[git pull] device mapper fixes for 7.2

[Mikulas Patocka <mpatocka@redhat.com>]

Hi Linus

The following changes since commit 8cdeaa50eae8dad34885515f62559ee83e7e8dda:

  Linux 7.2-rc2 (2026-07-05 14:44:06 -1000)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git tags/for-7.2/dm-fixes

for you to fetch changes up to 4b22d0801fadfcae2e106e6ba32e49439c7c7ebf:

  dm thin metadata: fix superblock refcount leak on snapshot shadow failure (2026-07-11 15:18:51 +0200)

Please, pull. Thanks.

Mikulas

----------------------------------------------------------------
- dm-log: fix overflow on 32-bit machines

- dm-era: fix out of bounds memory access; fix crashes on invalid args

- dm-verity: fix buffer overflow in forward error correction

- dm-thin: fix misbehavior on I/O failures

- dm-pcache: fix NULL pointer dereference on invalid arguments

- dm-inlinecrypt: fix memory leak on error handling

- dm-integrity: fix ignoring the 'fix_hmac' option on device open

- dm: don't store the keyring in memory for a long term

- 12 miscellaneous fixes for bugs found by Claude Opus 4.6
-----BEGIN PGP SIGNATURE-----

iIoEABYIADIWIQRnH8MwLyZDhyYfesYTAyx9YGnhbQUCalKUaxQcbXBhdG9ja2FA
cmVkaGF0LmNvbQAKCRATAyx9YGnhbbQwAP9pHgNUinD95o9vnu3d3QNmjnEDmrgZ
+kxNFRpWXvbzKQEArYWPLS/2dwf4nG0Fa8PtJTwkjI/6UeublAy5MrdTqA0=
=pkBx
-----END PGP SIGNATURE-----

----------------------------------------------------------------
Benjamin Marzinski (1):
      dm-log: fix a bitset_size overflow on 32bit machines

Cao Guanghui (2):
      dm era: fix NULL pointer dereference in metadata_open()
      dm era: fix error code propagation in era_ctr()

Christophe JAILLET (1):
      dm-inlinecrypt: Fix an error handling path in inlinecrypt_ctr()

Genjian Zhang (1):
      dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Ingo Blechschmidt (1):
      dm: avoid leaking the caller's thread keyring via the table device file

Mikulas Patocka (14):
      dm-verity: fix buffer overflow in FEC calculation
      dm-integrity: fix the 'fix_hmac' option
      dm-integrity: fix leaking uninitialized kernel memory
      dm-integrity: don't increment hash_offset twice
      dm-integrity: fix a bug if the bio is out of limits
      dm_early_create: fix freeing used table on dm_resume failure
      dm-ioctl: fix a possible overflow in list_version_get_info
      dm-verity: avoid double increment of &use_bh_wq_enabled
      dm-verity: fix a possible NULL pointer dereference
      dm-verity: increase sprintf buffer size
      dm-verity: make error counter atomic
      dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
      dm-stats: fix merge accounting
      dm-stats: fix dm_jiffies_to_msec64

Ming-Hung Tsai (1):
      dm thin metadata: fix metadata snapshot consistency on commit failure

Samuel Moelius (2):
      dm era: fix out-of-bounds memory access for non-zero start sector
      dm-pcache: reject option groups without values

 drivers/md/dm-bufio.c            |  4 ++-
 drivers/md/dm-era-target.c       | 16 ++++++----
 drivers/md/dm-inlinecrypt.c      |  4 ++-
 drivers/md/dm-integrity.c        | 26 +++++++++++-----
 drivers/md/dm-ioctl.c            |  4 +--
 drivers/md/dm-log.c              |  3 ++
 drivers/md/dm-pcache/dm_pcache.c |  8 +++++
 drivers/md/dm-stats.c            | 10 +++---
 drivers/md/dm-thin-metadata.c    | 67 +++++++++++++---------------------------
 drivers/md/dm-verity-fec.c       |  4 +--
 drivers/md/dm-verity-fec.h       |  2 +-
 drivers/md/dm-verity-loadpin.c   |  2 +-
 drivers/md/dm-verity-target.c    | 16 ++++++----
 drivers/md/dm-verity.h           |  2 +-
 drivers/md/dm.c                  | 11 ++++++-
 15 files changed, 97 insertions(+), 82 deletions(-)