[PATCH 6.12.y 0/2] backport to fix a race condition/UAF in padata_reorder

Bin Lan
2026-04-25T08:14:52Z

After applying these patches to v6.12.y, the padata.c file matches the upstream
version at commit 71203f68c774, with two exceptions:

1. cpumask_next_wrap API difference (line 310): The v6.12.y kernel still uses the
old 4-argument form cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false),
whereas upstream uses the newer 2-argument form cpumask_next_wrap(cpu, pd->cpumask.pcpu).
These are functionally equivalent — upstream simply changed the API signature
in a separate commit (dc5bb9b769c9), which is too invasive to backport.

2. Divide-by-zero guard in padata_mt_helper (after line 496): The v6.12.y
doesn't include an extra check that forces chunk_size to at least 1 when
the caller sets min_chunk to 0. This prevents a divide-by-zero panic.

Thanks
Bin Lan

Herbert Xu (2):
padata: Fix pd UAF once and for all
padata: Remove comment for reorder_work

include/linux/padata.h | 4 --
kernel/padata.c | 136 +++++++++++------------------------------
2 files changed, 37 insertions(+), 103 deletions(-)

--
2.43.0