {
@@ -2445,6 +2450,7 @@ static void __kick_flushing_caps(struct
}
first_tid = cf->tid + 1;
+ next = list_next_entry(cf, i_list);
if (!cf->is_capsnap) {
struct cap_msg_args arg;
@@ -2485,6 +2491,7 @@ static void __kick_flushing_caps(struct
}
spin_lock(&ci->i_ceph_lock);
+ cf = next;
}
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 055/935] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 054/935] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 056/935] ceph: bound num_export_targets array for mds info v2/v3 Greg Kroah-Hartman
` (885 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jérémy Jean, Alex Markuze,
Ilya Dryomov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit aedc9053d909508a5f56c3f49f885fc030df4730 upstream.
MDSMap export_targets entries are monitor controlled. check_new_map()
uses each entry as a bit number in a fixed stack bitmap, so a rank
outside the protocol namespace can make set_bit() write past the end of
the array.
Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not
validate against possible_max_rank here because maps may legitimately
reference ranks beyond a temporarily reduced max_mds.
Cc: stable@vger.kernel.org
Fixes: d517b3983dd3 ("ceph: reconnect to the export targets on new mdsmaps")
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mdsmap.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -263,6 +263,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(v
goto nomem;
for (j = 0; j < num_export_targets; j++) {
target = ceph_decode_32(&pexport_targets);
+ if (target >= CEPH_MAX_MDS) {
+ err = -EIO;
+ goto corrupt;
+ }
info->export_targets[j] = target;
}
} else {
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 056/935] ceph: bound num_export_targets array for mds info v2/v3
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 055/935] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 057/935] ceph: bound xattr value length in __build_xattrs() Greg Kroah-Hartman
` (884 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Viacheslav Dubeyko, Ilya Dryomov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit a3eb169ee297aa99670ba927c659990bd1e453f3 upstream.
ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from
each per-mds info record and advances the decode cursor by
num_export_targets * sizeof(u32) without first checking that many bytes
remain. The only upper-bound check that catches a runaway cursor
(*p > info_end) is gated on info_v >= 4, because info_end is left NULL
for info_v 2 and 3. When the monitor sends an MDS map whose per-mds
info version is 2 or 3 with an oversized num_export_targets, the cursor
moves past the message front buffer and the later export-targets loop
calls the unchecked ceph_decode_32() on out-of-bounds memory.
A kernel client processes CEPH_MSG_MDS_MAP from its monitor session
(net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to
ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and
calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an
on-path attacker on an unsigned/unencrypted messenger session, can
therefore drive an out-of-bounds read in the client kernel; on x86_64
with KASAN it is reported as a slab-out-of-bounds read in
ceph_mdsmap_decode(). The decoded values land in the internal
info->export_targets[] array, so the consequence is a kernel
out-of-bounds read, not an information leak to the attacker.
Impact: a malicious or compromised Ceph monitor sending an MDS map with
a per-mds info version of 2 or 3 and an oversized num_export_targets
field triggers an out-of-bounds read in the CephFS client kernel.
Add a ceph_decode_need() for the export-targets array before advancing
the cursor, so the bound is enforced for every info_v >= 2, not only
info_v >= 4. This mirrors the count-then-need idiom already used for
m_data_pg_pools later in the same function.
Compute the export-targets byte count with size_mul() and reuse that
checked length when advancing the cursor, so the attacker-controlled
num_export_targets multiplication fails closed on overflow rather than
relying on the later kcalloc() guard.
Cc: stable@vger.kernel.org
Fixes: d463a43d69f4 ("ceph: CEPH_FEATURE_MDSENC support")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <slava@dubeyko.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mdsmap.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/ceph/mdsmap.c
+++ b/fs/ceph/mdsmap.c
@@ -3,6 +3,7 @@
#include <linux/bug.h>
#include <linux/err.h>
+#include <linux/overflow.h>
#include <linux/random.h>
#include <linux/slab.h>
#include <linux/types.h>
@@ -123,6 +124,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(v
u8 mdsmap_v;
u16 mdsmap_ev;
u32 target;
+ size_t export_targets_len;
m = kzalloc(sizeof(*m), GFP_NOFS);
if (!m)
@@ -221,8 +223,11 @@ struct ceph_mdsmap *ceph_mdsmap_decode(v
*p += namelen;
if (info_v >= 2) {
ceph_decode_32_safe(p, end, num_export_targets, bad);
+ export_targets_len = size_mul(num_export_targets,
+ sizeof(u32));
+ ceph_decode_need(p, end, export_targets_len, bad);
pexport_targets = *p;
- *p += num_export_targets * sizeof(u32);
+ *p += export_targets_len;
} else {
num_export_targets = 0;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 057/935] ceph: bound xattr value length in __build_xattrs()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 056/935] ceph: bound num_export_targets array for mds info v2/v3 Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 058/935] audit: avoid dropping live tree ref on fsnotify rule autoremove Greg Kroah-Hartman
` (883 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Bommarito,
Viacheslav Dubeyko, Ilya Dryomov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Bommarito <michael.bommarito@gmail.com>
commit 68d541754d6cd3bb98d1fd8314f57e5eb533557d upstream.
__build_xattrs() decodes the MDS-supplied xattr blob one attribute at a
time. For each attribute it reads a 32-bit name length, advances past the
name bytes, reads a 32-bit value length, records the value pointer, and
advances past the value bytes. The two length fields are read with
ceph_decode_32_safe(), but the value bytes themselves are advanced over
with a bare "p += len" and no ceph_decode_need() check that "len" bytes
remain in the blob.
For every attribute except the last, the next iteration's
ceph_decode_32_safe() on the following name length implicitly verifies
that the previous value did not run past the blob end. The final
attribute has no successor, so its decoded value length is never checked
against the blob bounds. A malicious or compromised metadata server can
set the last attribute's value length larger than the bytes actually
present in the blob.
The blob is a dedicated kvmalloc() allocation sized to the wire length
(ceph_buffer_new() in ceph_fill_inode()). __set_xattr() records the
oversized length in xattr->val_len verbatim, and a later getxattr(2) runs
memcpy(value, xattr->val, xattr->val_len) into a user-supplied buffer,
copying bytes past the end of the allocation back to user space.
Impact: a malicious metadata server discloses adjacent kernel heap bytes
to a local user via getxattr(2) on a CephFS file. Add the missing
ceph_decode_need() so an out-of-bounds value length on the final
attribute fails the decode and returns -EIO instead of being stored.
Cc: stable@vger.kernel.org
Fixes: 355da1eb7a1f ("ceph: inode operations")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/xattr.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -811,6 +811,7 @@ start:
name = p;
p += len;
ceph_decode_32_safe(&p, end, len, bad);
+ ceph_decode_need(&p, end, len, bad);
val = p;
p += len;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 058/935] audit: avoid dropping live tree ref on fsnotify rule autoremove
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 057/935] ceph: bound xattr value length in __build_xattrs() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 059/935] HID: picolcd: clamp eeprom debugfs read to bytes actually received Greg Kroah-Hartman
` (882 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jérémy Jean,
Ricardo Robaina, Paul Moore
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
commit 783f0f0974c156aca630f4ffff248671082a098d upstream.
audit_del_rule() is used for both netlink deletion templates and internal
fsnotify autoremove. The former passes a parsed template which owns a
temporary tree reference; the latter passes the installed entry itself.
The unconditional audit_put_tree() at the end of audit_del_rule() assumes
the template case. For mixed AUDIT_DIR plus AUDIT_EXE rules, an fsnotify
autoremove event therefore drops the installed rule's live tree reference.
Repeating this across rules sharing the same tree can free the tree while
another rule still references it, and a later autoremove dereferences the
freed pathname while comparing rules.
Move the temporary-tree put to audit_rule_change(), the caller that owns
deletion templates. Keep it in the AUDIT_DEL_RULE cleanup so both
successful deletion and -ENOENT still release the parser-owned tree.
Cc: stable@kernel.org
Fixes: 34d99af52ad4 ("audit: implement audit by executable")
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Reviewed-by: Ricardo Robaina <rrobaina@redhat.com>
Tested-by: Ricardo Robaina <rrobaina@redhat.com>
[PM: dropped unnecessary comment for line length reasons]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/auditfilter.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1015,7 +1015,6 @@ static inline int audit_add_rule(struct
int audit_del_rule(struct audit_entry *entry)
{
struct audit_entry *e;
- struct audit_tree *tree = entry->rule.tree;
struct list_head *list;
int ret = 0;
#ifdef CONFIG_AUDITSYSCALL
@@ -1063,9 +1062,6 @@ int audit_del_rule(struct audit_entry *e
out:
mutex_unlock(&audit_filter_mutex);
- if (tree)
- audit_put_tree(tree); /* that's the temporary one */
-
return ret;
}
@@ -1150,6 +1146,8 @@ int audit_rule_change(int type, int seq,
}
if (err || type == AUDIT_DEL_RULE) {
+ if (type == AUDIT_DEL_RULE && entry->rule.tree)
+ audit_put_tree(entry->rule.tree);
if (entry->rule.exe)
audit_remove_mark(entry->rule.exe);
audit_free_rule(entry);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 059/935] HID: picolcd: clamp eeprom debugfs read to bytes actually received
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 058/935] audit: avoid dropping live tree ref on fsnotify rule autoremove Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 060/935] HID: roccat: free buffered reports when destroying device Greg Kroah-Hartman
` (881 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ibrahim Hashimov, Jiri Kosina
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ibrahim Hashimov <security@auditcode.ai>
commit e9c667395ac1f8024f623250b32bae4c7af9caa0 upstream.
picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte
supplied by the device in its REPORT_EE_DATA reply -- clamped only to
the caller's read() count:
ret = resp->raw_data[2];
if (ret > s)
ret = s;
if (copy_to_user(u, resp->raw_data+3, ret))
It never checks resp->raw_size, the number of bytes picolcd_raw_event()
actually copied into the 64-byte raw_data[] of the kmalloc'd struct
picolcd_pending. A device (or a spoofed picoLCD) returning a length byte
of 0xff, read with a count >= 255, makes copy_to_user() read past
raw_data[] into adjacent slab memory and return it to userspace through
the debugfs "eeprom" file:
BUG: KASAN: slab-out-of-bounds in _copy_to_user
Read of size 255 ... picolcd_debug_eeprom_read+0x214/0x2f0 [hid_picolcd]
The debug-dump path in the same file already validates the device length
byte against the received size before trusting it; this read does not.
The file is created S_IRUSR (root-only) and a crafted device is needed,
so it is neither unprivileged- nor remotely-triggerable.
Clamp the copy length to resp->raw_size - 3 (the payload actually
received, minus the 3-byte header), floored at 0 for short replies.
Fixes: 9bbf2b98ba11 ("HID: add experimental access to PicoLCD device's EEPROM and FLASH")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-picolcd_debugfs.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/hid/hid-picolcd_debugfs.c
+++ b/drivers/hid/hid-picolcd_debugfs.c
@@ -98,6 +98,15 @@ static ssize_t picolcd_debug_eeprom_read
ret = resp->raw_data[2];
if (ret > s)
ret = s;
+ /*
+ * raw_data[2] is a device-supplied length; also clamp it to
+ * what picolcd_raw_event() actually stored (raw_size), or a
+ * hostile device overruns the raw_data[] buffer.
+ */
+ if (ret > resp->raw_size - 3)
+ ret = resp->raw_size - 3;
+ if (ret < 0)
+ ret = 0;
if (copy_to_user(u, resp->raw_data+3, ret))
ret = -EFAULT;
else
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 060/935] HID: roccat: free buffered reports when destroying device
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 059/935] HID: picolcd: clamp eeprom debugfs read to bytes actually received Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 061/935] HID: sensor: custom: Fix field sysfs group cleanup on failure Greg Kroah-Hartman
` (880 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Rao, Jiri Kosina
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Rao <raoxu@uniontech.com>
commit bbff0ccbff360a5498075525005f6a913239a3d7 upstream.
roccat_report_event() duplicates each report with kmemdup() and stores
the allocation in a circular-buffer slot. The allocation is released only
when that slot is reused.
The device destruction paths free struct roccat_device without releasing
reports still stored in cbuf[]. This makes those allocations unreachable
and leaks up to ROCCAT_CBUF_SIZE report buffers per device.
Add a small destructor that frees every buffered report before freeing the
device, and use it in both paths that can destroy a registered device.
Fixes: 206f5f2fcb5f ("HID: roccat: propagate special events of roccat hardware to userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-roccat.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-roccat.c
+++ b/drivers/hid/hid-roccat.c
@@ -70,6 +70,15 @@ static struct roccat_device *devices[ROC
/* protects modifications of devices array */
static DEFINE_MUTEX(devices_lock);
+static void roccat_free_device(struct roccat_device *device)
+{
+ int i;
+
+ for (i = 0; i < ROCCAT_CBUF_SIZE; i++)
+ kfree(device->cbuf[i].value);
+ kfree(device);
+}
+
static ssize_t roccat_read(struct file *file, char __user *buffer,
size_t count, loff_t *ppos)
{
@@ -226,7 +235,7 @@ static int roccat_release(struct inode *
hid_hw_power(device->hid, PM_HINT_NORMAL);
hid_hw_close(device->hid);
} else {
- kfree(device);
+ roccat_free_device(device);
}
}
@@ -374,7 +383,7 @@ void roccat_disconnect(int minor)
hid_hw_close(device->hid);
wake_up_interruptible(&device->wait);
} else {
- kfree(device);
+ roccat_free_device(device);
}
}
EXPORT_SYMBOL_GPL(roccat_disconnect);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 061/935] HID: sensor: custom: Fix field sysfs group cleanup on failure
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 060/935] HID: roccat: free buffered reports when destroying device Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 062/935] HID: mcp2221: validate report size in mcp2221_raw_event() Greg Kroah-Hartman
` (879 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Srinivas Pandruvada,
Jiri Kosina
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <haoxiang_li2024@163.com>
commit 3789d0802ddb4b3be04062caf4bfadd23496e9a7 upstream.
hid_sensor_custom_add_attributes() creates one sysfs group for each
custom sensor field. If sysfs_create_group() fails after some groups
have already been created, the function returns the error without
removing the previously created groups.
Add a local unwind path to remove the groups that were already created.
With enable_sensor exposed only after the field attributes are ready,
this path can free sensor_inst->fields without leaving enable_sensor
able to access pointers into that array.
Fixes: 4a7de0519df5 ("HID: sensor: Custom and Generic sensor support")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-sensor-custom.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-sensor-custom.c
+++ b/drivers/hid/hid-sensor-custom.c
@@ -609,7 +609,7 @@ static int hid_sensor_custom_add_attribu
&sensor_inst->fields[i].
hid_custom_attribute_group);
if (ret)
- break;
+ goto err_remove_groups;
/* For power or report field store indexes */
if (sensor_inst->fields[i].attribute.attrib_id ==
@@ -621,6 +621,13 @@ static int hid_sensor_custom_add_attribu
}
return ret;
+
+err_remove_groups:
+ while (--i >= 0)
+ sysfs_remove_group(&sensor_inst->pdev->dev.kobj,
+ &sensor_inst->fields[i].hid_custom_attribute_group);
+ kfree(sensor_inst->fields);
+ return ret;
}
static void hid_sensor_custom_remove_attributes(struct hid_sensor_custom *
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 062/935] HID: mcp2221: validate report size in mcp2221_raw_event()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 061/935] HID: sensor: custom: Fix field sysfs group cleanup on failure Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 063/935] fs/ntfs3: validate dirty page table on log replay Greg Kroah-Hartman
` (878 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Jiri Kosina
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
commit 2c9a6998c19503626c57a2267bf279e204113079 upstream.
mcp2221_raw_event() never validates the size of incoming HID reports.
In the MCP2221_I2C_GET_DATA path it trusts the device-supplied data[3]
as the copy length without checking that 4 + data[3] bytes actually
exist in the received report. A malicious or misbehaving USB device can
send a short report with a large data[3], causing the memcpy to read
past the valid report data in the HID transfer buffer and leak
uninitialized kernel memory back to userspace through the I2C/SMBus
read path.
Add a minimum size check at entry and validate that the source range
fits within the received report before the copy.
Fixes: 67a95c21463d ("HID: mcp2221: add usb to i2c-smbus host bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-mcp2221.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/hid/hid-mcp2221.c
+++ b/drivers/hid/hid-mcp2221.c
@@ -739,6 +739,9 @@ static int mcp2221_raw_event(struct hid_
u8 *buf;
struct mcp2221 *mcp = hid_get_drvdata(hdev);
+ if (size < 4)
+ return 0;
+
switch (data[0]) {
case MCP2221_I2C_WR_DATA:
@@ -797,6 +800,10 @@ static int mcp2221_raw_event(struct hid_
mcp->status = -EINVAL;
break;
}
+ if (4 + data[3] > size) {
+ mcp->status = -EINVAL;
+ break;
+ }
buf = mcp->rxbuf;
memcpy(&buf[mcp->rxbuf_idx], &data[4], data[3]);
mcp->rxbuf_idx = mcp->rxbuf_idx + data[3];
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 063/935] fs/ntfs3: validate dirty page table on log replay
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 062/935] HID: mcp2221: validate report size in mcp2221_raw_event() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 064/935] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Greg Kroah-Hartman
` (877 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Konstantin Komarov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit 006cb7713dec10368e699abc4367e5faa334c9a5 upstream.
Each DIR_PAGE_ENTRY ends in a page_lcns[] array whose length is the on-disk
lcns_follow field. check_rstbl() validates the table bookkeeping but never
checks that this array fits in the entry, so a crafted lcns_follow lets the
v0->v1 conversion memmove and later replay passes run off the entry.
Add check_dp_table() to reject, right after check_rstbl(), any entry larger
than its size claims via struct_size() (the same expression used to allocate
these entries, so the check is overflow-safe by construction). All consumers
can then trust lcns_follow as the real capacity. This covers every
page_lcns[] access whose index is bounded by the entry itself (the
conversion memmove, the HotFix store via find_dp(), and the self-bounded
scan loops). Accesses whose index comes from the log record need a separate
bound and are handled in a follow-up patch.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -789,6 +789,20 @@ static bool check_rstbl(const struct RES
return true;
}
+static bool check_dp_table(const struct RESTART_TABLE *dptbl)
+{
+ u32 rsize = le16_to_cpu(dptbl->size);
+ struct DIR_PAGE_ENTRY *dp = NULL;
+
+ while ((dp = enum_rstbl((struct RESTART_TABLE *)dptbl, dp))) {
+ if (struct_size(dp, page_lcns, le32_to_cpu(dp->lcns_follow)) >
+ rsize)
+ return false;
+ }
+
+ return true;
+}
+
/*
* free_rsttbl_idx - Free a previously allocated index a Restart Table.
*/
@@ -4278,6 +4292,11 @@ check_dirty_page_table:
err = -EINVAL;
goto out;
}
+
+ if (!check_dp_table(rt)) {
+ err = -EINVAL;
+ goto out;
+ }
dptbl = kmemdup(rt, t32, GFP_NOFS);
if (!dptbl) {
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 064/935] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 063/935] fs/ntfs3: validate dirty page table on log replay Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 065/935] fs/ntfs3: bound page_lcns[] index by the log record Greg Kroah-Hartman
` (876 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Samuel Page, Konstantin Komarov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samuel Page <sam@bynar.io>
commit 35d1ea92c7d946e2ebdbe36cdb2c969c8704bebd upstream.
ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target
pages and then trusts decompress_lznt()'s return value:
unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,
frame_size);
if ((ssize_t)unc_size < 0) err = unc_size;
else if (!unc_size || unc_size > frame_size) err = -EINVAL;
decompress_lznt() stops as soon as the compressed stream is exhausted
(e.g. a zero chunk header) and returns the number of bytes it actually
wrote, which may be far less than frame_size. The bytes between unc_size
and frame_size are never written. The only memset() that follows zeroes
the region beyond i_valid; when the frame lies entirely within the file's
valid size that memset() does not run, so the gap retains whatever was in
the just-vmapped pages. All pages are then marked uptodate and returned
to userspace, disclosing uninitialized (recently-freed) kernel page
memory. A crafted compressed file whose stream decompresses to only a few
bytes leaks the remainder of every frame on a plain read(2), which is
enough to recover kernel pointers and defeat KASLR.
Zero the [unc_size, frame_size) tail immediately after a successful LZNT
decompress so the remainder reads back as zero.
Fixes: 4342306f0f0d ("fs/ntfs3: Add file operations and implementation")
Cc: stable@vger.kernel.org
Assisted-by: Bynario AI
Signed-off-by: Samuel Page <sam@bynar.io>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/frecord.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/fs/ntfs3/frecord.c
+++ b/fs/ntfs3/frecord.c
@@ -2668,6 +2668,15 @@ int ni_read_frame(struct ntfs_inode *ni,
err = unc_size;
else if (!unc_size || unc_size > frame_size)
err = -EINVAL;
+ else if (unc_size < frame_size) {
+ /*
+ * Partial decompress: zero the [unc_size, frame_size)
+ * tail. decompress_lznt() leaves it untouched, so
+ * without this the freshly vmapped pages would expose
+ * uninitialized kernel memory to userspace.
+ */
+ memset(frame_mem + unc_size, 0, frame_size - unc_size);
+ }
}
if (!err && valid_size < frame_vbo + frame_size) {
size_t ok = valid_size - frame_vbo;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 065/935] fs/ntfs3: bound page_lcns[] index by the log record
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 064/935] fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 066/935] eCryptfs: bound the packet-length peek to the user buffer Greg Kroah-Hartman
` (875 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Weiming Shi, Xiang Mei,
Konstantin Komarov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
commit 6f7b9dbdc1b7520206abce0049bdd143eb536e75 upstream.
The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i,
where i runs up to the log record's lcns_follow. That count is checked only
against the record's own length, not the target entry, so check_dp_table()
(which validates the entry's lcns_follow) does not cover it: the copy_lcns
entry may even be freshly allocated after that check, and find_dp() bounds j
but not i. A crafted record thus overflows page_lcns[] of an otherwise valid
entry.
Add dp_range_ok() and reject, before each loop, any record whose run does
not fit the entry. These are the only two page_lcns[] accesses indexed by
the record rather than the entry, so together with the entry validation
every access is now bounded.
Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal")
Cc: stable@vger.kernel.org
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
[almaz.alexandrovich@paragon-software.com: original patch contained changes to the problem already handled, applied partly]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ntfs3/fslog.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/fs/ntfs3/fslog.c
+++ b/fs/ntfs3/fslog.c
@@ -648,6 +648,14 @@ static inline void *enum_rstbl(struct RE
}
/*
+ * dp_range_ok - true if [j, j + count) fits in a page_lcns[cap] array.
+ */
+static inline bool dp_range_ok(size_t j, u32 count, u32 cap)
+{
+ return j < cap && count <= cap - j;
+}
+
+/*
* find_dp - Search for a @vcn in Dirty Page Table.
*/
static inline struct DIR_PAGE_ENTRY *find_dp(struct RESTART_TABLE *dptbl,
@@ -5061,6 +5069,13 @@ find_dirty_page:
/* Shorten length by any Lcns which were deleted. */
saved_len = dlen;
+ if (!dp_range_ok(le64_to_cpu(lrh->target_vcn) - le64_to_cpu(dp->vcn),
+ le16_to_cpu(lrh->lcns_follow),
+ le32_to_cpu(dp->lcns_follow))) {
+ err = -EINVAL;
+ goto out;
+ }
+
for (i = le16_to_cpu(lrh->lcns_follow); i; i--) {
size_t j;
u32 alen, voff;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 066/935] eCryptfs: bound the packet-length peek to the user buffer
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 065/935] fs/ntfs3: bound page_lcns[] index by the log record Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 067/935] ecryptfs: fix tag 11 packet exact-fit size check Greg Kroah-Hartman
` (874 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pengpeng Hou, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 95540462e630edbc8504e9537d16453d6942d143 upstream.
ecryptfs_miscdev_write() accepts the minimum one-byte packet-length
encoding, but always copies the maximum two-byte encoding from userspace
before parsing it. A six-byte message therefore reads one byte beyond the
submitted user buffer.
Zero-initialize the peek buffer and copy only the packet-length bytes
present. The existing exact packet-size check still rejects truncated
two-byte encodings after the parser determines their encoded length.
Fixes: 8bf2debd5f7b ("eCryptfs: introduce device handle for userspace daemon communications")
Cc: <stable@vger.kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/miscdev.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
@@ -357,7 +357,7 @@ ecryptfs_miscdev_write(struct file *file
u32 seq;
size_t packet_size, packet_size_length;
char *data;
- unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE];
+ unsigned char packet_size_peek[ECRYPTFS_MAX_PKT_LEN_SIZE] = { };
ssize_t rc;
if (count == 0) {
@@ -373,7 +373,8 @@ ecryptfs_miscdev_write(struct file *file
}
if (copy_from_user(packet_size_peek, &buf[PKT_LEN_OFFSET],
- sizeof(packet_size_peek))) {
+ min_t(size_t, count - PKT_LEN_OFFSET,
+ sizeof(packet_size_peek)))) {
printk(KERN_WARNING "%s: Error while inspecting packet size\n",
__func__);
return -EFAULT;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 067/935] ecryptfs: fix tag 11 packet exact-fit size check
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 066/935] eCryptfs: bound the packet-length peek to the user buffer Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 068/935] ecryptfs: hold msg ctx list lock when cleaning daemon queue Greg Kroah-Hartman
` (873 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 8b2ec0f56f55477f547d332526c9ae2a8fabc0a5 upstream.
parse_tag_11_packet() rejects a packet when the already-consumed tag and
length bytes plus the packet body exceed the caller supplied maximum
packet size. The check currently adds one extra byte, even though
*packet_size already includes the tag byte before the length is parsed.
Remove the extra byte so a tag 11 packet that exactly fits the available
buffer is accepted while oversized packets are still rejected.
Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/keystore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1576,7 +1576,7 @@ parse_tag_11_packet(unsigned char *data,
}
(*packet_size) += length_size;
(*tag_11_contents_size) = (body_size - 14);
- if (unlikely((*packet_size) + body_size + 1 > max_packet_size)) {
+ if (unlikely((*packet_size) + body_size > max_packet_size)) {
printk(KERN_ERR "Packet size exceeds max\n");
rc = -EINVAL;
goto out;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 068/935] ecryptfs: hold msg ctx list lock when cleaning daemon queue
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 067/935] ecryptfs: fix tag 11 packet exact-fit size check Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 069/935] ecryptfs: pass packet set buffer size to parser Greg Kroah-Hartman
` (872 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 779972513c2fa8c7938e54976f686091dafff22f upstream.
ecryptfs_exorcise_daemon() drops queued messages from a dying daemon
without holding ecryptfs_msg_ctx_lists_mux, but
ecryptfs_msg_ctx_alloc_to_free() requires that lock.
Take the list lock while moving the queued contexts back to the free
list to avoid racing with other global msg ctx list users.
Fixes: f66e883eb618 ("eCryptfs: integrate eCryptfs device handle into the module.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/messaging.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -165,6 +165,7 @@ int ecryptfs_exorcise_daemon(struct ecry
mutex_unlock(&daemon->mux);
goto out;
}
+ mutex_lock(&ecryptfs_msg_ctx_lists_mux);
list_for_each_entry_safe(msg_ctx, msg_ctx_tmp,
&daemon->msg_ctx_out_queue, daemon_out_list) {
list_del(&msg_ctx->daemon_out_list);
@@ -173,6 +174,7 @@ int ecryptfs_exorcise_daemon(struct ecry
"the out queue of a dying daemon\n", __func__);
ecryptfs_msg_ctx_alloc_to_free(msg_ctx);
}
+ mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
hlist_del(&daemon->euid_chain);
mutex_unlock(&daemon->mux);
kfree_sensitive(daemon);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 069/935] ecryptfs: pass packet set buffer size to parser
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 068/935] ecryptfs: hold msg ctx list lock when cleaning daemon queue Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 070/935] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Greg Kroah-Hartman
` (871 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 2602b79c5b3e2f6fce12e38a670f8e3fda4e46a2 upstream.
ecryptfs_parse_packet_set() receives a pointer into the file header, but
it calculates the remaining packet buffer size from PAGE_SIZE - 8. For
version 1 headers the packet set starts later in the header, so this can
overstate the available buffer.
Pass the actual packet set buffer length from the caller and calculate
per-packet limits from the remaining bytes in that buffer. Recompute the
remaining length after consuming a tag 3 packet before parsing the
following tag 11 packet.
Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/crypto.c | 2 +-
fs/ecryptfs/ecryptfs_kernel.h | 3 ++-
fs/ecryptfs/keystore.c | 23 ++++++++++++++++++++---
3 files changed, 23 insertions(+), 5 deletions(-)
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1306,7 +1306,7 @@ static int ecryptfs_read_headers_virt(ch
} else
set_default_header_data(crypt_stat);
rc = ecryptfs_parse_packet_set(crypt_stat, (page_virt + offset),
- ecryptfs_dentry);
+ PAGE_SIZE - offset, ecryptfs_dentry);
out:
return rc;
}
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -590,7 +590,8 @@ int ecryptfs_generate_key_packet_set(cha
size_t *len, size_t max);
int
ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
- unsigned char *src, struct dentry *ecryptfs_dentry);
+ unsigned char *src, size_t src_size,
+ struct dentry *ecryptfs_dentry);
int ecryptfs_truncate(struct dentry *dentry, loff_t new_length);
ssize_t
ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_inode,
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1743,6 +1743,7 @@ out:
* ecryptfs_parse_packet_set
* @crypt_stat: The cryptographic context
* @src: Virtual address of region of memory containing the packets
+ * @src_size: Size of the packet set buffer
* @ecryptfs_dentry: The eCryptfs dentry associated with the packet set
*
* Get crypt_stat to have the file's session key if the requisite key
@@ -1753,7 +1754,7 @@ out:
* conditions.
*/
int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat,
- unsigned char *src,
+ unsigned char *src, size_t src_size,
struct dentry *ecryptfs_dentry)
{
size_t i = 0;
@@ -1777,7 +1778,11 @@ int ecryptfs_parse_packet_set(struct ecr
* added the our &auth_tok_list */
next_packet_is_auth_tok_packet = 1;
while (next_packet_is_auth_tok_packet) {
- size_t max_packet_size = ((PAGE_SIZE - 8) - i);
+ size_t max_packet_size;
+
+ if (i >= src_size)
+ break;
+ max_packet_size = src_size - i;
switch (src[i]) {
case ECRYPTFS_TAG_3_PACKET_TYPE:
@@ -1792,12 +1797,16 @@ int ecryptfs_parse_packet_set(struct ecr
goto out_wipe_list;
}
i += packet_size;
+ if (i > src_size) {
+ rc = -EIO;
+ goto out_wipe_list;
+ }
rc = parse_tag_11_packet((unsigned char *)&src[i],
sig_tmp_space,
ECRYPTFS_SIG_SIZE,
&tag_11_contents_size,
&tag_11_packet_size,
- max_packet_size);
+ src_size - i);
if (rc) {
ecryptfs_printk(KERN_ERR, "No valid "
"(ecryptfs-specific) literal "
@@ -1809,6 +1818,10 @@ int ecryptfs_parse_packet_set(struct ecr
goto out_wipe_list;
}
i += tag_11_packet_size;
+ if (i > src_size) {
+ rc = -EIO;
+ goto out_wipe_list;
+ }
if (ECRYPTFS_SIG_SIZE != tag_11_contents_size) {
ecryptfs_printk(KERN_ERR, "Expected "
"signature of size [%d]; "
@@ -1836,6 +1849,10 @@ int ecryptfs_parse_packet_set(struct ecr
goto out_wipe_list;
}
i += packet_size;
+ if (i > src_size) {
+ rc = -EIO;
+ goto out_wipe_list;
+ }
crypt_stat->flags |= ECRYPTFS_ENCRYPTED;
break;
case ECRYPTFS_TAG_11_PACKET_TYPE:
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 070/935] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 069/935] ecryptfs: pass packet set buffer size to parser Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 071/935] ecryptfs: reject too-small tag 70 packets Greg Kroah-Hartman
` (870 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, HanQuan, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: HanQuan <eilaimemedsnaimel@gmail.com>
commit 5babe9c177c364521e3e682b949c5a8c47f4a441 upstream.
parse_tag_3_packet() set encrypted_key_size from the Tag 3 packet body
without bounding it against ECRYPTFS_MAX_KEY_BYTES (64). When
encrypted_key_size > 64, decrypt_passphrase_encrypted_session_key()
sets decrypted_key_size = encrypted_key_size and performs two
out-of-bounds writes:
1. crypto_skcipher_decrypt() writes encrypted_key_size bytes into
decrypted_key[64] via scatterlist, overflowing into the parent
ecryptfs_auth_tok struct.
2. memcpy(crypt_stat->key, decrypted_key, decrypted_key_size) writes
into crypt_stat->key[64], corrupting root_iv, keysig_list, and
mutexes in ecryptfs_crypt_stat.
Only AES-192 (cipher code 0x08) enables this because it sets
crypt_stat->key_size = 24 independently of encrypted_key_size,
allowing crypto_skcipher_setkey() to succeed while encrypted_key_size
exceeds ECRYPTFS_MAX_KEY_BYTES.
The PKI decryption path (parse_tag_65_packet) already validates
decrypted_key_size <= ECRYPTFS_MAX_KEY_BYTES; the passphrase path
omits this check.
Bound encrypted_key_size against ECRYPTFS_MAX_KEY_BYTES (64) rather
than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES (512). The 64-byte limit also
protects the 512-byte encrypted_key[] buffer, so the former 512-byte
check is removed as redundant.
Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
Cc: <stable@vger.kernel.org>
Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
[tyhicks: Adjust the code comment to refer to macros representing the
buffer sizes rather than mentioning the buffer size values since they
may change in the future]
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/keystore.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1424,10 +1424,20 @@ parse_tag_3_packet(struct ecryptfs_crypt
}
(*new_auth_tok)->session_key.encrypted_key_size =
(body_size - (ECRYPTFS_SALT_SIZE + 5));
+ /*
+ * Although encrypted_key_size is copied into the
+ * encrypted_key[ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES] buffer here,
+ * it later bounds operations on a smaller buffer:
+ * decrypt_passphrase_encrypted_session_key() sets decrypted_key_size =
+ * encrypted_key_size and decrypts into
+ * decrypted_key[ECRYPTFS_MAX_KEY_BYTES], then memcpy's into
+ * crypt_stat->key[ECRYPTFS_MAX_KEY_BYTES]. Limit to
+ * ECRYPTFS_MAX_KEY_BYTES to protect those smaller buffers.
+ */
if ((*new_auth_tok)->session_key.encrypted_key_size
- > ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES) {
+ > ECRYPTFS_MAX_KEY_BYTES) {
printk(KERN_WARNING "Tag 3 packet contains key larger "
- "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES\n");
+ "than ECRYPTFS_MAX_KEY_BYTES\n");
rc = -EINVAL;
goto out_free;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 071/935] ecryptfs: reject too-small tag 70 packets
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 070/935] ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 072/935] ecryptfs: release message context on send failure Greg Kroah-Hartman
` (869 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit e97bbe1b2bd82ec2ae37ad2e4965b4d3e78bbf7f upstream.
ecryptfs_parse_tag_70_packet() subtracts fixed metadata fields from the
parsed packet body size to derive the encrypted filename size. A
malformed packet with a body smaller than those fixed fields can underflow
that size calculation.
Reject tag 70 packets before the subtraction unless the body contains the
signature, cipher code, and at least one byte of encrypted filename data.
Fixes: 9c79f34f7ee7 ("eCryptfs: Filename Encryption: Tag 70 packets")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/keystore.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -937,6 +937,12 @@ ecryptfs_parse_tag_70_packet(char **file
"rc = [%d]\n", __func__, rc);
goto out;
}
+ if (s->parsed_tag_70_packet_size < (ECRYPTFS_SIG_SIZE + 2)) {
+ ecryptfs_printk(KERN_WARNING, "Invalid packet size [%zd]\n",
+ s->parsed_tag_70_packet_size);
+ rc = -EINVAL;
+ goto out;
+ }
s->block_aligned_filename_size = (s->parsed_tag_70_packet_size
- ECRYPTFS_SIG_SIZE - 1);
if ((1 + s->packet_size_len + s->parsed_tag_70_packet_size)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 072/935] ecryptfs: release message context on send failure
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 071/935] ecryptfs: reject too-small tag 70 packets Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 073/935] ecryptfs: show filename encryption options Greg Kroah-Hartman
` (868 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 219644a3ad5518217b2d62cad6d2c36a2308c949 upstream.
ecryptfs_send_message_locked() moves a message context from the free
list to the allocated list before sending the request to the userspace
daemon.
If ecryptfs_send_miscdev() fails, the context is left on the
allocated list and cannot be reused. Move it back to the free list on
failure and clear the caller's pointer.
Fixes: f66e883eb618 ("eCryptfs: integrate eCryptfs device handle into the module.")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/messaging.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/fs/ecryptfs/messaging.c
+++ b/fs/ecryptfs/messaging.c
@@ -285,9 +285,16 @@ ecryptfs_send_message_locked(char *data,
mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
rc = ecryptfs_send_miscdev(data, data_len, *msg_ctx, msg_type, 0,
daemon);
- if (rc)
+ if (rc) {
printk(KERN_ERR "%s: Error attempting to send message to "
"userspace daemon; rc = [%d]\n", __func__, rc);
+ mutex_lock(&ecryptfs_msg_ctx_lists_mux);
+ mutex_lock(&(*msg_ctx)->mux);
+ ecryptfs_msg_ctx_alloc_to_free(*msg_ctx);
+ mutex_unlock(&(*msg_ctx)->mux);
+ mutex_unlock(&ecryptfs_msg_ctx_lists_mux);
+ *msg_ctx = NULL;
+ }
out:
return rc;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 073/935] ecryptfs: show filename encryption options
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 072/935] ecryptfs: release message context on send failure Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 074/935] fat: restore original value when fat_ent_write failed Greg Kroah-Hartman
` (867 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yichong Chen, Tyler Hicks
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yichong Chen <chenyichong@uniontech.com>
commit 496ec2d0852a02d2e631771b5c439130b9c7dce7 upstream.
ecryptfs_show_options() prints most user-visible mount options but
omits the filename encryption cipher and key size.
Print ecryptfs_fn_cipher and ecryptfs_fn_key_bytes when filename
encryption is enabled so that the displayed mount options reflect the
active filename encryption settings.
Fixes: 87c94c4df014 ("eCryptfs: Filename Encryption: mount option")
Cc: <stable@vger.kernel.org>
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Signed-off-by: Tyler Hicks <code@tyhicks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/super.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -153,6 +153,13 @@ static int ecryptfs_show_options(struct
if (mount_crypt_stat->global_default_cipher_key_size)
seq_printf(m, ",ecryptfs_key_bytes=%zd",
mount_crypt_stat->global_default_cipher_key_size);
+ if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
+ seq_printf(m, ",ecryptfs_fn_cipher=%s",
+ mount_crypt_stat->global_default_fn_cipher_name);
+ if (mount_crypt_stat->global_default_fn_cipher_key_bytes)
+ seq_printf(m, ",ecryptfs_fn_key_bytes=%zd",
+ mount_crypt_stat->global_default_fn_cipher_key_bytes);
+ }
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)
seq_printf(m, ",ecryptfs_passthrough");
if (mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 074/935] fat: restore original value when fat_ent_write failed
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 073/935] ecryptfs: show filename encryption options Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 075/935] fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Greg Kroah-Hartman
` (866 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yemu Lu, Ren Wei, Yuan Tan, Yifan Wu,
Juefei Pu, Xin Liu, OGAWA Hirofumi, Christian Brauner,
Andrew Morton
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yemu Lu <prcups@krgm.moe>
commit 64d9183203eebe33de6188b70a8c1e91f52885db upstream.
fat_ent_write() may have committed the new link to the primary FAT but
then failed on the mirror copy, leaving the chain pointing to new_dclus
even though the caller will free it. Restore the original value to keep
the chain consistent.
Link: https://lore.kernel.org/20260525085649.781643-1-n05ec@lzu.edu.cn
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Yemu Lu <prcups@krgm.moe>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Cc: Christian Brauner <brauner@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fat/misc.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -127,7 +127,11 @@ int fat_chain_add(struct inode *inode, i
ret = fat_ent_read(inode, &fatent, last);
if (ret >= 0) {
int wait = inode_needs_sync(inode);
+ int old = ret;
+
ret = fat_ent_write(inode, &fatent, new_dclus, wait);
+ if (ret < 0)
+ fat_ent_write(inode, &fatent, old, wait);
fatent_brelse(&fatent);
}
if (ret < 0)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 075/935] fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 074/935] fat: restore original value when fat_ent_write failed Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 076/935] fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Greg Kroah-Hartman
` (865 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Runyu Xiao, Helge Deller
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Runyu Xiao <runyu.xiao@seu.edu.cn>
commit f8e43fe0f22b7137ce456e6fe3581d3098174f74 upstream.
dsicm_probe() registers the display before initializing ddata->lock.
Once omapdss_register_display() publishes the display, another consumer
can reach a dsicm callback that takes this mutex while it is still
uninitialized.
Initialize the mutex before registering the display so the published
callbacks always see a valid lock.
Fixes: f76ee892a99e ("omapfb: copy omapdss & displays for omapfb")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
+++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c
@@ -1190,14 +1190,14 @@ static int dsicm_probe(struct platform_d
dssdev->caps = OMAP_DSS_DISPLAY_CAP_MANUAL_UPDATE |
OMAP_DSS_DISPLAY_CAP_TEAR_ELIM;
+ mutex_init(&ddata->lock);
+
r = omapdss_register_display(dssdev);
if (r) {
dev_err(dev, "Failed to register panel\n");
goto err_reg;
}
- mutex_init(&ddata->lock);
-
atomic_set(&ddata->do_update, 0);
if (gpio_is_valid(ddata->reset_gpio)) {
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 076/935] fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 075/935] fbdev: omapfb: panel-dsi-cm: initialize lock before registering display Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 077/935] fbdev: uvesafb: unregister connector callback on init failure Greg Kroah-Hartman
` (864 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Florian Fuchs,
Helge Deller
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <fuchsfl@gmail.com>
commit 5dc2e70dd74b1f03e2e13bfb6922111d9e0adf90 upstream.
Add __user annotation to buf, as it is passed as a user pointer in
pin_user_pages_fast(). Use an empty initializer for the sentinel
board-table entry to avoid initializing a function pointer with an
integer literal.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607131247.fpQ6eTc7-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/pvr2fb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -638,7 +638,7 @@ static irqreturn_t __maybe_unused pvr2fb
}
#ifdef CONFIG_PVR2_DMA
-static ssize_t pvr2fb_write(struct fb_info *info, const char *buf,
+static ssize_t pvr2fb_write(struct fb_info *info, const char __user *buf,
size_t count, loff_t *ppos)
{
unsigned long dst, start, end, len;
@@ -1068,7 +1068,7 @@ static struct pvr2_board {
#ifdef CONFIG_PCI
{ pvr2fb_pci_init, pvr2fb_pci_exit, "PCI PVR2" },
#endif
- { 0, },
+ { },
};
static int __init pvr2fb_init(void)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 077/935] fbdev: uvesafb: unregister connector callback on init failure
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 076/935] fbdev: pvr2fb: correct user pointer annotation and sentinel initializer Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 078/935] forcedeth: fix off-by-one when saving/restoring non-PCI config space Greg Kroah-Hartman
` (863 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ijae Kim, Myeonghun Pak,
Helge Deller
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myeonghun Pak <mhun512@gmail.com>
commit de8db23aa7c337e606fca9faf48b3ba72968597a upstream.
uvesafb_init() registers the v86d connector callback before registering
the platform driver. If platform_driver_register() fails, the function
returns the error directly and leaves the connector callback registered.
The later platform-device failure path already unregisters the callback.
Add the same cleanup before the final return when platform-driver
registration fails.
This issue was identified during our ongoing static-analysis research while
reviewing kernel code.
Fixes: 8bdb3a2d7df4 ("uvesafb: the driver core")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/uvesafb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/video/fbdev/uvesafb.c
+++ b/drivers/video/fbdev/uvesafb.c
@@ -1917,6 +1917,8 @@ static int uvesafb_init(void)
err = 0;
}
}
+ if (err)
+ cn_del_callback(&uvesafb_cn_id);
return err;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 078/935] forcedeth: fix off-by-one when saving/restoring non-PCI config space
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 077/935] fbdev: uvesafb: unregister connector callback on init failure Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 079/935] fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Greg Kroah-Hartman
` (862 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Czernohous, Simon Horman,
Zhu Yanjun, Jakub Kicinski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Czernohous <marek@czernohous.de>
commit 9393f1d656a79693e0c123ff7bc7c5c0f708046d upstream.
nv_suspend() and nv_resume() walk the non-PCI configuration space with
for (i = 0; i <= np->register_size/sizeof(u32); i++)
which runs one iteration too many. saved_config_space is declared as
u32 saved_config_space[NV_PCI_REGSZ_MAX/4];
and NV_PCI_REGSZ_VER3 is equal to NV_PCI_REGSZ_MAX (0x604), so on a VER3
device register_size/sizeof(u32) is exactly the array length and the last
iteration addresses one element past the end.
The element it lands on is np->name_rx[0..3]: saved_config_space[] is
followed immediately by char name_rx[IFNAMSIZ + 3], and char needs no
padding. Nothing observable is corrupted by that, because nv_request_irq()
rewrites name_rx with sprintf() before it is ever passed to request_irq().
The bug is the out-of-bounds access itself, which UBSAN reports and which
CONFIG_UBSAN_TRAP=y turns into a trap that aborts the running kernel code,
plus an MMIO read and, on resume, an MMIO writel() to base + 0x604, one
dword past the range the driver mapped:
np->base = ioremap(addr, np->register_size);
VER1 and VER2 devices stay inside the array, but they too get the stray
read and the stray write one dword past their own window.
Caught by UBSAN on an Apple Macmini3,1 (MCP79) during a deep S3 cycle.
The splat below is trimmed: the build path in the file name, the CPU
and taint lines, the Workqueue line, the "?" hint frames, and the
frames below device_suspend are all cut. The kernel was tainted, with
an out-of-tree nouveau and CPU_OUT_OF_SPEC; forcedeth itself was the
stock module.
UBSAN: array-index-out-of-bounds in drivers/net/ethernet/nvidia/forcedeth.c:6225:25
index 385 is out of range for type 'u32 [385]'
Call Trace:
dump_stack_lvl+0x5d/0x80
ubsan_epilogue+0x5/0x2b
__ubsan_handle_out_of_bounds.cold+0x54/0x59
__this_module+0xe398c/0xe9010 [forcedeth]
pci_pm_suspend+0x80/0x170
dpm_run_callback+0x51/0x160
device_suspend+0x1a2/0x4a0
...
Both loops are hit. UBSAN reports each source location only once per module
load (__ubsan_handle_out_of_bounds() calls suppress_report(), which does
test_and_set_bit(REPORTED_BIT, ...) on the struct source_location), so the
two splats land in the first S3 cycle after the module is loaded and later
cycles are silent even though the access still runs off the end every time.
In that first cycle line 6225 is reported from pci_pm_suspend and line 6240
from pci_pm_resume.
The same off-by-one was fixed in nv_get_regs() by commit ba9aa134287f
("forcedeth: fix buffer overflow") in 2012; these two loops were missed.
The suspend and resume side was reported on LKML in September 2013 by Marc
Weber, with the same analysis and the same one-character fix, but the patch
was attached rather than sent inline and the thread ended there.
Use < instead of <=, which saves and restores exactly register_size bytes.
Fixes: 1a1ca86158ee ("[netdrvr] forcedeth: save/restore device configuration space")
Cc: stable@vger.kernel.org
Signed-off-by: Marek Czernohous <marek@czernohous.de>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Link: https://patch.msgid.link/178682367885.3748309.10595890901761762683@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/nvidia/forcedeth.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -6224,7 +6224,7 @@ static int nv_suspend(struct device *dev
netif_device_detach(dev);
/* save non-pci configuration space */
- for (i = 0; i <= np->register_size/sizeof(u32); i++)
+ for (i = 0; i < np->register_size/sizeof(u32); i++)
np->saved_config_space[i] = readl(base + i*sizeof(u32));
return 0;
@@ -6239,7 +6239,7 @@ static int nv_resume(struct device *devi
int i, rc = 0;
/* restore non-pci configuration space */
- for (i = 0; i <= np->register_size/sizeof(u32); i++)
+ for (i = 0; i < np->register_size/sizeof(u32); i++)
writel(np->saved_config_space[i], base+i*sizeof(u32));
if (np->driver_data & DEV_NEED_MSI_FIX)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 079/935] fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 078/935] forcedeth: fix off-by-one when saving/restoring non-PCI config space Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 080/935] hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Greg Kroah-Hartman
` (861 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tien Sung Ang, Tze Yee Ng, Xu Yilun,
Xu Yilun
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tien Sung Ang <tien.sung.ang@altera.com>
commit c14a8b15c87b49efc3ef898cec8ac7c30336a080 upstream.
Fix incorrect stratix10_svc_done() usage during FPGA reconfiguration.
Do not call stratix10_svc_done() at the end of write_init() on success, so
the SVC session remains active through write() and write_complete(). Call
stratix10_svc_done() on failure in write_init() and write() so the shared
SVC mailbox is released when reconfiguration aborts, allowing coexistence
with other SVC clients such as soc64-hwmon.
Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
Cc: stable@vger.kernel.org # 5.1+
Signed-off-by: Tien Sung Ang <tien.sung.ang@altera.com>
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/8768ce3260489c9febdfce08e27d03f5f5ed9c33.1782801986.git.tze.yee.ng@altera.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/fpga/stratix10-soc.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/drivers/fpga/stratix10-soc.c
+++ b/drivers/fpga/stratix10-soc.c
@@ -194,20 +194,18 @@ static int s10_ops_write_init(struct fpg
ret = s10_svc_send_msg(priv, COMMAND_RECONFIG,
&ctype, sizeof(ctype));
if (ret < 0)
- goto init_done;
+ goto init_error;
- ret = wait_for_completion_timeout(
- &priv->status_return_completion, S10_RECONFIG_TIMEOUT);
- if (!ret) {
+ if (!wait_for_completion_timeout(&priv->status_return_completion,
+ S10_RECONFIG_TIMEOUT)) {
dev_err(dev, "timeout waiting for RECONFIG_REQUEST\n");
ret = -ETIMEDOUT;
- goto init_done;
+ goto init_error;
}
- ret = 0;
if (!test_and_clear_bit(SVC_STATUS_OK, &priv->status)) {
ret = -ETIMEDOUT;
- goto init_done;
+ goto init_error;
}
/* Allocate buffers from the service layer's pool. */
@@ -216,14 +214,16 @@ static int s10_ops_write_init(struct fpg
if (IS_ERR(kbuf)) {
s10_free_buffers(mgr);
ret = PTR_ERR(kbuf);
- goto init_done;
+ goto init_error;
}
priv->svc_bufs[i].buf = kbuf;
priv->svc_bufs[i].lock = 0;
}
-init_done:
+ return 0;
+
+init_error:
stratix10_svc_done(priv->chan);
return ret;
}
@@ -341,6 +341,9 @@ static int s10_ops_write(struct fpga_man
if (!s10_free_buffers(mgr))
dev_err(dev, "%s not all buffers were freed\n", __func__);
+ if (ret < 0)
+ stratix10_svc_done(priv->chan);
+
return ret;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 080/935] hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 079/935] fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 081/935] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Greg Kroah-Hartman
` (860 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Merlijn Wajer, Ivaylo Dimitrov,
Sebastian Reichel
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
commit e81250ec6b69248b00d38c523dc6a13efaf38aab upstream.
The OMAP SSI driver uses a synthetic HSI controller device allocated via
hsi_alloc_controller(), which does not go through the normal OF/platform
device initialization path.
As a result, the embedded struct device does not have a DMA mask
initialized by default.
After recent DMA API hardening changes, dma_map_sg() and related helpers
now require a valid dma_mask to be present, otherwise the driver may
crash or trigger warnings when attempting DMA mapping operations.
Fix this by explicitly initializing the DMA mask for the SSI controller
device and setting a 32-bit DMA mask, which matches the hardware
capabilities.
Cc: stable@vger.kernel.org
Fixes: f959dcd6ddfd ("dma-direct: Fix potential NULL pointer dereference")
Reported-by: Merlijn Wajer <merlijn@wizzup.org>
Closes: https://lore.kernel.org/linux-omap/4ed95c71-2066-6b4c-ad1b-53ef02d79d53@wizzup.org/
Signed-off-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Link: https://patch.msgid.link/20260724130522.706480-1-ivo.g.dimitrov.75@gmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hsi/controllers/omap_ssi_core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/hsi/controllers/omap_ssi_core.c
+++ b/drivers/hsi/controllers/omap_ssi_core.c
@@ -509,6 +509,12 @@ static int ssi_probe(struct platform_dev
pm_runtime_enable(&pd->dev);
+ ssi->device.dma_mask = &ssi->device.coherent_dma_mask;
+
+ err = dma_set_mask_and_coherent(&ssi->device, DMA_BIT_MASK(32));
+ if (err)
+ goto out2;
+
err = ssi_hw_init(ssi);
if (err < 0)
goto out2;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 081/935] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 080/935] hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 082/935] alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Greg Kroah-Hartman
` (859 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Wilczyński,
Bjorn Helgaas, Magnus Lindholm
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Wilczyński <kwilczynski@kernel.org>
commit 651fb94aaf245430590216d497fb8b02dd73d5f9 upstream.
pci_legacy_write() in arch/alpha/kernel/pci-sysfs.c passes its arguments to
outb(), outw() and outl() in the wrong order:
outb(port, val);
The Alpha I/O accessors in arch/alpha/include/asm/io.h take the value first
and the port second:
extern void outb(u8 b, unsigned long port);
So the port number is written as data to the I/O address taken from the
user-supplied value, and the intended write to the requested port never
happens.
The arguments have been reversed since the file was added, and the function
returns the access size regardless, so the caller sees success while the
requested port is left untouched.
Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260706175423.98305-1-kwilczynski@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/pci-sysfs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -364,17 +364,17 @@ int pci_legacy_write(struct pci_bus *bus
switch(size) {
case 1:
- outb(port, val);
+ outb(val, port);
return 1;
case 2:
if (port & 1)
return -EINVAL;
- outw(port, val);
+ outw(val, port);
return 2;
case 4:
if (port & 3)
return -EINVAL;
- outl(port, val);
+ outl(val, port);
return 4;
}
return -EINVAL;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 082/935] alpha: marvel: Fix irq_set_status_flags to use correct IRQ number
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 081/935] alpha/PCI: Fix I/O port accessor argument order in pci_legacy_write() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 083/935] alpha: marvel: Fix lock ordering in init_io7_irqs() Greg Kroah-Hartman
` (858 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit 3a3ac1f6c6a67b3803f2643584310f78301e58a8 upstream.
Pass base + i to irq_set_status_flags() to match the IRQ number
used in irq_set_chip_and_handler(). Previously, IRQ_LEVEL was set
on the wrong (low-numbered) IRQ descriptors rather than the IO7
IRQs at base + i.
Cc: stable@vger.kernel.org
Fixes: 08876fe8519c ("alpha: marvel: Convert irq_chip functions")
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260528230516.1839694-1-mattst88@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/sys_marvel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -275,7 +275,7 @@ init_io7_irqs(struct io7 *io7,
/* Set up the lsi irqs. */
for (i = 0; i < 128; ++i) {
irq_set_chip_and_handler(base + i, lsi_ops, handle_level_irq);
- irq_set_status_flags(i, IRQ_LEVEL);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
}
/* Disable the implemented irqs in hardware. */
@@ -289,7 +289,7 @@ init_io7_irqs(struct io7 *io7,
/* Set up the msi irqs. */
for (i = 128; i < (128 + 512); ++i) {
irq_set_chip_and_handler(base + i, msi_ops, handle_level_irq);
- irq_set_status_flags(i, IRQ_LEVEL);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
}
for (i = 0; i < 16; ++i)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 083/935] alpha: marvel: Fix lock ordering in init_io7_irqs()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 082/935] alpha: marvel: Fix irq_set_status_flags to use correct IRQ number Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 084/935] ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Greg Kroah-Hartman
` (857 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matt Turner, Magnus Lindholm
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Turner <mattst88@gmail.com>
commit 24d68db713d63dfe3660c56b50e887784844baea upstream.
Move irq_set_chip_and_handler() and irq_set_status_flags() calls
outside the io7->irq_lock raw spinlock. These functions take
sparse_irq_lock, which is a mutex, and taking a sleeping lock while
holding a raw spinlock is invalid. The raw spinlock only needs to
protect the hardware CSR accesses.
This fixes the following lockdep splat during boot:
[ BUG: Invalid wait context ]
swapper/0/0 is trying to lock:
sparse_irq_lock{....}-{4:4}, at: irq_mark_irq
other info that might help us debug this:
context-{5:5}
1 lock held by swapper/0/0:
#0: &io7->irq_lock{....}-{2:2}, at: init_io7_irqs.constprop.0
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Matt Turner <mattst88@gmail.com>
Reviewed-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20260528230516.1839694-2-mattst88@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/alpha/kernel/sys_marvel.c | 25 ++++++++++++-------------
1 file changed, 12 insertions(+), 13 deletions(-)
--- a/arch/alpha/kernel/sys_marvel.c
+++ b/arch/alpha/kernel/sys_marvel.c
@@ -263,6 +263,18 @@ init_io7_irqs(struct io7 *io7,
*/
printk(" Interrupts reported to CPU at PE %u\n", boot_cpuid);
+ /* Set up the lsi irqs. */
+ for (i = 0; i < 128; ++i) {
+ irq_set_chip_and_handler(base + i, lsi_ops, handle_level_irq);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
+ }
+
+ /* Set up the msi irqs. */
+ for (i = 128; i < (128 + 512); ++i) {
+ irq_set_chip_and_handler(base + i, msi_ops, handle_level_irq);
+ irq_set_status_flags(base + i, IRQ_LEVEL);
+ }
+
raw_spin_lock(&io7->irq_lock);
/* set up the error irqs */
@@ -272,12 +284,6 @@ init_io7_irqs(struct io7 *io7,
io7_redirect_irq(io7, &io7->csrs->STV_CTL.csr, boot_cpuid);
io7_redirect_irq(io7, &io7->csrs->HEI_CTL.csr, boot_cpuid);
- /* Set up the lsi irqs. */
- for (i = 0; i < 128; ++i) {
- irq_set_chip_and_handler(base + i, lsi_ops, handle_level_irq);
- irq_set_status_flags(base + i, IRQ_LEVEL);
- }
-
/* Disable the implemented irqs in hardware. */
for (i = 0; i < 0x60; ++i)
init_one_io7_lsi(io7, i, boot_cpuid);
@@ -285,13 +291,6 @@ init_io7_irqs(struct io7 *io7,
init_one_io7_lsi(io7, 0x74, boot_cpuid);
init_one_io7_lsi(io7, 0x75, boot_cpuid);
-
- /* Set up the msi irqs. */
- for (i = 128; i < (128 + 512); ++i) {
- irq_set_chip_and_handler(base + i, msi_ops, handle_level_irq);
- irq_set_status_flags(base + i, IRQ_LEVEL);
- }
-
for (i = 0; i < 16; ++i)
init_one_io7_msi(io7, i, boot_cpuid);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 084/935] ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 083/935] alpha: marvel: Fix lock ordering in init_io7_irqs() Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 085/935] auxdisplay: charlcd: cancel backlight work on registration failure Greg Kroah-Hartman
` (856 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Niklas Cassel,
Damien Le Moal
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 79cce911e623c0baa0fde307ce3a434e084b881a upstream.
ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the
UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM
descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte
ata_scsi_rbuf staging buffer, and the number of bytes copied is compared
against the logical sector size by the caller:
size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);
if (size != len) /* len == sdp->sector_size */
goto invalid_param_len;
ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE
(2048). On a device whose logical sector size exceeds that (e.g. a 4Kn
device, where sector_size == 4096) the function can never return more than
2048, while the caller expects it to return sector_size. The comparison
therefore always fails, so every TRIM is rejected with "Parameter list
length error" and WARN_ON() splats on each attempt. TRIM / discard is
thus completely broken on such devices.
The descriptor was incorrectly sized from the logical sector size. A DSM
TRIM payload is a list of 512-byte pages, each holding up to
ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical
sector size. The Block Limits VPD page already advertises a single such
page as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical
blocks), so the block layer never sends a request that needs more than one
page.
Emit exactly one 512-byte page, independent of the logical sector size,
and transfer only that page (COUNT == 1). For a 512-byte-sector device
this is unchanged; devices with larger logical sectors now work instead of
failing every TRIM.
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Fixes: ef2d7392c4ec ("libata: SCT Write Same / DSM Trim")
Cc: stable@vger.kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-scsi.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3103,17 +3103,13 @@ static unsigned int ata_scsi_pass_thru(s
static size_t ata_format_dsm_trim_descr(struct scsi_cmnd *cmd, u32 trmax,
u64 sector, u32 count)
{
- struct scsi_device *sdp = cmd->device;
- size_t len = sdp->sector_size;
+ size_t len = ATA_SECT_SIZE;
size_t r;
__le64 *buf;
u32 i = 0;
unsigned long flags;
- WARN_ON(len > ATA_SCSI_RBUF_SIZE);
-
- if (len > ATA_SCSI_RBUF_SIZE)
- len = ATA_SCSI_RBUF_SIZE;
+ BUILD_BUG_ON(ATA_SECT_SIZE > ATA_SCSI_RBUF_SIZE);
spin_lock_irqsave(&ata_scsi_rbuf_lock, flags);
buf = ((void *)ata_scsi_rbuf);
@@ -3148,13 +3144,11 @@ static unsigned int ata_scsi_write_same_
{
struct ata_taskfile *tf = &qc->tf;
struct scsi_cmnd *scmd = qc->scsicmd;
- struct scsi_device *sdp = scmd->device;
- size_t len = sdp->sector_size;
struct ata_device *dev = qc->dev;
const u8 *cdb = scmd->cmnd;
u64 block;
u32 n_block;
- const u32 trmax = len >> 3;
+ const u32 trmax = ATA_MAX_TRIM_RNUM;
u32 size;
u16 fp;
u8 bp = 0xff;
@@ -3199,13 +3193,13 @@ static unsigned int ata_scsi_write_same_
goto invalid_param_len;
/*
- * size must match sector size in bytes
- * For DATA SET MANAGEMENT TRIM in ACS-2 nsect (aka count)
- * is defined as number of 512 byte blocks to be transferred.
+ * The TRIM descriptor is a single 512-byte page, which is the maximum
+ * WRITE SAME length advertised in the Block Limits VPD page. For DATA
+ * SET MANAGEMENT TRIM the COUNT field (aka nsect) is the number of
+ * 512-byte blocks to be transferred.
*/
-
size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);
- if (size != len)
+ if (size != ATA_SECT_SIZE)
goto invalid_param_len;
if (ata_ncq_enabled(dev) && ata_fpdma_dsm_supported(dev)) {
@@ -3231,6 +3225,12 @@ static unsigned int ata_scsi_write_same_
ATA_TFLAG_WRITE;
ata_qc_set_pc_nbytes(qc);
+ /*
+ * The DSM TRIM payload is a single 512-byte page, which may be smaller
+ * than the WRITE SAME data-out buffer (one logical block); only
+ * transfer that page so the length matches the COUNT field.
+ */
+ qc->nbytes = size;
return 0;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 085/935] auxdisplay: charlcd: cancel backlight work on registration failure
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 084/935] ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 086/935] Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Greg Kroah-Hartman
` (855 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Hongyan Xu,
Andy Shevchenko
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongyan Xu <getshell@seu.edu.cn>
commit e3e3bf40916c1e810df03958cfa7ba6883cdce79 upstream.
With CONFIG_CHARLCD_BL_FLASH, charlcd_init() schedules bl_work before
charlcd_register() calls misc_register(). If registration fails, the
caller frees the charlcd object while delayed work still contains its
address.
Add charlcd_deinit() to cancel the delayed work and turn the backlight
off. Use it for both registration rollback and normal unregistration.
Fixes: 39f8ea46724e ("auxdisplay: charlcd: Extract character LCD core from misc/panel")
Cc: stable@vger.kernel.org
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/auxdisplay/charlcd.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
--- a/drivers/auxdisplay/charlcd.c
+++ b/drivers/auxdisplay/charlcd.c
@@ -594,6 +594,16 @@ static int charlcd_init(struct charlcd *
return 0;
}
+static void charlcd_deinit(struct charlcd *lcd)
+{
+ struct charlcd_priv *priv = charlcd_to_priv(lcd);
+
+ if (lcd->ops->backlight) {
+ cancel_delayed_work_sync(&priv->bl_work);
+ lcd->ops->backlight(lcd, CHARLCD_OFF);
+ }
+}
+
struct charlcd *charlcd_alloc(unsigned int drvdata_size)
{
struct charlcd_priv *priv;
@@ -653,8 +663,10 @@ int charlcd_register(struct charlcd *lcd
return ret;
ret = misc_register(&charlcd_dev);
- if (ret)
+ if (ret) {
+ charlcd_deinit(lcd);
return ret;
+ }
the_charlcd = lcd;
register_reboot_notifier(&panel_notifier);
@@ -664,16 +676,11 @@ EXPORT_SYMBOL_GPL(charlcd_register);
int charlcd_unregister(struct charlcd *lcd)
{
- struct charlcd_priv *priv = charlcd_to_priv(lcd);
-
unregister_reboot_notifier(&panel_notifier);
charlcd_puts(lcd, "\x0cLCD driver unloaded.\x1b[Lc\x1b[Lb\x1b[L-");
misc_deregister(&charlcd_dev);
the_charlcd = NULL;
- if (lcd->ops->backlight) {
- cancel_delayed_work_sync(&priv->bl_work);
- priv->lcd.ops->backlight(&priv->lcd, CHARLCD_OFF);
- }
+ charlcd_deinit(lcd);
return 0;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 086/935] Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 085/935] auxdisplay: charlcd: cancel backlight work on registration failure Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 087/935] Bluetooth: btusb: Add ASUS USB-BT600 " Greg Kroah-Hartman
` (854 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Zwerschke, Paul Menzel,
Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Zwerschke <cito@online.de>
commit 980084de4d9b25193398d89a1c0430ba3501b683 upstream.
Add the vendor/product ID (0x0b05, 0x1bef) to the usb_device_id table for
the Realtek RTL8761CU-based ASUS USB-BT540 adapter. It binds via the
generic Bluetooth class today, so BTUSB_REALTEK is never set and the
rtl8761cu firmware is not loaded, leaving the controller non-functional.
With the entry the driver loads rtl_bt/rtl8761cu_fw.bin (already shipped by
linux-firmware) and the adapter works (tested: A2DP and ASHA).
Similar to commit bc597f0cc44f
("Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV").
Device info from /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 22 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0b05 ProdID=1bef Rev= 2.00
S: Manufacturer=Realtek
S: Product=Bluetooth Controller
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
Cc: stable@vger.kernel.org
Signed-off-by: Christoph Zwerschke <cito@online.de>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -528,6 +528,10 @@ static const struct usb_device_id blackl
{ USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ /* Additional Realtek 8761CU Bluetooth devices */
+ { USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
+
/* Additional Realtek 8821AE Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 087/935] Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 086/935] Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 088/935] bnx2x: fix double free in bnx2x_init_firmware() error path Greg Kroah-Hartman
` (853 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Zwerschke, Paul Menzel,
Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Zwerschke <cito@online.de>
commit 6f0624b4427e38c3bb63a951c536cf8adaee1238 upstream.
Add the vendor/product ID (0x0b05, 0x1d70) to the usb_device_id table for
the Realtek RTL8761CU-based ASUS USB-BT600 adapter. It binds via the
generic Bluetooth class today, so BTUSB_REALTEK is never set and the
rtl8761cu firmware is not loaded, leaving the controller non-functional.
With the entry the driver loads rtl_bt/rtl8761cu_fw.bin (already shipped by
linux-firmware) and the adapter works (tested: A2DP and ASHA).
Similar to commit bc597f0cc44f
("Bluetooth: btusb: Add TP-Link UB600 for Realtek 8761BUV").
Device info from /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 23 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0b05 ProdID=1d70 Rev= 2.00
S: Manufacturer=Realtek
S: Product=Bluetooth Controller
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=1ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms
Cc: stable@vger.kernel.org
Signed-off-by: Christoph Zwerschke <cito@online.de>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btusb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -531,6 +531,8 @@ static const struct usb_device_id blackl
/* Additional Realtek 8761CU Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x1bef), .driver_info = BTUSB_REALTEK |
BTUSB_WIDEBAND_SPEECH },
+ { USB_DEVICE(0x0b05, 0x1d70), .driver_info = BTUSB_REALTEK |
+ BTUSB_WIDEBAND_SPEECH },
/* Additional Realtek 8821AE Bluetooth devices */
{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 088/935] bnx2x: fix double free in bnx2x_init_firmware() error path
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 087/935] Bluetooth: btusb: Add ASUS USB-BT600 " Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:51 ` [PATCH 5.15 089/935] dm-era: fix shadowed superblock leak on take-snap failure Greg Kroah-Hartman
` (852 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiangshan Yi, Simon Horman,
Jakub Kicinski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiangshan Yi <yijiangshan@kylinos.cn>
commit d2796ffe38cb4155afe0eab23636295b096c27a5 upstream.
bnx2x_init_firmware() frees bp->init_ops, bp->init_data and
bp->init_ops_offsets in its error path without setting them to NULL.
The cleanup function bnx2x_release_firmware() frees the same three
pointers unconditionally, so if init_firmware fails and
release_firmware is later called (e.g. from __bnx2x_remove or through
the function state machine), all three are freed a second time.
Set each pointer to NULL after kfree() in the error path so that the
subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.
Fixes: 94a78b79cb5f ("bnx2x: Separated FW from the source.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260815122149.951215-1-yijiangshan@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13493,10 +13493,13 @@ static int bnx2x_init_firmware(struct bn
iro_alloc_err:
kfree(bp->init_ops_offsets);
+ bp->init_ops_offsets = NULL;
init_offsets_alloc_err:
kfree(bp->init_ops);
+ bp->init_ops = NULL;
init_ops_alloc_err:
kfree(bp->init_data);
+ bp->init_data = NULL;
request_firmware_exit:
release_firmware(bp->firmware);
bp->firmware = NULL;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 089/935] dm-era: fix shadowed superblock leak on take-snap failure
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 088/935] bnx2x: fix double free in bnx2x_init_firmware() error path Greg Kroah-Hartman
@ 2026-09-12 6:51 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 090/935] dm raid1: reserve space for NUL-terminator in build_constructor_string() Greg Kroah-Hartman
` (851 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:51 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, liyouhong, Mikulas Patocka
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: liyouhong <liyouhong@kylinos.cn>
commit 39c5aa3bd8ec3912d2cd0b3fe092642b0d2b0713 upstream.
metadata_take_snap() bumps the live superblock refcount and then
dm_tm_shadow_block() allocates a new block for the metadata snapshot.
If the subsequent dm_sm_inc_block() of writeset_tree_root or
era_array_root fails, the function only unlocks the clone and
returns. The newly allocated shadow block is never returned to the
metadata space map, so each failed take-snap permanently leaks one
metadata block.
Free the clone with dm_sm_dec_block() on those error paths, matching
the final step of metadata_drop_snap().
Fixes: eec40579d848 ("dm: add era target")
Cc: stable@vger.kernel.org
Signed-off-by: liyouhong <liyouhong@kylinos.cn>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-era-target.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -1019,6 +1019,7 @@ static int metadata_checkpoint(struct er
static int metadata_take_snap(struct era_metadata *md)
{
int r, inc;
+ dm_block_t location;
struct dm_block *clone;
if (md->metadata_snap != SUPERBLOCK_LOCATION) {
@@ -1056,7 +1057,9 @@ static int metadata_take_snap(struct era
r = dm_sm_inc_block(md->sm, md->writeset_tree_root);
if (r) {
DMERR("%s: couldn't inc writeset tree root", __func__);
+ location = dm_block_location(clone);
dm_tm_unlock(md->tm, clone);
+ dm_sm_dec_block(md->sm, location);
return r;
}
@@ -1064,7 +1067,9 @@ static int metadata_take_snap(struct era
if (r) {
DMERR("%s: couldn't inc era tree root", __func__);
dm_sm_dec_block(md->sm, md->writeset_tree_root);
+ location = dm_block_location(clone);
dm_tm_unlock(md->tm, clone);
+ dm_sm_dec_block(md->sm, location);
return r;
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 090/935] dm raid1: reserve space for NUL-terminator in build_constructor_string()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-09-12 6:51 ` [PATCH 5.15 089/935] dm-era: fix shadowed superblock leak on take-snap failure Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 091/935] dm array: reject an array block whose value size is not the callers Greg Kroah-Hartman
` (850 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilya Krutskih, Mikulas Patocka
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Krutskih <devsec@tpz.ru>
commit 73c37fe54cd056d07461b142ab0b8b81e1ef6ad8 upstream.
Reserve space for the termination NUL after the maximum 20 decimal
digits of a long long value to avoid buffer overflow in sprintf().
Fixes: f5db4af466e2 ("dm raid1: add userspace log")
Cc: stable@vger.kernel.org
Signed-off-by: Ilya Krutskih <devsec@tpz.ru>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-log-userspace-base.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -138,6 +138,7 @@ static int build_constructor_string(stru
str_size += strlen(argv[i]) + 1; /* +1 for space between args */
str_size += 20; /* Max number of chars in a printed u64 number */
+ str_size++; /* For NUL-terminator */
str = kzalloc(str_size, GFP_KERNEL);
if (!str) {
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 091/935] dm array: reject an array block whose value size is not the callers
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 090/935] dm raid1: reserve space for NUL-terminator in build_constructor_string() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 092/935] cpufreq: schedutil: Fix rate limit overflow Greg Kroah-Hartman
` (849 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ming-Hung Tsai, Bryam Vargas,
Mikulas Patocka
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 4538a287bdf5d0f9a379c678e5262b9f5783f547 upstream.
array_block_check() can only compare the header against itself, so a block
with value_size 4 and max_entries 1018 is internally consistent and passes.
dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the
roots for both live in the superblock. Point the mappings root at a hint
block and __load_mappings() walks it through an info whose value size is 8,
so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160
of a 4096-byte block.
get_ablock() and __shadow_ablock() are the two places that hold the block
and the caller at once. Reject there when the two value sizes disagree.
Arrays only ever read their own blocks, so this fires on crafted metadata
only.
Fixes: 6513c29f44f2 ("dm persistent data: add transactional array")
Suggested-by: Ming-Hung Tsai <mtsai@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Reviewed-by: Ming-Hung Tsai <mtsai@redhat.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-array.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/md/persistent-data/dm-array.c
+++ b/drivers/md/persistent-data/dm-array.c
@@ -223,6 +223,14 @@ static int get_ablock(struct dm_array_in
return r;
*ab = dm_block_data(*block);
+ if (le32_to_cpu((*ab)->value_size) != info->value_type.size) {
+ DMERR_LIMIT("%s failed: value_size %u != wanted %u", __func__,
+ le32_to_cpu((*ab)->value_size),
+ info->value_type.size);
+ dm_tm_unlock(info->btree_info.tm, *block);
+ return -EILSEQ;
+ }
+
return 0;
}
@@ -285,6 +293,14 @@ static int __shadow_ablock(struct dm_arr
return r;
*ab = dm_block_data(*block);
+ if (le32_to_cpu((*ab)->value_size) != info->value_type.size) {
+ DMERR_LIMIT("%s failed: value_size %u != wanted %u", __func__,
+ le32_to_cpu((*ab)->value_size),
+ info->value_type.size);
+ dm_tm_unlock(info->btree_info.tm, *block);
+ return -EILSEQ;
+ }
+
if (inc)
inc_ablock_entries(info, *ab);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 092/935] cpufreq: schedutil: Fix rate limit overflow
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 091/935] dm array: reject an array block whose value size is not the callers Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 093/935] Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
` (848 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hui Su, Zhongqiu Han,
Rafael J. Wysocki
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Su <sh_def@163.com>
commit 3bff8f8e95fdc6ad19c8a1a8f87029094747e4bf upstream.
rate_limit_us is an unsigned int, while NSEC_PER_USEC is defined as
1000L. On 32-bit systems, the multiplication is therefore performed
using 32-bit unsigned arithmetic before the result is assigned to
freq_update_delay_ns.
For example, writing 4294968 to rate_limit_us wraps the delay from
4294968000 ns to 704 ns. This makes schedutil update far more often
than configured.
Add sugov_update_rate_limit_us() to widen rate_limit_us to s64 before
converting it to nanoseconds. Use the helper when updating the tunable
through sysfs and when starting the governor, so both paths perform the
conversion without overflow.
Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
Signed-off-by: Hui Su <sh_def@163.com>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Cc: All applicable <stable@vger.kernel.org>
Link: https://patch.msgid.link/20260806142304.1761454-1-sh_def@163.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/cpufreq_schedutil.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -67,6 +67,17 @@ static DEFINE_PER_CPU(struct sugov_cpu,
/************************ Governor internals ***********************/
+static void sugov_update_rate_limit_us(struct sugov_policy *sg_policy)
+{
+ /*
+ * Cast rate_limit_us before multiplication to force 64-bit arithmetic.
+ * Otherwise, on 32-bit platforms, both operands are converted to
+ * 32-bit unsigned long and the multiplication may overflow.
+ */
+ sg_policy->freq_update_delay_ns =
+ (s64)sg_policy->tunables->rate_limit_us * NSEC_PER_USEC;
+}
+
static bool sugov_should_update_freq(struct sugov_policy *sg_policy, u64 time)
{
s64 delta_ns;
@@ -548,7 +559,7 @@ rate_limit_us_store(struct gov_attr_set
tunables->rate_limit_us = rate_limit_us;
list_for_each_entry(sg_policy, &attr_set->policy_list, tunables_hook)
- sg_policy->freq_update_delay_ns = rate_limit_us * NSEC_PER_USEC;
+ sugov_update_rate_limit_us(sg_policy);
return count;
}
@@ -779,7 +790,7 @@ static int sugov_start(struct cpufreq_po
void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
unsigned int cpu;
- sg_policy->freq_update_delay_ns = sg_policy->tunables->rate_limit_us * NSEC_PER_USEC;
+ sugov_update_rate_limit_us(sg_policy);
sg_policy->last_freq_update_time = 0;
sg_policy->next_freq = 0;
sg_policy->work_in_progress = false;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 093/935] Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 092/935] cpufreq: schedutil: Fix rate limit overflow Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 094/935] Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Greg Kroah-Hartman
` (847 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit dc6b7c771a963e20aedf4a21ffa22543b9837ba8 upstream.
bcm_request_irq() calls pm_runtime_use_autosuspend(), but bcm_close()
does not call the matching pm_runtime_dont_use_autosuspend() when
tearing down runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: e88ab30d3669 ("Bluetooth: hci_bcm: Add suspend/resume runtime PM functions")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_bcm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -529,6 +529,7 @@ static int bcm_close(struct hci_uart *hu
if (IS_ENABLED(CONFIG_PM) && bdev->irq_acquired) {
devm_free_irq(bdev->dev, bdev->irq, bdev);
device_init_wakeup(bdev->dev, false);
+ pm_runtime_dont_use_autosuspend(bdev->dev);
pm_runtime_disable(bdev->dev);
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 094/935] Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 093/935] Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 095/935] Bluetooth: RFCOMM: serialize security confirmation handling Greg Kroah-Hartman
` (846 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gongwei Li, Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gongwei Li <ligongwei@kylinos.cn>
commit a9355799343e10014f2acfd4b6844d2335ecafea upstream.
When reading the local version information for vendor detection
fails, the error is only printed and 0 is returned, which masks the
setup failure from the HCI core.
Return PTR_ERR(skb) instead.
Fixes: fb2ce8d11f039 ("Bluetooth: hci_uart: Add support for vendor detection flag")
Fixes: 82f5169bf3d3b ("Bluetooth: hci_uart: add serdev driver support library")
Cc: stable@vger.kernel.org
Signed-off-by: Gongwei Li <ligongwei@kylinos.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_ldisc.c | 2 +-
drivers/bluetooth/hci_serdev.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -445,7 +445,7 @@ static int hci_uart_setup(struct hci_dev
if (IS_ERR(skb)) {
BT_ERR("%s: Reading local version information failed (%ld)",
hdev->name, PTR_ERR(skb));
- return 0;
+ return PTR_ERR(skb);
}
if (skb->len != sizeof(*ver)) {
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -221,7 +221,7 @@ static int hci_uart_setup(struct hci_dev
if (IS_ERR(skb)) {
bt_dev_err(hdev, "Reading local version info failed (%ld)",
PTR_ERR(skb));
- return 0;
+ return PTR_ERR(skb);
}
if (skb->len != sizeof(*ver))
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 095/935] Bluetooth: RFCOMM: serialize security confirmation handling
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 094/935] Bluetooth: hci_uart: Fix false success return in hci_uart_setup() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 096/935] Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Greg Kroah-Hartman
` (845 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <nicoyip.dev@gmail.com>
commit 759c185d0bbdb131357408f50b8735e04ed3caff upstream.
rfcomm_security_cfm() looks up a session on session_list and then walks
its DLC list without holding rfcomm_mutex. Since RFCOMM session teardown
uses rfcomm_mutex, krfcommd can close and free the same session and DLCs
concurrently:
hci_rx_work krfcommd
----------- ---------
rfcomm_session_get()
rfcomm_lock()
rfcomm_session_close()
rfcomm_dlc_unlink()
rfcomm_session_del()
kfree(s)
rfcomm_unlock()
walk s->dlcs
The callback can then read a freed session list head and touch freed DLCs
while updating their flags or timers.
Serialize the session lookup and DLC traversal in rfcomm_security_cfm()
with rfcomm_mutex. This matches the existing RFCOMM session lifetime
rules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink()
from tearing the objects down while the callback is using them.
KASAN reported:
BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440
Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89
Workqueue: hci0 hci_rx_work
Call Trace:
rfcomm_security_cfm+0x41c/0x440
hci_encrypt_cfm+0x139/0x590
hci_encrypt_change_evt+0x37b/0xc40
hci_event_packet+0x71b/0xb20
hci_rx_work+0x293/0x730
Allocated by task 69:
rfcomm_session_add+0x9e/0x2f0
rfcomm_run+0x44b/0x41e0
Freed by task 69:
kfree+0x131/0x3c0
rfcomm_session_del+0x188/0x220
rfcomm_run+0x1985/0x41e0
Fixes: 08c30aca9e698faddebd34f81e1196295f9dc063 ("Bluetooth: Remove RFCOMM session refcnt")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/rfcomm/core.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2203,9 +2203,13 @@ static void rfcomm_security_cfm(struct h
BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
+ rfcomm_lock();
+
s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
- if (!s)
+ if (!s) {
+ rfcomm_unlock();
return;
+ }
list_for_each_entry_safe(d, n, &s->dlcs, list) {
if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
@@ -2237,6 +2241,8 @@ static void rfcomm_security_cfm(struct h
set_bit(RFCOMM_AUTH_REJECT, &d->flags);
}
+ rfcomm_unlock();
+
rfcomm_schedule();
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 096/935] Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 095/935] Bluetooth: RFCOMM: serialize security confirmation handling Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 097/935] Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
` (844 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Valentin Kindschi,
Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Kindschi <valentin.kindschi@fiveco.ch>
commit 941929abe5feaed672b9a52e330e547d333240c6 upstream.
le_conn_complete_evt() clears HCI_LE_ADV before looking at the event
status, on the premise stated in its comment that all controllers stop
advertising when a connection is created.
That premise only holds when a connection was actually created. On a
non-zero status none was, and the controller is still advertising: after
the host issues LE Create Connection Cancel the event arrives with
Unknown Connection Identifier (0x02), and a connection timeout behaves
the same way. Clearing the flag there leaves the host believing
advertising is off while the controller has it on.
It is also wrong for extended advertising, where several sets can be
advertising at once. hci_cc_le_set_ext_adv_enable() is careful about
this - on disabling one set it walks hdev->adv_instances and only clears
HCI_LE_ADV once no instance is still enabled. The unconditional clear
here discards that bookkeeping, so one set connecting drops the flag
while the others keep advertising.
The direction of the error matters. A flag left set is self-correcting:
hci_disable_advertising_sync() sends LE Set Advertising Enable(0) and
the command complete puts the state back. A flag left clear is not,
because that same function returns early without sending anything while
the flag is clear:
- LE Set Advertising Parameters is then sent to a controller that is
still advertising, and is correctly rejected with Command Disallowed
(0x0c);
- hci_enable_advertising_sync() returns at that point, before the
LE Set Advertising Enable that would set HCI_LE_ADV again.
On a controller without LE Extended Advertising that is reachable from
here: hci_schedule_adv_instance_sync() re-arms adv_instance_expire every
HCI_DEFAULT_ADV_DURATION (2 s) and its "already advertising" shortcut
tests HCI_LE_ADV, which can no longer become true, so the parameter
write is retried for as long as advertising is configured:
Bluetooth: hci0: Opcode 0x2006 failed: -16
Only clear the flag when a connection was established.
Note this is not on its own sufficient to stop that retry loop - the
redundant enable queued by hci_le_conn_failed() clears HCI_LE_ADV itself
and recreates the same mismatch, which patch 1 addresses. This patch
fixes the event handler reporting a state the controller is not in.
Verified on the affected device (BCM43455, legacy advertising only) with
this patch and patch 1 applied. A 221 s btmon capture with an out-of-range
peer at -90 dBm contains two outgoing connection attempts that the host
cancelled, each producing exactly the event this patch changes:
< LE Set Advertising Parameters 0x2006 Success
< LE Set Advertising Enable 0x200a Success
< LE Create Connection Cancel 0x200e Success
> LE Connection Complete Unknown Connection Identifier (0x02), central
Nothing follows either one; the next command is an unrelated scan restart
70 ms later. Over the whole capture: 7 LE Set Advertising Parameters sent,
all Success; 10 LE Set Advertising Enable, all Success; no Command
Disallowed of any opcode, and no 2 s cadence anywhere. Two central
connections to other peers completed normally afterwards, with feature
exchange and a connection parameter update, so advertising was still live
across the cancelled attempts.
The extended advertising case above is a code argument, not a measurement:
this controller has no LE Extended Advertising, so that path is not
exercised by the capture.
Fixes: fbd96c151cdc ("Bluetooth: Fix clearing HCI_LE_ADV for LE connections")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5 btmon
Signed-off-by: Valentin Kindschi <valentin.kindschi@fiveco.ch>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5330,10 +5330,11 @@ static void le_conn_complete_evt(struct
hci_dev_lock(hdev);
- /* All controllers implicitly stop advertising in the event of a
- * connection, so ensure that the state bit is cleared.
+ /* Advertising stops when a connection is created. On a failed
+ * connection it keeps running, so leave the state bit alone.
*/
- hci_dev_clear_flag(hdev, HCI_LE_ADV);
+ if (!status)
+ hci_dev_clear_flag(hdev, HCI_LE_ADV);
conn = hci_lookup_le_connect(hdev);
if (!conn) {
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 097/935] Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 096/935] Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 098/935] Bluetooth: hci_intel: " Greg Kroah-Hartman
` (843 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 853a92b97ca547a7ddd9790ff90651b2fd943498 upstream.
h5_btrtl_open() calls pm_runtime_use_autosuspend(), but
h5_btrtl_close() does not call the matching
pm_runtime_dont_use_autosuspend() when tearing down runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: d9dd833cf6d2 ("Bluetooth: hci_h5: Add runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_h5.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -981,8 +981,10 @@ static void h5_btrtl_open(struct h5 *h5)
static void h5_btrtl_close(struct h5 *h5)
{
- if (!test_bit(H5_WAKEUP_DISABLE, &h5->flags))
+ if (!test_bit(H5_WAKEUP_DISABLE, &h5->flags)) {
+ pm_runtime_dont_use_autosuspend(&h5->hu->serdev->dev);
pm_runtime_disable(&h5->hu->serdev->dev);
+ }
gpiod_set_value_cansleep(h5->device_wake_gpio, 0);
gpiod_set_value_cansleep(h5->enable_gpio, 0);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 098/935] Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 097/935] Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 099/935] ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Greg Kroah-Hartman
` (842 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit c7e9a8cb6918656884a0757c92465075c7555ffa upstream.
intel_set_power() calls pm_runtime_use_autosuspend() when powering on
the device, but the power-off path does not call the matching
pm_runtime_dont_use_autosuspend() before disabling runtime PM.
If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped and usage_count remains
unbalanced.
Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.
This issue was found by manual code inspection.
Fixes: 74cdad37cd24 ("Bluetooth: hci_intel: Add runtime PM support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_intel.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -348,6 +348,7 @@ static int intel_set_power(struct hci_ua
devm_free_irq(&idev->pdev->dev, idev->irq, idev);
device_wakeup_disable(&idev->pdev->dev);
+ pm_runtime_dont_use_autosuspend(&idev->pdev->dev);
pm_runtime_disable(&idev->pdev->dev);
}
}
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 099/935] ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 098/935] Bluetooth: hci_intel: " Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 100/935] ip6_gre: fix hardware header length for NBMA tunnels Greg Kroah-Hartman
` (841 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vega, Ido Schimmel, Zhiling Zou,
Jakub Kicinski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit 87f21b59ddc618eff9670c174842964ad65fdade upstream.
ip6_tnl_xmit() may need to expand headroom before it can push the
outer IPv6 and optional encap headers. It currently does that with
skb_realloc_headroom(), copies skb->sk ownership, consumes the original
skb, and then continues processing with the replacement skb kept only in
its local variable.
That is safe only if the helper cannot fail afterwards. But this helper
still has post-reallocation error exits. collect_md tunnels reject
non-NONE encap after the replacement, and ip6_tnl_encap() can also fail
later. In those cases the helper returns an error to its callers while
the caller still only has the original skb pointer.
Both ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on
error, so they can end up freeing an skb that ip6_tnl_xmit() already
consumed.
Use skb_cow_head() instead. It provides the required headroom and
writability without privately replacing the caller-owned skb, so later
error returns cannot leave callers with a stale pointer.
The Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING
and already call skb_cow_head() before entering ip6_tnl_xmit(). They do
not rely on the removed skb_shared() reallocation. This also makes the
IPv6 tunnel path consistent with ip_tunnel_xmit().
Fixes: 058214a4d1df ("ip6_tun: Add infrastructure for doing encapsulation")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Link: https://patch.msgid.link/30807a062ccc5c9c8a5ec2c5eb805ef279c50bdd.1786452593.git.zhilinz@nebusec.ai
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_tunnel.c | 15 ++-------------
1 file changed, 2 insertions(+), 13 deletions(-)
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1218,19 +1218,8 @@ route_lookup:
*/
max_headroom += LL_RESERVED_SPACE(tdev);
- if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
- (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
- struct sk_buff *new_skb;
-
- new_skb = skb_realloc_headroom(skb, max_headroom);
- if (!new_skb)
- goto tx_err_dst_release;
-
- if (skb->sk)
- skb_set_owner_w(new_skb, skb->sk);
- consume_skb(skb);
- skb = new_skb;
- }
+ if (skb_cow_head(skb, max_headroom))
+ goto tx_err_dst_release;
if (t->parms.collect_md) {
if (t->encap.type != TUNNEL_ENCAP_NONE)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 100/935] ip6_gre: fix hardware header length for NBMA tunnels
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 099/935] ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 101/935] ipv6: use RCU iterator to dump route exceptions Greg Kroah-Hartman
` (840 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Zhiling Zou,
Paolo Abeni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiling Zou <zhilinz@nebusec.ai>
commit 505b6d296c486ef7d1274f279d4c43a172f63224 upstream.
ip6gre_tnl_link_config_route() accumulates the lower device's hardware
header length into dev->hard_header_len whenever header_ops is set. This
is incorrect for both users of header_ops.
ip6gretap and ip6erspan have a fixed Ethernet hardware header length.
For an NBMA ip6gre tunnel, ip6gre_header() creates only the GRE header,
the optional FOU or GUE header, and the outer IPv6 header. The lower
device header is headroom needed later, not part of the tunnel device's
hardware header.
Keep the lower device header in needed_headroom. Set hard_header_len to
the tunnel header length only for ARPHRD_IP6GRE devices with header_ops,
and leave the fixed Ethernet header length unchanged for tap and erspan
devices.
Fixes: 832ba596494b ("net: ip6_gre: set dev->hard_header_len when using header_ops")
Cc: stable@vger.kernel.org
Suggested-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/64b46542bbe1701f07702aaa50273e2a87903db5.1786542637.git.zhilinz@nebusec.ai
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_gre.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1151,13 +1151,8 @@ static void ip6gre_tnl_link_config_route
return;
if (rt->dst.dev) {
- unsigned short dst_len = rt->dst.dev->hard_header_len +
- t_hlen;
-
- if (t->dev->header_ops)
- dev->hard_header_len = dst_len;
- else
- dev->needed_headroom = dst_len;
+ dev->needed_headroom = rt->dst.dev->hard_header_len +
+ t_hlen;
if (set_mtu) {
int mtu = rt->dst.dev->mtu - t_hlen;
@@ -1185,8 +1180,8 @@ static int ip6gre_calc_hlen(struct ip6_t
t_hlen = tunnel->hlen + sizeof(struct ipv6hdr);
- if (tunnel->dev->header_ops)
- tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen;
+ if (tunnel->dev->header_ops && tunnel->dev->type == ARPHRD_IP6GRE)
+ tunnel->dev->hard_header_len = t_hlen;
else
tunnel->dev->needed_headroom = LL_MAX_HEADER + t_hlen;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 101/935] ipv6: use RCU iterator to dump route exceptions
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 100/935] ip6_gre: fix hardware header length for NBMA tunnels Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 102/935] libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Greg Kroah-Hartman
` (839 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuyang Huang, Stefano Brivio,
Ido Schimmel, David S. Miller, Jakub Kicinski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuyang Huang <sigefriedhyy@gmail.com>
commit 47cdab0d51aaa9bd85f8e4904585bd5bd4df4488 upstream.
rt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over
RCU-protected exception lists. The caller holds rcu_read_lock(), but does
not hold rt6_exception_lock, so rt6_insert_exception() can concurrently
add an entry with hlist_add_head_rcu().
KCSAN reports this race (irrelevant details omitted):
==================================================================
BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions
write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:
rt6_insert_exception+0x3bb/0x760
__ip6_rt_update_pmtu+0x4fe/0x750
ip6_sk_update_pmtu+0x19a/0x3b0
udpv6_err+0x3ff/0x800
icmpv6_notify+0x1e1/0x440
icmpv6_rcv+0x8c0/0xab0
ip6_protocol_deliver_rcu+0x616/0x840
ip6_input_finish+0xb9/0x160
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:
rt6_nh_dump_exceptions+0xb3/0x260
rt6_dump_route+0x53e/0x5f0
fib6_dump_node+0x6d/0xf0
fib6_walk_continue+0x290/0x2d0
fib6_dump_table+0x28d/0x360
inet6_dump_fib+0x37d/0x620
rtnl_dumpit+0x7b/0xd0
netlink_dump+0x3ae/0x7e0
...
entry_SYSCALL_64_after_hwframe+0x77/0x7f
4 locks held by dumper/549:
...
#1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620
#2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360
#3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0
value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100
Reported by Kernel Concurrency Sanitizer on:
CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted
7.2.0-rc7-virtme #38 PREEMPT(lazy)
...
Use hlist_for_each_entry_rcu() to safely iterate over the exception list.
Fixes: 1e47b4837f3b ("ipv6: Dump route exceptions if requested")
Cc: stable@vger.kernel.org
Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260815084651.69477-1-sigefriedhyy@gmail.com
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5852,7 +5852,7 @@ static int rt6_nh_dump_exceptions(struct
return 0;
for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
- hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
+ hlist_for_each_entry_rcu(rt6_ex, &bucket->chain, hlist) {
if (w->skip) {
w->skip--;
continue;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 102/935] libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 101/935] ipv6: use RCU iterator to dump route exceptions Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 103/935] md: do overflow check for sb->bblog_shift in super_1_load() Greg Kroah-Hartman
` (838 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alison Schofield, Bryam Vargas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryam Vargas <hexlabsecurity@proton.me>
commit 037770686126155eafc44501312989e2837b9659 upstream.
The on-media namespace index field nslot is a u32 read from the DIMM
label storage area. __nd_label_validate() bounds it against the config
area size, but sizeof_namespace_label() returns unsigned, so the product
nslot * label_size is evaluated in 32-bit and wraps modulo 2^32 before
the comparison. A crafted nslot passes the bound and is then used as the
loop trip count in nd_label_data_init(), whose memset() walks off the end
of the config_size buffer: an out-of-bounds write.
The field is not trusted -- it comes from the medium, or from userspace
via ND_CMD_SET_CONFIG_DATA. Evaluate the product in 64-bit so the bound
check is exact; conforming labels are unaffected.
The check was safe when introduced by commit 4a826c83db4e ("libnvdimm:
namespace indices: read and validate"): it multiplied by sizeof(struct
nd_namespace_label), a size_t, so on a 64-bit build the product did not
wrap. Commit 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label
definitions") narrowed it to 32 bits when the label size became a runtime
value read via sizeof_namespace_label().
Fixes: 564e871aa66f ("libnvdimm, label: add v1.2 nvdimm label definitions")
Cc: stable@vger.kernel.org
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://patch.msgid.link/20260624-b4-disp-d8279485-v3-1-cdb6cab28b41@proton.me
Signed-off-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvdimm/label.c
+++ b/drivers/nvdimm/label.c
@@ -194,7 +194,7 @@ static int __nd_label_validate(struct nv
}
nslot = __le32_to_cpu(nsindex[i]->nslot);
- if (nslot * sizeof_namespace_label(ndd)
+ if ((u64)nslot * sizeof_namespace_label(ndd)
+ 2 * sizeof_namespace_index(ndd)
> ndd->nsarea.config_size) {
dev_dbg(dev, "nsindex%d nslot: %u invalid, config_size: %#x\n",
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 103/935] md: do overflow check for sb->bblog_shift in super_1_load()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 102/935] libnvdimm/labels: Prevent integer overflow in __nd_label_validate() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 104/935] mpls: reload header after pskb_may_pull() Greg Kroah-Hartman
` (837 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ramesh Adhikari, Coly Li, Yu Kuai
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Coly Li <colyli@fygo.io>
commit 35d522bd32462afcf1981dab6da8a9256c26c1e0 upstream.
In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on-
disk superblock. It is used for badblocks API badblocks_set() by the
following sequence,
1930 rdev->badblocks.shift = sb->bblog_shift;
1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {
1932 u64 bb = le64_to_cpu(*bbp);
1933 int count = bb & (0x3ff);
1934 u64 sector = bb >> 10;
1935 sector <<= sb->bblog_shift;
1936 count <<= sb->bblog_shift;
1937 if (bb + 1 == 0)
1938 break;
1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1))
1940 return -EINVAL;
1941 }
bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for
an invalid bb->bblog_shit, it is possible to make sector be overflowed
by the following calculation,
1935 sector <<= sb->bblog_shift;
Then in turn when call badblocks_set() at line 1939 with the invalid
rdev->badblocks.shift set at line 1930, may result an overflow inside
_badblocks_clear() in block/badblocks.c.
Although there are many places to call badblocks APIs, the non-zero
shift value is only used in super_1_load(), other places always use 0 as
the shift value. Therefore it is unnecessary to do a general shift value
overflow check inside badblock API, and just check here as the caller.
This may avoid unnecessary check, make the badblocks API code more simple
and elegant.
Fixes: 2699b67223ac ("md: load/store badblock list from v1.x metadata")
Fixes: 1726c7746783 ("badblocks: improve badblocks_set() for multiple ranges handling")
Cc: stable@vger.kernel.org
Cc: Ramesh Adhikari <adhikari.resume@gmail.com>
Signed-off-by: Coly Li <colyli@fygo.io>
Reviewed-by: Yu Kuai <yukuai@fygo.io>
Link: https://patch.msgid.link/20260720111400.2120834-1-colyli@fygo.io
Signed-off-by: Yu Kuai <yukuai@fygo.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1746,6 +1746,13 @@ static int super_1_load(struct md_rdev *
rdev->bb_page, REQ_OP_READ, 0, true))
return -EIO;
bbp = (__le64 *)page_address(rdev->bb_page);
+
+ /* check for badblocks api. */
+ if (sb->bblog_shift >= BITS_PER_TYPE(sector_t)) {
+ pr_err("md: %pg: bogus bblog_shift %u for badblocks.\n",
+ rdev->bdev, sb->bblog_shift);
+ return -EINVAL;
+ }
rdev->badblocks.shift = sb->bblog_shift;
for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) {
u64 bb = le64_to_cpu(*bbp);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 104/935] mpls: reload header after pskb_may_pull()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 103/935] md: do overflow check for sb->bblog_shift in super_1_load() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 105/935] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Greg Kroah-Hartman
` (836 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qing Ming, Simon Horman, Paolo Abeni
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qing Ming <a0yami@mailbox.org>
commit 29e63b8d9fc150cc191b1c6eb7e16e1247e1b650 upstream.
mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop
when an MPLS route has multiple nexthops. While walking the MPLS label
stack, the hash routine caches hdr for the current label. After finding
the bottom-of-stack label, it calls pskb_may_pull() before reading the
inner IP header.
If an skb is constructed with the inner IP header in nonlinear data and
insufficient tailroom in the linear head, pskb_may_pull() calls
pskb_expand_head() to replace the skb head and free the old one. This
leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr
again when it performs a second pull for the larger header.
The issue was found through static analysis. A reproducer sending a legal
Geneve packet through a bareudp/MPLS multipath setup triggered the same
KASAN report in 2 of 2 unpatched runs:
BUG: KASAN: slab-use-after-free in mpls_select_multipath
Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23
Call Trace:
mpls_select_multipath
mpls_forward
__netif_receive_skb_list_core
netif_receive_skb_list_internal
napi_complete_done
gro_cell_poll
__napi_poll
net_rx_action
Freed by task 23:
kfree
pskb_expand_head
__pskb_pull_tail
mpls_select_multipath
Reload hdr from the current skb head after each successful pull before
deriving the inner IPv4 or IPv6 header pointer.
Fixes: 9f427a0e474a ("net: mpls: Fix multipath selection for LSR use case")
Cc: stable@vger.kernel.org
Signed-off-by: Qing Ming <a0yami@mailbox.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260814095404.7205-1-a0yami@mailbox.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mpls/af_mpls.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -197,6 +197,7 @@ static u32 mpls_multipath_hash(struct mp
if (pskb_may_pull(skb, mpls_hdr_len + sizeof(struct iphdr))) {
const struct iphdr *v4hdr;
+ hdr = mpls_hdr(skb) + label_index;
v4hdr = (const struct iphdr *)(hdr + 1);
if (v4hdr->version == 4) {
hash = jhash_3words(ntohl(v4hdr->saddr),
@@ -207,6 +208,7 @@ static u32 mpls_multipath_hash(struct mp
sizeof(struct ipv6hdr))) {
const struct ipv6hdr *v6hdr;
+ hdr = mpls_hdr(skb) + label_index;
v6hdr = (const struct ipv6hdr *)(hdr + 1);
hash = __ipv6_addr_jhash(&v6hdr->saddr, hash);
hash = __ipv6_addr_jhash(&v6hdr->daddr, hash);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 105/935] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 104/935] mpls: reload header after pskb_may_pull() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 106/935] SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Greg Kroah-Hartman
` (835 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harshit Varu, Matthieu Baerts (NGI0),
Jakub Kicinski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Varu <harshitvaru666@gmail.com>
commit b878dfdd12d7a5b8722a78d35e313506140ca3d9 upstream.
mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,
backup, join_id, token and msk from the saved cookie entry when rebuilding
the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it
does not restore local_id, even though the SYN path saved it.
subflow_ulp_clone() then reads that uninitialized field and stores it as
the joined subflow's address-ID. Because the request-sock slab is
SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale
byte of a previously freed request socket, which an off-path peer can
influence by sending concurrent MP_JOIN SYNs. This corrupts the path
manager's id-based subflow bookkeeping for the connection.
Restore subflow_req->local_id from the cookie entry, as done for the other
fields.
Fixes: 9466a1ccebbe ("mptcp: enable JOIN requests even if cookies are in use")
Cc: stable@vger.kernel.org
Signed-off-by: Harshit Varu <harshitvaru666@gmail.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260815115205.197151-1-harshitvaru666@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/syncookies.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/mptcp/syncookies.c
+++ b/net/mptcp/syncookies.c
@@ -118,6 +118,7 @@ bool mptcp_token_join_cookie_init_state(
subflow_req->local_nonce = e->local_nonce;
subflow_req->backup = e->backup;
subflow_req->remote_id = e->join_id;
+ subflow_req->local_id = e->local_id;
subflow_req->token = e->token;
subflow_req->msk = msk;
spin_unlock_bh(&join_entry_locks[i]);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 106/935] SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 105/935] mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 107/935] sunrpc: route to a populated pool in svc_pool_for_cpu() Greg Kroah-Hartman
` (834 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 3f491306dcb673ff5e78e1044ba450c58978774e upstream.
xdr_buf_trim() trims `len` bytes from the tail of an xdr_buf by
walking the tail, pages, and head iovecs. Each per-section step
uses min_t() so it never removes more bytes than that section
holds, but the final accounting at the fix_len label subtracts the
total bytes actually consumed from buf->len without any clamp:
fix_len:
buf->len -= (len - trim);
When the caller has set buf->len to a value smaller than the sum
of the iov_lens, (len - trim) can exceed buf->len and the unsigned
subtraction wraps to near UINT_MAX. gss_krb5_unwrap_v2() reaches
xdr_buf_trim() in exactly that state:
buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
buf->len is a small wire-derived value while the iov_lens are at
page scale, so the per-section loops legitimately consume far more
bytes than buf->len records. The wrapped buf->len then propagates
as the authoritative stream bound into every downstream XDR
decoder.
Fix by clamping the decrement so buf->len bottoms out at zero:
buf->len -= min_t(unsigned int, buf->len, len - trim);
On the normal path where the iov_lens sum to buf->len, (len - trim)
is always <= buf->len and the result is identical to before. No
callers change behavior outside the underflow case.
Fixes: 4c190e2f913f ("sunrpc: trim off trailing checksum before returning decrypted or integrity authenticated buffer")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260524010213.557424-4-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/xdr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sunrpc/xdr.c
+++ b/net/sunrpc/xdr.c
@@ -1732,7 +1732,7 @@ void xdr_buf_trim(struct xdr_buf *buf, u
trim -= cur;
}
fix_len:
- buf->len -= (len - trim);
+ buf->len -= min_t(unsigned int, buf->len, len - trim);
}
EXPORT_SYMBOL_GPL(xdr_buf_trim);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 107/935] sunrpc: route to a populated pool in svc_pool_for_cpu()
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 106/935] SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 108/935] SUNRPC: always drain cache_cleaner before destroying a cache_detail Greg Kroah-Hartman
` (833 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f6310491c4cdb88af73aa551ec9df1f10a90c709 upstream.
svc_set_num_threads() spreads the requested threads evenly across the
service's pools (base = nrservs / sv_nrpools). When a service runs
fewer threads than it has pools -- e.g. an nfsd configured with fewer
threads than the host has NUMA nodes while running in "pernode" or
"percpu" mode -- the trailing pools are left with no threads at all.
svc_xprt_enqueue() selects a pool from the CPU servicing the transport,
queues the transport on that pool's sp_xprts, and only wakes a thread
from the same pool. Each thread services exclusively its own pool, so a
transport that lands on a threadless pool is enqueued on sp_xprts and
never picked up: the connection hangs indefinitely.
Have svc_pool_for_cpu() skip pools that currently have no threads,
falling back to the next populated pool. This trades NUMA locality for
a guarantee that the work is actually serviced. sp_nrthreads is only
updated under the service mutex; the lockless read here is a best-effort
routing hint, so annotate it with data_race().
Fixes: bfd241600a3b ("[PATCH] knfsd: make rpc threads pools numa aware")
Cc: stable@vger.kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260706-sunrpc-pool-mode-v5-1-6c4ee7cd89aa@kernel.org
Signed-off-by: Chuck Lever <cel@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/svc.c | 29 ++++++++++++++++++++++++++++-
1 file changed, 28 insertions(+), 1 deletion(-)
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -366,6 +366,7 @@ svc_pool_for_cpu(struct svc_serv *serv,
{
struct svc_pool_map *m = &svc_pool_map;
unsigned int pidx = 0;
+ unsigned int i;
if (serv->sv_nrpools <= 1)
return serv->sv_pools;
@@ -378,8 +379,34 @@ svc_pool_for_cpu(struct svc_serv *serv,
pidx = m->to_pool[cpu_to_node(cpu)];
break;
}
+ pidx %= serv->sv_nrpools;
- return &serv->sv_pools[pidx % serv->sv_nrpools];
+ /*
+ * It's possible to have a pool with no threads. Userland can just set
+ * things up this way directly. Also, when threads are autodistributed
+ * they are spread evenly across the pools, but when there are fewer
+ * threads than pools some pools can end up with none.
+ *
+ * A transport enqueued on a threadless pool would never be picked up,
+ * since each thread only services its own pool. Fall back to the next
+ * populated pool, trading NUMA locality for a guarantee that the
+ * transport is serviced.
+ */
+ for (i = 0; i < serv->sv_nrpools; i++) {
+ struct svc_pool *pool = &serv->sv_pools[pidx];
+
+ /* This is set under the service mutex and rarely ever
+ * changes. A data race here is harmless.
+ */
+ if (data_race(pool->sp_nrthreads))
+ return pool;
+
+ if (++pidx >= serv->sv_nrpools)
+ pidx = 0;
+ }
+
+ /* No pool has any threads; nothing can service the transport. */
+ return &serv->sv_pools[pidx];
}
int svc_rpcb_setup(struct svc_serv *serv, struct net *net)
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 108/935] SUNRPC: always drain cache_cleaner before destroying a cache_detail
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 107/935] sunrpc: route to a populated pool in svc_pool_for_cpu() Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 109/935] SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Greg Kroah-Hartman
` (832 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit f42d0fda0c67695db6bc704b04b7c10240805377 upstream.
sunrpc_destroy_cache_detail() only cancels the global cache_cleaner
delayed_work when cache_list is empty. During per-netns teardown
cache_list is never empty because init_net's caches remain registered,
so the cancel never fires. After unlink, the caller proceeds to
cache_destroy_net() which kfrees the cache_detail while cache_clean()
may still hold a dangling pointer to it. The result is a
use-after-free: cache_dequeue() takes cd->queue_lock on freed memory,
and cache_put() dereferences cd->cache_put as a function pointer from
freed slab.
Drop the list_empty guard so that cancel_delayed_work_sync() always
runs, ensuring any in-flight cache_clean() completes before the
cache_detail is freed. Re-arm the cleaner afterwards if other caches
are still registered.
Fixes: 820f9442e711 ("SUNRPC: split cache creation and PipeFS registration")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260526-cache_cleaner_vs_destroy_no_sync-v1-1-a707a6fcfd32@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/cache.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -410,10 +410,9 @@ void sunrpc_destroy_cache_detail(struct
list_del_init(&cd->others);
spin_unlock(&cd->hash_lock);
spin_unlock(&cache_list_lock);
- if (list_empty(&cache_list)) {
- /* module must be being unloaded so its safe to kill the worker */
- cancel_delayed_work_sync(&cache_cleaner);
- }
+ cancel_delayed_work_sync(&cache_cleaner);
+ if (!list_empty(&cache_list))
+ queue_delayed_work(system_power_efficient_wq, &cache_cleaner, 0);
}
EXPORT_SYMBOL_GPL(sunrpc_destroy_cache_detail);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 109/935] SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 108/935] SUNRPC: always drain cache_cleaner before destroying a cache_detail Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 110/935] SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Greg Kroah-Hartman
` (831 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit f8870b9b75afb77986bc65940a231d54068ff2b1 upstream.
svcauth_gss_release() reads gc_proc and switches on gc_svc before
consulting rq_auth_stat. On the SVC_DENIED path after a failed
svcauth_gss_accept(), those fields may hold stale values from a
prior request or uninitialized slab residue: svcauth_gss_accept()
allocates gss_svc_data with non-zeroing kmalloc and clears only
gsd_databody_offset and rsci per request, not clcred.
Because RPC_GSS_PROC_DATA is zero, a zeroed or stale-zero gc_proc
passes the existing guard and falls through into the gc_svc switch,
which can dispatch to svcauth_gss_wrap_integ() or
svcauth_gss_wrap_priv(). Both wrap helpers call
svcauth_gss_prepare_to_wrap() before any rsci->mechctx dereference,
and that helper already returns early when rq_auth_stat is not
rpc_auth_ok, so the downstream NULL dereference is blocked. The
dispatch itself remains structurally wrong: it reads scalars that
the caller has no contract to have initialized after a failed
authentication.
Mirror the existing rq_auth_stat gate in
svcauth_gss_prepare_to_wrap() one frame up, so
svcauth_gss_release() skips the clcred dispatch entirely when
authentication has not succeeded. The cleanup tail that releases
rq_client, rq_gssclient, cr_group_info, and rsci still runs.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260528-tier2-v1-4-d026a1415e0b@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/svcauth_gss.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1837,6 +1837,8 @@ svcauth_gss_release(struct svc_rqst *rqs
if (!gsd)
goto out;
+ if (rqstp->rq_auth_stat != rpc_auth_ok)
+ goto out;
gc = &gsd->clcred;
if (gc->gc_proc != RPC_GSS_PROC_DATA)
goto out;
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 110/935] SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 109/935] SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 111/935] SUNRPC: harden gss_unwrap_resp_priv length checks Greg Kroah-Hartman
` (830 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 6959297aaa9572783d620a226d73c3fb94494888 upstream.
gss_krb5_unwrap_v2() reads the EC and RRC header fields at ptr+4 and
ptr+6 before validating that the token is at least GSS_KRB5_TOK_HDR_LEN
(16) bytes long, and its rotate_left() helper passes buf->len - base
to xdr_buf_subsegment() without verifying that base <= buf->len. When
a caller hands in a sub-16-byte token, or a token whose declared len
leaves base past the end of the buffer, three distinct failures follow:
gss_krb5_unwrap_v2(offset, len, buf)
ptr = buf->head[0].iov_base + offset
ec = *(ptr + 4) /* OOB read on short head */
rrc = *(ptr + 6) /* OOB read on short head */
rotate_left(offset + 16, buf, rrc)
xdr_buf_subsegment(buf, &subbuf,
base, buf->len - base) /* u32 wrap when base > len */
_rotate_left(&subbuf, shift)
shift %= buf->len /* divide-by-zero when base == len */
After decryption, the cleanup arithmetic has the same shape:
movelen = min_t(unsigned int, buf->head[0].iov_len, len);
movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
buf->head[0].iov_len);
The BUG_ON re-adds the value just subtracted, so it reduces to
min(A, B) > A and is permanently false; it cannot catch the unsigned
underflow of movelen, which then drives a ~UINT_MAX-byte memmove().
Add four defense-in-depth guards inside the unwrap core so it is safe
regardless of what its callers validate:
- reject tokens with len - offset < GSS_KRB5_TOK_HDR_LEN before
touching ptr+4/ptr+6;
- bail from rotate_left() when buf->len <= base, covering both the
underflow and zero-length cases;
- return early from _rotate_left() when buf->len is zero, so the
shift %= buf->len modulo cannot fault;
- replace the dead BUG_ON with a live check that returns
GSS_S_DEFECTIVE_TOKEN before the movelen subtraction.
Fixes: de9c17eb4a91 ("gss_krb5: add support for new token formats in rfc4121")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260524010213.557424-5-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_krb5_wrap.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
+++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
@@ -389,6 +389,8 @@ static void _rotate_left(struct xdr_buf
int shifted = 0;
int this_shift;
+ if (!buf->len)
+ return;
shift %= buf->len;
while (shifted < shift) {
this_shift = min(shift - shifted, LOCAL_BUF_LEN);
@@ -401,6 +403,8 @@ static void rotate_left(u32 base, struct
{
struct xdr_buf subbuf;
+ if (buf->len <= base)
+ return;
xdr_buf_subsegment(buf, &subbuf, base, buf->len - base);
_rotate_left(&subbuf, shift);
}
@@ -476,6 +480,9 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *
if (kctx->gk5e->decrypt_v2 == NULL)
return GSS_S_FAILURE;
+ if (len - offset <= GSS_KRB5_TOK_HDR_LEN)
+ return GSS_S_DEFECTIVE_TOKEN;
+
ptr = buf->head[0].iov_base + offset;
if (be16_to_cpu(*((__be16 *)ptr)) != KG2_TOK_WRAP)
@@ -542,9 +549,9 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *
* head buffer space rather than that actually occupied.
*/
movelen = min_t(unsigned int, buf->head[0].iov_len, len);
+ if (movelen < offset + GSS_KRB5_TOK_HDR_LEN + headskip)
+ return GSS_S_DEFECTIVE_TOKEN;
movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
- BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
- buf->head[0].iov_len);
memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen);
buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
buf->len = len - (GSS_KRB5_TOK_HDR_LEN + headskip);
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 111/935] SUNRPC: harden gss_unwrap_resp_priv length checks
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 110/935] SUNRPC: harden gss_krb5_unwrap_v2 against short tokens Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 112/935] sunrpc: init gssp_lock before publishing proc entry Greg Kroah-Hartman
` (829 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 87831b92112c81db251d46756d65daa4f91af6a2 upstream.
gss_unwrap_resp_priv() validates the RPCSEC_GSS opaque length with
offset = (u8 *)(p) - (u8 *)head->iov_base;
if (offset + opaque_len > rcv_buf->len)
goto unwrap_failed;
maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
offset + opaque_len, rcv_buf);
Both operands are u32 and the sum is computed in u32. A reply with
opaque_len near 0xffffffff makes offset + opaque_len wrap to a small
value that is below rcv_buf->len, so the bound check passes and
gss_unwrap() is called with end < begin. The check also lacks a
lower bound, so any opaque_len in [0, GSS_KRB5_TOK_HDR_LEN) is
accepted and forwarded to gss_krb5_unwrap_v2(), whose pre-decrypt
header reads at ptr+4 and ptr+6 then run past the token.
A krb5p NFS server returning a crafted RPCSEC_GSS reply can drive
the client into out-of-bounds reads in gss_krb5_unwrap_v2() and the
rotate_left() loop that follows.
Fix by replacing the single combined check with three guards that
are safe in u32 arithmetic and that enforce the RFC 4121 minimum
outer token length:
if (offset > rcv_buf->len)
goto unwrap_failed;
if (opaque_len > rcv_buf->len - offset)
goto unwrap_failed;
if (opaque_len < GSS_KRB5_TOK_HDR_LEN)
goto unwrap_failed;
The first guard makes the subtraction in the second guard
unconditionally safe; offset is derived from a successful
xdr_inline_decode() in the head kvec, so in practice it already
satisfies the bound. The floor mirrors the server-side check added
in commit 5b757c2e57a5 ("SUNRPC: svcauth_gss: enforce krb5 token
minimum length").
Fixes: 2d2da60c63b6 ("RPCSEC_GSS: client-side privacy support")
Cc: stable@vger.kernel.org
Assisted-by: kres (claude-opus-4-7)
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260524010213.557424-3-cel@kernel.org
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/auth_gss.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -2050,7 +2050,11 @@ gss_unwrap_resp_priv(struct rpc_task *ta
goto unwrap_failed;
opaque_len = be32_to_cpup(p++);
offset = (u8 *)(p) - (u8 *)head->iov_base;
- if (offset + opaque_len > rcv_buf->len)
+ if (offset > rcv_buf->len)
+ goto unwrap_failed;
+ if (opaque_len > rcv_buf->len - offset)
+ goto unwrap_failed;
+ if (opaque_len <= GSS_KRB5_TOK_HDR_LEN)
goto unwrap_failed;
maj_stat = gss_unwrap(ctx->gc_gss_ctx, offset,
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 112/935] sunrpc: init gssp_lock before publishing proc entry
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 111/935] SUNRPC: harden gss_unwrap_resp_priv length checks Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 113/935] SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field Greg Kroah-Hartman
` (828 subsequent siblings)
940 siblings, 0 replies; 972+ messages in thread
From: Greg Kroah-Hartman @ 2026-09-12 6:52 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mason, Jeff Layton,
Chuck Lever
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mason <clm@meta.com>
commit 5ce1ed6159731a41fdd0b03eedbed4e147036a5a upstream.
create_use_gss_proxy_proc_entry() publishes /proc/net/rpc/use-gss-proxy
via proc_create_data() before init_gssp_clnt() runs mutex_init() on
sn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is
immediately reachable from userspace, so a write that lands in the
window drives set_gssp_clnt() into mutex_lock() on a zero-initialized
struct mutex.
create_use_gss_proxy_proc_entry(net)
proc_create_data("use-gss-proxy", ...) /* dentry live */
init_gssp_clnt(sn)
mutex_init(&sn->gssp_lock) /* too late */
write_gssp()
set_gssp_clnt(net)
mutex_lock(&sn->gssp_lock) /* uninitialized */
gssp_rpc_create(...)
sn->gssp_clnt = clnt
mutex_unlock(&sn->gssp_lock)
The window spans only the two statements between proc_create_data()
returning and init_gssp_clnt(), so a writer reaches it only if the
registering thread is preempted there while another task is already
opening the freshly published file. register_pernet_subsys() runs in
preemptible context under pernet_ops_rwsem, so that preemption is
possible, and the window widens on auth_rpcgss module load, when the
proc entry is created for every live net namespace whose tasks are
already running. A writer that wins the race locks a zero-filled
struct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a
"lock used without init" splat; on a production kernel the fast path
acquires the lock via CMPXCHG(owner, 0, current). In the latter case
a second writer that arrives before init_gssp_clnt() re-zeroes owner
can enter set_gssp_clnt() concurrently, shut down the first writer's
clnt while it is still in use, and leak the loser's clnt.
Fix by initializing sn->gssp_lock in sunrpc_init_net() so its lifetime
matches the sunrpc_net it lives in. sn->gssp_clnt is already NULL from
the kzalloc that backs net_generic storage, so the lazy helper is no
longer needed; drop init_gssp_clnt(), its prototype, and the call from
create_use_gss_proxy_proc_entry(). sunrpc.ko is a build-time
dependency of auth_rpcgss.ko, so sunrpc_init_net() has always run on
every netns before any auth_gss pernet init can publish the proc
entry.
Fixes: 030d794bf498 ("SUNRPC: Use gssproxy upcall for server RPCGSS authentication.")
Cc: stable@vger.kernel.org
Assisted-by: kres:claude-opus-4-7
Signed-off-by: Chris Mason <clm@meta.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Link: https://patch.msgid.link/20260530-tier2-local-v2-1-5a0fd532db57@oracle.com
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/auth_gss/gss_rpc_upcall.c | 6 ------
net/sunrpc/auth_gss/gss_rpc_upcall.h | 1 -
net/sunrpc/auth_gss/svcauth_gss.c | 1 -
net/sunrpc/sunrpc_syms.c | 1 +
4 files changed, 1 insertion(+), 8 deletions(-)
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.c
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c
@@ -121,12 +121,6 @@ out:
return result;
}
-void init_gssp_clnt(struct sunrpc_net *sn)
-{
- mutex_init(&sn->gssp_lock);
- sn->gssp_clnt = NULL;
-}
-
int set_gssp_clnt(struct net *net)
{
struct sunrpc_net *sn = net_generic(net, sunrpc_net_id);
--- a/net/sunrpc/auth_gss/gss_rpc_upcall.h
+++ b/net/sunrpc/auth_gss/gss_rpc_upcall.h
@@ -29,7 +29,6 @@ int gssp_accept_sec_context_upcall(struc
struct gssp_upcall_data *data);
void gssp_free_upcall_data(struct gssp_upcall_data *data);
-void init_gssp_clnt(struct sunrpc_net *);
int set_gssp_clnt(struct net *);
void clear_gssp_clnt(struct sunrpc_net *);
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1497,7 +1497,6 @@ static int create_use_gss_proxy_proc_ent
&use_gss_proxy_proc_ops, net);
if (!*p)
return -ENOMEM;
- init_gssp_clnt(sn);
return 0;
}
--- a/net/sunrpc/sunrpc_syms.c
+++ b/net/sunrpc/sunrpc_syms.c
@@ -54,6 +54,7 @@ static __net_init int sunrpc_init_net(st
INIT_LIST_HEAD(&sn->all_clients);
spin_lock_init(&sn->rpc_client_lock);
spin_lock_init(&sn->rpcb_clnt_lock);
+ mutex_init(&sn->gssp_lock);
return 0;
err_pipefs:
^ permalink raw reply [flat|nested] 972+ messages in thread* [PATCH 5.15 113/935] SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
2026-09-12 6:50 [PATCH 5.15 000/935] 5.15.221-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-09-12 6:52 ` [PATCH 5.15 112/935] sunrpc: init gssp_lock before publishing proc entry Greg Kroah-Hartman
@ 2026-09-12 6:52 ` Greg Kroah-Hartman
2026-09-12 6:52 ` [PATCH 5.15 114/935] svcrdma: Fix offset arithmetic in read_chunk_range